Export the whole overrides array from project-lint and document the lint config

.agents/memory/bot-agents-lint-opt-outs.md

@@ -1,21 +0,0 @@
----
-description: bot-agents lint has prefer-readonly-parameter-types and the size/complexity rules off (Deno had no limits) and no overrides; nothing else
----
-
-The repo follows [[lint-config-shape]] with one recorded exception, present
-when the migration PR was approved:
-
-- `typescript/prefer-readonly-parameter-types` is `"off"` in
-  `scripts/project-lint.ts`, as in the explicit-types template, because
-  Node/web types (`Response`, `Stats`, `RequestInit`) can never satisfy it.
-- `vite.config.ts` has no `overrides`. The `scripts/**` override for
-  `typescript/no-unsafe-enum-comparison` was removed (2026-10-16):
-  `scripts/project-lint.ts` compares node types with `AST_NODE_TYPES` members
-  from `@typescript-eslint/types` instead of string literals
-  ([[lint-overrides-policy]]).
-
-Size and complexity limits match Deno, which had none here, so every Oxlint
-limit rule is `"off"` ([[lint-config-shape]]). `src/run/index.ts` and `src/post/index.ts` keep
-main's single-file layout (2026-10-17 revert of the size splits). Sequential
-awaits in loops became recursion or a `reduce` chain (`no-await-in-loop`) to
-stay sequential. Add no other opt-out without the user.

.agents/memory/imports-aliases-barrels.md

@@ -72,7 +72,7 @@ import { x } from "../x.ts"; // no: no ../ anywhere
 - An area used from outside exposes its API through its alias target, and
   callers import the alias (`#ui`), not files inside it.
 - Barrels are also the standard fix for `import/max-dependencies`: one barrel
-  import replaces many direct ones ([[lint-overrides-policy]]).
+  import replaces many direct ones ([[lint-config]]).
 - `import/no-cycle` is on; a barrel must not create a cycle.
 
 Relative imports are written with the `.ts` extension.

.agents/memory/lint-config-shape.md

@@ -1,48 +0,0 @@
----
-description: vite.config.ts lint uses Oxlint categories at error with Deno size limits, names no rule itself, and spreads configs from the plugins and scripts/project-lint.ts
----
-
-The lint config is short and category-driven (user decisions 2026-10-14/15):
-turn on whole categories, then list only what parity or a real need adds.
-
-```ts
-lint: {
-  plugins: ["typescript", "unicorn", "oxc", "import"],
-  jsPlugins: ["eslint-plugin-explicit-types", "./scripts/project-lint.ts"],
-  categories: { correctness: "error", suspicious: "error", pedantic: "error", perf: "error" },
-  rules: { ...explicitTypes.configs.concrete.rules, ...projectLint.configs.project.rules },
-  ignorePatterns: ["src/generated/**"], // generated files only, see below
-  options: { typeAware: true, typeCheck: true, maxWarnings: 0, reportUnusedDisableDirectives: "error" },
-},
-```
-
-- **Categories:** `correctness`, `suspicious`, `pedantic`, `perf` at `error`.
-  `style` and `restriction` are never turned on wholesale; pick single rules
-  from them in `configs.project`. Extra rules that categories bring are fine.
-- **Size limits match Deno** (2026-10-17, replaces the 2026-10-16 "default
-  limits stay"): repos behave as they did on Deno. bot-agents ran `deno lint`
-  with no config, so it had no size or complexity limit, and every Oxlint
-  limit rule (`complexity`, `max-lines`, `max-params`, `id-length`,
-  `no-nested-ternary`, `max-lines-per-function`, `max-classes-per-file`,
-  `max-depth`, `max-nested-callbacks`, `max-statements`,
-  `import/max-dependencies`, `unicorn/max-nested-calls`) is `"off"` in
-  `configs.project`. No file is split for size. Do not add new opt-outs
-  anywhere without asking the user.
-- **`vite.config.ts` names no rule.** Every rule id, built-in ones included,
-  lives in `configs.project` of `scripts/project-lint.ts`
-  ([[project-lint-plugin]]). `vite.config.ts` only spreads configs.
-- **Published plugins are consumed through their configs**: ESLint flat config
-  uses `plugin.configs.<name>`; Oxlint lists the package in `jsPlugins` and
-  spreads `plugin.configs.<name>.rules`, since Oxlint plugins carry no configs.
-  Use the configs equivalent to what the repo enabled under Deno.
-- **`maxWarnings: 0`** keeps Deno's "every diagnostic fails" behaviour.
-- **`ignorePatterns`** is only for generated files (compiled output, codegen).
-  Hand-written code is never ignored.
-- **No lint disable comments**: [[lint-no-disable-comments]].
-- **Parity:** [[lint-parity-never-shrinks]]. **Naming:** [[naming-id-match]].
-- Don't add a second import sorter; the import-structure plugin's
-  `enforce-import-order` is the only one, and Oxfmt's `sortImports` stays off.
-
-`perf` came last: in the template it flagged nine `.includes` on constant
-arrays, fixed as `ReadonlySet` + `.has()` rather than by turning a rule off.
-That is the expected response to any new rule: change the code.

.agents/memory/lint-config.md

@@ -0,0 +1,51 @@
+---
+description: Lint config shape: every non-nursery Oxlint category on, plugins via `all`, a blacklist of offs in configs.project, per-file exceptions only in projectOverrides, ignorePatterns only for generated output
+---
+
+Policy (2026-10-19): a blacklist, not a whitelist. Replaces the older
+category-subset and "no overrides" notes.
+
+- **Categories:** `correctness`, `suspicious`, `pedantic`, `perf`, `style`,
+  `restriction` at `error`. `nursery` stays off (no line for it).
+- **Plugins** are enabled whole through their `all` config
+  (`explicitTypes.configs.all.rules`, `importStructure.configs.all.rules`).
+- **Blacklist:** repo-wide offs and option tweaks live in
+  `projectLint.configs.project.rules` in `scripts/project-lint.ts`, spread
+  last in `rules`, each with a one-line reason. Never re-list a rule a
+  category already turns on. bot-agents runs on Node everywhere, so
+  `import/no-nodejs-modules`, `unicorn/no-process-exit`, and `no-console` are
+  off repo-wide.
+- **Per-file exceptions** only via `projectOverrides`, the whole `overrides`
+  array exported from `scripts/project-lint.ts`: the Node code entry
+  (`vite.config.ts`, `scripts/**`, `nodeRules`) first, then one entry per
+  exception with a why-comment. `vite.config.ts` has exactly
+  `overrides: projectOverrides`.
+- **No `allowFiles`** options in custom rules, and no disable comments
+  ([[lint-no-disable-comments]]).
+- **`ignorePatterns`** only for generated or build output, never hand-written
+  code. A hand-written file is linted, with override entries for only what it
+  legitimately breaks. bot-agents has no generated code, so none.
+- **Precedence:** categories < `rules` (a later spread wins) < `overrides` (a
+  later entry wins).
+- Size and complexity limits (`complexity`, `max-lines`, ...) are set to the
+  smallest value the current code passes.
+
+```ts
+// scripts/project-lint.ts
+export const projectOverrides: OxlintOverride[] = [
+  { files: ["vite.config.ts", "scripts/**"], rules: nodeRules },
+  // Why: src/example.ts must ... (a per-file exception, if one is ever needed)
+  // { files: ["src/example.ts"], rules: { "some-rule": "off" } },
+];
+
+// vite.config.ts
+rules: {
+  ...explicitTypes.configs.all.rules,
+  ...importStructure.configs.all.rules,
+  ...projectLint.configs.project.rules,
+},
+overrides: projectOverrides,
+```
+
+A new category hit is fixed in the code; an off or exception is added only
+for a real collision or churn, with its reason. Rules: [[project-lint-plugin]].

.agents/memory/lint-overrides-policy.md

@@ -1,33 +0,0 @@
----
-description: No lint overrides for source files; narrow ones only for scripts/**; generated files go in ignorePatterns; size limits match Deno, so nothing is split for size
----
-
-Final policy (2026-10-16). The user considers per-file `overrides` bad
-practice.
-
-- **Source files: never.** No `overrides` entry may target `src/**` or any
-  other hand-written production or test code.
-- **The one exception** is in lint-plugin repos: `import/max-dependencies`
-  off for `src/rules/index.ts`, the rule registry, which must import every
-  rule. It is not a precedent for apps.
-- **`scripts/**`:** a narrow override is allowed when a tooling script truly
-  needs it, e.g. `no-console` in a CLI script.
-- **Generated files:** list them in `ignorePatterns`, never `overrides`.
-- **Anything else needs the user's approval first.** When the user is away,
-  don't add it: refactor, or leave the violation failing and log the question.
-
-## Fix the code instead
-
-Category rule violations are fixed in the code without behavior change,
-covered by the tests, inside the same migration PR; e.g. `prefer-set-has`
-becomes `const K: ReadonlySet<string> = new Set([...])` with `.has`.
-
-Size and complexity limits are not refactored for: they match what Deno
-enforced (2026-10-17, replacing the earlier "refactor to Oxlint's defaults"),
-which for bot-agents is none, so those rules are `"off"`
-([[lint-config-shape]]).
-
-Alias rule: an alias may point anywhere and owns its target (a folder's
-`index.ts` owns the folder and below, any other file owns only itself); no
-two aliases may own the same file, and `../` is banned everywhere
-([[imports-aliases-barrels]]).

.agents/memory/project-lint-plugin.md

@@ -52,5 +52,5 @@ export default plugin;
   and every repo should look the same.
 
 `scripts/` is tooling, not production code: never packed or published, and
-no tests. Narrow `overrides` for `scripts/**` are allowed when a script truly
-needs one (e.g. `no-console`); see [[lint-overrides-policy]].
+no tests. Its offs sit in the Node code entry of `projectOverrides`; see
+[[lint-config]].