diff --git a/.oxlintrc.json b/.oxlintrc.json
index 7fedf96..36c12b6 100644
--- a/.oxlintrc.json
+++ b/.oxlintrc.json
@@ -3,6 +3,6 @@
   "categories": { "correctness": "off" },
   "ignorePatterns": ["src/**/*.test.ts", "src/property-harness.ts"],
   "rules": {
-    "eslint/max-lines-per-function": ["error", { "max": 52 }]
+    "eslint/max-lines-per-function": ["error", { "IIFEs": true, "max": 52, "skipBlankLines": false, "skipComments": false }]
   }
 }
diff --git a/AGENTS.md b/AGENTS.md
index f83610b..6fe017b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -79,7 +79,8 @@ dependency — CommonJS-only, some fifty packages with React among them, and a r
 Renovate to automerge — re-pinned by hand when a payload or a report shows the need.
 `devDependencies`: few, each earning its keep; they never reach a consumer. `fast-check` earns its
 place shrinking a failing generated document to the nodes that break it, `oxlint` measuring §10's
-size ratchet — TypeScript 7 is a native compiler and exposes no parser to write that check against.
+size ratchet — TypeScript 7 is a native compiler publishing no in-process parser, only the
+`unstable/` AST surface an out-of-process handshake reaches.
 
 ## 6. The package contract
 
@@ -257,10 +258,12 @@ compared against `undefined` — have a half no valid document reaches.
 
 The size ratchet is the other such number, `.oxlintrc.json`'s single rule over the files
 `tsconfig.build.json` builds: no function past 52 lines, today's worst (`parseInline`), moving only
-downward. It guards against drift and never drives a refactor, so no cyclomatic rule and no second
-lint rule join it — neither measure picked out what nine readers found hard (the comprehension
-panel, 2026-09-20), and `eslint/complexity` charges a point for each `?.` and `??` the branch floor
-above already exempts.
+downward. It stops where the package does, because one ceiling covering the tests and the harness
+too would have to be their worst — 64 — which loosens the guard over the shipped code. It guards
+against drift and never drives a refactor, so no cyclomatic rule and no second lint rule join it:
+neither measure picked out what nine readers found hard (the comprehension panel, 2026-09-20). The
+leg passes `--deny-warnings` and an explicit `-c`, since oxlint exits 0 on a warning and, finding
+no config, falls back to 96 default rules — either way green with the ceiling gone.
 
 The corpus, all checked in: hand-built fixtures per node and combination; real ADF Atlassian's
 editor wrote; the CommonMark spec suite against `markdownToAdf` and `markdownToHtml`.
diff --git a/package.json b/package.json
index be196c5..cab9c6e 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
-    "size-ratchet": "oxlint src",
+    "size-ratchet": "oxlint --deny-warnings -c .oxlintrc.json src",
     "test": "node --test --experimental-test-coverage --test-coverage-exclude=\"src/**/*.test.ts\" --test-coverage-exclude=src/property-harness.ts --test-coverage-branches=98 --test-coverage-functions=100 --test-coverage-lines=100 \"src/**/*.test.ts\"",
     "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.build.json"
   },
diff --git a/todo-history.md b/todo-history.md
index 28ee8f6..5ddaa64 100644
--- a/todo-history.md
+++ b/todo-history.md
@@ -868,11 +868,14 @@ The done `todo.md` items in full, as they were written. `todo.md` keeps a one-li
       ranks no better: `emitList` and `blockNode` are both 26 lines, one the panel's unanimous top
       four and the other the clearest map of the format in the repo. So the ceiling guards against
       drift and never drives a refactor — 19 to 27 are where the hard work actually is.
-      **Done** (2026-09-20): `.oxlintrc.json` carries the one rule, every category and plugin off,
-      over the 40 files `tsconfig.build.json` builds — the tests and `property-harness.ts` out, as
-      they are out of the coverage floors, the harness's own 59-line function with them. The
-      ceiling is 52, `parseInline`'s length and the repo's worst; at 51 the gate reddens on it.
-      `npm run size-ratchet` is the leg, beside the typecheck at 0.8s, and the lockfile carries
+      **Done** (2026-09-20): `.oxlintrc.json` carries the one rule, `correctness` off so nothing
+      else runs, over the 40 files `tsconfig.build.json` builds — the tests and
+      `property-harness.ts` out, five functions over the ceiling with them, the worst 64. The
+      ceiling is 52, `parseInline`'s length and the built set's worst; at 51 the gate reddens on
+      it. The leg runs `oxlint --deny-warnings -c .oxlintrc.json src` beside the typecheck at 0.8s,
+      the two flags because oxlint exits 0 on a warning and, discovering no config, falls back to
+      96 default rules; `IIFEs`, `skipBlankLines` and `skipComments` are spelled so a changed
+      default cannot move what 52 counts (the stability-reviewer, 2026-09-20). The lockfile carries
       every platform binding, so `npm ci` resolves the musl one inside the image.
 - [x] **18 — The subtree the directive spelling asks about (`0.2.0`).** The parser asks
       `commonMarkSpelling` at every directive-spelled block and the answer emits the whole subtree