diff --git a/.changeset/exclude-adds-to-defaults.md b/.changeset/exclude-adds-to-defaults.md
new file mode 100644
index 00000000..1a604abb
--- /dev/null
+++ b/.changeset/exclude-adds-to-defaults.md
@@ -0,0 +1,5 @@
+---
+'onsystem': minor
+---
+
+`exclude` adds to the defaults instead of replacing them. A config whose `exclude` lists folders without repeating the defaults now also leaves out tests and stories (`*.test.tsx`, `*.stories.tsx`, `__tests__`, `__stories__` and `__mocks__` folders) and `.d.ts` files, which it checked before. To check one of them again, add the default with `!` in front (`"!**/*.{test,spec,stories}.{ts,tsx,js,jsx}"`), or pass `--include-tests` to check tests and stories for one run; a `!` pattern that names no default gets a warning. A design-system package's `exclude` adds to the defaults for finding its own components too.
diff --git a/.changeset/registry-aware-zero-config.md b/.changeset/registry-aware-zero-config.md
new file mode 100644
index 00000000..4b1612ef
--- /dev/null
+++ b/.changeset/registry-aware-zero-config.md
@@ -0,0 +1,7 @@
+---
+'onsystem': minor
+---
+
+Zero config reads the folders `npx shadcn add` copies other registries' code into as read-only design systems, next to `components/ui`: for each registry in the `registries` of `components.json`, the folder of that name under the `components` alias (`@signoff-ui` → `components/signoff-ui`, `@ai-elements` → `components/ai-elements`). Before, that code was checked as the app's own: in VoltAgent's chatbot starter, which the corpus now checks, 11 of the 14 findings of `check .` were in `components/ai-elements`, and the next `shadcn add` could bring findings in registry files nobody edited, which failed `check` and the GitHub Action. Now `check`, the Claude Code hook, the ESLint plugin and the Action skip those files, as they skip `components/ui`; `search_components`, `get_component` and `list_components` find their components, and `get_component` says which registry one was installed from and that changes to it belong upstream; and the app's code is checked against them, so `<DiffReview tone="danger">` or `<Message.Header>` is a finding, and so is an icon-only registry button without a name. None of them is suggested in place of a native element, and the helpers in a folder's `lib/` (signoff-ui's `Img` and icons) are left out of `list_components` and `search_components`. `inspect` names the folders on its `detected` line, and `inspect --explain` says why each was read or not. A folder is not read when the app's components come from a workspace package imported through its `exports`, and code a registry copies loose into `components/` is still checked as the app's. `init` names those folders on its "Found the design system" line instead of a note of its own.
+
+A config that lists such a folder in `components`, as `init` writes it, reads it the same way: its components are no longer suggested for native elements (signoff-ui's `Img` for an `<img>`); map one in `elements` to have it suggested. A folder that `components.json` names in no `registries` entry is read as before.
diff --git a/corpus/repos.json b/corpus/repos.json
index 86a93f5d..a1843fcd 100644
--- a/corpus/repos.json
+++ b/corpus/repos.json
@@ -13,6 +13,19 @@
       "sha": "c2f8235e1f3ea903ad8b7f61447c4f74164b5c58",
       "runs": [{ "name": "chatbot", "cwd": ".", "check": ["app", "components"] }]
     },
+    {
+      "name": "voltagent",
+      "url": "https://github.com/VoltAgent/voltagent",
+      "sha": "72a46c76b4507e1f98b41d5050a92bd30587eb70",
+      "paths": ["examples/next-js-chatbot-starter-template"],
+      "runs": [
+        {
+          "name": "voltagent-chatbot",
+          "cwd": "examples/next-js-chatbot-starter-template",
+          "check": ["."]
+        }
+      ]
+    },
     {
       "name": "shadcn-ui",
       "url": "https://github.com/shadcn-ui/ui",
diff --git a/corpus/snapshot.json b/corpus/snapshot.json
index 1ac97524..0e2921ee 100644
--- a/corpus/snapshot.json
+++ b/corpus/snapshot.json
@@ -1,6 +1,6 @@
 {
   "$comment": "Written by `node scripts/corpus.mjs --update`. Counts per run and rule; `labels` records which labelled findings were reported.",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "runs": {
     "saas-starter": {
       "inspect": {
@@ -70,6 +70,35 @@
         }
       }
     },
+    "voltagent-chatbot": {
+      "inspect": {
+        "detected": "components.json (ui: @/components/ui → components/ui); from shadcn registries, read-only: components/ai-elements (@ai-elements, 31 files)",
+        "files": "49 component files, 1 token file, 0 docs",
+        "components": 53,
+        "parts": 208,
+        "tokens": {
+          "color": 36,
+          "typography": 2,
+          "radius": 8,
+          "spacing": 1
+        },
+        "warnings": 0
+      },
+      "files": 3,
+      "flagged": 1,
+      "rules": {
+        "icon-button-accessible-name": {
+          "errors": 1,
+          "warnings": 0,
+          "fixes": 0
+        },
+        "no-hardcoded-color": {
+          "errors": 0,
+          "warnings": 3,
+          "fixes": 0
+        }
+      }
+    },
     "shadcn-website": {
       "inspect": {
         "detected": "components.json (ui: @/registry/new-york-v4/ui → registry/new-york-v4/ui)",
diff --git a/docs/ci.md b/docs/ci.md
index dce7eaab..aebf6487 100644
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -2,7 +2,7 @@
 
 The check that runs after each edit in Claude Code also gates every pull request, whoever or whatever wrote it. `onsystem check` runs the same rules as `check_ui` and exits 1 on errors (or on more than `--max-warnings` warnings). It skips the design system's own component files, the ones `components` matches: they implement the scale and the primitives the rules enforce, so a fresh shadcn/ui project's `p-[3px]` is not a finding. `--include-design-system`, or `"includeDesignSystem": true` in the config, lints them too.
 
-In folders and globs, `check` also leaves out tests and stories (`*.test.tsx`, `*.spec.tsx`, `*.stories.tsx`, and whatever is in `__tests__`, `__stories__` and `__mocks__` folders; `--include-tests` checks them), or what the config's `exclude` lists in their place ([a list replaces them](configuration.md#config-file)), and what git ignores (through `git check-ignore`, so nested `.gitignore` files count); a file named outright is always checked. Only JS and TS files are (`.tsx`, `.jsx`, `.ts`, `.js` and their `.mts`, `.cts`, `.mjs` and `.cjs` forms): the CSS, Markdown and JSON that `check $(git diff --name-only)` names or `check "**/*"` matches are skipped, as `check_ui` refuses them. A file that renders an image or an email is not checked, since tokens and classes don't apply there: one that imports `next/og`, `@vercel/og`, `satori` or `@react-email/*`, a Next.js `opengraph-image`, `twitter-image`, `icon` or `apple-icon` route, or a file in an `og` folder. The summary line counts what was left out. Code installed from a shadcn registry is checked as your own until the config sets it apart: [code from shadcn registries](configuration.md#code-from-shadcn-registries).
+In folders and globs, `check` also leaves out tests and stories (`*.test.tsx`, `*.spec.tsx`, `*.stories.tsx`, and whatever is in `__tests__`, `__stories__` and `__mocks__` folders; `--include-tests` checks them), what the config's `exclude` adds to them ([`exclude`](configuration.md#config-file)), and what git ignores (through `git check-ignore`, so nested `.gitignore` files count); a file named outright is always checked. Only JS and TS files are (`.tsx`, `.jsx`, `.ts`, `.js` and their `.mts`, `.cts`, `.mjs` and `.cjs` forms): the CSS, Markdown and JSON that `check $(git diff --name-only)` names or `check "**/*"` matches are skipped, as `check_ui` refuses them. A file that renders an image or an email is not checked, since tokens and classes don't apply there: one that imports `next/og`, `@vercel/og`, `satori` or `@react-email/*`, a Next.js `opengraph-image`, `twitter-image`, `icon` or `apple-icon` route, or a file in an `og` folder. The summary line counts what was left out. Code that `npx shadcn add` copied into the folder of a registry `components.json` names is skipped like `components/ui`; other registry code is checked as your own until the config sets it apart: [code from shadcn registries](configuration.md#code-from-shadcn-registries).
 
 A folder stands for the `.tsx` and `.jsx` files in it. A JavaScript app can write its JSX in `.js` files (Next.js's JavaScript template has `app/page.js`): `check` names those it left out and gives the command that checks them, such as `check . "**/*.js"`. A `.js` file over 512 KB or named `*.min.js` is taken for a bundle and not looked at. With the [GitHub Action](required-check.md), list the glob in `paths` without quotes, `paths: . **/*.js`: the action passes each path as it is, with no shell.
 
diff --git a/docs/configuration.md b/docs/configuration.md
index 76e00260..88629683 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -6,7 +6,7 @@ Most projects need no config: onsystem finds the design system the way your app
 
 Without a config file of its own, a project first takes on the config its design-system package declares in its `package.json`, if one of its dependencies does ([design-system packages](design-system-packages.md)). With a config file of its own, it reads none of the package's config, so copy the package's `components`, `importPath` and `tokens` into it ([what it loses otherwise](design-system-packages.md#in-the-apps)). Without a config file (or with one that leaves `components` unset), the server looks for the design system in this order, and `inspect` prints what it found on its `detected` line:
 
-1. **`components.json`** (shadcn/ui): the `ui` alias, resolved through tsconfig `paths` (`@/registry/new-york-v4/ui`) or a workspace package's `exports` (`@workspace/ui/components` in shadcn's monorepo templates), and `tailwind.css` for tokens.
+1. **`components.json`** (shadcn/ui): the `ui` alias, resolved through tsconfig `paths` (`@/registry/new-york-v4/ui`) or a workspace package's `exports` (`@workspace/ui/components` in shadcn's monorepo templates), and `tailwind.css` for tokens. The folders `npx shadcn add` fills from the other registries it names are read too, as read-only design systems ([code from shadcn registries](#code-from-shadcn-registries)).
 2. **The root is a design-system package** (when it has no `components.json`): its `package.json` `exports` lead to three or more component files (`"./button": "./src/components/button.tsx"` or `"./components/*": "./src/components/*.tsx"`). An export that points at a barrel (`"./components/button": "./components/button/index.ts"`, as `@calcom/ui` has them) stands for the `.tsx` files the barrel re-exports, through `export *`, `export { … } from` and imported bindings exported again. An export built to `dist/` is read from its source: the `entry` of a tsup, tsdown or Vite config (read as text, never run), else the same path under `src/`, and `.` from `src/index.*`, so Dub's `@dub/ui` (`"import": "./dist/index.mjs"`) is read from `src/index.tsx` and what it re-exports. Exported stylesheets that exist are read as tokens, else `src/globals.css` and the like.
 3. **A dependency named like a design system** (`@acme/ui`, `@acme/ui-kit`, `@acme/design-system`, `acme-ui`) that resolves to workspace sources, through a `node_modules` link or the workspace's package globs (pnpm, npm, Yarn and Bun). It is read the same way, or through its own `components.json`, and added to what `components.json` found: Cal.com's app has `@coss/ui` in its `components.json` and imports `@calcom/ui` too, and both are read. Without a `components.json`, the app's own `components/ui` is kept alongside it. A package without `exports` that apps import by path, as Documenso imports `@documenso/ui/primitives/button`, is read from the files the app's code imports, each suggested with the specifier it uses, with a stylesheet imported from it as the theme.
 4. **A flat `src/` of components** that wrap a primitives library, the way React Aria's Tailwind starter ships them (`src/Button.tsx`, `src/Checkbox.tsx`). It takes all of: a dependency on `react-aria-components`, `react-aria`, Radix, Base UI, Headless UI or Ark UI; no app entry (`main.tsx`, `App.tsx`, `index.tsx`) or `app`, `pages` or `routes` folder in `src/`; and at least five PascalCase `.tsx` files at its top level, four in five of which import that library. An app's `src/` of pages and features does not qualify. A stylesheet such as `src/index.css` is read as the theme.
@@ -43,7 +43,7 @@ The root stays one project, as before, when it has a design system of its own (a
 {
   "$schema": "https://unpkg.com/onsystem/schema.json",
   "components": ["src/components/**/*.tsx"],
-  "exclude": ["**/*.stories.tsx", "**/*.test.tsx"],
+  "exclude": ["src/legacy/**"],
   "tokens": ["src/styles/globals.css", { "path": "tokens/*.tokens.json", "prefix": "acme" }],
   "docs": ["docs/components/**/*.mdx"],
   "importPath": "@acme/ui",
@@ -62,7 +62,7 @@ The root stays one project, as before, when it has a design system of its own (a
 | Field                 | Default                                                                                                                                                                                                        |
 | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `components`          | [Detected](#zero-config), else `components/ui/**/*.{tsx,jsx}`, `src/components/ui/**/*.{tsx,jsx}`                                                                                                              |
-| `exclude`             | `**/*.{test,spec,stories}.{ts,tsx,js,jsx}`, `**/__{tests,stories,mocks}__/**`, `**/*.d.ts`. A list replaces these, so repeat the ones to keep; `node_modules` is left out either way unless a pattern names it |
+| `exclude`             | `**/*.{test,spec,stories}.{ts,tsx,js,jsx}`, `**/__{tests,stories,mocks}__/**`, `**/*.d.ts`. A list adds to these, and `!` takes one out (`"!**/*.d.ts"`). `node_modules` is left out unless a pattern names it |
 | `tokens`              | Detected, else `app/globals.css`, `src/app/globals.css`, `styles/globals.css`, `src/styles/globals.css`, `src/index.css`, `app/app.css`, `**/*.tokens.json`; and the stylesheets they import                   |
 | `docs`                | `docs/components/**/*.{md,mdx}` and `.md`/`.mdx` files next to the components                                                                                                                                  |
 | `importPath`          | Inferred from package `exports` (`@acme/ui/button`), then `tsconfig` `paths` (`@/components/ui/button`). `@acme/ui/{path}` suggests each file by its path in its package                                       |
@@ -83,9 +83,20 @@ CLI flags override the file: `--root`, `--config`, `--components`, `--tokens`, `
 
 ## Code from shadcn registries
 
-`npx shadcn add` also installs items from other registries, often into a folder of their own: AI Elements into `components/ai-elements`, signoff-ui into `components/signoff-ui`. Zero config takes only the `ui` folder of `components.json` as the design system, so it checks that code as your own: a native `<button>` or an arbitrary color in it is a finding, in files you would rather update with `shadcn add` than rewrite. Set each registry's folder apart in one of two ways.
+`npx shadcn add` also installs items from other registries, often into a folder of their own: AI Elements into `components/ai-elements`, signoff-ui into `components/signoff-ui`. That code is the registry's: you update it with `shadcn add`, not by hand.
 
-**List it in `components`**, next to `components/ui`. Its files become part of the design system: `check` and the Claude Code hook skip them, as they skip `components/ui`, agents find its components with `search_components` and `get_component`, and your code is checked against their props (`<DiffReview> has no prop "tone"`). A config that sets `components` turns detection off, so it lists `components/ui` too, and the theme's stylesheet in `tokens`. `npx onsystem init` writes that config from what zero config found; add the registry folders to its `components`:
+**Zero config reads those folders as read-only design systems.** For each registry in the `registries` of `components.json` (`"@signoff-ui": "https://signoff-ui.vercel.app/r/{name}.json"`), the folder of that name under the `components` alias (`@/components` and `@signoff-ui` → `components/signoff-ui`) is a design system of its own, after `components/ui`:
+
+- `check`, the Claude Code hook, the ESLint plugin and the GitHub Action skip its files, as they skip `components/ui`, so the next `shadcn add` brings no findings in files nobody edited.
+- Your code is checked against its components (`<DiffReview> has no prop "tone"`, `Message has no member "Header"`).
+- Agents find them with `search_components` and `get_component`, which says which registry a component was installed from and that changes to it belong upstream. The helpers in the folder's `lib/` are left out of `list_components` and `search_components`.
+- None of them is suggested in place of a native element; `components/ui`'s are. signoff-ui's internal `Img` does not replace your `<img>`. To have one suggested, map it in [`elements`](#config-file) (`{ "img": "Img" }`).
+
+`inspect` names the folders on its `detected` line (`components.json (ui: @/components/ui → components/ui); from shadcn registries, read-only: components/ai-elements (@ai-elements, 31 files)`), and `inspect --explain` says why each registry's folder was read or not: one that does not exist yet, or holds no `.tsx` or `.jsx` file, is read once `shadcn add` fills it. `npx onsystem init` writes the folders into `components`, next to `components/ui`, with the ones that do not exist yet, and a config that lists them keeps them read-only. To check that code as your own, take its folder out of `components`, or pass `--include-design-system` for one run.
+
+Zero config does not set apart code a registry copies loose into `components/` (React Bits puts `components/Dock.tsx` there), code in a folder that `components.json` names in no `registries` entry, or registry folders in an app whose components come from a workspace package imported through its `exports` (`@workspace/ui` in shadcn's monorepo templates). Set that code apart in one of two ways.
+
+**List its folder in `components`**, next to `components/ui`. Its files become part of the design system: `check` and the Claude Code hook skip them, as they skip `components/ui`, agents find its components with `search_components` and `get_component`, and your code is checked against their props (`<DiffReview> has no prop "tone"`). A config that sets `components` turns detection off, so it lists `components/ui` too, and the theme's stylesheet in `tokens`. `npx onsystem init` writes that config from what zero config found; add the other folders to its `components`:
 
 ```json title="onsystem.config.json"
 {
@@ -99,7 +110,7 @@ CLI flags override the file: `--root`, `--config`, `--components`, `--tokens`, `
 }
 ```
 
-Every component the folder's files export counts, helpers too: with all of signoff-ui listed, the `Img` in its `lib/primitives.tsx` is suggested in place of a native `<img>` in your code. To leave a folder's helpers out, list its top level only (`components/signoff-ui/*.{tsx,jsx}`) and turn the rules off for the rest of the folder with an `overrides` entry like the one below, with `"files": ["components/signoff-ui/lib/**"]`. Without that entry, `check` reads `lib/` as your code and reports its files.
+A listed folder that `components.json` names in no `registries` entry is no registry's: every component its files export counts, helpers too, and can be suggested for a native element. With all of such a `components/signoff-ui` listed, the `Img` in its `lib/primitives.tsx` is suggested in place of a native `<img>` in your code. To leave a folder's helpers out, list its top level only (`components/signoff-ui/*.{tsx,jsx}`) and turn the rules off for the rest of the folder with an `overrides` entry like the one below, with `"files": ["components/signoff-ui/lib/**"]`. Without that entry, `check` reads `lib/` as your code and reports its files.
 
 **Or turn the rules off for it** in `overrides`. Nothing in its files is reported, by `check`, the hook or `check_ui`, and zero config still finds the design system, but agents do not learn the registry's components:
 
@@ -124,9 +135,6 @@ Every component the folder's files export counts, helpers too: with all of signo
 }
 ```
 
-`exclude` is not enough on its own:
-
-- A file named outright on the command line is checked whatever `exclude` says (`npx onsystem check components/signoff-ui/diff-review.tsx`). The Claude Code hook and `check_ui` leave it out, as `check .` does, so an agent that edits a registry file is not told to fix it.
-- In an app's config, `exclude` replaces the default list rather than adding to it: with `"exclude": ["components/signoff-ui/**"]`, `check .` leaves the folder out and reports tests and stories from then on. Repeat the defaults ([`exclude`](#config-file)) to keep them out.
+`exclude` is not enough on its own: a file named outright on the command line is checked whatever `exclude` says (`npx onsystem check components/signoff-ui/diff-review.tsx` with `"exclude": ["components/signoff-ui/**"]`). The Claude Code hook and `check_ui` leave it out, as `check .` does, so an agent that edits a registry file is not told to fix it. `exclude` adds to the default list, so tests and stories stay out ([`exclude`](#config-file)).
 
-After `npx shadcn add` from a registry you have not set apart yet, add its folder to the config, or `check` reports its files as your code.
+After `npx shadcn add` from a registry that `components.json` does not name, add its folder to the config, or `check` reports its files as your code.
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
index b97bc581..3653b08d 100644
--- a/docs/troubleshooting.md
+++ b/docs/troubleshooting.md
@@ -59,7 +59,7 @@ npm's `min-release-age` (a number of days, usually in `.npmrc`) makes npm and np
 
 ## Findings in code from a shadcn registry
 
-`check .` reports files in `components/ai-elements`, `components/signoff-ui` or another folder that `npx shadcn add` filled from a registry other than shadcn/ui's. Zero config takes only the `ui` folder of `components.json` as the design system. List the registry's folder in `components`, or turn the rules off for it in `overrides`: [code from shadcn registries](configuration.md#code-from-shadcn-registries) has both, and why `exclude` is not enough.
+`check .` reports files in `components/ai-elements`, `components/signoff-ui` or another folder that `npx shadcn add` filled from a registry other than shadcn/ui's. Zero config skips the folder of each registry in the `registries` of `components.json`, read-only, and checks other registry code as your own: a folder of a registry it does not name, or files a registry copies loose into `components/`. Name the registry in `components.json`, list its folder in `components`, or turn the rules off for it in `overrides`: [code from shadcn registries](configuration.md#code-from-shadcn-registries) has the details, and why `exclude` is not enough.
 
 ## Still stuck
 
diff --git a/schema.json b/schema.json
index 37b2da99..9071e9f4 100644
--- a/schema.json
+++ b/schema.json
@@ -22,7 +22,7 @@
       ]
     },
     "exclude": {
-      "description": "Globs for files to leave out (stories, tests), relative to the root: `check` in folders and globs, the ESLint plugin, the Claude Code hook and check_ui leave them out, and finding components skips them. A folder (`app/legacy`) covers everything in it. Replaces the defaults; node_modules is skipped either way unless a pattern names it.",
+      "description": "Globs for files to leave out, relative to the root: `check` in folders and globs, the ESLint plugin, the Claude Code hook and check_ui leave them out, and finding components skips them. A folder (`app/legacy`) covers everything in it. Adds to the defaults (node_modules, .d.ts files, tests and stories); a pattern that starts with `!` takes out the default it names, such as `!**/*.d.ts`.",
       "type": "array",
       "items": {
         "type": "string"
diff --git a/src/config.ts b/src/config.ts
index e364a59c..ad9be567 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -137,7 +137,7 @@ const configShape = {
     .array(z.string())
     .optional()
     .describe(
-      'Globs for files to leave out (stories, tests), relative to the root: `check` in folders and globs, the ESLint plugin, the Claude Code hook and check_ui leave them out, and finding components skips them. A folder (`app/legacy`) covers everything in it. Replaces the defaults; node_modules is skipped either way unless a pattern names it.',
+      'Globs for files to leave out, relative to the root: `check` in folders and globs, the ESLint plugin, the Claude Code hook and check_ui leave them out, and finding components skips them. A folder (`app/legacy`) covers everything in it. Adds to the defaults (node_modules, .d.ts files, tests and stories); a pattern that starts with `!` takes out the default it names, such as `!**/*.d.ts`.',
     ),
   tokens: z
     .union([tokenSourceSchema, z.array(tokenSourceSchema)])
@@ -570,10 +570,27 @@ export async function loadConfigWith(
           ...FALLBACK_TOKENS.map((p) => ({ path: p, fallback: true })),
         ];
 
-  const exclude = (config.exclude ?? DEFAULT_EXCLUDE)
-    .map(slashGlob)
-    // `./app/legacy/` is the folder `app/legacy`, also when a root config's pattern is rebased.
-    .map((e) => e.replace(/^(?:\.\/)+/, '').replace(/(.)\/+$/, '$1'))
+  // `exclude` adds to the defaults. A pattern that starts with `!` takes out the default it
+  // names (`!**/*.d.ts`), for a project that checks what the defaults leave out.
+  const tidy = (e: string) =>
+    slashGlob(e)
+      // `./app/legacy/` is the folder `app/legacy`, also when a root config's pattern is rebased.
+      .replace(/^(?:\.\/)+/, '')
+      .replace(/(.)\/+$/, '$1');
+  const listed = config.exclude ?? [];
+  const dropped = new Set(listed.filter((e) => e.startsWith('!')).map((e) => tidy(e.slice(1))));
+  for (const pattern of dropped) {
+    if (DEFAULT_EXCLUDE.includes(pattern)) continue;
+    warnings.push(
+      `"!${pattern}" in "exclude" takes out none of the defaults, which are ${DEFAULT_EXCLUDE.map((d) => `"${d}"`).join(', ')}: a pattern that starts with "!" names one of them.`,
+    );
+  }
+  const exclude = [
+    ...new Set([
+      ...DEFAULT_EXCLUDE.filter((d) => !dropped.has(d)),
+      ...listed.filter((e) => !e.startsWith('!')).map(tidy),
+    ]),
+  ]
     .map(excludeFromBase)
     .filter((e): e is string => e !== undefined);
 
@@ -589,7 +606,8 @@ export async function loadConfigWith(
           : DEFAULT_COMPONENTS
     ).map(slashGlob),
     // An app keeps the default excludes for its own files: a package's own `exclude` is about
-    // the package, and only adds to them. Finding the package's files uses its list as it is.
+    // the package, and only adds to them, whatever defaults it takes out. Finding the package's
+    // files uses its list as it is.
     exclude: declared && config.exclude ? [...new Set([...DEFAULT_EXCLUDE, ...exclude])] : exclude,
     ...(declared && config.exclude ? { designSystemExclude: exclude } : {}),
     tokens: tokenSources.map((t) => ({ ...t, path: slashGlob(t.path) })),
diff --git a/src/design-system.ts b/src/design-system.ts
index 5a94cc37..8dcb0655 100644
--- a/src/design-system.ts
+++ b/src/design-system.ts
@@ -8,7 +8,13 @@ import { glob } from 'tinyglobby';
 import type ts from 'typescript';
 
 import { loadConfig, rulesFor, type ResolvedConfig, type TokenSourceConfig } from './config.js';
-import { presetResolver, stylesheetResolver, workspaceRootOf } from './detect.js';
+import {
+  presetResolver,
+  registryFolders,
+  stylesheetResolver,
+  workspaceRootOf,
+  type DesignSystemSource,
+} from './detect.js';
 import { extractComponents } from './extract/components.js';
 import { attachDocs, parseDoc, type ParsedDoc } from './extract/docs.js';
 import {
@@ -43,7 +49,7 @@ import type {
   TokenCategory,
 } from './types.js';
 import { silentLogger, type Logger } from './util/log.js';
-import { globBase, isHomeOrAbove, isInside, relativePath } from './util/paths.js';
+import { globBase, isHomeOrAbove, isInside, matchesGlob, relativePath } from './util/paths.js';
 import { closest, plural, unique } from './util/strings.js';
 import { COLOR_UTILITY, parseUtility } from './lint/tailwind.js';
 import { VERSION } from './version.js';
@@ -54,25 +60,58 @@ export class DesignSystem {
   private readonly searchIndex: Bm25Index<ComponentInfo>;
   /**
    * The components the tools offer: all of them, except a library's (MUI's) where the project
-   * has its own of that name, a wrapper the team means to be used. The rules still check code
-   * that imports the library's directly against the library's.
+   * has its own of that name, a wrapper the team means to be used, and the helpers in a
+   * registry folder's `lib/` (signoff-ui's `Img` and icons). The rules still check code that
+   * imports either directly against them.
    */
   private readonly offered: ComponentInfo[];
+  /** The design systems the rules rank, with the registry folders a config lists. */
+  private readonly sources: DesignSystemSource[] | undefined;
 
   constructor(
     readonly model: DesignSystemModel,
     readonly config: ResolvedConfig,
   ) {
-    this.lint = new LintTarget(model, config, new ModuleResolver(config));
+    this.sources = rankedSources(config);
+    this.lint = new LintTarget(
+      model,
+      this.sources === config.designSystems ? config : { ...config, designSystems: this.sources },
+      new ModuleResolver(config),
+    );
     const own = new Set(
       model.components.filter((c) => !c.library).flatMap((c) => [c.name, ...c.aliases]),
     );
     this.offered = model.components.filter(
-      (c) => !c.library || !(own.has(c.name) || (c.parent !== undefined && own.has(c.parent))),
+      (c) =>
+        (!c.library || !(own.has(c.name) || (c.parent !== undefined && own.has(c.parent)))) &&
+        !this.registryHelper(c),
     );
     this.searchIndex = buildSearchIndex(this.offered);
   }
 
+  /**
+   * The shadcn registry a component was copied from (`@signoff-ui`), when its folder is one
+   * components.json names: a read-only design system, whose code is the registry's.
+   */
+  registryOf(component: ComponentInfo): { registry: string; folder: string } | undefined {
+    if (component.library) return undefined;
+    const file = component.source.file;
+    for (const source of this.sources ?? []) {
+      if (!source.registry) continue;
+      const glob = source.components.find((g) => matchesGlob(file, g));
+      // Its folder, as zero config wrote the glob: `components/signoff-ui/**/*.{tsx,jsx}`.
+      const folder = glob?.replace(/\/\*\*\/\*\.\{tsx,jsx\}$/, '').replace(/\\(.)/g, '$1');
+      if (folder !== undefined) return { registry: source.registry, folder };
+    }
+    return undefined;
+  }
+
+  /** A component in a registry folder's `lib/`: an internal of its items, not one of them. */
+  private registryHelper(component: ComponentInfo): boolean {
+    const from = this.registryOf(component);
+    return from !== undefined && component.source.file.startsWith(`${from.folder}/lib/`);
+  }
+
   get root(): string {
     return this.model.root;
   }
@@ -197,6 +236,37 @@ export class DesignSystem {
 
 const CONFIGURATION_DOCS = 'https://onsystem.vercel.app/docs/configuration';
 
+/**
+ * The design systems the rules rank, first to last: zero config's, or, for a config that lists
+ * the folders `npx shadcn add` copies the registries of components.json into (as `init` writes
+ * them), its other components first and each such folder after them, read-only, as zero config
+ * reads them.
+ */
+function rankedSources(config: ResolvedConfig): DesignSystemSource[] | undefined {
+  if (config.designSystems || !config.configured) return config.designSystems;
+  const listed = registryFolders(config.root, config.tsconfig).filter((f) =>
+    config.components.some((g) => matchesGlob(`${f.dir}/index.tsx`, g)),
+  );
+  if (!listed.length) return undefined;
+  const inRegistry = (glob: string) => {
+    const base = globBase(glob);
+    return listed.some((f) => base === f.dir || base.startsWith(`${f.dir}/`));
+  };
+  return [
+    {
+      source: 'components',
+      components: config.components.filter((g) => !inRegistry(g)),
+      imports: 0,
+    },
+    ...listed.map((f) => ({
+      source: `${f.dir} (${f.namespace})`,
+      components: [f.glob],
+      imports: 0,
+      registry: f.namespace,
+    })),
+  ];
+}
+
 /** `border-ring` → token `ring`, for color utilities a token's usage list does not spell out. */
 function matchUtility(base: string, tokens: Token[]): Token | undefined {
   const key = COLOR_UTILITY.exec(base)?.[1];
diff --git a/src/detect.ts b/src/detect.ts
index 95b6ad57..1da6cf55 100644
--- a/src/detect.ts
+++ b/src/detect.ts
@@ -99,6 +99,13 @@ export interface DesignSystemSource {
   source: string;
   components: string[];
   imports: number;
+  /**
+   * The shadcn registry (`@signoff-ui`) whose code `npx shadcn add` copied into these files, as
+   * the `registries` of components.json name it: a read-only design system, after the others.
+   * Code that imports it is checked against its components, which are never suggested for a
+   * native element, and its own files are skipped like the others' are.
+   */
+  registry?: string | undefined;
 }
 
 interface Found {
@@ -112,6 +119,8 @@ interface Found {
   package?: string | undefined;
   /** Specifiers the app imports them by: a package name, a `components.json` alias. */
   prefixes?: string[] | undefined;
+  /** The shadcn registry the files were copied from (`@signoff-ui`). */
+  registry?: string | undefined;
 }
 
 const COMPONENT_FILE = /\.[jt]sx$/;
@@ -146,6 +155,10 @@ const STYLESHEETS = [
  * (`designSystems`). A candidate whose globs match no file is skipped. Returns undefined
  * when nothing applies, so the shadcn defaults stay in force.
  *
+ * Next to the ui folder `components.json` names, the folders `npx shadcn add` copies other
+ * registries' code into (its `registries`: `@signoff-ui` → `components/signoff-ui`) are
+ * read-only design systems, after all the others ({@link fromRegistries}).
+ *
  * `declared` is the dependency whose config the root takes on ({@link findDesignSystemPackage}):
  * it is read first among the dependencies in step 3, whatever its name, and also when it is
  * installed from a registry rather than a workspace package.
@@ -162,12 +175,14 @@ export function detectProject(
   const found: Found[] = [];
 
   const shadcn = readJson(path.join(root, 'components.json'));
+  const project = shadcn ? readProjectConfig(root, tsconfig) : undefined;
   let why = 'no ui or components alias';
-  const fromShadcn = shadcn
-    ? fromComponentsJson(root, root, shadcn, readProjectConfig(root, tsconfig), packages, (r) => {
-        why = r;
-      })
-    : undefined;
+  const fromShadcn =
+    shadcn && project
+      ? fromComponentsJson(root, root, shadcn, project, packages, (r) => {
+          why = r;
+        })
+      : undefined;
   if (!shadcn) {
     step(
       'components.json',
@@ -271,11 +286,33 @@ export function detectProject(
       );
     }
   }
+  // Other registries' code next to the ui folder: read-only, after every other design system.
+  const registries =
+    shadcn && project && fromShadcn && !withDefaults
+      ? fromRegistries(root, shadcn, fromShadcn, found, project, step)
+      : [];
   if (found.length) {
     step('a flat src/ of components', false, 'not read: a design system was found');
+    // Registry code is named after the rest: `…; from shadcn registries, read-only: …`.
+    const named = (source: string) =>
+      registries.length
+        ? `${source}; from shadcn registries, read-only: ${registries.map((r) => r.source).join(', ')}`
+        : source;
+    // Each registry's folder is a design system of its own, never the primary one.
+    const read = registries.map((f) => ({
+      source: f.source,
+      components: f.components,
+      imports: 0,
+      registry: f.registry,
+    }));
     if (found.length === 1) {
       const [only] = found;
-      return detection(root, found, withDefaults, only?.source ?? '');
+      const source = only?.source ?? '';
+      if (!only || !read.length) return detection(root, found, withDefaults, source);
+      return {
+        ...detection(root, [...found, ...registries], withDefaults, named(source)),
+        designSystems: [{ source, components: only.components, imports: 0 }, ...read],
+      };
     }
     // Several design systems: the most imported first, the rest after it.
     const counts = importCounts(
@@ -291,15 +328,20 @@ export function detectProject(
     return {
       ...detection(
         root,
-        ranked.map((r) => r.f),
+        [...ranked.map((r) => r.f), ...registries],
         withDefaults,
-        `primary: ${primary ? describe(primary) : ''}; also: ${rest.map(describe).join(', ')}`,
+        named(
+          `primary: ${primary ? describe(primary) : ''}; also: ${rest.map(describe).join(', ')}`,
+        ),
       ),
-      designSystems: ranked.map((r) => ({
-        source: r.f.source,
-        components: r.f.components,
-        imports: r.imports,
-      })),
+      designSystems: [
+        ...ranked.map((r) => ({
+          source: r.f.source,
+          components: r.f.components,
+          imports: r.imports,
+        })),
+        ...read,
+      ],
     };
   }
 
@@ -506,6 +548,131 @@ function fromComponentsJson(
   };
 }
 
+/** How a shadcn registry is named in components.json: `@` and a name, so none leads out of the folder. */
+const REGISTRY_NAMESPACE = /^@[a-z0-9][\w-]*$/i;
+
+/** A folder `npx shadcn add` copies a registry's code into: `components/signoff-ui` for `@signoff-ui`. */
+export interface RegistryFolder {
+  namespace: string;
+  /** Relative to the root, with forward slashes. */
+  dir: string;
+  /** The glob, from the root, for its .tsx and .jsx files. */
+  glob: string;
+}
+
+/**
+ * The registries `components.json` names (`"registries": { "@signoff-ui": … }`), sorted, and
+ * where `npx shadcn add` copies their code: the components alias, through tsconfig `paths`, when
+ * it names a folder in the project. `why` says why there is none.
+ */
+function registryBase(
+  root: string,
+  json: Record<string, unknown>,
+  project: ProjectConfig,
+): { namespaces: string[]; base?: string; alias?: string; why?: string } {
+  const namespaces = Object.keys(asRecord(json.registries))
+    .filter((n) => REGISTRY_NAMESPACE.test(n))
+    .sort();
+  const alias = asRecord(json.aliases).components;
+  if (typeof alias !== 'string') return { namespaces, why: 'no components alias' };
+  const base = namespaces.length ? resolveThroughPaths(alias, project) : undefined;
+  if (!base || !isInside(root, base)) {
+    return {
+      namespaces,
+      why: `the components alias ${alias} names no folder in the project through tsconfig paths`,
+    };
+  }
+  return { namespaces, base, alias };
+}
+
+/** The folder of a registry's code: the namespace without its `@`, under the components folder. */
+function registryFolder(root: string, base: string, namespace: string): RegistryFolder {
+  const dir = relativePath(root, path.join(base, namespace.slice(1)));
+  return { namespace, dir, glob: `${escapePath(dir)}/**/*.{tsx,jsx}` };
+}
+
+/**
+ * The folders `npx shadcn add` copies the code of the registries `components.json` names into,
+ * whether they hold files yet or not, outside the ui folder ({@link fromRegistries}). A config
+ * that lists them in `components` reads them as zero config does: read-only, after the rest.
+ */
+export function registryFolders(root: string, tsconfig?: string): RegistryFolder[] {
+  const json = readJson(path.join(root, 'components.json'));
+  if (!json || !Object.keys(asRecord(json.registries)).length) return [];
+  const project = readProjectConfig(root, tsconfig);
+  const { namespaces, base } = registryBase(root, json, project);
+  if (!base) return [];
+  const ui = asRecord(json.aliases).ui;
+  const uiDir = typeof ui === 'string' ? resolveThroughPaths(ui, project) : undefined;
+  return namespaces
+    .filter((namespace) => !uiDir || !isInside(uiDir, path.join(base, namespace.slice(1))))
+    .map((namespace) => registryFolder(root, base, namespace));
+}
+
+/**
+ * The folders `npx shadcn add` copies the code of the registries `components.json` names into
+ * (`@/components` and `@signoff-ui` → `components/signoff-ui`). Each one that holds a .tsx or
+ * .jsx file is a read-only design system: the app's code is checked against its components, and
+ * its own files are skipped as the ui folder's are. Not when a design system found is imported
+ * through a package's `exports` (`@workspace/ui`): a config that names that package would give
+ * registry code its name too. A folder inside the ui folder is already part of it. Code a
+ * registry copies loose into the components folder (React Bits) is not set apart.
+ */
+function fromRegistries(
+  root: string,
+  json: Record<string, unknown>,
+  ui: Found,
+  others: readonly Found[],
+  project: ProjectConfig,
+  step: (candidate: string, accepted: boolean, reason: string) => void,
+): Found[] {
+  const { namespaces, base, alias, why } = registryBase(root, json, project);
+  if (!namespaces.length) return [];
+  const no = (reason: string) => {
+    for (const namespace of namespaces) step(`registry ${namespace}`, false, reason);
+    return [];
+  };
+  // A config that names one package for the design system would give their files its name.
+  const exported = others.find((f) => f.imports.length);
+  if (exported) {
+    return no(
+      `not read: ${exported.package ?? 'a package'} is imported through its exports, and the registry's code is not`,
+    );
+  }
+  if (!base || alias === undefined) return no(why ?? 'no components alias');
+  const found: Found[] = [];
+  for (const namespace of namespaces) {
+    const candidate = `registry ${namespace}`;
+    const { dir, glob } = registryFolder(root, base, namespace);
+    const absolute = path.join(root, dir);
+    if (ui.dirs.some((d) => isInside(d, absolute))) {
+      step(candidate, false, `${dir} is in the ui folder`);
+      continue;
+    }
+    const files = isDirectory(absolute) ? componentGlob(root, [glob]).length : 0;
+    if (!files) {
+      step(
+        candidate,
+        false,
+        `${dir} ${isDirectory(absolute) ? 'holds no .tsx or .jsx file yet' : 'does not exist yet'}`,
+      );
+      continue;
+    }
+    step(candidate, true, `${dir}, ${plural(files, 'component file')}, read-only`);
+    found.push({
+      components: [glob],
+      tokens: [],
+      imports: [],
+      // Markdown in it is the registry's, not docs for the app's components.
+      dirs: [],
+      source: `${dir} (${namespace}, ${plural(files, 'file')})`,
+      prefixes: [`${alias}/${namespace.slice(1)}`],
+      registry: namespace,
+    });
+  }
+  return found;
+}
+
 /**
  * The workspace package a `components.json` folder belongs to, when it is not the root
  * itself (`@coss/ui/components`, through tsconfig `paths` or the package), and the
diff --git a/src/explain.ts b/src/explain.ts
index fec0c12b..83b445f1 100644
--- a/src/explain.ts
+++ b/src/explain.ts
@@ -95,10 +95,15 @@ export function explainProject(ds: DesignSystem, cwd: string, indent = ''): stri
   );
   if (config.tailwindConfig) field('tailwind', display(config.root, config.tailwindConfig));
   if (config.designSystems) {
+    // Imports are counted to rank several design systems; a registry's folder always comes last.
+    const ranked = config.designSystems.filter((d) => !d.registry).length > 1;
     field(
       'primary',
       config.designSystems
-        .map((d, i) => `${i ? 'then ' : ''}${d.source} (${d.imports} imports)`)
+        .map(
+          (d, i) =>
+            `${i ? 'then ' : ''}${d.source}${d.registry ? ', read-only' : ranked ? ` (${d.imports} imports)` : ''}`,
+        )
         .join('; '),
     );
   }
diff --git a/src/lint/rules/components.ts b/src/lint/rules/components.ts
index 7993985e..27d8073c 100644
--- a/src/lint/rules/components.ts
+++ b/src/lint/rules/components.ts
@@ -4,7 +4,7 @@ import ts from 'typescript';
 
 import type { ComponentInfo, PropInfo, TextEdit } from '../../types.js';
 import { propertyName } from '../../extract/cva.js';
-import { toPosix } from '../../util/paths.js';
+import { matchesGlob, toPosix } from '../../util/paths.js';
 import { closest, editDistance } from '../../util/strings.js';
 import {
   asFunction,
@@ -79,6 +79,11 @@ export const preferDesignSystemComponent: Rule = {
       }
       const component = context.target.elements.get(key);
       if (!component) continue;
+      // Code copied from a shadcn registry is checked against, not suggested: signoff-ui's
+      // internal `Img` is no replacement for an app's <img>. Unless the config maps it.
+      if (fromRegistry(component, context) && context.target.config.elements[key] === undefined) {
+        continue;
+      }
       // An element no one sees or reaches is no UI to replace: the off-screen input that
       // carries a custom select's `required`, an `aria-hidden` proxy.
       if (hiddenFromUser(element)) continue;
@@ -119,6 +124,18 @@ export const preferDesignSystemComponent: Rule = {
   },
 };
 
+/**
+ * Whether `component` is in the folder of a shadcn registry that components.json names
+ * (`components/signoff-ui`): a read-only design system, ranked after the others.
+ */
+function fromRegistry(component: ComponentInfo, context: RuleContext): boolean {
+  const file = component.source.file;
+  return (context.target.config.designSystems ?? []).some(
+    (source) =>
+      source.registry !== undefined && source.components.some((g) => matchesGlob(file, g)),
+  );
+}
+
 const definitionsByFile = new WeakMap<ts.SourceFile, Set<string>>();
 
 /** Whether the element's `className` calls a `cva(...)` or `tv(...)` definition declared in this file. */
diff --git a/src/server/render.ts b/src/server/render.ts
index 134b93ab..0080f536 100644
--- a/src/server/render.ts
+++ b/src/server/render.ts
@@ -41,7 +41,7 @@ export function renderComponentList(ds: DesignSystem, project?: string): string
     '',
   ];
   const own = roots.filter((c) => !c.library);
-  for (const component of own) lines.push(...listItem(component));
+  for (const component of own) lines.push(...listItem(component, registryNote(ds, component)));
   // A library's components, imported alike: the import is said once.
   for (const library of new Set(roots.flatMap((c) => (c.library ? [c.library] : [])))) {
     if (own.length) lines.push('');
@@ -53,6 +53,12 @@ export function renderComponentList(ds: DesignSystem, project?: string): string
   return lines.join('\n');
 }
 
+/** ` (from @signoff-ui, read-only)` for a component copied from a shadcn registry. */
+function registryNote(ds: DesignSystem, component: ComponentInfo): string {
+  const from = ds.registryOf(component);
+  return from ? ` (from ${from.registry}, read-only)` : '';
+}
+
 function listItem(component: ComponentInfo, note = '', withImport = true): string[] {
   const element = component.element ? ` <${component.element}>` : '';
   const lines = [
@@ -187,6 +193,12 @@ export function renderComponent(
   ].filter(Boolean);
   lines.push(facts.join(' · '));
   if (origin) lines.push(`From ${origin.package}, used by ${listOf(origin.projects)}.`);
+  const registry = ds.registryOf(component);
+  if (registry) {
+    lines.push(
+      `Installed from the shadcn registry ${registry.registry} into ${registry.folder}: use it as it is. Its code is the registry's, so change it upstream, not here; \`npx shadcn add --overwrite\` replaces the file.`,
+    );
+  }
 
   lines.push('', '## Props');
   if (!component.props.length && !component.inherits.length) lines.push('No props.');
diff --git a/test/config.test.ts b/test/config.test.ts
index 7a43b28b..425f49d5 100644
--- a/test/config.test.ts
+++ b/test/config.test.ts
@@ -8,6 +8,7 @@ import {
   ConfigError,
   configJsonSchema,
   DEFAULT_COMPONENTS,
+  DEFAULT_EXCLUDE,
   loadConfig,
   nodeRunsTypeScript,
   rulesFor,
@@ -298,7 +299,7 @@ describe('loadConfig', () => {
       components: ['components/ui/**/*.tsx'],
       tokens: [{ path: 'app/globals.css' }, { path: 'tokens/*.tokens.json', prefix: 'acme' }],
       docs: ['guides/*.mdx'],
-      exclude: ['**/*.stories.tsx', 'app/\\(marketing\\)/**'],
+      exclude: [...DEFAULT_EXCLUDE, '**/*.stories.tsx', 'app/\\(marketing\\)/**'],
     });
   });
 
diff --git a/test/design-system-package.test.ts b/test/design-system-package.test.ts
index bfcbd775..2b98d92b 100644
--- a/test/design-system-package.test.ts
+++ b/test/design-system-package.test.ts
@@ -246,6 +246,7 @@ describe('a config a design-system package declares', () => {
       '**/*.stories.tsx',
     ]);
     expect(config.designSystemExclude).toEqual([
+      ...DEFAULT_EXCLUDE,
       '../../packages/kit/src/index.tsx',
       '**/*.stories.tsx',
     ]);
@@ -488,8 +489,9 @@ describe('a config a design-system package declares', () => {
     const config = await loadConfig({ root: app });
     const own = ['../../packages/kit/src/index.tsx', '../../packages/kit/src/legacy/**'];
     expect(config.exclude).toEqual([...DEFAULT_EXCLUDE, ...own]);
-    // The package's files are found with its own list, as the package finds them.
-    expect(config.designSystemExclude).toEqual(own);
+    // The package's files are found with its own list, which adds to the defaults, as the
+    // package finds them.
+    expect(config.designSystemExclude).toEqual([...DEFAULT_EXCLUDE, ...own]);
     expect((await run(['inspect', '--no-cache'], app)).stdout).toMatch(
       /Components \(3 \+ 0 parts\)\n {2}Button .*\n {2}Card .*\n {2}Input /,
     );
diff --git a/test/exclude-additive.test.ts b/test/exclude-additive.test.ts
new file mode 100644
index 00000000..1b90f0f7
--- /dev/null
+++ b/test/exclude-additive.test.ts
@@ -0,0 +1,102 @@
+import { describe, expect, it } from 'vitest';
+
+import { main, type Io } from '../src/cli.js';
+import { DEFAULT_EXCLUDE, DEFAULT_TEST_EXCLUDE, loadConfig } from '../src/config.js';
+import { fixture } from './helpers.js';
+
+// `exclude` adds to the defaults (node_modules, .d.ts files, tests and stories) instead of
+// replacing them. Before, `"exclude": ["components/signoff-ui/**"]`, the advice for a folder
+// installed from a registry, left that folder out and started checking every test and story.
+
+const json = (value: unknown) => JSON.stringify(value, null, 2);
+
+const BUTTON =
+  'export function Button(props: React.ComponentProps<"button">) { return <button {...props} /> }\n';
+const TOKENS = ':root {\n  --primary: oklch(0.2 0 0);\n  --destructive: oklch(0.58 0.22 27);\n}\n';
+const RED = 'export default () => <button className="bg-[#ff0000]">Hi</button>\n';
+
+function app(exclude?: string[]): string {
+  return fixture({
+    'components/ui/button.tsx': BUTTON,
+    'app/globals.css': TOKENS,
+    'app/page.tsx': RED,
+    'app/page.stories.tsx': RED,
+    'app/__tests__/page.tsx': RED,
+    'app/legacy/old.tsx': RED,
+    'components/signoff-ui/diff-review.tsx': RED,
+    ...(exclude ? { 'onsystem.config.json': json({ exclude }) } : {}),
+  });
+}
+
+async function run(args: string[], cwd: string) {
+  const out: string[] = [];
+  const err: string[] = [];
+  const io: Io = { cwd, color: false, stdout: (t) => out.push(t), stderr: (t) => err.push(t) };
+  const code = await main(args, io);
+  return { code, stdout: out.join('\n'), stderr: err.join('\n') };
+}
+
+async function checked(cwd: string, ...args: string[]): Promise<string[]> {
+  const { stdout } = await run(['check', '.', ...args, '--format', 'json', '--no-cache'], cwd);
+  return (JSON.parse(stdout) as { file: string; diagnostics: unknown[] }[])
+    .filter((r) => r.diagnostics.length)
+    .map((r) => r.file)
+    .sort();
+}
+
+describe('exclude adds to the defaults', () => {
+  it('keeps tests and stories out when a config leaves out a folder', async () => {
+    const root = app(['components/signoff-ui/**', 'app/legacy']);
+    expect((await loadConfig({ root })).exclude).toEqual([
+      ...DEFAULT_EXCLUDE,
+      'components/signoff-ui/**',
+      'app/legacy',
+    ]);
+    expect(await checked(root)).toEqual(['app/page.tsx']);
+    const summary = (await run(['check', '.', '--no-cache'], root)).stdout.split('\n').at(-1);
+    expect(summary).toContain(
+      '(1 design-system file skipped; 2 tests and stories left out; 2 excluded files left out)',
+    );
+    // --include-tests still checks them for one run.
+    expect(await checked(root, '--include-tests')).toEqual([
+      'app/__tests__/page.tsx',
+      'app/page.stories.tsx',
+      'app/page.tsx',
+    ]);
+  });
+
+  it('repeats nothing for a config that lists the defaults, as configs had to before', async () => {
+    const root = app([...DEFAULT_EXCLUDE, 'app/legacy']);
+    expect((await loadConfig({ root })).exclude).toEqual([...DEFAULT_EXCLUDE, 'app/legacy']);
+  });
+
+  it('takes out a default that a pattern starting with "!" names', async () => {
+    const root = app([`!${DEFAULT_TEST_EXCLUDE}`, 'components/signoff-ui']);
+    const config = await loadConfig({ root });
+    expect(config.exclude).toEqual([
+      ...DEFAULT_EXCLUDE.filter((e) => e !== DEFAULT_TEST_EXCLUDE),
+      'components/signoff-ui',
+    ]);
+    expect(config.warnings).toBeUndefined();
+    // Stories are checked; the __tests__ folder, another default, stays out.
+    expect(await checked(root)).toEqual([
+      'app/legacy/old.tsx',
+      'app/page.stories.tsx',
+      'app/page.tsx',
+    ]);
+  });
+
+  it('warns about a "!" pattern that names no default', async () => {
+    const root = app(['!app/legacy']);
+    const config = await loadConfig({ root });
+    expect(config.exclude).toEqual(DEFAULT_EXCLUDE);
+    expect(config.warnings).toEqual([
+      `"!app/legacy" in "exclude" takes out none of the defaults, which are ${DEFAULT_EXCLUDE.map((d) => `"${d}"`).join(', ')}: a pattern that starts with "!" names one of them.`,
+    ]);
+  });
+
+  it('leaves out the defaults with an empty list, as with none', async () => {
+    expect((await loadConfig({ root: app([]) })).exclude).toEqual(DEFAULT_EXCLUDE);
+    expect((await loadConfig({ root: app() })).exclude).toEqual(DEFAULT_EXCLUDE);
+  });
+});
diff --git a/test/exclude-scope.test.ts b/test/exclude-scope.test.ts
index 36fb79e8..85128c17 100644
--- a/test/exclude-scope.test.ts
+++ b/test/exclude-scope.test.ts
@@ -125,7 +125,8 @@ describe('coveredByGlob', () => {
 });
 
 describe('exclude: the same files left out everywhere', () => {
-  const kept = ['app/legacy-v2/page.tsx', 'app/page.stories.tsx', 'app/page.tsx'];
+  // `exclude` adds to the defaults: the story stays out too.
+  const kept = ['app/legacy-v2/page.tsx', 'app/page.tsx'];
   const patterns = [
     'app/legacy',
     'app/legacy/',
diff --git a/test/init-registry-folders.test.ts b/test/init-registry-folders.test.ts
index f2b98fe7..3de0bd1c 100644
--- a/test/init-registry-folders.test.ts
+++ b/test/init-registry-folders.test.ts
@@ -119,22 +119,23 @@ describe('init writes the folders shadcn add fills from other registries', () =>
     expect(init.code).toBe(0);
     expect(written(root)).toEqual({
       $schema: 'https://unpkg.com/onsystem/schema.json',
+      // Zero config found the folders that hold code, read-only; init adds the one to come.
       components: [
         'components/ui/**/*.{tsx,jsx}',
         'components/ai-elements/**/*.{tsx,jsx}',
-        'components/react-bits/**/*.{tsx,jsx}',
         'components/signoff-ui/**/*.{tsx,jsx}',
+        'components/react-bits/**/*.{tsx,jsx}',
       ],
       tokens: ['app/globals.css'],
     });
     expect(init.stdout).toContain(
-      `Added components/ai-elements (@ai-elements, 1 file) and components/signoff-ui (@signoff-ui, 1 file) to "components": they hold the code \`shadcn add\` copied from those registries in components.json. \`check\` and the hook skip it as design-system code, and your code is checked against every component its files export, helpers included, so a native element such as <img> can be told to use one of them. To leave the helpers out, see ${LINK}; to check that code as your own, take the folders out of "components".`,
+      'Found the design system through components.json (ui: @/components/ui → components/ui); from shadcn registries, read-only: components/ai-elements (@ai-elements, 1 file), components/signoff-ui (@signoff-ui, 1 file).',
     );
     // No components/react-bits yet: a registry named before its first `shadcn add` gets its
     // folder too. React Bits puts its files loose in components/, which the config cannot tell
     // apart, so the line says that code is checked as the app's.
     expect(init.stdout).toContain(
-      `Also added components/react-bits (@react-bits) to "components", though it does not exist yet: \`check\` and the hook skip the code \`shadcn add\` copies there from that registry in components.json. Code a registry copies somewhere else, such as loose into components/, is checked as your own (${LINK}).`,
+      `Added components/react-bits (@react-bits) to "components", though it does not exist yet: \`check\` and the hook skip the code \`shadcn add\` copies there from that registry in components.json. Code a registry copies somewhere else, such as loose into components/, is checked as your own (${LINK}).`,
     );
     // The dry run and the baseline hold the app's findings only, and React Bits' loose file.
     expect(init.stdout).toContain('Baseline: 5 findings in 2 files');
@@ -183,8 +184,8 @@ describe('init writes the folders shadcn add fills from other registries', () =>
     expect(written(root).components).toEqual([
       'src/components/ui/**/*.{tsx,jsx}',
       'src/components/ai-elements/**/*.{tsx,jsx}',
-      'src/components/react-bits/**/*.{tsx,jsx}',
       'src/components/signoff-ui/**/*.{tsx,jsx}',
+      'src/components/react-bits/**/*.{tsx,jsx}',
     ]);
   });
 
diff --git a/test/registry-aware.test.ts b/test/registry-aware.test.ts
new file mode 100644
index 00000000..836740e0
--- /dev/null
+++ b/test/registry-aware.test.ts
@@ -0,0 +1,424 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js';
+import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import { ESLint, type Linter } from 'eslint';
+import { build } from 'tsdown';
+import tseslint from 'typescript-eslint';
+import { beforeAll, describe, expect, it } from 'vitest';
+
+import { main, type Io } from '../src/cli.js';
+import { loadConfig } from '../src/config.js';
+import { createServer } from '../src/server/index.js';
+import { fixture, load, TSCONFIG } from './helpers.js';
+
+// Zero config in a shadcn/ui app with code from other registries: the folders `npx shadcn add`
+// copies @signoff-ui and @ai-elements into, as components.json's `registries` names them, are
+// read-only design systems next to components/ui. `check`, the hook and ESLint skip their files,
+// the app's code is checked against their components, agents find them, and none of them is
+// suggested for a native element. Before, the first `check .` reported that code as the app's,
+// and the next `shadcn add` brought new findings in files nobody edited.
+
+const json = (value: unknown) => JSON.stringify(value, null, 2);
+
+const stock = fs.readFileSync(
+  path.join(import.meta.dirname, 'fixtures/shadcn-neutral/globals.css'),
+  'utf8',
+);
+
+const DIFF_REVIEW = 'components/signoff-ui/diff-review.tsx';
+const PRIMITIVES = 'components/signoff-ui/lib/primitives.tsx';
+const MESSAGE = 'components/ai-elements/message.tsx';
+const DOCK = 'components/Dock.tsx';
+const PAGE = 'app/page.tsx';
+const INVENTED = 'app/invented/page.tsx';
+
+const REGISTRIES = {
+  '@signoff-ui': 'https://signoff-ui.vercel.app/r/{name}.json',
+  '@ai-elements': { url: 'https://registry.ai-sdk.dev/{name}.json' },
+  '@react-bits': 'https://reactbits.dev/r/{name}-TS-TW.json',
+};
+
+/**
+ * The app as `npx shadcn add` leaves it: signoff-ui and AI Elements in folders of their own,
+ * with a native <button>, <textarea> and arbitrary values in them, and React Bits loose in
+ * components/. The app's own page uses them as they are, and another invents props and parts.
+ */
+function app(files: Record<string, string | undefined> = {}): string {
+  const all: Record<string, string | undefined> = {
+    'package.json': json({ name: 'app', private: true }),
+    'tsconfig.json': TSCONFIG,
+    'components.json': json({
+      style: 'new-york',
+      tsx: true,
+      tailwind: { css: 'app/globals.css' },
+      aliases: { components: '@/components', ui: '@/components/ui', utils: '@/lib/utils' },
+      registries: REGISTRIES,
+    }),
+    'app/globals.css': stock,
+    'components/ui/button.tsx':
+      'export function Button(props: React.ComponentProps<"button">) { return <button {...props} /> }\n',
+    [DIFF_REVIEW]: `import { Img } from "./lib/primitives"
+
+export interface DiffReviewProps {
+  files: string[]
+  onAccept?: () => void
+}
+
+/** Review an agent's file changes, hunk by hunk, and accept or reject them. */
+export function DiffReview({ files, onAccept }: DiffReviewProps) {
+  return (
+    <div className="rounded-[7px] bg-[#f6f8fa]">
+      <Img src="/avatar.png" alt="" />
+      <textarea aria-label="Comment" className="p-[3px]" />
+      <button className="bg-[#123456] px-3" onClick={onAccept}>Accept {files.length}</button>
+    </div>
+  )
+}
+`,
+    [PRIMITIVES]: `export function Img(props: React.ComponentProps<"img">) {
+  return <img className="rounded-[7px]" {...props} />
+}
+
+export function IconCheck(props: React.ComponentProps<"svg">) {
+  return <svg viewBox="0 0 16 16" fill="white" {...props} />
+}
+`,
+    [MESSAGE]: `/** A chat message, from the user or the assistant. */
+export function Message({ from, children }: { from: "user" | "assistant"; children?: React.ReactNode }) {
+  return <div data-from={from} className="bg-[#f4f4f5] p-[3px]">{children}<button>Copy</button></div>
+}
+
+/** The body of a message. */
+export function MessageContent({ children }: { children?: React.ReactNode }) {
+  return <div className="rounded-[10px]">{children}</div>
+}
+`,
+    [DOCK]:
+      'export default function Dock() { return <nav className="bg-[#060010]"><button>Home</button></nav> }\n',
+    [PAGE]: `import { Button } from "@/components/ui/button"
+import { DiffReview } from "@/components/signoff-ui/diff-review"
+import { Message, MessageContent } from "@/components/ai-elements/message"
+
+export default function Page() {
+  return (
+    <main>
+      <Message from="assistant">
+        <MessageContent>Done.</MessageContent>
+      </Message>
+      <DiffReview files={[]} />
+      <Button>Go</Button>
+    </main>
+  )
+}
+`,
+    [INVENTED]: `import { DiffReview, DiffReviewPanel } from "@/components/signoff-ui/diff-review"
+import { Message } from "@/components/ai-elements/message"
+
+export default function Page() {
+  return (
+    <main>
+      <DiffReview files={[]} tone="danger" />
+      <DiffReviewPanel />
+      <Message from="user" size="lg">
+        <Message.Header />
+      </Message>
+      <img src="/logo.png" alt="Logo" />
+      <button>Go</button>
+    </main>
+  )
+}
+`,
+    ...files,
+  };
+  return fixture(
+    Object.fromEntries(
+      Object.entries(all).filter((entry): entry is [string, string] => entry[1] !== undefined),
+    ),
+  );
+}
+
+async function run(args: string[], cwd: string) {
+  const out: string[] = [];
+  const err: string[] = [];
+  const io: Io = { cwd, color: false, stdout: (t) => out.push(t), stderr: (t) => err.push(t) };
+  const code = await main(args, io);
+  return { code, stdout: out.join('\n'), stderr: err.join('\n') };
+}
+
+type Results = { file: string; diagnostics: { ruleId: string; message: string }[] }[];
+
+async function check(cwd: string, ...args: string[]) {
+  const text = await run(['check', ...args, '--no-cache'], cwd);
+  const { stdout } = await run(['check', ...args, '--no-cache', '--format', 'json'], cwd);
+  const results = JSON.parse(stdout) as Results;
+  return {
+    code: text.code,
+    text: text.stdout,
+    reported: results
+      .filter((r) => r.diagnostics.length)
+      .map((r) => r.file)
+      .sort(),
+    messages: (file: string) =>
+      results.filter((r) => r.file === file).flatMap((r) => r.diagnostics.map((d) => d.message)),
+  };
+}
+
+/** Calls one MCP tool on the app's design system. */
+async function tool(root: string, name: string, args: Record<string, unknown>): Promise<string> {
+  const ds = await load(root);
+  const server = createServer({ getDesignSystem: () => Promise.resolve(ds) });
+  const client = new Client({ name: 'test-client', version: '1.0.0' });
+  const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+  await Promise.all([server.connect(serverTransport), client.connect(clientTransport)]);
+  try {
+    const result = (await client.callTool({ name, arguments: args })) as CallToolResult;
+    const first = result.content[0];
+    return first?.type === 'text' ? first.text : '';
+  } finally {
+    await client.close();
+  }
+}
+
+describe('zero config reads shadcn registry folders as read-only design systems', () => {
+  it("skips the registry folders' code in check, as it skips components/ui", async () => {
+    const root = app({ [INVENTED]: undefined });
+    const all = await check(root, '.');
+    // React Bits puts its files loose in components/: they are checked as the app's.
+    expect(all.reported).toEqual([DOCK]);
+    expect(all.text).toContain('4 design-system files skipped');
+    // The hook and `check $(git diff --name-only)` name the files: skipped too.
+    const named = await check(root, DIFF_REVIEW, MESSAGE, PRIMITIVES);
+    expect([named.code, named.reported]).toEqual([0, []]);
+    expect(named.text).toContain('3 design-system files skipped');
+  });
+
+  it('keeps passing when the next shadcn add brings a primitive the registry code lacks', async () => {
+    // `npx shadcn add @ai-elements/prompt-input` adds components/ui/textarea.tsx, so the native
+    // <textarea> in untouched signoff-ui code now has a design-system component, and
+    // `@signoff-ui/run-meter` brings an arbitrary radius.
+    const root = app({
+      [INVENTED]: undefined,
+      [DOCK]: undefined,
+      'components/ui/textarea.tsx':
+        'export function Textarea(props: React.ComponentProps<"textarea">) { return <textarea {...props} /> }\n',
+      'components/ai-elements/prompt-input.tsx':
+        'export function PromptInput() { return <form className="rounded-[10px]"><textarea /></form> }\n',
+      'components/signoff-ui/run-meter.tsx':
+        'export function RunMeter() { return <div className="rounded-[3px] bg-[#e5e7eb]" /> }\n',
+    });
+    expect(await check(root, '.')).toMatchObject({ code: 0, reported: [] });
+  });
+
+  it('checks the app against their components, and suggests only the primary for native elements', async () => {
+    const root = app();
+    const { reported, messages } = await check(root, INVENTED);
+    expect(reported).toEqual([INVENTED]);
+    expect(messages(INVENTED)).toEqual([
+      '<DiffReview> has no prop "tone".',
+      '"DiffReviewPanel" is not a design-system component (imported from "@/components/signoff-ui/diff-review"). Did you mean <DiffReview>?',
+      '<Message> has no prop "size".',
+      'Message has no member "Header". Its parts are MessageContent.',
+      'Native <button> where the design system has <Button>. Use <Button> (import { Button } from "@/components/ui/button").',
+    ]);
+    // signoff-ui's internal Img is no replacement for the app's <img>.
+    expect(messages(INVENTED).some((m) => m.includes('<Img>'))).toBe(false);
+  });
+
+  it('keeps the primary component where a registry exports one of the same name', async () => {
+    const root = app({
+      [INVENTED]: undefined,
+      'components/ai-elements/actions.tsx':
+        'export function Button(props: React.ComponentProps<"button"> & { tooltip?: string }) { return <button {...props} /> }\n',
+      [PAGE]: 'export default function Page() { return <button>Go</button> }\n',
+    });
+    const { messages } = await check(root, PAGE);
+    expect(messages(PAGE)).toEqual([
+      'Native <button> where the design system has <Button>. Use <Button> (import { Button } from "@/components/ui/button").',
+    ]);
+  });
+
+  it("names the folders on inspect's detected line, and why each registry was read or not", async () => {
+    const root = app();
+    const inspect = await run(['inspect', '--no-cache'], root);
+    expect(inspect.code).toBe(0);
+    expect(inspect.stdout).toContain(
+      'detected components.json (ui: @/components/ui → components/ui); from shadcn registries, read-only: components/ai-elements (@ai-elements, 1 file), components/signoff-ui (@signoff-ui, 2 files)',
+    );
+    const explain = await run(['inspect', '--explain', '--no-cache'], root);
+    expect(explain.stdout).toContain(
+      'found  registry @ai-elements: components/ai-elements, 1 component file, read-only',
+    );
+    expect(explain.stdout).toContain(
+      'found  registry @signoff-ui: components/signoff-ui, 2 component files, read-only',
+    );
+    expect(explain.stdout).toContain(
+      'no     registry @react-bits: components/react-bits does not exist yet',
+    );
+    expect(explain.stdout).toContain(
+      'primary      components.json (ui: @/components/ui → components/ui); then components/ai-elements (@ai-elements, 1 file), read-only; then components/signoff-ui (@signoff-ui, 2 files), read-only',
+    );
+  });
+
+  it('lets agents find them, labelled as installed from the registry, without its lib/ helpers', async () => {
+    const root = app();
+    const component = await tool(root, 'get_component', { name: 'DiffReview' });
+    expect(component).toMatch(/^# DiffReview\n/);
+    expect(component).toContain(
+      "Installed from the shadcn registry @signoff-ui into components/signoff-ui: use it as it is. Its code is the registry's, so change it upstream, not here; `npx shadcn add --overwrite` replaces the file.",
+    );
+    expect(await tool(root, 'get_component', { name: 'Button' })).not.toContain('Installed from');
+    expect(
+      await tool(root, 'search_components', { query: 'review a diff of agent file changes' }),
+    ).toMatch(/best first:\n\n1\. DiffReview/);
+    const list = await tool(root, 'list_components', {});
+    expect(list).toContain('DiffReview <div> (from @signoff-ui, read-only) — Review an agent');
+    expect(list).toContain('Message <div> (from @ai-elements, read-only) — A chat message');
+    expect(list).toContain('Button <button> — No description.');
+    expect(list).not.toMatch(/^(Img|IconCheck)\b/m);
+    expect(await tool(root, 'search_components', { query: 'img image check icon' })).not.toMatch(
+      /\d\. (Img|IconCheck) /,
+    );
+  });
+
+  it('leaves the ESLint plugin off the registry folders, as check does', async () => {
+    const root = app({ [INVENTED]: undefined });
+    const results = await eslint(root, ['components', 'app']);
+    expect(
+      results
+        .filter((r) => r.messages.length)
+        .map((r) => path.relative(root, r.filePath).split(path.sep).join('/')),
+    ).toEqual([DOCK]);
+  });
+
+  it('reads no registry folder when components.json names none, or a package holds the ui folder', async () => {
+    const plain = app({
+      'components.json': json({
+        tailwind: { css: 'app/globals.css' },
+        aliases: { components: '@/components', ui: '@/components/ui' },
+      }),
+      [INVENTED]: undefined,
+    });
+    const config = await loadConfig({ root: plain });
+    expect(config.components).toEqual(['components/ui/**/*.{tsx,jsx}']);
+    expect(config.designSystems).toBeUndefined();
+    expect((await check(plain, '.')).reported).toEqual([DOCK, MESSAGE, DIFF_REVIEW, PRIMITIVES]);
+
+    // shadcn/ui's monorepo layout, with the ui folder in a package imported by its name.
+    const monorepo = fixture({
+      'pnpm-workspace.yaml': 'packages:\n  - apps/*\n  - packages/*\n',
+      'package.json': json({ name: 'monorepo', private: true }),
+      'packages/ui/package.json': json({
+        name: '@workspace/ui',
+        private: true,
+        exports: { './components/*': './src/components/*.tsx' },
+      }),
+      'packages/ui/src/components/button.tsx':
+        'export function Button(props: React.ComponentProps<"button">) { return <button {...props} /> }\n',
+      'apps/web/package.json': json({
+        name: 'web',
+        dependencies: { '@workspace/ui': 'workspace:*' },
+      }),
+      'apps/web/tsconfig.json': TSCONFIG,
+      'apps/web/components.json': json({
+        tailwind: { css: '../../packages/ui/src/styles/globals.css' },
+        aliases: { components: '@/components', ui: '@workspace/ui/components' },
+        registries: REGISTRIES,
+      }),
+      'apps/web/components/signoff-ui/diff-review.tsx':
+        'export function DiffReview() { return <button className="bg-[#123456]">Accept</button> }\n',
+    });
+    const web = path.join(monorepo, 'apps/web');
+    expect((await loadConfig({ root: web })).components).toEqual([
+      '../../packages/ui/src/components/**/*.{tsx,jsx}',
+    ]);
+    const explain = await run(['inspect', '--explain', '--no-cache'], web);
+    expect(explain.stdout).toContain(
+      "no     registry @signoff-ui: not read: @workspace/ui is imported through its exports, and the registry's code is not",
+    );
+  });
+
+  it('keeps the folders read-only in a config that lists them, as init writes it', async () => {
+    const listed = {
+      components: [
+        'components/ui/**/*.{tsx,jsx}',
+        'components/ai-elements/**/*.{tsx,jsx}',
+        'components/signoff-ui/**/*.{tsx,jsx}',
+      ],
+      tokens: ['app/globals.css'],
+    };
+    const root = app({ 'onsystem.config.json': json(listed) });
+    const { reported, messages, text } = await check(root, '.');
+    expect(reported).toEqual([INVENTED, DOCK]);
+    expect(text).toContain('4 design-system files skipped');
+    expect(messages(INVENTED)).toEqual([
+      '<DiffReview> has no prop "tone".',
+      '"DiffReviewPanel" is not a design-system component (imported from "@/components/signoff-ui/diff-review"). Did you mean <DiffReview>?',
+      '<Message> has no prop "size".',
+      'Message has no member "Header". Its parts are MessageContent.',
+      'Native <button> where the design system has <Button>. Use <Button> (import { Button } from "@/components/ui/button").',
+    ]);
+    expect(await tool(root, 'get_component', { name: 'DiffReview' })).toContain(
+      'Installed from the shadcn registry @signoff-ui into components/signoff-ui',
+    );
+    // `elements` still names one for a native element.
+    const mapped = app({ 'onsystem.config.json': json({ ...listed, elements: { img: 'Img' } }) });
+    expect((await check(mapped, INVENTED)).messages(INVENTED)).toContain(
+      'Native <img> where the design system has <Img>. Use <Img> (import { Img } from "@/components/signoff-ui/lib/primitives").',
+    );
+  });
+
+  it('leaves a config that sets "components" as it is', async () => {
+    const root = app({
+      [INVENTED]: undefined,
+      'onsystem.config.json': json({ components: ['components/ui/**/*.{tsx,jsx}'] }),
+    });
+    const config = await loadConfig({ root });
+    expect(config.designSystems).toBeUndefined();
+    expect((await check(root, '.')).reported).toEqual([DOCK, MESSAGE, DIFF_REVIEW, PRIMITIVES]);
+  });
+});
+
+// The ESLint plugin as it ships, built into its own folder, so its worker is a real file.
+const REPO = path.resolve(import.meta.dirname, '..');
+const OUT = path.join(REPO, 'node_modules/.cache/onsystem-eslint-registry-test');
+
+interface Plugin {
+  configs: { recommended: Linter.Config };
+}
+let plugin: Plugin;
+
+beforeAll(async () => {
+  await build({
+    cwd: REPO,
+    config: false,
+    entry: { eslint: 'src/eslint/index.ts', 'eslint-worker': 'src/eslint/worker.ts' },
+    outDir: OUT,
+    format: 'esm',
+    platform: 'node',
+    target: 'node22.18',
+    fixedExtension: false,
+    dts: false,
+    publint: false,
+    clean: true,
+    logLevel: 'silent',
+  });
+  ({ default: plugin } = (await import(pathToFileURL(path.join(OUT, 'eslint.js')).href)) as {
+    default: Plugin;
+  });
+});
+
+function eslint(cwd: string, files: string[]): Promise<ESLint.LintResult[]> {
+  const linter = new ESLint({
+    cwd,
+    overrideConfigFile: true,
+    overrideConfig: [
+      { files: ['**/*.{ts,tsx,js,jsx}'], languageOptions: { parser: tseslint.parser } },
+      plugin.configs.recommended,
+    ],
+  });
+  return linter.lintFiles(files);
+}
diff --git a/test/registry-code.test.ts b/test/registry-code.test.ts
index 969c738c..f1dd81a2 100644
--- a/test/registry-code.test.ts
+++ b/test/registry-code.test.ts
@@ -128,7 +128,7 @@ async function tool(root: string, name: string, args: Record<string, unknown>):
 }
 
 describe('code from shadcn registries (docs/configuration.md)', () => {
-  it('without a config, checks the registry folders as app code', async () => {
+  it('without a config, checks folders that components.json names no registry for as app code', async () => {
     const { reported } = await check(app(), '.');
     expect(reported).toEqual([MESSAGE, DIFF_REVIEW, PRIMITIVES]);
   });
@@ -221,11 +221,13 @@ describe('code from shadcn registries (docs/configuration.md)', () => {
     );
   });
 
-  it('with `exclude`, still checks a file named outright, and starts checking stories', async () => {
+  it('with `exclude`, still checks a file named outright, and keeps stories out', async () => {
     expect(configuration).toContain('`"exclude": ["components/signoff-ui/**"]`');
     const root = app({ exclude: ['components/signoff-ui/**'] });
     const all = await check(root, '.');
-    expect(all.reported).toEqual(['app/page.stories.tsx', MESSAGE]);
+    // `exclude` adds to the defaults, which leave tests and stories out.
+    expect(all.reported).toEqual([MESSAGE]);
+    expect(all.text).toContain('1 test or story left out');
     const named = await check(root, DIFF_REVIEW);
     expect([named.code, named.reported]).toEqual([1, [DIFF_REVIEW]]);
     // check_ui leaves it out, as `check .` and the hook do.
@@ -234,7 +236,7 @@ describe('code from shadcn registries (docs/configuration.md)', () => {
     );
   });
 
-  it('lists the default `exclude` in the field table, which keeps tests and stories out again', async () => {
+  it('lists the default `exclude` in the field table, which a list adds to', async () => {
     const row = configuration.split('\n').find((line) => line.startsWith('| `exclude`'));
     const defaults = [
       ...(row?.split('|')[2]?.split('. A list')[0] ?? '').matchAll(/`([^`]+)`/g),
@@ -242,7 +244,7 @@ describe('code from shadcn registries (docs/configuration.md)', () => {
     expect([...defaults].sort()).toEqual(
       DEFAULT_EXCLUDE.filter((e) => e !== '**/node_modules/**').sort(),
     );
-    expect(row).toContain('A list replaces these');
+    expect(row).toContain('A list adds to these');
     const root = app({ exclude: ['components/signoff-ui/**', ...defaults] });
     const all = await check(root, '.');
     expect(all.reported).toEqual([MESSAGE]);