paperlint 9.0.0 → 9.0.1

package/plugin/CLAUDE.md

@@ -0,0 +1,22 @@
+<!-- vigiles:sha256:6312a3b8f9804eba compiled from plugin/CLAUDE.md.spec.ts -->
+
+# CLAUDE.md
+
+## `plugin/`
+
+Not a plugin any more. `plugin/hooks/hooks.json` is the hook wiring that `paperlint init` merges
+into the consumer's `.claude/settings.json`, and it is the only source of that wiring.
+
+## Why there is no Claude Code plugin
+
+There is no Claude Code plugin or marketplace entry; it was removed in the release after 1.0.0
+(#82). Do not bring it back without answering each of these, measured (`docs/install.md`,
+"Why it is shaped this way"):
+
+- **A plugin cannot carry the code.** Claude Code installs a plugin's dependencies with a 60-second
+  timeout, and a failed install never blocks the plugin: the hooks load and fail with
+  `cannot find module vigiles`, silently.
+- **The skills need the npm package anyway.** 23 of 24 skills ran scripts that resolve only through
+  `node_modules/paperlint/`.
+- **Its manifests carried versions nothing updated**, and Claude Code decides plugin updates from
+  that number.

package/plugin/CLAUDE.md.spec.ts

@@ -0,0 +1,22 @@
+// Compiled to plugin/CLAUDE.md by `npx vigiles compile`. Edit THIS file, never the markdown.
+import { file, instructionFile, prose } from "vigiles/spec";
+
+export default instructionFile({
+  sections: {
+    "`plugin/`": prose`Not a plugin any more. ${file("plugin/hooks/hooks.json")} is the hook wiring that \`paperlint init\` merges
+into the consumer's \`.claude/settings.json\`, and it is the only source of that wiring.`,
+
+    "Why there is no Claude Code plugin": prose`There is no Claude Code plugin or marketplace entry; it was removed in the release after 1.0.0
+(#82). Do not bring it back without answering each of these, measured (${file("docs/install.md")},
+"Why it is shaped this way"):
+
+- **A plugin cannot carry the code.** Claude Code installs a plugin's dependencies with a 60-second
+  timeout, and a failed install never blocks the plugin: the hooks load and fail with
+  \`cannot find module vigiles\`, silently.
+- **The skills need the npm package anyway.** 23 of 24 skills ran scripts that resolve only through
+  \`node_modules/paperlint/\`.
+- **Its manifests carried versions nothing updated**, and Claude Code decides plugin updates from
+  that number.`,
+  },
+  rules: {},
+});

package/scripts/coverage-config.test.ts

@@ -400,8 +400,9 @@ test("the exclude list is exactly the justified set", () => {
     "**/*.test.*",
     // PAID LLM evaluations, never run by `npm test`
     "**/*.eval.mjs",
-    // skill sources vigiles compiles into SKILL.md
+    // skill and CLAUDE.md sources vigiles compiles; a glob's `**` skips a dot directory
     "**/*.spec.ts",
+    ".github/*.spec.ts",
     // type declarations
     "**/*.d.ts",
     "**/*.d.mts",

package/skills/CLAUDE.md

@@ -0,0 +1,19 @@
+<!-- vigiles:sha256:e0aa2cec8926b04f compiled from skills/CLAUDE.md.spec.ts -->
+
+# CLAUDE.md
+
+## `skills/`
+
+The skills this package ships. Loaded when working under `skills/`. The consumer's root and the
+package's location come from `skills/paper-pipeline/scripts/consumer.mjs`; the links are made by
+`src/link-skills.ts`; install-specific paths are flagged by `eslint-rules/install-path-literals.ts`.
+
+## Rules
+
+### Skills Ship In Skills
+
+**Guidance only** — Skills ship in `skills/`, never `.claude/skills/`. `paperlint init` symlinks each one into the consumer's `.claude/skills/<name>`; the link's directory name is the skill's name. `skills/` is the npm layout: of 855 packages scanned, 336 shipped `skills/` against 15 `.claude/skills/`. Rejected: leaving the skills for Claude Code to find inside `node_modules` (`docs/install.md`); a symlink loads at startup, deterministically.
+
+### A Criterion That Judges Prose
+
+**Guidance only** — It follows the five principles in `eslint-rules/CLAUDE.md` ("A rule that judges prose"). A skill does not grep prose for what a rule can count.

package/skills/CLAUDE.md.spec.ts

@@ -0,0 +1,18 @@
+// Compiled to skills/CLAUDE.md by `npx vigiles compile`. Edit THIS file, never the markdown.
+import { file, guidance, instructionFile, prose } from "vigiles/spec";
+
+export default instructionFile({
+  sections: {
+    "`skills/`": prose`The skills this package ships. Loaded when working under \`skills/\`. The consumer's root and the
+package's location come from ${file("skills/paper-pipeline/scripts/consumer.mjs")}; the links are made by
+${file("src/link-skills.ts")}; install-specific paths are flagged by ${file("eslint-rules/install-path-literals.ts")}.`,
+  },
+  rules: {
+    "skills-ship-in-skills": guidance(
+      "Skills ship in `skills/`, never `.claude/skills/`. `paperlint init` symlinks each one into the consumer's `.claude/skills/<name>`; the link's directory name is the skill's name. `skills/` is the npm layout: of 855 packages scanned, 336 shipped `skills/` against 15 `.claude/skills/`. Rejected: leaving the skills for Claude Code to find inside `node_modules` (`docs/install.md`); a symlink loads at startup, deterministically.",
+    ),
+    "a-criterion-that-judges-prose": guidance(
+      'It follows the five principles in `eslint-rules/CLAUDE.md` ("A rule that judges prose"). A skill does not grep prose for what a rule can count.',
+    ),
+  },
+});

package/skills/plan-paper-timeline/plan-paper-timeline.effects.harness.mjs

@@ -1,51 +1,23 @@
 /**
- * plan-paper-timeline — the EFFECTS tier. What the run can actually reach, not what
- * SKILL.md says it reaches.
+ * plan-paper-timeline — the EFFECTS tier. What the run actually does, not what
+ * SKILL.md says it does.
  *
  * SIBLING, NOT REPLACEMENT. `plan-paper-timeline.harness.mjs` next door is static
  * (`checkSkill()`): frontmatter, wiring, script paths, verdict vocabulary. It is untouched.
  * This file runs the REAL `claude` CLI against a SCRIPTED MOCK MODEL (`runHarnessTest`),
- * so it costs $0 and no API key — and observes the one thing static analysis structurally
- * cannot: whether the tools this skill DECLARES EXIST WHERE IT RUNS.
+ * so it costs $0 and no API key.
  *
- * ── WHY THIS SKILL FOR THIS CHANNEL ──────────────────────────────────────────────
- * It is the only skill in the corpus whose core step is an MCP call. §3 says, literally,
- * «Use `mcp__Google_Calendar__create_event` … 🔴 Read the zone, do not assume it». Four of its ten
- * declared entries are MCP calendar tools. A declaration naming a tool that is not there is
- * invisible to every static check in this repo and to `vigiles audit`, which scores this
- * corpus Structure 100.
+ * Run A: the skill activates, its body reaches the model, and a declared, granted tool
+ * (`Read`) works. Run B: §3's prescribed `create_event` call, parsed out of SKILL.md,
+ * replayed against a strict calendar double.
  *
- * ── SAFETY: WHY THIS CANNOT TOUCH A REAL CALENDAR ───────────────────────────
- * Measured before this file was written, not assumed. The probe below is `list_events`,
- * which is READ-ONLY; `create_event`/`update_event` are NEVER called here, on purpose,
- * even though the surface turns out to be absent. The run also happens in a `mkdtemp`
- * work dir the runner deletes. If a future CLI ever exposes the calendar headlessly, the
- * read-only probe starts PASSING and this test FAILS loudly — which is the point of
- * pinning it, and is a far better way to learn it than a created event.
- *
- * ── WHAT THIS PINS (a characterization test, deliberately) ───────────────────────
- * Under `claude -p` at `CHARACTERIZED_CLI` (`lib/agent-cli-version.mjs`, 2.1.227) the whole
- * `mcp__*` surface is ABSENT, and so is `ToolSearch`.
- *
- * 🔴 THAT NUMBER IS A VALUE, NOT PROSE, and it was prose until issue #7. The probe below used
- * to run with `stdio: "ignore"`, so the version the CLI printed was never read — this tier
- * characterized whatever the runner installed that day while this paragraph kept saying 2.1.227.
- * Measured: 2.1.273 on the reporter's machine and on this one, forty-six patch releases of drift
- * that nothing in a green log could show. The version is now OBSERVED, reported in the summary
- * below, and named in every failure message — so a red says which version it characterized.
- * That means:
- *   1. §3 of this skill is UNEXECUTABLE in any headless / CI context. It is an
- *      interactive-session-only step. Nothing in the file says so.
- *   2. 🔴 THE RECORDED `ToolSearch` FINDING DOES NOT REPRODUCE HERE, AND THE CORRECTION
- *      MATTERS. `.claude/lib/skill-effects-results/README.md` (2026-08-10, $0.82)
- *      recorded "the model called ToolSearch … it isn't in allowed-tools," with the caveat
- *      that it might be an artifact of the headless environment. It is the opposite:
- *      headless has NO ToolSearch to call. Adding `ToolSearch` to `allowed-tools` would
- *      therefore fix nothing here. The reachability of these four tools is a property of
- *      the ENVIRONMENT, not of the declaration.
- *
- * If either fact changes, this file fails and says which one — that is its whole job.
- * It is not asserting that absence is good.
+ * ── WHY RUN A NO LONGER PROBES THE CALENDAR ─────────────────────────────────────
+ * It used to call `mcp__Google_Calendar__list_events` and `ToolSearch` and pin "No such
+ * tool available" as a finding about headless runs. It was a finding about the FIXTURE:
+ * the run happens in an empty `mkdtemp` with no MCP server configured, so the calendar
+ * tool is missing by construction, whatever the CLI can do. vigiles 38 refuses a
+ * scripted call to a tool the CLI does not have, for exactly this reason. Run B is
+ * where the calendar step is tested, with the surface supplied.
  *
  * Cost: $0 (scripted mock model, no API key). Wall clock ~30-60s for one CLI spawn.
  */
@@ -114,37 +86,19 @@ const r = await runHarnessTest({
   transcript: true,
   timeoutMs: 180_000,
   prompt: "plan the AISec timeline",
-  // The SESSION grant. Deliberately WIDER than the skill's declaration for `Read`, and
-  // deliberately missing `Bash` — that asymmetry is what turns the two probes below into
-  // a control and a measurement inside ONE permission configuration.
-  allowedTools: ["Read", "Write", "Skill", "ToolSearch", ...declaredMcp],
+  // The SESSION grant: the tools the script below calls, and no others.
+  allowedTools: ["Read", "Skill"],
   files: { "cfp.md": "AISec 2026 — submission 24 Jul AoE\n" },
   model: [
     { tool: "Skill", input: { skill: "plan-paper-timeline" } },
-    // CONTROL: a tool that is present and permitted. If this failed, every "absent"
-    // verdict below would be a broken run, not a finding.
+    // CONTROL: a tool that is present and permitted.
     { tool: "Read", input: { file_path: "cfp.md" } },
-    // READ-ONLY calendar probe. Never create_event / update_event — see header.
-    {
-      tool: "mcp__Google_Calendar__list_events",
-      input: { calendarId: "primary" },
-    },
-    // The tool the 2026-08-10 sweep said was missing from the declaration.
-    {
-      tool: "ToolSearch",
-      input: {
-        query: "select:mcp__Google_Calendar__create_event",
-        max_results: 1,
-      },
-    },
     { text: "done" },
   ],
 });
 
 try {
   const call = (name) => r.toolCalls.find((c) => c.name === name);
-  const absent = (c) =>
-    c !== undefined && c.isError && /No such tool available/.test(c.resultText);
 
   // ── 1. The run actually happened and the skill actually loaded ──────────────────
   // Asserted FIRST and separately from everything below. A confident "nothing was
@@ -172,48 +126,14 @@ try {
     throw new Error(
       `POSITIVE CONTROL FAILED: Read — a tool this skill declares and the session grants — ` +
         `did not succeed (${ctrl ? ctrl.resultText.slice(0, 160) : "never called"}). ` +
-        `Until this passes, no "tool absent" result below can be believed.`,
-    );
-
-  // ── 2. The pinned environment fact: the declared MCP surface is not there ───────
-  const cal = call("mcp__Google_Calendar__list_events");
-  if (!absent(cal))
-    throw new Error(
-      `THE ENVIRONMENT CHANGED — and this is good news that must be read, not silenced. ` +
-        `Observed \`claude\` ${cli.version} (characterized against ${cli.characterized}). ` +
-        `\`mcp__Google_Calendar__list_events\` is now REACHABLE from \`claude -p\` ` +
-        `(result: ${cal ? cal.resultText.slice(0, 200) : "no call recorded"}). ` +
-        `Consequences: (a) §3 of this skill is now executable headlessly, so it can finally be ` +
-        `tested for real instead of characterized; (b) 🔴 every future run of this tier can now ` +
-        `WRITE A REAL CALENDAR — re-check the safety argument in this file's header BEFORE ` +
-        `adding a create_event probe; (c) update this assertion deliberately, do not delete it.`,
-    );
-
-  const ts = call("ToolSearch");
-  if (!absent(ts))
-    throw new Error(
-      `\`ToolSearch\` is now available under \`claude -p\` ${cli.version} ` +
-        `(characterized against ${cli.characterized}) (result: ` +
-        `${ts ? ts.resultText.slice(0, 200) : "no call recorded"}). The 2026-08-10 sweep recorded ` +
-        `"ToolSearch missing from allowed-tools" as a finding about THIS SKILL; measured on ` +
-        `2026-08-11 it was a fact about the ENVIRONMENT (headless had no ToolSearch at all). ` +
-        `If it exists now, that finding becomes actionable again: add it to allowed-tools.`,
+        `The skill loaded but the run cannot use the tools it declares.`,
     );
 
-  // ── 3. What that means, stated once, where a reader will see it ────────────────
+  // ── 2. The version goes in the REPORT, not only into failures ──────────────────
   console.log(
     `✓ plan-paper-timeline [effects]: skill activated and its body reached the model; ` +
       `Read (declared+granted) works — the run is live.\n` +
-      // 🔴 The version goes in the REPORT, not only into failures. A characterization test that
-      // silently still holds is indistinguishable from one nobody re-checked, so the run says
-      // which version it held against — and says it whether or not the numbers agree.
-      `  CLI: ${cli.note}\n` +
-      `  PINNED: ${String(declaredMcp.length)} of its 10 declared entries are MCP calendar tools, ` +
-      `and the whole mcp__* surface is ABSENT under \`claude -p\`; \`ToolSearch\` is absent too.\n` +
-      `  → §3 ("Create the calendar events") is an INTERACTIVE-SESSION-ONLY step. Nothing in ` +
-      `SKILL.md says so, and no static check can see it.\n` +
-      `  → Corrects the 2026-08-10 sweep: the ToolSearch gap was environmental, not a defect ` +
-      `in this declaration.`,
+      `  CLI: ${cli.note}`,
   );
 } finally {
   r.cleanup();
@@ -222,9 +142,8 @@ try {
 // ════════════════════════════════════════════════════════════════════════════════
 // RUN B — §3 EXECUTED, not characterized
 //
-// Run A above pins that the calendar surface is absent from a headless session, which
-// is true and worth knowing and also means the skill's CENTRAL STEP has never been
-// checked by anything. Run B supplies the surface with a stand-in
+// A headless run in an empty work dir has no calendar surface, so without a stand-in
+// the skill's CENTRAL STEP is checked by nothing. Run B supplies the surface with a stand-in
 // (`fixtures/fake-google-calendar.ts`) carrying the REAL API's required-field sets,
 // so the step becomes executable for the first time.
 //

package/src/CLAUDE.md

@@ -1,9 +1,15 @@
-# CLAUDE.md — `src/`
+<!-- vigiles:sha256:f51051aae2ef09f8 compiled from src/CLAUDE.md.spec.ts -->
+
+# CLAUDE.md
+
+## `src/`
 
 The package's TypeScript: the CLI, the build, the toolchain installer, and the measuring that feeds
 the facts file. Loaded when working under `src/`; the repository-wide rules are in the root
 `CLAUDE.md`.
 
+## The two layer axes
+
 **`src/` is hexagonal on two axes, and the linter enforces both** (`eslint.config.mjs`; fixtures in
 `test/fixtures/layers/`, run by `test/eslint-layers.test.ts`; issue #76).
 
@@ -49,3 +55,19 @@ against `process.cwd()`, so lint started from any other directory classifies not
 `checkAllOrigins: true`: without it no `module:` policy is evaluated, so axis B and the library bans
 report nothing — dropping it turns the fixtures `src/domain/reads-disk.ts` and
 `src/adapters/one/disk.ts` clean (measured).
+
+## Readers and commands
+
+`@retorquere/bibtex-parser` is the one `.bib` reader, behind `src/ports/bib-reader.ts`.
+Rejected on 2026-09-27, so not proposed again: a separate `paperlint refs` command; the slowness it
+would have moved was a cache thrown away after every build (`docs/references.md`).
+
+## Rules
+
+### Layers
+
+**Enforced by:** `eslint/boundaries/dependencies`
+
+### Effect Globals
+
+**Enforced by:** `eslint/no-restricted-globals`

package/src/CLAUDE.md.spec.ts

@@ -0,0 +1,72 @@
+// Compiled to src/CLAUDE.md by `npx vigiles compile`. Edit THIS file, never the markdown.
+import { enforce, file, instructionFile, prose } from "vigiles/spec";
+
+export default instructionFile({
+  sections: {
+    "`src/`": prose`The package's TypeScript: the CLI, the build, the toolchain installer, and the measuring that feeds
+the facts file. Loaded when working under \`src/\`; the repository-wide rules are in the root
+\`CLAUDE.md\`.`,
+
+    "The two layer axes": prose`**\`src/\` is hexagonal on two axes, and the linter enforces both** (\`eslint.config.mjs\`; fixtures in
+\`test/fixtures/layers/\`, run by ${file("test/eslint-layers.test.ts")}; issue #76).
+
+**Axis A — knowledge. Core means the DOMAIN, not "no I/O".** A file belongs to an adapter when it
+exists because of one external program or format: _if banal / pdf.js / TeX Live / ESLint / Claude
+Code disappeared tomorrow, which files would change? Those are its adapter, wherever they sit
+today._ The domain is what would not change if every one of them were swapped. Purity is not the
+test — a parser for banal's JSON is pure and is still banal's.
+
+| element   | where                  | holds                                                                                                                                                              | may import                                                                                                              |
+| --------- | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------- |
+| \`domain\`  | \`src/domain/\`          | values and decisions in the paper's vocabulary                                                                                                                     | \`domain\`; \`ts-essentials\`, \`node:path\`, \`node:crypto\`                                                                   |
+| \`port\`    | \`src/ports/\`           | interfaces **shaped by what the inside needs**, never by what a tool does (Graça: "created to fit the Application Core needs and not simply mimic the tools APIs") | \`domain\`, \`port\`; the same three externals                                                                              |
+| \`app\`     | \`src/*.ts\`             | use cases over ports; **no I/O defaults** — a use case without its deps does not compile                                                                           | \`domain\`, \`port\`, \`app\`, the package's \`.mjs\`; Node's \`util\`/\`url\`/\`module\`                                             |
+| \`adapter\` | \`src/adapters/<tool>/\` | everything that knows \`<tool>\` exists, pure parsers included; used through its \`index.ts\`                                                                          | \`domain\`, \`port\`, its own folder, its tool's packages, the package's \`.mjs\`. **Never** \`app\`, **never** another adapter |
+| \`root\`    | \`src/cli.ts\`           | reads \`process.*\`, builds adapters, wires ports                                                                                                                    | anything                                                                                                                |
+
+Folders are ELEMENTS of \`eslint-plugin-boundaries\`, single files are CATEGORIES (\`root\`, \`app\`,
+\`test\`, \`io\`): v7 matches element patterns as folders. Everyone — tests included — reaches an
+adapter through its \`index.ts\`; the files inside one adapter import each other freely.
+
+**Axis B — purity.** An effect (disk, process, network, env, clock, TTY) may be written only in
+\`src/adapters/<tool>/<x>.io.ts\` and \`src/cli.ts\`. Every other file, adapters' parsers included,
+takes a port. Test: _can a call here fail for a reason not in its arguments?_ Imports are checked
+through the \`io\` file category in \`boundaries/dependencies\`; the \`process\` and \`fetch\` globals by
+\`no-restricted-globals\`.
+
+**The legacy app files are held by a ratchet, not exempted.** A site that still breaks either axis
+carries \`// eslint-disable-next-line <rule> -- legacy <I/O|layer>, moves behind a port in #76\`.
+Unused directives are errors (\`reportUnusedDisableDirectives\`), so a fixed site must drop its
+comment; the per-file counts are frozen in \`scripts/layer-legacy.frozen.json\` and checked by
+${file("scripts/layer-legacy-frozen.ts")} (\`npm run check\`, CI), which counts ESLint's own
+\`suppressedMessages\` and fails when a file's count grows, a file not in the list carries one, or
+anything under \`src/domain/\`, \`src/ports/\` or \`src/adapters/\` does. A NEW module that needs the
+world is a new \`*.io.ts\` in the adapter of the program it talks to — never a new directive.
+
+Parse at the boundary, into types that cannot hold an invalid state (a banal path that exists only
+after its sha256 and probe passed; a \`Ready\` only an installer mints; an outcome as a discriminated
+union, not a string); the inside never re-validates.
+
+⚠️ **Two settings are load-bearing.** \`boundaries/root-path\`: without it the plugin matches paths
+against \`process.cwd()\`, so lint started from any other directory classifies nothing and passes.
+\`checkAllOrigins: true\`: without it no \`module:\` policy is evaluated, so axis B and the library bans
+report nothing — dropping it turns the fixtures \`src/domain/reads-disk.ts\` and
+\`src/adapters/one/disk.ts\` clean (measured).`,
+
+    "Readers and commands": prose`\`@retorquere/bibtex-parser\` is the one \`.bib\` reader, behind ${file("src/ports/bib-reader.ts")}.
+Rejected on 2026-09-27, so not proposed again: a separate \`paperlint refs\` command; the slowness it
+would have moved was a cache thrown away after every build (${file("docs/references.md")}).`,
+  },
+  rules: {
+    layers: enforce(
+      "eslint/boundaries/dependencies",
+      "Both axes: what a layer may import, and where an effect may be written.",
+      { render: "id" },
+    ),
+    "effect-globals": enforce(
+      "eslint/no-restricted-globals",
+      "The process and fetch globals only where an effect may be written.",
+      { render: "id" },
+    ),
+  },
+});

package/src/build.ts

@@ -34,7 +34,7 @@
  * The decision of the LaTeX loop is `latex-loop.ts`, reading the log is `latex-log.ts`; both are
  * pure. This file is the shell: it runs processes through the injected `run` (the existing port —
  * `spawnSync` by default) and reads the files a pass left behind. Where paperlint's own files live is
- * answered by `package-dirs.ts`, the one module allowed to know it (rule 10).
+ * answered by `package-dirs.ts`, the one module allowed to know it (root CLAUDE.md).
  */
 // eslint-disable-next-line boundaries/dependencies -- legacy I/O, moves behind a port in #76
 import { existsSync, readdirSync, readFileSync, rmSync } from "node:fs";

package/src/tex-requirements.ts

@@ -17,7 +17,7 @@
  * of every violation, it is never read as "no packages".
  *
  * Where the profiles live is answered by `presetsDir()` in `package-dirs.ts` — the one module
- * allowed to know where this package's data is installed (rule 10).
+ * allowed to know where this package's data is installed (root CLAUDE.md).
  */
 // eslint-disable-next-line boundaries/dependencies -- legacy I/O, moves behind a port in #76
 import { readFileSync, readdirSync } from "node:fs";

package/src/toolchain.ts

@@ -3,7 +3,7 @@
  * declare, into paperlint's own cache, and banal (the page-geometry script HotCRP runs) at its pinned
  * commit (`adapters/banal/`). `paperlint build` offers the TeX Live install on a terminal.
  *
- * 🔴 WHY paperlint INSTALLS TeX AT ALL (rule 11). "Install TeX Live yourself" was a manual step with a
+ * 🔴 WHY paperlint INSTALLS TeX AT ALL (root CLAUDE.md: installing must be smooth). "Install TeX Live yourself" was a manual step with a
  * trap in it: the distribution packages cost 2.1 GB, and a smaller hand-picked set silently typeset
  * acmart papers in Computer Modern. The engine decision (2026-09-24) is TeX Live's pdflatex,
  * installed the way Playwright installs browsers: one command, a cache directory, idempotent.