fix(cli): reject nested Vale fixture directories instead of skipping them

The two halves of verification disagreed about recursion. `fixtureFiles`
reads one directory deep, but Vale is invoked over the whole
`rule-tests/<rule>` tree and lints recursively, so a nested fixture was
linted while never being collected.

That fails in the dangerous direction. A nested `pass/` fixture that
wrongly fires produces a finding the expected-set never knew about, so
`unexpectedFindings` discards it; a nested `fail/` fixture is never
required to fire. Either way the rule reports `passed: true` with half
its fixtures unchecked -- the same "ships looking verified" failure
`ValeFixtureCoverage` was added to prevent, one directory deeper.

Flat and loud rather than recursive: one legal layout instead of two, and
the error names the offending path the moment someone creates it. Nothing
nests today, so this closes the gap before it can be hit rather than
fixing a live break.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jwc9FFroR3mTZ4hLiSkkX3

Author: thecodedrift

packages/cli/src/rules/vale/verify.ts

@@ -89,6 +89,20 @@ async function directoryEntries(directory: string): Promise<Dirent[]> {
  * one-sided, and could report `passed: true` having never checked the pass side
  * at all. A permissions problem must not read as "no pass fixtures were
  * written".
+ *
+ * A bucket is one directory deep, and a nested directory is rejected rather
+ * than ignored. The two halves of verification disagree about recursion: this
+ * read is flat, but Vale is invoked over the whole `rule-tests/<rule>` tree and
+ * lints recursively. Silently skipping a nested entry therefore fails in the
+ * dangerous direction — a nested `pass/` fixture that wrongly fires produces a
+ * finding this function never collected, so `unexpectedFindings` discards it,
+ * and a nested `fail/` fixture is never required to fire. Either way the rule
+ * reports `passed: true` while half its fixtures went unchecked, which is the
+ * exact failure `ValeFixtureCoverage` exists to prevent.
+ *
+ * Flat-and-loud is chosen over recursing because it keeps one layout legal
+ * instead of two, and because the error names the offending path at the moment
+ * someone creates it.
  */
 async function fixtureFiles(
   cwd: string,
@@ -97,6 +111,17 @@ async function fixtureFiles(
 ): Promise<string[]> {
   const directory = join(valeRuleTestsDirectory(cwd, ruleId), bucket);
   const entries = await directoryEntries(directory);
+
+  const nested = entries.find((entry) => entry.isDirectory());
+  if (nested !== undefined) {
+    throw new Error(
+      `Vale fixture buckets are flat: ${join(directory, nested.name)} is a ` +
+        `directory. Move its documents directly into ${bucket}/ — Vale lints ` +
+        `the rule's whole directory, so a nested fixture is linted but never ` +
+        `checked.`
+    );
+  }
+
   return entries
     .filter((entry) => entry.isFile())
     .map((entry) => join(directory, entry.name));

packages/cli/test/vale-verify.test.ts

@@ -162,6 +162,32 @@ asUser("verifyValeRule with an unreadable bucket", () => {
   });
 });
 
+describe("fixture buckets are flat", () => {
+  it("rejects a nested directory instead of silently skipping it", async () => {
+    // The dangerous case: Vale lints `rule-tests/<rule>` recursively, so a
+    // nested fixture IS linted, but a flat read never collects it. Skipping it
+    // quietly would let a nested `pass/` fixture fire with its finding
+    // discarded, and a nested `fail/` fixture never be required to fire —
+    // `passed: true` over fixtures that were never checked.
+    const cwd = makeProject(
+      { "no-simply": existence("simply") },
+      {
+        "no-simply": {
+          pass: { "clean.md": "Nothing objectionable.\n" },
+          fail: { "a.md": "Just simply do it.\n" },
+        },
+      }
+    );
+    mkdirSync(join(cwd, ".taskless", "vale", "rule-tests", "no-simply", "pass", "nested"), {
+      recursive: true,
+    });
+
+    await expect(verifyValeRule(cwd, "no-simply")).rejects.toThrow(
+      /fixture buckets are flat/i
+    );
+  });
+});
+
 withVale("verifyValeRule", () => {
   it("passes when every fail fixture fires and every pass fixture is clean", async () => {
     const cwd = makeProject(