plan 52: tighten schema-source matching to one level deep

isSchemaOrArchetypeFile matched any *.md under or below a
configured archetype root. With archetype-roots: ["."] it matched
the whole repo, disabling required-structure validation and
suppressing the misplaced <?require?> warning for every document.

Now the check accepts only files that are direct children of the
root: archetype discovery only finds <root>/<name>.md, so the
schema-source check should match that exact shape. Files in
subdirectories get treated as normal documents again.

Added tests for both cases: archetype-roots "." with a nested
doc, and a nested file under "archetypes/sub/" with the default
root.

Author: claude

internal/rules/requiredstructure/rule.go

@@ -253,17 +253,26 @@ func (r *Rule) isSchemaOrArchetypeFile(f *lint.File) bool {
 	}
 	for _, root := range roots {
 		cleanRoot := filepath.ToSlash(filepath.Clean(root))
-		if cleanRoot == "." {
-			cleanRoot = ""
-		} else {
-			cleanRoot += "/"
-		}
 		for _, c := range candidates {
-			if strings.HasSuffix(c, ".md") &&
-				(cleanRoot == "" ||
-					strings.HasPrefix(c, cleanRoot)) {
-				return true
+			if !strings.HasSuffix(c, ".md") {
+				continue
+			}
+			// An archetype lives at "<root>/<name>.md" — exactly one
+			// file deep. `.` is a root with no prefix at all, so the
+			// candidate must have no path separators.
+			var rel string
+			switch {
+			case cleanRoot == ".":
+				rel = c
+			case strings.HasPrefix(c, cleanRoot+"/"):
+				rel = strings.TrimPrefix(c, cleanRoot+"/")
+			default:
+				continue
+			}
+			if rel == "" || strings.Contains(rel, "/") {
+				continue
 			}
+			return true
 		}
 	}
 	return false

internal/rules/requiredstructure/rule_test.go

@@ -269,6 +269,34 @@ func newFileInRootDirOnly(t *testing.T, root, name, body string) *lint.File {
 	return f
 }
 
+func TestCheck_DotRootOnlyMatchesTopLevelMarkdown(t *testing.T) {
+	root := t.TempDir()
+	// Nested doc under a subdirectory — must NOT be treated as an
+	// archetype source just because archetype-roots is ".".
+	require.NoError(t, os.MkdirAll(filepath.Join(root, "docs"), 0o755))
+	src := "<?require\nfilename: \"doc-*.md\"\n?>\n# Title\n"
+	f := newFileInRoot(t, root, filepath.Join("docs", "doc.md"), src)
+	r := &Rule{ArchetypeRoots: []string{"."}}
+	diags := r.Check(f)
+	// Expect the misplaced-require warning because docs/doc.md is a
+	// normal doc, not a top-level schema source.
+	expectDiagMsg(t, diags, "<?require?>")
+}
+
+func TestCheck_NonDotRootOnlyMatchesDirectChildren(t *testing.T) {
+	root := t.TempDir()
+	// File lives in archetypes/sub/story.md — deeper than archetype
+	// discovery supports, so not a schema source.
+	require.NoError(t, os.MkdirAll(
+		filepath.Join(root, "archetypes", "sub"), 0o755))
+	src := "<?require\nfilename: \"story-*.md\"\n?>\n# ?\n"
+	f := newFileInRoot(t, root,
+		filepath.Join("archetypes", "sub", "story.md"), src)
+	r := &Rule{}
+	diags := r.Check(f)
+	expectDiagMsg(t, diags, "<?require?>")
+}
+
 func TestCheck_ArchetypeRootEscapesProjectRoot(t *testing.T) {
 	root := t.TempDir()
 	f := newFileInRoot(t, root, "doc.md", "# Title\n")