@@ -47,6 +47,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { workspaceDirs } from "./lib/workspaces.mjs";
 
 const repoRoot = path.resolve(
   path.dirname(fileURLToPath(import.meta.url)),
@@ -164,6 +165,21 @@ export function main(root = repoRoot) {
       ? JSON.parse(readFileSync(manifest, "utf8"))
       : undefined;
   });
+  // A workspace added since the last install has a manifest and no lockfile
+  // entry at all, so the comparison above (which walks the lockfile) never
+  // reaches it. Found from the root manifest's `workspaces`, not the lockfile.
+  const rootManifestPath = path.join(root, "package.json");
+  const workspaces = existsSync(rootManifestPath)
+    ? JSON.parse(readFileSync(rootManifestPath, "utf8")).workspaces
+    : undefined;
+  if (Array.isArray(workspaces) && workspaces.length > 0) {
+    for (const { dir, hasManifest } of workspaceDirs(root, workspaces)) {
+      if (hasManifest && lock.packages?.[dir] === undefined)
+        problems.push(
+          `  ${dir}/package.json: a workspace the lockfile has no entry for`,
+        );
+    }
+  }
   for (const d of drift)
     problems.push(
       `  ${path.posix.join(d.dir || ".", "package.json")} ${d.section}.${d.name}: manifest ${d.manifest ?? "(absent)"}, lockfile ${d.lock ?? "(absent)"}`,
 
@@ -172,6 +172,20 @@ test("main fails when a manifest declares what the lockfile does not", (t) => {
   );
 });
 
+test("main fails on a workspace the lockfile has never seen", (t) => {
+  const { root, write } = fixture(t);
+  t.mock.method(console, "log", () => {});
+  const error = t.mock.method(console, "error", () => {});
+  write("node_modules/sdk/package.json", { version: "2.1.0" });
+  write("package.json", { name: "root", workspaces: ["src/*"] });
+  write("src/newserver/package.json", { name: "newserver" });
+  assert.equal(main(root), 1);
+  assert.match(
+    error.mock.calls[0].arguments[0],
+    /src\/newserver\/package\.json: a workspace the lockfile has no entry for/,
+  );
+});
+
 function fixture(t) {
   const root = mkdtempSync(path.join(tmpdir(), "install-fresh-"));
   t.after(() => rmSync(root, { recursive: true, force: true }));
 
@@ -102,15 +102,34 @@ export function findRetries(file, text) {
   const rules = RULES.filter((r) => r.files.test(file));
   if (rules.length === 0) return [];
   const findings = [];
-  text.split("\n").forEach((lineText, index) => {
+  const lines = text.split("\n");
+  lines.forEach((physical, index) => {
+    // A shell command continued with a trailing backslash is one command: the
+    // runner can be on one line and its retry flag on the next. Each line is
+    // therefore read together with its continuation lines, and a finding is
+    // reported at the line the command starts on. Only a line that does not
+    // itself continue a previous one starts a command, so a continued command
+    // is reported once.
+    let lineText = physical;
+    if (/\\\s*$/.test(physical)) {
+      if (index > 0 && /\\\s*$/.test(lines[index - 1])) return;
+      let end = index;
+      while (end < lines.length - 1 && /\\\s*$/.test(lines[end])) end += 1;
+      lineText = lines
+        .slice(index, end + 1)
+        .map((l) => l.replace(/\\\s*$/, " "))
+        .join("");
+    } else if (index > 0 && /\\\s*$/.test(lines[index - 1])) {
+      return;
+    }
     for (const rule of rules) {
       if (rule.pattern.test(lineText))
         findings.push({
           file,
           line: index + 1,
           rule: rule.id,
           why: rule.why,
-          text: lineText.trim(),
+          text: lineText.trim().replace(/\s+/g, " "),
         });
     }
   });
 
@@ -100,6 +100,23 @@ for (const [file, text, rules] of cases) {
   });
 }
 
+test("a flag on a continuation line is found, at the line the command starts", () => {
+  const found = findRetries(
+    ".github/workflows/python.yml",
+    [
+      "      - run: |",
+      "          uv run pytest \\",
+      "            -q \\",
+      "            --reruns 3",
+      "          echo done",
+    ].join("\n"),
+  );
+  assert.deepEqual(
+    found.map((f) => [f.rule, f.line, f.text]),
+    [["workflow-retry-flag", 2, "uv run pytest -q --reruns 3"]],
+  );
+});
+
 test("a finding carries its file, line and the offending text", () => {
   const [finding] = findRetries(
     "src/a/vitest.config.ts",