paperlint 4.0.0 → 4.2.0

package/docs/e2e.md

@@ -1,37 +1,50 @@
 # End-to-end tests
 
-They are `test/e2e/install.ts` and `test/e2e/build.ts`. Both are
-part of `npm run check`, so nobody has to remember to call them. `npm run test:e2e` runs just
-these, install first; if the install e2e fails or is skipped, the build e2e does not run.
+They are vitest tests named `*.e2e.ts` under `test/e2e/`, one vitest project per environment they
+need, found by the project's glob — no list of files exists in `package.json`, `scripts/check.ts`
+or CI:
+
+| script                     | project       | what it needs                                | files                       |
+| -------------------------- | ------------- | -------------------------------------------- | --------------------------- |
+| `npm run test:e2e:install` | `e2e-install` | npm and pnpm, and the network for `npm pack` | `test/e2e/install/*.e2e.ts` |
+| `npm run test:e2e:tex`     | `e2e-tex`     | TeX Live from `paperlint toolchain`, banal   | `test/e2e/tex/*.e2e.ts`     |
+| `npm run test:e2e`         | both          |                                              |                             |
+
+Both areas are part of `npm run check`, so nobody has to remember to call them. CI runs each in the
+job that has its environment: `test:e2e:install` in `gates`, `test:e2e:tex` in `build-e2e`.
 
 This page says what they prove, what they deliberately do not, and when a change owes a new one.
 
-## The line between a harness and an end-to-end run
+## The line between the other tests and an end-to-end run
 
-Most of this package is tested by harnesses, described in [`CONTRIBUTING.md`](../CONTRIBUTING.md):
-a rule is handed a file with a defect and must find it, then a clean file and must stay silent.
-That is the right shape for a rule, and it cannot answer a different kind of question.
+The rest of the package is tested by unit and integration tests and, for what an agent sees, by
+harnesses — [`testing.md`](testing.md) says which is which. A rule is tested twice before any e2e:
+unit tests beside it hand its logic a defect and a clean input, and `src/rule-cases.test.ts` runs
+every registered rule through real ESLint on a small paper tree, the way `paperlint lint` does.
+That is still an integration test: no TeX, no install, the working tree as it is.
 
-A harness runs **in this repository's process, against this repository's working tree**. It
-imports the module directly. Every path resolves, every dependency is already installed, and the
-file it reads is the file in `git`. An end-to-end run exists because all three of those are
+Those tests run **in this repository's process, against this repository's working tree**. They
+import the modules directly. Every path resolves, every dependency is already installed, and the
+file they read is the file in `git`. An end-to-end run exists because all three of those are
 assumptions that stop holding the moment somebody else installs the package.
 
-| question                                                                             | answered by                                               |
-| ------------------------------------------------------------------------------------ | --------------------------------------------------------- |
-| does this rule find this defect, and stay quiet otherwise                            | harness                                                   |
-| does the CLI pick the right script, with the right interpreter                       | harness (`src/build.harness.mjs` substitutes `spawnSync`) |
-| does the tarball, installed into a tree that is not this one, contain what it claims | **e2e**                                                   |
-| do the paths written inside a skill resolve where the package actually lands         | **e2e**                                                   |
-| did a PDF come out, and is it typeset in the fonts the venue requires                | **e2e**                                                   |
+| question                                                                             | answered by                                                   |
+| ------------------------------------------------------------------------------------ | ------------------------------------------------------------- |
+| does this rule find this defect, and stay quiet otherwise                            | unit, beside the rule                                         |
+| does the rule run through ESLint, wired, on the file it is for                       | integration (`src/rule-cases.test.ts`)                        |
+| does the CLI pick the right script, with the right interpreter                       | integration (`src/build.harness.mjs` substitutes `spawnSync`) |
+| does the tarball, installed into a tree that is not this one, contain what it claims | **e2e**                                                       |
+| do the paths written inside a skill resolve where the package actually lands         | **e2e**                                                       |
+| did a PDF come out, and is it typeset in the fonts the venue requires                | **e2e**                                                       |
 
-The third and fourth rows are the ones a harness cannot reach even in principle: the defect only
-exists once the code is somewhere else.
+The last three rows are the ones no other test can reach even in principle: the defect only exists
+once the code is somewhere else, or once a real TeX has typeset it.
 
-## `test/e2e/install.ts` — the package, installed
+## `test/e2e/install/install.e2e.ts` — the package, installed
 
-`test/e2e/install.ts`. It runs `npm pack`, then installs the resulting tarball into a fresh
-temporary tree, **under npm and under pnpm separately**, and drives the installed binary:
+It runs `npm pack`, then installs the resulting tarball into a fresh temporary tree, **under npm
+and under pnpm separately** — one test per manager, each the whole scenario, because its steps
+depend on each other — and drives the installed binary:
 
 - the install itself finishes
 - `paperlint --help` answers with zero
@@ -55,13 +68,21 @@ that works under npm can be dead under pnpm with no error anywhere. The same run
 binary **directly** rather than through `node <path>`: under npm `.bin` holds a symlink, under
 pnpm a shell wrapper, and calling `node bin` measures the caller's habit instead of the package.
 
-## `test/e2e/build.ts` — a real `pdflatex`
+## `test/e2e/tex/build.e2e.ts` — a real `pdflatex`
 
-`test/e2e/build.ts`. It copies `fixtures/build-e2e/` — eight papers, none with a build script paperlint
-would run — into a temporary tree, points a config at it, and runs `paperlint build --all`. paperlint compiles
-each paper itself with the real `pdflatex` and `bibtex`; the artifacts are then measured with
+It copies `fixtures/build-e2e/` — nine papers, none with a build script paperlint would run — into
+a temporary tree, points a config at it, and runs `paperlint build --all`. paperlint compiles each
+paper itself with the real `pdflatex` and `bibtex`; the artifacts are then measured with
 paperlint's own pdf.js reader from `dist/`, and the fonts are cross-checked against the list of
-programs pdfTeX writes into `paper.log`:
+programs pdfTeX writes into `paper.log`.
+
+**Each fixture declares what it must produce** in `fixtures/build-e2e/<name>/expect.json`, parsed
+with the schema in `test/e2e/tex/build-expect.ts`: whether it builds (`build.outcome`), what its
+lines of the build output say, its fonts, its last page's text, files in its directory, the facts
+the build measured, and — for `paperlint lint` after the build — the exit code and **exactly** the
+findings for each rule it names (`[]` is "none"). One `describe` per fixture directory turns each
+declared field into a test. A folder without `expect.json`, or with one the schema rejects, fails.
+A new venue fixture is a new folder: its paper, its `paperlint.json`, its `expect.json`.
 
 | fixture      | what it is there to prove                                                                                                                                                                                                                                                                        |
 | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
@@ -72,6 +93,8 @@ programs pdfTeX writes into `paper.log`:
 | `unbalanced` | a two-column acmart paper whose last page comes out 621.5 / 264.8 pt builds **green** — the build does not judge the layout and rewrites nothing — while `_build/paper.facts.json` records both heights, and `paperlint lint` with `pdf/last-page-balance` turned on in `rules` reports the page |
 | `broken`     | a failing build names pdflatex and its exit code, quotes the error line and its `l.NNN` context, and deletes the stale `paper.pdf` planted before the run                                                                                                                                        |
 | `no-source`  | a paper with no `paper.tex` is named separately, and the run as a whole is a failure                                                                                                                                                                                                             |
+| `empty`      | a document with no pages: pdflatex exits 0 and writes no PDF, and that is a failure, not a green `paper.pdf`                                                                                                                                                                                     |
+| `aidc`       | a real `[conference,compsoc]{IEEEtran}` paper builds on paperlint's TeX Live in NimbusRomNo9L, `tex/template`, `tex/required-section` and the `pdf/*` rules find nothing, and `tex/venue-leftover` warns once, on its planted line                                                               |
 
 The `fallback` row is the point of the whole file. `acmart.cls` checks for `libertine.sty`,
 `zi4.sty` and `newtxmath.sty`, and failing to find any of them sets `\@ACM@newfontsfalse` and
@@ -79,28 +102,30 @@ typesets the paper in Computer Modern. The build is green, the PDF looks fine, t
 and therefore so does the pagination. A submitted paper went out that way. **An exit code cannot
 see it, so the content of the artifact is what gets measured.**
 
-Before the fixtures, the run proves the refusal with no TeX at all: PATH holds `node` alone, the
+Beside the fixtures, one test proves the refusal with no TeX at all: PATH holds `node` alone, the
 cache directory is empty and `CI` is set, and `paperlint build` must exit 1 with one line naming
-`npx paperlint toolchain` and the venue's packages, print no plan and create no PDF and no cache. It then
-asks `paperlint build --dry-run` which TeX Live the real run will use; under `--strict` (CI) that must be
-paperlint's own cache, because the runner has no other.
+`npx paperlint toolchain` and the venue's packages, print no plan and create no PDF and no cache.
+The rest asks `paperlint build --dry-run` which TeX Live the real run will use; under CI that must
+be paperlint's own cache, because the runner has no other.
 
-## `test/e2e/toolchain.ts` — real TeX Live, and only it
+## `test/e2e/tex/toolchain.e2e.ts` — real TeX Live, and only it
 
 `paperlint toolchain` into `$PAPERLINT_TEXLIVE_DIR` against real CTAN; a second run must say "nothing to do"
 within seconds; `--check` must exit 0; then the `acmart` fixture is built with PATH holding `node`
 only, so no other TeX Live and no PDF tool can stand in, and the PDF must carry Libertine and Biolinum
-and no Computer Modern face. Without `PAPERLINT_TEXLIVE_DIR` it is a declared skip: installing ~270 MB
+and no Computer Modern face. Without `PAPERLINT_TEXLIVE_DIR` its tests are skipped: installing ~270 MB
 into a home directory as a side effect of `npm run check` is the unasked install rule 11 forbids.
 `src/toolchain.harness.mjs` covers the installer's logic (mirror fallback, archive check, time
 limit, verification, idempotence) against a fake mirror on disk, without the network.
 
-## Skips are declared, never silent
+## Skips are reported, never passed
 
 A clone without TeX Live genuinely cannot run the build e2e; a machine without pnpm cannot run
-half of the install e2e. Each says so and exits **77** — the skip code vigiles' own runner uses —
-not zero, and `npm run check` reports it as `SKIPPED — not run, not passed`. In CI the same absence
-means a broken environment, so `--strict` turns the skip into a failure.
+half of the install e2e. Their tests are then `skipIf`'d, and vitest reports them as skipped.
+`npm run check` reads that count from vitest's JSON report and prints the gate as
+`SKIPPED — not run, not passed`. In CI the same absence means a broken environment: with `CI` set
+(or `PAPERLINT_E2E_STRICT=1`) each such file registers one more test that fails and names what is
+missing (`test/e2e/need.ts`).
 
 A skipped step and a passed one look identical in a CI interface. That is the class this whole
 package is written against, so it is not allowed to happen inside it either.
@@ -115,9 +140,13 @@ Not every change does. The trigger is countable — ask whether the change touch
 - anything read through `package.json` fields — `bin`, `files`, `exports`
 - a new external program the pipeline shells out to
 - a new artifact the pipeline produces whose **content** can be wrong while the exit code is zero
+- a new template-family preset: the TeX packages it declares, and the page size and fonts measured
+  from a real build of its class → one fixture folder in `fixtures/build-e2e/`, with its
+  `expect.json`
 
-If none of those apply, a harness beside the changed module is the right test, and an e2e run
-would only make the suite slower without making it stricter.
+If none of those apply, a unit or integration test beside the changed module is the right test,
+and an e2e run would only make the suite slower without making it stricter. A new rule is not a
+trigger by itself: its cases in `src/rule-cases.test.ts` already run it through real ESLint.
 
 ## What these two do NOT cover
 
@@ -142,7 +171,7 @@ everything.
 
 ## The corpus
 
-`stageCorpus()` in `test/e2e/install.ts` writes a small paper by hand — a declared stage, its
+`stageCorpus()` in `test/e2e/install/install.e2e.ts` writes a small paper by hand — a declared stage, its
 PDF, its byte counts, the cross-check between them — and copies `fixtures/build-e2e/acmart` beside
 it so the LaTeX rules see LaTeX rather than a placeholder.
 

package/docs/install.md

@@ -121,7 +121,7 @@ a CI workflow and a heavy toolchain), asks two questions and guesses the rest.
 
 **npm and pnpm are covered; Yarn Plug'n'Play is not supported.**
 
-`test/e2e/install.ts` packs the tarball, installs it into a clean project with each manager that
+`test/e2e/install/install.e2e.ts` packs the tarball, installs it into a clean project with each manager that
 launches on the machine, and runs the hook command to see whether it resolves. A grep over
 `hooks.json` would not do: the string is right under any manager, and whether it resolves depends
 on the tree the manager laid out. It also checks that every shipped skill is reachable as

package/docs/prior-art/README.md

@@ -1,7 +1,7 @@
 # Prior art — how comparable tools are shaped
 
 **Why this folder lives in the repository.** These are technical records that code and other docs
-cite by path: `test/e2e/install.ts` cites `package-location.md`, `scripts/marketplace-shape.mjs`
+cite by path: `test/e2e/install/install.e2e.ts` cites `package-location.md`, `scripts/marketplace-shape.mjs`
 and `docs/install.md` point at the probes in `repro/`, and `eslint.config.mjs` excludes `repro/`
 by name. Moving the folder out would leave those references pointing nowhere. The notes are for
 contributors and maintainers, not for someone checking a paper, which is why the README does not

package/docs/prior-art/package-location.md

@@ -1,6 +1,6 @@
 # How a package finds its own installed files, and its own bin
 
-**Question this file answers:** `test/e2e/install.ts` inspects the tree it just installed by
+**Question this file answers:** `test/e2e/install/install.e2e.ts` inspects the tree it just installed by
 spelling the layout out — `node_modules/research-paper-pipeline` (line 172),
 `node_modules/.bin/rpp` (line 276), and `node_modules/.../plugin/hooks/hooks.json` (line 135).
 `contentDelivery()` separately tries THREE candidate base directories for a path written as prose
@@ -54,7 +54,7 @@ argument of `import.meta.resolve` is the non-standard part:
 
 ### 🔴 `import.meta.resolve` is the wrong tool here, and it fails SILENTLY
 
-`test/e2e/install.ts` runs from the repository and inspects a consumer somewhere in `os.tmpdir()`.
+`test/e2e/install/install.e2e.ts` runs from the repository and inspects a consumer somewhere in `os.tmpdir()`.
 `import.meta.resolve` always resolves from **the file that calls it** — `cwd` is irrelevant and
 the `parent` argument is ignored without the flag rather than rejected:
 
@@ -165,7 +165,7 @@ literal node_modules/ : <WORK>/consumer-pnpm/node_modules/research-paper-pipelin
 Under pnpm the hardcode addresses the **symlink** and resolution addresses the **store realpath**
 (Node realpaths by default; `--preserve-symlinks` flips it, and `resolve-package-path` carries
 `lib/should-preserve-symlinks.js` for exactly that). `realpathSync` of one equals the other, so
-every `existsSync` / `readdirSync` / `readFileSync` in `test/e2e/install.ts` gives the same answer
+every `existsSync` / `readdirSync` / `readFileSync` in `test/e2e/install/install.e2e.ts` gives the same answer
 either way. Two interesting asymmetries, both measured:
 
 - `module.findPackageJSON` returns the **symlink** path under pnpm, not the store path — the
@@ -348,7 +348,7 @@ node_modules present? NO
    today the npm channel is the one that delivers the runnable code — but it is not impossible.
 3. 🔴 **The blocker the note does NOT name is the immovable one, and no resolution API fixes it.**
    PnP resolves to a path **inside a zip**. Line 3: the outside process gets `existsSync: false`
-   for the very path PnP just handed it; only PnP's patched `fs` can open it. `test/e2e/install.ts`
+   for the very path PnP just handed it; only PnP's patched `fs` can open it. `test/e2e/install/install.e2e.ts`
    inspects the installed tree with `existsSync`, `readdirSync` and `readFileSync` **from its own
    process**. Under PnP those read nothing, whatever API produced the path — and `yarn bin rpp`
    (line 4) hands back the same unreadable path, so the supported bin lookup does not help either.
@@ -359,7 +359,7 @@ and it should be recorded as such rather than as "PnP has no node_modules".
 
 ## 9. The second guess: the base directory for a path written in prose
 
-`contentDelivery()` (in `test/e2e/install.ts`) tries three bases per reference.
+`contentDelivery()` (in `test/e2e/install/install.e2e.ts`) tries three bases per reference.
 Measured over the real corpus with `claim6-doc-path-candidates.mjs`:
 
 ```console

package/docs/prior-art/repro/README.md

@@ -56,7 +56,7 @@ $ claude plugin validate /tmp/m --strict; echo "RC=$?"
 ## The CLAIM 4–6 probes — where an installed package is, and how to find it
 
 These back [`../package-location.md`](../package-location.md). They measure the two hardcodes in
-`test/e2e/install.ts` (`node_modules/<name>` and `node_modules/.bin/rpp`) against the
+`test/e2e/install/install.e2e.ts` (`node_modules/<name>` and `node_modules/.bin/rpp`) against the
 resolution APIs Node actually offers, under npm, pnpm and Yarn Berry (PnP).
 
 Build the consumer trees once — it packs this repository and installs the SAME tarball twice:

package/docs/prior-art/test-tooling.md

@@ -27,16 +27,27 @@ So the genuinely agent-facing harnesses are three: `hooks/hooks.harness.ts` (`ru
 (`runHarnessTest`, which spawns the real `claude` binary against a scripted model), and the skill
 contract checks. Everything else is ordinary Node testing that happens to carry the suffix.
 
-## Why the install e2e stays a script
-
-`test/e2e/install.ts` is one linear scenario per package manager with strictly dependent steps
-— install, bin, `init`, `lint`, hook commands, content delivery — and a summary. A runner adds
-named subtests and a reporter; the script already prints per-check `✓`/`✗` and a per-manager
-verdict. The pack-and-install work stays in our code under any host, so the host buys only the
-reporter, at the cost of a second exit-code path.
-
-It also stays OUT of `npm test`: it needs the network for the consumer's transitive dependencies
-and takes minutes. It is its own CI step with its own timeout.
+## The e2e runs are vitest projects
+
+The end-to-end runs are vitest tests (`test/e2e/<area>/*.e2e.ts`), one project per environment
+they need — `e2e-install` (npm and pnpm) and `e2e-tex` (TeX Live) — found by the project's glob, so
+no list of files exists in `package.json`, `scripts/check.ts` or CI (#132). What the runner buys is
+not the reporter alone:
+
+- **the fixture table.** `fixtures/build-e2e/` is a table of independent cases, and each fixture's
+  `expect.json` becomes its own tests through one `describe.each` over the directory. A new venue
+  fixture is a folder, not a block of test code.
+- **a skip the aggregate can read.** A missing tool is `skipIf`, and vitest's JSON report counts it,
+  which is what `npm run check` reads to print a gate as skipped rather than passed. Under CI the
+  same absence fails (`test/e2e/need.ts`).
+
+`install.e2e.ts` stays ONE test per package manager, each the whole scenario — install, bin,
+`init`, `lint`, hook commands, content delivery — because its steps depend on each other: a
+failure in the install makes every later step meaningless. Inside it, each check is a soft
+expectation, so a run reports every mismatch, not the first.
+
+The e2e projects stay OUT of `npm test` (project `unit`): they need the network, TeX Live or
+several minutes. Each runs in its own CI job, with its own timeout.
 
 ## Tarball-by-path versus a local registry
 

package/docs/rules/tex/claim-provenance.md

@@ -0,0 +1,83 @@
+# tex/claim-provenance
+
+**Level:** warn · **Reads:** `paper.tex`
+
+## What it catches
+
+A sentence of the body that states a number and does not say whose the number is. The sentence is
+reported once, however many numbers it holds. Any one of these owners silences it:
+
+| owner                        | in the sentence                                                                                                                   |
+| ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
+| a work outside the paper     | a `\cite` (any of natbib's or biblatex's forms), a `\url`, an `\href`, or a footnote that cites or links                          |
+| the authors                  | _we_, _our_, _ours_, _us_ (the capitalised country _US_ is not the authors)                                                       |
+| a place in the paper         | `\ref`, `\cref`, `\autoref` and their kin, or the words _Section 4_, _Table 2_, _Fig. 3_, _Appendix B_, _§4_                      |
+| a claimant named as one      | _advertises_, _claims_: _"the skill advertises a 65% reduction"_, _"(claim 63%)"_                                                 |
+| the sample the number counts | _n = 134_ (in prose or in math), or a count followed by what it counts: _48 runs_, _48 independent runs_, _of 1,836 repositories_ |
+
+It reads the body of the whole paper — `paper.tex` with the files it `\input`s, `\include`s or
+`\subfile`s spliced in — from the start of the document, the abstract included, to `\appendix` or the
+bibliography. A sentence in an included file is reported at that include, with the file and line at
+the front of the message. Footnotes are read as sentences of their own. A citation or a footnote set right after
+the full stop belongs to the sentence the full stop ends.
+
+A number is digits a reader sees — `42\%`, `0.37`, `1,836`, `3x`, `3×`. Not a number: a year on its
+own (1900–2099); a number right after a capitalised word inside the sentence (_Claude 3_, _Python
+3.12_, _Node 22_), which is a name; the level of an interval (the 95 of _95% CI_); digits glued to a letter, a hyphen or a point (`GPT-4`, `COVID-19`, `v1.2`, `10k`,
+`0x1F`); anything inside math, a table, a figure, a caption, a heading (a run-in one too: `\textbf{Threats.}` opening a paragraph), code, a comment, a macro
+definition, or the title block.
+
+## Why
+
+A reviewer who cannot tell a property of the world from a cited finding from the authors' own
+measurement says so, and scores the paper's soundness on it. Academic prose carries the owner by
+default — _we found_, _[12] report_, _(Table 2)_ — and a sentence rewritten for punch loses it first:
+_"Under test the rules held in 97% of cases"_ has no subject, and a reader takes it
+for a result from the literature. This rule is the floor under the rules that shorten sentences.
+
+## Examples
+
+```latex
+Agents ignore 42\% of the rules they are given.            % warns
+Under test the rules held in 97\% of cases.                  % warns: no one ran the test
+We find that agents ignore 42\% of the rules.                % silent: the authors
+Agents ignore 42\% of the rules~\cite{smith2025}.            % silent: a citation
+Agents ignore 42\% of the rules (Table~\ref{t:rates}).       % silent: a place in the paper
+Of 1,836 repositories, 12\% ship hooks.                      % silent: the sample
+In 2024 the first agents shipped with GPT-4.                 % silent: a year and a name
+```
+
+The first line reports:
+
+> «42%» — whose number is this? A reader cannot tell a cited finding from your own measurement from
+> a general fact. Say it in the sentence: cite the work (\cite), claim it (we measured, our census),
+> point to where it is shown (\ref, Section N, Table N), or name the sample it counts (n = 134, 48
+> runs)
+
+## Options / preset fields
+
+None. It is on, as a warning, for every `paper.tex`; turn it off or up in the `rules` setting like
+any other rule.
+
+## What it does not check
+
+- Whether the owner is the right one: a citation that does not report the number, or a _we_ in a
+  sentence about someone else's work, silences the sentence all the same.
+- What a custom macro prints: `\rate{}` defined as `42\%` is not a number here.
+- Which numbers are names, beyond the two shapes it knows: a number after a lowercase word (_version
+  3 of the model_) is read as a quantity, and so is the number of a name that opens the sentence
+  (_Claude 3 fails …_).
+- Whether a count followed by a plural noun is really the sample (_3 times faster_ passes as one).
+- Markdown papers (`paper.md`): it reads the LaTeX parse tree only.
+
+## How to fix
+
+Say whose the number is, in the sentence — usually by putting back the subject a punchy rewrite took
+out: _"We ran the rules in 48 sessions and saw no violation"_, not _"No violation in 48 runs."_ A
+number that is common knowledge, or quoted on purpose, keeps its sentence with ESLint's directive and
+the reason:
+
+```latex
+% eslint-disable-next-line tex/claim-provenance -- the venue's own page limit, quoted
+The limit is 8.
+```

package/docs/rules/tex/missing-input.md

@@ -0,0 +1,58 @@
+# tex/missing-input
+
+**Level:** warn · **Reads:** `paper.tex`, and every file it includes
+
+## What it catches
+
+An `\input`, `\include` or `\subfile` that names a file which is not there. The path is resolved the
+way TeX resolves it, from the paper's directory: `name.tex` first, then `name` as written. An
+include inside an included file is resolved from the paper's directory too.
+
+## Why
+
+The rules that read the parse tree — `tex/template`, `tex/required-section`, `tex/venue-leftover`,
+`tex/claim-provenance` — read the whole paper: `paper.tex` with every included file spliced in where
+it is included, as TeX reads it. A file that is not there cannot be read, and without this rule the
+others would report a clean body for text they never saw. TeX stops on it too.
+
+## Examples
+
+```latex
+\input{sections/results}   % warns when neither sections/results.tex nor sections/results exists
+\input{sections/intro}     % silent: sections/intro.tex is there
+```
+
+The first line reports:
+
+> `sections/results` is not there (tried `sections/results.tex` and `sections/results`, from the
+> paper's directory): TeX stops on it, and no rule read what it should hold
+
+A missing file included by another included file is reported at the include in `paper.tex` that
+brought that file in, and the message names the file that holds it.
+
+## Options / preset fields
+
+None.
+
+## What it does not check
+
+- A path built from a macro (`\input{\dir/intro}`): macros are not expanded, so the path is looked
+  up as written.
+- `\import{dir}{file}` and other packages' include macros.
+
+## How to fix
+
+Correct the path, or add the file. A file that a build step writes (a table of generated numbers)
+is absent before that step runs — keep the include with a disable directive and the reason:
+
+```latex
+% eslint-disable-next-line tex/missing-input -- written by repro/numbers.sh before the build
+\input{generated/numbers}
+```
+
+## Where findings in included files are reported
+
+ESLint reports a finding in the file it lints, and paperlint lints `paper.tex`. A finding of any of
+the rules above whose text came from an included file is reported at the include in `paper.tex`,
+with the included file, line and column at the front of its message
+(`sections/results.tex:12:3: …`). A disable directive for it goes above that include.

package/docs/rules/tex/register.md

@@ -0,0 +1,77 @@
+# tex/register
+
+**Level:** warn · **Reads:** `paper.tex` and the files it includes
+
+## What it catches
+
+A body in which more than 0.8 sentences per 1000 words open with _And_, _So_, _But_, _Nor_, _Or_ or
+_Yet_. It is reported once, at the body's first sentence, with the count, the rate and the first
+three such sentences.
+
+It reads the body of the whole paper — `paper.tex` with the files it `\input`s, `\include`s or
+`\subfile`s spliced in — from the start of the document, the abstract included, to `\appendix` or the
+bibliography: paragraphs, list items and footnotes. Headings are not sentences, and neither is a
+run-in heading — a bold or italic phrase ending in `.` or `:` that opens a paragraph or an item
+(`\textbf{Threats.} …`). Captions, tables, figures, code and math environments are left out. A
+citation, a cross-reference or inline math counts as one word, as it reads on the page. Sentences
+are cut exactly as [`tex/claim-provenance`](claim-provenance.md) cuts them.
+
+A conjunction counts only as the capitalised first word of a sentence; the _and_ that opens a list
+item continuing the sentence before the list does not.
+
+A body under 2 000 words is not judged: there one sentence decides the rate.
+
+## Why
+
+Reviewers called our prose "too informal" and "a blogpost". Measured against eleven accepted
+papers, sentences opening with a coordinating conjunction set our four drafts apart:
+
+| measure                                                      |           11 accepted papers | our 4 drafts |
+| ------------------------------------------------------------ | ---------------------------: | -----------: |
+| sentences opening with And/So/But/Nor/Or/Yet, per 1000 words | 0–0.58 (the ACSAC papers: 0) |    0.29–2.98 |
+
+The limit sits above the accepted range with room to spare: the rule flags a body that has drifted
+to a post's register, not one a little above the median. Mean sentence length did not separate the
+two groups. The share of sentences under eight words did not either, once measured on the parse
+tree: 3.3–7.3% on the two accepted papers in this repository's corpus, 5.1–7.0% on three of ours.
+
+On the corpus (`fixtures/accepted-papers/`) the rule measures:
+
+| paper                               | per 1000 words |
+| ----------------------------------- | -------------: |
+| `secure-acsac24` (ACSAC 2024)       |           0.00 |
+| `llm-splained-acsac25` (ACSAC 2025) |           0.00 |
+| `agenticdev-acm26` (ours, accepted) |           1.60 |
+
+The vocabulary of machine-written text (_delve_, _crucial_) is a different question, and a different
+check; a paper can avoid every such word and still read as a post.
+
+## Examples
+
+```latex
+We measured the cost on four tools. But the bill barely moves.       % a conjunction start
+We measured the cost on four tools, and the bill barely moves.       % none
+We measured the cost on four tools. However, the bill barely moves.  % none
+```
+
+On a body where such sentences run above the limit, the rule reports:
+
+> 7 sentences open with And, So, But, Nor, Or or Yet — 1.60 per 1000 words (first: «…», «…», «…»).
+> Accepted papers measured 0–0.58; this rule warns above 0.8. Join the sentence to the one before,
+> or open with the connective a paper uses (However, Therefore, Moreover)
+
+## Options / preset fields
+
+In a paper's `paperlint.json`:
+
+```json
+{
+  "rules": {
+    "tex/register": ["warn", { "conjunctionStartsPer1000": 0.8 }]
+  }
+}
+```
+
+| option                     | default | what it is                                                 |
+| -------------------------- | ------: | ---------------------------------------------------------- |
+| `conjunctionStartsPer1000` |     0.8 | the conjunction starts per 1000 words above which it warns |

package/docs/rules/tex/required-section.md

@@ -0,0 +1,75 @@
+# tex/required-section
+
+**Level:** error · **Reads:** `paper.tex`, and the preset its `paperlint.json` extends
+
+## What it catches
+
+A section the venue requires is missing, or is not where the venue requires it. The preset lists
+the required sections by title in `required_sections`; the paper must have a `\section` or
+`\section*` with exactly that title (whitespace collapsed), and, when the preset says
+`position: "last"`, no section of the main text may come after it.
+
+It reads the sections of the whole paper, the files `paper.tex` includes spliced in where they are
+included, so a required section kept in `sections/llm-usage.tex` counts.
+
+It only knows the sections a preset lists. A paper whose `paperlint.json` names no preset, or a
+preset with no `required_sections`, gets no finding.
+
+## Why
+
+Some venues make a section mandatory and desk-reject without it. ACSAC's AI Usage Policy, which
+its AIDC workshop applies (https://www.acsac.org/2026/submissions/ai/):
+
+> If LLMs are used, authors must include a separate, clearly marked section titled "LLM Usage
+> Statement" at the end of the paper. This section does not count towards the page limit.
+
+> Failure to comply with these requirements is grounds for desk rejection without further review.
+
+A common near miss is a bold paragraph in another venue's wording («Use of Generative AI.»): not a
+section, and not that title.
+
+**"If LLMs are used" is not something a rule can know, so the rule always requires the section for
+a preset that lists it.** An author who used none says so in it («No LLMs were used in this
+work.»).
+
+## Examples
+
+Under a preset with
+`"required_sections": [{ "title": "LLM Usage Statement", "position": "last" }]`:
+
+```latex
+\paragraph{Use of Generative AI.} We used an LLM.   % fails: a paragraph, not a section
+\section*{LLM usage statement}                      % fails: not the exact title
+\section*{LLM Usage Statement}                      % passes, after the last section of the text
+```
+
+A missing section reports:
+
+> aidc requires a section titled «LLM Usage Statement» and there is none — add
+> `\section*{LLM Usage Statement}` (the title exactly; a bold paragraph does not count)
+
+The right title in the wrong place — before the introduction — reports:
+
+> «LLM Usage Statement» must close the paper at aidc, and the section «Introduction» comes after it
+> — move it after the last section of the body (after the bibliography is fine)
+
+## Preset field
+
+No rule options. It reads `required_sections`; a child preset's list replaces its parent's:
+
+```jsonc
+"required_sections": [{ "title": "LLM Usage Statement", "position": "last" }]
+```
+
+`title` is compared exactly after collapsing whitespace — the venue's words are the contract.
+`position: "last"` requires it after every section of the main text, which is every section before
+`\appendix` and the bibliography (`\bibliography`, `\printbibliography`, `thebibliography`); after
+the bibliography or an appendix is fine. Without `position`, anywhere will do.
+
+## What it does not check
+
+- Whether LLMs were used, or what the section says.
+
+## How to fix
+
+Add `\section*{<the title>}` where the message says, with the content the venue asks for.