2sagaco48 1.0.0

package/src/lib/flaws/software-extended.ts

@@ -0,0 +1,125 @@
+/**
+ * Software Engineering & AI Codegen Pack — v15.1
+ * - Deduplicated soft.swift-actor-protocol-mismatch (was declared twice)
+ * - Added V13-V15 web-verified detectors: CORS wildcard, debug endpoint leak,
+ *   Rust tokio::select cancel-unsafe, Rust blocking-in-async, npm prod sourcemap.
+ * - Added soft.node-then-without-catch (V14 distinct from unhandled-promise).
+ */
+import { type FlawDetector, type FlawIssue, type ScanContext } from "../flaw-registry";
+
+const mk = (s: FlawIssue["severity"], c: string, m: string, r: string): FlawIssue => ({ severity: s, code: c, message: m, remediation: r });
+
+function T(c: ScanContext): string { return `${c.prompt}\n${c.answer}`; }
+function isNode(c: ScanContext) { return /\b(Node\.js|Express|Fastify|Koa|http\.createServer|app\.get|app\.post|router)\b/i.test(T(c)); }
+function isPython(c: ScanContext) { return /\b(python|flask|django|fastapi|\.py\b|def\s+\w+\s*\()\b/i.test(T(c)); }
+function isGo(c: ScanContext) { return /\b(go\s+func|goroutine|chan\s+\w+|<-\s*\w+|make\s*\(\s*chan)\b/i.test(T(c)); }
+function isRust(c: ScanContext) { return /\b(rust|tokio|\.await|async\s+fn|cargo|impl|trait)\b/i.test(T(c)); }
+function isSwift(c: ScanContext) { return /\b(Swift|SwiftUI|UIKit|@MainActor|Actor|Sendable)\b/i.test(T(c)); }
+function isTailwind(c: ScanContext) { return /\b(tailwind|className|class=)\b/i.test(T(c)); }
+function isWebContext(c: ScanContext) { return /\b(cors|Access-Control-Allow-Origin|express|fastify|koa|fetch|api endpoint|http server|route)\b/i.test(T(c)); }
+
+export const SOFTWARE_EXTENDED_FLAWS: FlawDetector[] = [
+  // ── Node.js ───────────────────────────────────────────────────────────────
+  { id: "soft.node-event-loop-blocking", domain: "domain", appliesTo: isNode, scan: c => /\b(app\.(?:get|post|put|delete|patch)|router\.(?:get|post)|server\.on\(['"]request)\b[\s\S]{0,500}\b(fs\.(?:readFileSync|writeFileSync|existsSync)|execSync|spawnSync|child_process\.execSync)\b/i.test(T(c)) ? [mk("major", "NODE_EVENT_LOOP_BLOCKING", "Synchronous blocking call inside a request handler — stalls the entire event loop.", "Move CPU/blocking I/O to worker_threads or libuv pool (async fs).")] : [] },
+  { id: "soft.node-pipeline-http-destroy", domain: "domain", appliesTo: isNode, scan: c => /\bpipeline\s*\([\s\S]{0,300}\b(?:res|response)\b[\s\S]{0,200}(?:err|error)\s*(?:=>|\))/i.test(T(c)) && /\b(?:res|response)\.(?:end|send|status|writeHead|json)\s*\(/i.test(T(c)) && !/\b(?:source|file|readStream)\.on\s*\(\s*['"]error['"]/i.test(T(c)) ? [mk("major", "NODE_PIPELINE_HTTP_DESTROY", "stream.pipeline() destroys the destination socket on error — fallback res.end() is unreachable.", "Handle source stream errors separately before pipeline().")] : [] },
+  { id: "soft.node-cjs-esm-interop", domain: "domain", appliesTo: isNode, scan: c => { const esm = /"type"\s*:\s*"module"|\.mjs\b/i.test(T(c)); const cjs = /\b(__dirname|__filename|module\.exports\s*=|require\s*\()\b/i.test(T(c)); return esm && cjs ? [mk("major", "NODE_CJS_ESM_INTEROP", "CJS globals (__dirname, require, module.exports) used in ESM context.", "Use import.meta.url + fileURLToPath() for __dirname, import for require, export for module.exports.")] : []; } },
+  { id: "soft.node-toctou-fs", domain: "domain", appliesTo: isNode, scan: c => /\bfs\.(?:access|exists|existsSync)\s*\([\s\S]{0,200}\bfs\.(?:open|readFile|writeFile|appendFile|createWriteStream|createReadStream)\b/i.test(T(c)) ? [mk("major", "NODE_FS_TOCTOU", "fs.access()/exists() check before open/read/write — TOCTOU race condition.", "Open/read/write directly and handle ENOENT/EACCES atomically.")] : [] },
+  { id: "soft.node-unhandled-promise", domain: "domain", appliesTo: isNode, scan: c => /\b(Promise\.all|Promise\.race|Promise\.allSettled)\s*\([\s\S]{0,300}\)\s*;/i.test(T(c)) && !/\.(catch|finally)\s*\(/.test(T(c)) && !/\bawait\b[\s\S]{0,50}\bPromise\.\b/i.test(T(c)) ? [mk("major", "NODE_UNHANDLED_PROMISE_REJECTION", "Promise combinator launched without .catch() or await.", "Await the Promise combinator or append .catch().")] : [] },
+  { id: "soft.node-then-without-catch", domain: "domain", appliesTo: isNode, scan: c => { const thenChain = /\.then\s*\(\s*(?:async\s*)?(?:\([^)]*\)|\w+)\s*=>[\s\S]{0,200}\)\s*(?:;|\n|$)/i.test(c.answer); const hasCatch = /\.catch\s*\(|\.then\s*\([^,]+,\s*(?:async\s*)?(?:\(|\w+\s*=>)|\bawait\s+/i.test(c.answer); const global = /\bprocess\.on\s*\(\s*['"]unhandledRejection['"]/i.test(c.answer); return thenChain && !hasCatch && !global ? [mk("major", "NODE_THEN_WITHOUT_CATCH", ".then() chain has no .catch() handler — rejected promises become unhandledRejection.", "Append .catch(err => ...) or convert to async/await with try/catch.")] : []; } },
+  { id: "soft.node-setmaxlisteners-mask", domain: "domain", appliesTo: isNode, scan: c => /\.setMaxListeners\s*\(\s*(?:0|Infinity)\s*\)/i.test(T(c)) ? [mk("major", "NODE_SETMAXLISTENERS_MASK", "setMaxListeners(0/Infinity) silences the EventEmitter leak warning without fixing the underlying leak.", "Fix listener ownership/cleanup; never disable the warning.")] : [] },
+  { id: "soft.node-http-timeout-missing", domain: "domain", appliesTo: isNode, scan: c => /\b(http\.createServer|https\.createServer|app\.listen)\b/i.test(T(c)) && /\b(?:production|prod|server|api|express|fastify|koa)\b/i.test(T(c)) && !/\b(?:requestTimeout|headersTimeout|keepAliveTimeout|server\.timeout\s*=)/i.test(T(c)) ? [mk("warning", "NODE_HTTP_TIMEOUT_MISSING", "HTTP server without explicit timeout policy.", "Set server.requestTimeout, headersTimeout, keepAliveTimeout deliberately.")] : [] },
+  { id: "soft.node-async-context-loss", domain: "domain", appliesTo: isNode, scan: c => /\bAsyncLocalStorage\b/i.test(T(c)) && /\b(?:\.on\s*\(\s*['"]|EventEmitter|setImmediate|setTimeout|callback)\b/i.test(T(c)) && !/\b(?:AsyncResource|util\.promisify|\.bind\s*\()\b/i.test(T(c)) ? [mk("major", "NODE_ASYNC_CONTEXT_LOSS", "AsyncLocalStorage across callback/EventEmitter without AsyncResource.", "Wrap callbacks with `new AsyncResource('name').bind(fn)`.")] : [] },
+
+  // ── TypeScript ────────────────────────────────────────────────────────────
+  { id: "soft.ts-any-io-boundary", domain: "domain", appliesTo: c => /\b(TypeScript|fetch|axios|JSON\.parse|req\.body)\b/i.test(T(c)), scan: c => /\b(?:const|let|var)\s+\w+\s*:\s*any\s*=\s*(?:await\s+)?(?:fetch|res\.json\(\)|JSON\.parse|req\.body|response\.json)/i.test(T(c)) && !/\b(zod|joi|valibot|io-ts|safeParse|validate|schema\.parse)\b/i.test(T(c)) ? [mk("major", "TS_ANY_IO_BOUNDARY", "External I/O value typed as `any` without runtime schema validation.", "Use Zod/Valibot/io-ts schema validation.")] : [] },
+  { id: "soft.ts-strict-disabled", domain: "domain", appliesTo: c => /\b(tsconfig|TypeScript)\b/i.test(T(c)), scan: c => /["\s](?:strict|strictNullChecks|noUncheckedIndexedAccess|exactOptionalPropertyTypes)["']?\s*:\s*false/i.test(T(c)) ? [mk("critical", "TS_STRICT_DISABLED", "TypeScript strictness flag disabled.", "Enable strict: true. Fix underlying type errors instead of disabling.")] : [] },
+  { id: "soft.ts-discriminated-union-nonexhaustive", domain: "domain", appliesTo: c => /\b(TypeScript|switch)\b/i.test(T(c)), scan: c => /\bswitch\s*\([^)]+\)\s*\{[\s\S]{0,800}\bdefault\s*:\s*(?![\s\S]{0,60}\bconst\s+_:\s*never\b)/i.test(T(c)) && /\bcase\s+['"][A-Z_]+['"]\s*:/i.test(T(c)) ? [mk("warning", "TS_SWITCH_NONEXHAUSTIVE", "Discriminated union switch lacks never-based exhaustiveness check.", "Add `default: { const _: never = x; return _; }`.")] : [] },
+  { id: "soft.ts-module-resolution-mismatch", domain: "domain", appliesTo: c => /\b(tsconfig|moduleResolution|package\.json)\b/i.test(T(c)), scan: c => /"moduleResolution"\s*:\s*"node(?:10)?"/i.test(T(c)) && /"type"\s*:\s*"module"|import\.meta|\.mjs\b|"module"\s*:\s*"(?:node16|nodenext|esnext|es20\d\d)"/i.test(T(c)) ? [mk("major", "TS_MODULE_RESOLUTION_MISMATCH", "Legacy moduleResolution 'node' (Node10) with ESM context — runtime resolution will fail.", "Set moduleResolution to 'node16', 'nodenext', or 'bundler'.")] : [] },
+  { id: "soft.ts-no-unchecked-index", domain: "domain", appliesTo: c => /\b(Record<string,|Map<)\b/i.test(T(c)), scan: c => /\b\w+\s*\[(?:key|id|name|type|kind|prop|\w+)\s*\]\s*\.\s*\w+/i.test(T(c)) && !/\b(noUncheckedIndexedAccess|\?\?|if\s*\(\s*\w+\[)/i.test(T(c)) ? [mk("warning", "TS_NO_UNCHECKED_INDEX_MISSING", "Index lookup result used directly without null/undefined guard.", "Enable noUncheckedIndexedAccess; use optional chaining.")] : [] },
+
+  // ── Swift ─────────────────────────────────────────────────────────────────
+  { id: "soft.swift-force-unwrap", domain: "domain", appliesTo: isSwift, scan: c => { const m = T(c).match(/\btry!|\bas!|\b[A-Za-z_]\w*!(?=[.\s),;\]])/g) ?? []; const forced = m.filter(x => x !== "!=").length; return forced >= 2 ? [mk("warning", "SWIFT_FORCE_UNWRAP", `Swift code uses force-unwrap / try! / as! ${forced} time(s).`, "Replace with guard let / if let / do-catch.")] : []; } },
+  { id: "soft.swift-global-mutable-state", domain: "domain", appliesTo: isSwift, scan: c => /\bstatic\s+var\s+\w+/i.test(T(c)) && !/\b(@MainActor|actor\s+\w+|nonisolated\(unsafe\)|Mutex|NSLock|DispatchQueue)\b/i.test(T(c)) ? [mk("major", "SWIFT_GLOBAL_MUTABLE_STATE", "Mutable static var without actor isolation under Swift Concurrency.", "Isolate to an actor or mark @MainActor.")] : [] },
+  { id: "soft.swift-mainactor-nonisolated", domain: "domain", appliesTo: isSwift, scan: c => /\bDispatchQueue\.main\.async\s*\{/i.test(T(c)) && /\b(ViewModel|ObservableObject|@Published|objectWillChange)\b/i.test(T(c)) && !/\b(@MainActor|await\s+MainActor\.run)\b/i.test(T(c)) ? [mk("major", "SWIFT_MAINACTOR_NONISOLATED", "DispatchQueue.main.async used for UI updates instead of @MainActor/MainActor.run.", "Use `await MainActor.run { ... }` or annotate the type with @MainActor.")] : [] },
+  { id: "soft.swift-actor-protocol-mismatch", domain: "domain", appliesTo: isSwift, scan: c => /\bprotocol\s+\w+/i.test(T(c)) && /@MainActor\s+(?:final\s+)?class\s+\w+\s*:\s*\w+/i.test(T(c)) && !/\b@preconcurrency\b/i.test(T(c)) ? [mk("major", "SWIFT_ACTOR_PROTOCOL_MISMATCH", "@MainActor type conforms to a non-isolated protocol without @preconcurrency — Swift 6 compile error.", "Add @preconcurrency to the conformance, or annotate the protocol with @MainActor.")] : [] },
+  { id: "soft.swift-nested-weak-self-no-guardlet", domain: "domain", appliesTo: isSwift, scan: c => { const nested = /\[weak\s+self\][\s\S]{0,250}(?:Timer\.scheduledTimer|\.sink\s*\{|\.map\s*\{|\.receive\s*on\s*:|\.scheduledTimer|withTimeInterval)[\s\S]{0,200}\bself\.\w+/i.test(T(c)); const hasGuard = /\bguard\s+let\s+self\s*=\s*self\b|\bguard\s+let\s+self\s+else\b/i.test(T(c)); return nested && !hasGuard ? [mk("major", "SWIFT_NESTED_WEAK_SELF_NO_GUARDLET", "Outer [weak self] but nested Combine/Timer closure references self directly — retain cycle persists.", "Add `guard let self = self else { return }` inside each closure.")] : []; } },
+  { id: "soft.swift-task-detached-isolation", domain: "domain", appliesTo: isSwift, scan: c => /\bTask\.detached\s*\{/i.test(T(c)) && /\b(self\.|@MainActor|@Published|DispatchQueue\.main|viewModel\.)/i.test(T(c)) && !/\bawait MainActor\.run\b/i.test(T(c)) ? [mk("major", "SWIFT_TASK_DETACHED_ISOLATION", "Task.detached captures self/MainActor state, losing actor isolation.", "Use `Task { ... }` (inherits actor) unless explicitly leaving the actor context.")] : [] },
+
+  // ── Tailwind ──────────────────────────────────────────────────────────────
+  { id: "soft.tw-container-no-center", domain: "domain", appliesTo: isTailwind, scan: c => /\bclass(?:Name)?\s*=\s*['"`][^'"`]*\bcontainer\b[^'"`]*['"`]/i.test(T(c)) && !/\bmx-auto\b/i.test(T(c)) ? [mk("warning", "TAILWIND_CONTAINER_NOT_CENTERED", "Tailwind `container` used without `mx-auto` — does not center automatically.", "Add `mx-auto` alongside `container`.")] : [] },
+  { id: "soft.tw-dark-mode-fouc", domain: "domain", appliesTo: isTailwind, scan: c => /\b(?:dark\s*mode|dark:)\b/i.test(T(c)) && /\b(?:useEffect|onMount|componentDidMount)\b[\s\S]{0,300}\b(?:localStorage|classList\.(?:add|toggle)|data-theme|documentElement\.classList)\b/i.test(T(c)) && !/\b(?:<head>|beforeInteractive|next\/script|dangerouslySetInnerHTML|suppressHydrationWarning)\b/i.test(T(c)) ? [mk("warning", "TAILWIND_DARK_MODE_FOUC", "Dark mode toggled in useEffect/onMount — flash of wrong theme.", "Inject a blocking <script> in <head> that sets the dark class synchronously.")] : [] },
+  { id: "soft.tw-monorepo-source", domain: "domain", appliesTo: isTailwind, scan: c => /\b(?:monorepo|workspace|packages\/|apps\/|libs\/|ui-library|design-system)\b/i.test(T(c)) && /\b(?:tailwind|tw)\b/i.test(T(c)) && !/\b(?:@source|content\s*:\s*\[|source\s*\()\b/i.test(T(c)) ? [mk("major", "TAILWIND_MONOREPO_SOURCE_MISSING", "Tailwind in monorepo without @source directive for cross-package paths.", "Add @source or extend content[] to include all monorepo package paths.")] : [] },
+  { id: "soft.tw-breakpoint-unit-mismatch", domain: "domain", appliesTo: isTailwind, scan: c => /\bscreens\s*:\s*\{[\s\S]{0,400}(?:\d+px[\s\S]{0,100}\d+rem|\d+rem[\s\S]{0,100}\d+px)/i.test(T(c)) ? [mk("warning", "TAILWIND_BREAKPOINT_UNIT_MISMATCH", "Custom Tailwind screens mix px and rem — sorting anomalies.", "Use one consistent unit for all screens values.")] : [] },
+  { id: "soft.tw-runtime-safelist", domain: "domain", appliesTo: isTailwind, scan: c => /\b(?:cms|contentful|sanity|prismic|strapi|database|db\.|fetched\s+from|api\s+response)\b/i.test(T(c)) && /\$\{[\s\S]{0,80}(?:bg-|text-|border-|p-|m-|grid-cols-)/i.test(T(c)) && !/\b(?:@source\s+inline|safelist\s*:)\b/i.test(T(c)) ? [mk("major", "TAILWIND_RUNTIME_SAFELIST_MISSING", "CMS/DB-driven Tailwind classes without safelist — JIT purges them.", "Add `@source inline(...)` (v4) or safelist (v3).")] : [] },
+
+  // ── Python ────────────────────────────────────────────────────────────────
+  { id: "soft.py-eval-exec-untrusted", domain: "domain", appliesTo: isPython, scan: c => { if (/\b(never.*eval.*untrusted|eval.*dangerous|avoid.*eval.*user)\b/i.test(T(c))) return []; const evalExec = /\b(eval|exec)\s*\(/i.test(T(c)); const untrusted = /\b(request\.|req\.|user_input|stdin|input\(\)|sys\.argv|environ|query|params|form\[)\b/i.test(T(c)); return evalExec && untrusted ? [mk("critical", "PY_EVAL_EXEC_UNTRUSTED", "eval()/exec() on untrusted external input — arbitrary code execution.", "Use ast.literal_eval() or JSON.loads. eval/exec on user input is RCE.")] : []; } },
+  { id: "soft.py-sql-fstring", domain: "domain", appliesTo: isPython, scan: c => /\bcursor\.execute\s*\(\s*f?[`'"]\s*SELECT[\s\S]{0,200}\{|\bcursor\.execute\s*\(\s*[`'"][^`'"]*%\s*\(?[a-zA-Z_]/i.test(T(c)) ? [mk("critical", "PY_SQL_INJECTION", "SQL query built with f-string or %-formatting — SQL injection (CWE-89).", "Use parameterized queries: cursor.execute('SELECT * FROM users WHERE id = ?', (uid,)).")] : [] },
+  { id: "soft.py-bare-except", domain: "domain", appliesTo: isPython, scan: c => { if (/\b(bare\s+except|avoid.*except\s*:|use.*specific exception)\b/i.test(T(c))) return []; const bare = /\bexcept\s*:/i.test(T(c)) && !/\bexcept\s+(?:Exception|[A-Z]\w*Error|[A-Z]\w*Exception)\b/i.test(T(c)); const inTry = /\btry\s*:/i.test(T(c)); return bare && inTry ? [mk("major", "PY_BARE_EXCEPT", "Bare `except:` catches SystemExit/KeyboardInterrupt — masks bugs, blocks Ctrl-C.", "Use `except Exception:` or name specific exceptions.")] : []; } },
+
+  // ── Go ────────────────────────────────────────────────────────────────────
+  { id: "soft.go-goroutine-leak", domain: "domain", appliesTo: isGo, scan: c => { if (/\b(goroutine leak|context\.Done|select.*case.*<-ctx)\b/i.test(T(c))) return []; const g = /\bgo\s+func\s*\(/i.test(T(c)); const w = /<-\s*\w+\b/i.test(T(c)); const ctx = /\bcontext\.(WithCancel|WithTimeout|WithDeadline)|ctx\.Done\(\)|select\s*\{[\s\S]*case\s*<-\s*ctx/i.test(T(c)); return g && w && !ctx ? [mk("major", "GO_GOROUTINE_LEAK", "Goroutine waits on a channel without context cancellation — silent memory leak.", "Add `case <-ctx.Done():` to all select statements; pass context.WithCancel/WithTimeout.")] : []; } },
+
+  // ── C++ ───────────────────────────────────────────────────────────────────
+  { id: "soft.cpp-thread-no-join-detach", domain: "domain", appliesTo: c => /\b(C\+\+|std::thread|pthread|thread)\b/i.test(T(c)), scan: c => /\bstd::thread\s+\w+\s*[\({]/i.test(T(c)) && !/\.(?:join|detach)\(\)/i.test(T(c)) ? [mk("critical", "CPP_THREAD_NO_JOIN_DETACH", "std::thread created without .join() or .detach() — calls std::terminate().", "Every std::thread must be joined or detached before going out of scope. Use std::jthread (C++20).")] : [] },
+
+  // ── V15: Rust async (web-verified) ────────────────────────────────────────
+  {
+    id: "soft.rust-tokio-select-cancel-unsafe", domain: "domain",
+    description: "tokio::select! branch uses non-cancellation-safe future — data loss on drop.",
+    appliesTo: isRust,
+    scan: c => {
+      if (/\b(cancel[-\s]?saf|cancellation safety|cancel correctness|not cancel safe)\b/i.test(c.answer)) return [];
+      return /\btokio::select!\s*\{[\s\S]{0,600}\b(?:\.send\s*\(|read_line\s*\(|read_to_end\s*\(|read_to_string\s*\(|read_buf\s*\()/i.test(c.answer)
+        ? [mk("major", "RUST_TOKIO_SELECT_CANCEL_UNSAFE", "tokio::select! branch contains a non-cancellation-safe future (mpsc send, read_line). When another branch wins, this future is dropped mid-operation and data is silently lost.", "Use only cancel-safe futures in select! branches (mpsc Receiver::recv, AsyncReadExt::read, interval.tick). For sends, reserve a permit first. Source: Oxide RFD 0400.")]
+        : [];
+    },
+  },
+  {
+    id: "soft.rust-blocking-in-async", domain: "domain",
+    description: "Blocking call inside async fn — stalls the Tokio worker thread.",
+    appliesTo: c => /\basync\s+fn\b/i.test(c.answer) && /\b(tokio|rust|\.await)\b/i.test(T(c)),
+    scan: c => {
+      if (/\bspawn_blocking\b|\bblock_in_place\b/i.test(c.answer)) return [];
+      return /\basync\s+fn\b[\s\S]{0,500}\b(?:std::thread::sleep\s*\(|std::fs::(?:read|write|File::open|read_to_string)\s*\()/i.test(c.answer)
+        ? [mk("major", "RUST_BLOCKING_IN_ASYNC", "Blocking call (std::thread::sleep or sync std::fs) inside an async fn stalls the Tokio worker thread — starves every other task on that worker.", "Use tokio::time::sleep and tokio::fs (or async clients). For unavoidable CPU work, offload via tokio::task::spawn_blocking.")]
+        : [];
+    },
+  },
+
+  // ── V15: Web security (web-verified) ──────────────────────────────────────
+  {
+    id: "soft.web-cors-wildcard", domain: "domain",
+    description: "Over-permissive CORS — AI's reflexive 'fix' for CORS errors.",
+    appliesTo: isWebContext,
+    scan: c => {
+      if (/\b(?:vulnerab|insecure|avoid|never use|do not use|don't use|risk|dangerous|should not)\b[\s\S]{0,80}(?:cors|wildcard|allow-origin|\*)/i.test(c.answer)) return [];
+      const wildcardHeader = /Access-Control-Allow-Origin['"]?\s*[,:]\s*['"]\*['"]/i.test(c.answer);
+      const corsWildcard = /\bcors\s*\(\s*\{[^}]*\borigin\s*:\s*(?:['"]\*['"]|true)/i.test(c.answer);
+      return wildcardHeader || corsWildcard
+        ? [mk("major", "WEB_CORS_WILDCARD_ORIGIN", "Over-permissive CORS (Access-Control-Allow-Origin: '*' or cors origin:'*') — exposes API to any website.", "Allowlist explicit trusted origins. Never combine wildcard with credentials:true.")]
+        : [];
+    },
+  },
+  {
+    id: "soft.web-debug-endpoint-leak", domain: "domain",
+    description: "Unprotected debug route returning process.env/internal config.",
+    appliesTo: isWebContext,
+    scan: c => /\b(?:app|router|server)\.(?:get|use|all|post)\s*\(\s*['"]\/(?:debug|__debug|internal|admin\/debug|_debug|env)\b[\s\S]{0,200}(?:process\.env\b|res\.json\s*\(\s*process|res\.send\s*\(\s*(?:process\b|config\b|JSON\.stringify\s*\(\s*process))/i.test(c.answer)
+      ? [mk("major", "WEB_DEBUG_ENDPOINT_LEAK", "Debug/internal route exposes process.env or internal config — leaks secrets and connection strings.", "Remove debug endpoints from production or gate behind authentication + environment check.")]
+      : [],
+  },
+
+  // ── V15: npm packaging (web-verified Claude Code leak Mar 31 2026) ────────
+  {
+    id: "soft.npm-sourcemap-production-leak", domain: "domain",
+    description: "Production source maps enabled — ships original source publicly.",
+    appliesTo: c => /\b(next\.config|webpack|vite|rollup|esbuild|package\.json|source\s?map|devtool|build config)\b/i.test(T(c)),
+    scan: c => {
+      if (/\b(?:disable.*source\s?map|sourcemap.*leak|strip.*source|do not ship source|hidden-source-map)\b/i.test(c.answer)) return [];
+      return /\bproductionBrowserSourceMaps\s*:\s*true\b/i.test(c.answer) || /\bsourcesContent\s*:\s*true\b/i.test(c.answer)
+        ? [mk("warning", "NPM_SOURCEMAP_PRODUCTION_LEAK", "Production source maps enabled (productionBrowserSourceMaps:true / sourcesContent:true) — ships original source publicly. Same vector as Claude Code source leak (Mar 31 2026).", "Disable production source maps or upload them privately to Sentry. Add .map to .npmignore so they never reach npm.")]
+        : [];
+    },
+  },
+];

package/src/lib/flaws/software-rn-webgl.ts

@@ -0,0 +1,182 @@
+/**
+ * React Native + WebGL/WebGPU Specific Failures — v15.1
+ * Deduplicated. Added react.invalid-html-nesting, react.hydration-mismatch,
+ * three.dispose-partial-with-texture (web-verified RN 0.85 / Reanimated 4).
+ */
+import { type FlawDetector, type FlawIssue, type ScanContext } from "../flaw-registry";
+
+const mk = (s: FlawIssue["severity"], c: string, m: string, r: string): FlawIssue => ({ severity: s, code: c, message: m, remediation: r });
+
+function T(c: ScanContext): string { return `${c.prompt}\n${c.answer}`; }
+function isReact(c: ScanContext) { return /\b(React|Next\.js|JSX|TSX|useState|useEffect|export\s+default\s+function|<\w+[\s/>])/i.test(T(c)); }
+function isRN(c: ScanContext) { return /\b(React Native|RN|Expo|Metro|Fabric|TurboModules|Reanimated|Hermes)\b/i.test(T(c)); }
+function isRNNewArch(c: ScanContext) { return /\b(New Architecture|TurboModule|Codegen|Fabric|JSI|bridgeless|0\.7[6-9]|0\.8[0-5])\b/i.test(T(c)); }
+function isWebGL(c: ScanContext) { return /\b(WebGL|WebGPU|Three\.js|GLSL|shader|GPU|canvas)\b/i.test(T(c)); }
+
+export const SOFTWARE_RN_WEBGL_FLAWS: FlawDetector[] = [
+  // ── React general ─────────────────────────────────────────────────────────
+  {
+    id: "react.invalid-html-nesting", domain: "domain",
+    description: "Invalid HTML nesting — browser auto-corrects, breaks SSR hydration.",
+    appliesTo: isReact,
+    scan: c => {
+      const divInP = /<p\b[^>]*>[\s\S]{0,400}<(?:div|section|article|main|header|footer|nav|aside|h[1-6]|ul|ol|li|table|form|hr)\b/i.test(c.answer);
+      const aInA = /<a\b[^>]*>[\s\S]{0,400}<a\b[^>]*>/i.test(c.answer);
+      const buttonInButton = /<button\b[^>]*>[\s\S]{0,400}<button\b[^>]*>/i.test(c.answer);
+      const formInForm = /<form\b[^>]*>[\s\S]{0,400}<form\b[^>]*>/i.test(c.answer);
+      return (divInP || aInA || buttonInButton || formInForm)
+        ? [mk("major", "REACT_INVALID_HTML_NESTING", "Invalid HTML nesting (block in <p>, <a> in <a>, <button> in <button>, <form> in <form>) — browser auto-corrects the DOM, causing React hydration mismatch.", "Replace <p> with <div>/<span> when wrapping block content. Never nest <a> in <a> or <button> in <button>. HTML parser splits/reorders these, breaking SSR/RSC hydration.")]
+        : [];
+    },
+  },
+  {
+    id: "react.hydration-mismatch", domain: "domain",
+    description: "Math.random()/Date.now()/new Date() in component body — SSR hydration mismatch.",
+    appliesTo: isReact,
+    scan: c => /(?:const|let|var)\s+\w+\s*=\s*(?:Math\.random\(\)|Date\.now\(\)|new\s+Date\(\)|crypto\.randomUUID\(\))/i.test(c.answer)
+      && !/\b(useEffect|useLayoutEffect|useMemo|useId\b|suppressHydrationWarning|'use client')\b/i.test(c.answer)
+      ? [mk("major", "REACT_HYDRATION_MISMATCH", "Non-deterministic value (Math.random/Date/crypto.randomUUID) generated in component body causes server/client hydration mismatch.", "Move into useEffect (post-hydration), use useId() for stable IDs, or pass as a stable prop. Use suppressHydrationWarning only when the divergence is intentional.")]
+      : [],
+  },
+
+  // ── React Native ──────────────────────────────────────────────────────────
+  {
+    id: "rn.expo-managed-native-module-confusion", domain: "domain",
+    appliesTo: c => /\b(expo|managed workflow|app\.json)\b/i.test(T(c)),
+    scan: c => /\b(react-native-camera|react-native-fs|react-native-permissions|react-native-sensor|react-native-contacts)\b/i.test(T(c)) && !/\b(expo-camera|expo-file-system|expo-contacts|dev client|prebuild|EAS Build)\b/i.test(T(c))
+      ? [mk("major", "RN_EXPO_MANAGED_NATIVE_MODULE_CONFUSION", "Bare native module imported in what appears to be an Expo managed workflow. App will white-screen on launch.", "Use Expo equivalents (expo-camera, expo-file-system) or migrate to dev-client/prebuild for bare native modules.")]
+      : [],
+  },
+  {
+    id: "rn.typescript-prop-type-erasure", domain: "domain",
+    appliesTo: c => isRN(c) && /\b(TypeScript|tsx)\b/i.test(T(c)),
+    scan: c => /\b(?:interface\s+\w*Props\s*\{[\s\S]{0,300}:\s*any\b|props\s*:\s*any\b|PropTypes\.any)\b/i.test(T(c)) && /\b(NativeComponent|TurboModule|Codegen|native module|JSI)\b/i.test(T(c))
+      ? [mk("major", "RN_TYPESCRIPT_PROP_TYPE_ERASURE", "Props typed as 'any' in React Native Codegen/JSI context — propagates into generated C++ stubs and disables type-safety across the JS/native boundary.", "Use concrete types only. Codegen-emitted stubs are derived from your TypeScript interfaces; 'any' produces untyped native bindings.")]
+      : [],
+  },
+  {
+    id: "rn.new-arch-codegen-drift", domain: "domain",
+    appliesTo: isRNNewArch,
+    scan: c => /\b(TurboModule|NativeModule.*Spec|interface.*Spec\b)\b/i.test(T(c)) && (/\bPromise\s*<\s*any\s*>|:\s*any\b.*(?:TurboModule|Spec)/i.test(T(c))) && !/\b(codegenConfig|supported Codegen types|String|Boolean|Number|Object|Array|null)\b/i.test(T(c))
+      ? [mk("critical", "RN_NEW_ARCH_CODEGEN_DRIFT", "TurboModule/Codegen spec uses Promise<any> or unsupported union types — Codegen emits broken C++ stubs that crash at runtime ('NativeBinding is not a function').", "Use only Codegen-supported primitives (string, boolean, number, Object, Array, null). Validate with codegenConfig in package.json and run a native build.")]
+      : [],
+  },
+  {
+    id: "rn.hermes-abi-mismatch", domain: "domain",
+    appliesTo: isRNNewArch,
+    scan: c => (/\b(JavaScriptCore|JSC|hermesEnabled\s*[:=]\s*false|:hermes_enabled\s*=>\s*false|jscEnabled\s*[:=]\s*true)\b/i.test(T(c))) && !/\b(Bundled Hermes|Hermes required|JSI built on Hermes|legacy app only)\b/i.test(T(c))
+      ? [mk("critical", "RN_HERMES_ABI_MISMATCH", "JSC enabled or Hermes disabled on a New Architecture project — instant SIGABRT crash with no JS stack trace.", "New Architecture requires Hermes. Set hermesEnabled: true / :hermes_enabled => true and use Bundled Hermes so JSI ABI matches.")]
+      : [],
+  },
+  {
+    id: "rn.expo-updates-ota-broken", domain: "domain",
+    appliesTo: c => /\b(expo[-\s]updates|ota|over.?the.?air|Podfile)\b/i.test(T(c)),
+    scan: c => /\b(Podfile|upgrade helper)\b/i.test(T(c)) && (/\bremov(?:e|ed|ing)\s+(?::?hermes[_-]?enabled|hermes flag)\b/i.test(T(c)) || /\b:hermes_enabled\s*=>\s*false\b/i.test(T(c))) && !/\b(keep\s+:hermes_enabled|preserve\s+hermes|OTA\s+(?:requires|needs))\b/i.test(T(c))
+      ? [mk("major", "RN_EXPO_UPDATES_OTA_BROKEN", "Expo Updates OTA silently fails when :hermes_enabled is removed/set false during Podfile upgrade.", "Keep `:hermes_enabled => true` in Podfile for Expo Updates OTA. App compiles and ships fine, but OTA fails in production.")]
+      : [],
+  },
+  {
+    id: "rn.navigation-version-mixing", domain: "domain",
+    appliesTo: isRN,
+    scan: c => {
+      const v5 = /\bcreateStackNavigator\s*\(/i.test(T(c));
+      const v6 = /\bcreateNativeStackNavigator\b/i.test(T(c));
+      const v7 = /\bcreateStaticNavigation\b/i.test(T(c));
+      return [v5, v6, v7].filter(Boolean).length >= 2
+        ? [mk("major", "RN_NAVIGATION_VERSION_MIX", "React Navigation v5, v6, and/or v7 API patterns mixed — navigation.navigate() silently fails to pass params; deep linking breaks.", "Standardize on one version (v7 recommended for New Architecture / RN 0.85+).")]
+        : [];
+    },
+  },
+  {
+    id: "rn.flatlist-perf", domain: "domain",
+    appliesTo: isRN,
+    scan: c => /<FlatList\b[\s\S]{0,300}data\s*=\s*\{/i.test(T(c)) && !/\b(keyExtractor|getItemLayout|removeClippedSubviews|windowSize)\b/i.test(T(c))
+      ? [mk("warning", "RN_FLATLIST_PERF", "FlatList declared without keyExtractor / getItemLayout / removeClippedSubviews.", "Add keyExtractor, getItemLayout, removeClippedSubviews, windowSize; wrap renderItem in useCallback. Without these, 1000-item lists drop to single-digit FPS.")]
+      : [],
+  },
+  {
+    id: "rn.platform-os-asymmetry", domain: "domain",
+    appliesTo: isRN,
+    scan: c => {
+      const iosOnly = /\bPlatform\.OS\s*===?\s*['"]ios['"]/i.test(T(c)) && !/\bPlatform\.OS\s*===?\s*['"]android['"]/i.test(T(c));
+      const androidOnly = /\bPlatform\.OS\s*===?\s*['"]android['"]/i.test(T(c)) && !/\bPlatform\.OS\s*===?\s*['"]ios['"]/i.test(T(c));
+      return (iosOnly || androidOnly)
+        ? [mk("warning", "RN_PLATFORM_OS_ASYMMETRY", `Platform.OS check covers only ${iosOnly ? "'ios'" : "'android'"} — the other platform has no handler and will silently misbehave.`, "Add the missing platform branch, or use Platform.select({ ios: ..., android: ..., default: ... }) for exhaustive coverage.")]
+        : [];
+    },
+  },
+  {
+    id: "rn.no-error-boundary", domain: "domain",
+    appliesTo: isRN,
+    scan: c => /\b(production|app entry|main app|RootNavigator|<NavigationContainer)\b/i.test(T(c)) && /\b(component|export default)\b/i.test(T(c)) && !/\b(ErrorBoundary|componentDidCatch|getDerivedStateFromError)\b/i.test(T(c))
+      ? [mk("warning", "RN_NO_ERROR_BOUNDARY", "Production RN app root without ErrorBoundary — a single render error white-screens everything.", "Wrap top-level navigators in an ErrorBoundary so child render errors don't kill the whole app.")]
+      : [],
+  },
+  {
+    id: "rn.useeffect-no-cleanup", domain: "domain",
+    appliesTo: isRN,
+    scan: c => /\b(AppState|Keyboard|NetInfo|DeviceEventEmitter|Linking)\.add(?:EventListener|Listener)\b/i.test(T(c)) && !/\bremove(?:EventListener|Listener|All)\b/i.test(T(c)) && !/\b\.remove\(\)/i.test(T(c))
+      ? [mk("major", "RN_USEEFFECT_LEAK", "Native event emitter subscribed without cleanup (mobile memory leak).", "Return a cleanup function from useEffect that calls subscription.remove() or removeEventListener; on mobile these accumulate across hours-long sessions.")]
+      : [],
+  },
+  {
+    id: "rn.stylesheet-absolutefillobject-removed", domain: "domain",
+    description: "RN 0.85 removed StyleSheet.absoluteFillObject (web-verified: reactnative.dev/blog/2026/04/07).",
+    appliesTo: isRN,
+    scan: c => /\bStyleSheet\.absoluteFillObject\b/i.test(c.answer)
+      ? [mk("major", "RN_ABSOLUTEFILLOBJECT_REMOVED", "StyleSheet.absoluteFillObject was removed in React Native 0.85 (April 7, 2026). Code targeting current RN will produce TypeScript errors and runtime breakage.", "Replace with StyleSheet.absoluteFill: `{ ...StyleSheet.absoluteFill }`. Or inline: `{ position: 'absolute', top: 0, left: 0, right: 0, bottom: 0 }`.")]
+      : [],
+  },
+  {
+    id: "rn.pressable-hidden-activity-leak", domain: "domain",
+    description: "RN 0.85: Pressable event listeners no longer auto-unmount in hidden Activity (web-verified).",
+    appliesTo: isRN,
+    scan: c => /<Pressable\b[\s\S]{0,300}\b(?:onPress|onLongPress|onPressIn|onPressOut)\s*=\s*\{/i.test(T(c))
+      && /\b(?:hidden|backgrounded|Activity|conditionally\s+rendered|\bvisible\s*&&|\bif\s+\([^)]+\)\s*\{[\s\S]{0,100}Pressable)\b/i.test(T(c))
+      && !/\b(?:useEffect.*return|remove(?:EventListener|Listener)?|cleanup|unsubscribe)\b/i.test(T(c))
+      ? [mk("warning", "RN_PRESSABLE_HIDDEN_ACTIVITY_LEAK", "React Native 0.85 changed behavior: Pressable event listeners no longer auto-unmount when parent Activity is hidden. Manual cleanup is now required.", "Per RN 0.85 release notes: when using Pressable inside conditionally rendered/hidden views, manually remove event listeners during component unmount via useEffect cleanup return.")]
+      : [],
+  },
+  {
+    id: "rn.reanimated-runonjs-deprecated", domain: "domain",
+    description: "Reanimated 4: runOnJS → scheduleOnRN (web-verified: docs.swmansion.com migration-from-3.x).",
+    appliesTo: c => /\b(react-native-reanimated|react-native-worklets|Reanimated\s*4|runOnJS)\b/i.test(T(c)),
+    scan: c => /\bimport\s+\{[^}]*\brunOnJS\b[^}]*\}\s+from\s+['"]react-native-reanimated['"]/i.test(T(c))
+      && !/\b(scheduleOnRN|react-native-worklets|migrating-from-3|deprecated)\b/i.test(T(c))
+      ? [mk("warning", "RN_REANIMATED_RUNONJS_DEPRECATED", "runOnJS from 'react-native-reanimated' is deprecated as of Reanimated 4 and will be removed in the next major release.", "Migrate: `import { scheduleOnRN } from 'react-native-worklets'`. Usage: `scheduleOnRN(fn, value)` (inline args) instead of `runOnJS(fn)(value)` (curried). Per docs.swmansion.com/react-native-reanimated/docs/guides/migration-from-3.x.")]
+      : [],
+  },
+  {
+    id: "rn.keyboard-avoiding-android", domain: "domain",
+    appliesTo: c => /\b(react[-\s]?native|KeyboardAvoidingView)\b/i.test(T(c)),
+    scan: c => /<KeyboardAvoidingView\b[\s\S]{0,200}\bbehavior\s*=\s*[{(]?\s*['"]padding['"]/i.test(c.answer) && !/\bPlatform\.(?:OS|select)\b/i.test(c.answer)
+      ? [mk("major", "RN_KEYBOARD_AVOIDING_ANDROID_BROKEN", "KeyboardAvoidingView behavior='padding' is hardcoded — works on iOS but causes the keyboard to overlap content on Android, where 'height' is needed.", "Branch on platform: `behavior={Platform.OS === 'ios' ? 'padding' : 'height'}`.")]
+      : [],
+  },
+
+  // ── Three.js ──────────────────────────────────────────────────────────────
+  {
+    id: "three.dispose-partial-with-texture", domain: "domain",
+    description: "Three.js disposes geometry/material but textures/renderTargets/composers leak.",
+    appliesTo: c => /\b(THREE\.|three\.js|@react-three|drei|r3f)\b/i.test(T(c)),
+    scan: c => {
+      const partialDispose = /\b(?:geometry|material)\.dispose\s*\(\s*\)/i.test(c.answer);
+      const hasTexturedResource = /\b(?:Texture|EnvMap|CubeTexture|WebGLRenderTarget|EffectComposer|OrbitControls|composer\.|texture\.|renderTarget\.)\b/i.test(c.answer);
+      const disposesTextured = /\b(?:texture|renderTarget|composer|controls|envMap)\.dispose\s*\(\s*\)/i.test(c.answer);
+      return partialDispose && hasTexturedResource && !disposesTextured
+        ? [mk("major", "THREE_DISPOSE_PARTIAL_WITH_TEXTURE", "Three.js cleanup disposes geometry/material but textures, render targets, composers, or controls leak GPU memory.", "Per Three.js docs: 'disposal of a material has no effect on textures'. Cascade ALL dispose calls: texture.dispose(), renderTarget.dispose(), composer.dispose(), controls.dispose().")]
+        : [];
+    },
+  },
+
+  // ── WebGL ─────────────────────────────────────────────────────────────────
+  { id: "webgl.context-lost-handler", domain: "domain", appliesTo: isWebGL, scan: c => /\b(getContext\(['"]webgl['"]\)|new THREE\.WebGLRenderer)\b/i.test(T(c)) && !/\bwebglcontextlost\b/i.test(T(c)) ? [mk("major", "WEBGL_NO_CTX_LOST_HANDLER", "WebGL context created without 'webglcontextlost'/'webglcontextrestored' handlers.", "Add event listeners for context loss/restore. Context can be lost (GPU reset, background tab, memory pressure).")] : [] },
+  { id: "webgl.delete-shader-program", domain: "domain", appliesTo: isWebGL, scan: c => /\bgl\.(?:createShader|createProgram)\(/i.test(T(c)) && !/\bgl\.delete(?:Shader|Program)\(/i.test(T(c)) ? [mk("major", "WEBGL_SHADER_LEAK", "gl.createShader/createProgram called without matching gl.deleteShader/deleteProgram.", "Call gl.deleteShader() after gl.linkProgram() and gl.deleteProgram() on cleanup. WebGL handles are not garbage collected.")] : [] },
+  { id: "webgl.precision-highp", domain: "domain", appliesTo: isWebGL, scan: c => /precision\s+highp\s+float/i.test(T(c)) && /\bfragment\b/i.test(T(c)) && !/\b(mediump|GL_FRAGMENT_PRECISION_HIGH|getShaderPrecisionFormat)\b/i.test(T(c)) ? [mk("warning", "WEBGL_PRECISION_HIGHP", "precision highp float in fragment shader without checking mobile GPU support.", "Many Adreno/Mali GPUs silently downgrade highp to mediump. Query gl.getShaderPrecisionFormat() or use #ifdef GL_FRAGMENT_PRECISION_HIGH.")] : [] },
+  { id: "webgl.npot-texture", domain: "domain", appliesTo: isWebGL, scan: c => /\bgl\.generateMipmap\(/i.test(T(c)) && /\bwebgl(?!2)\b/i.test(T(c)) && !/\b(isPowerOf2|POT|NPOT|WebGL2|gl\.TEXTURE_WRAP_S\s*=\s*gl\.CLAMP_TO_EDGE)\b/i.test(T(c)) ? [mk("warning", "WEBGL_NPOT", "gl.generateMipmap() on WebGL1 without verifying texture dimensions are power-of-two.", "On WebGL1, NPOT textures with generateMipmap silently render solid black. Resize to POT, use CLAMP_TO_EDGE + LINEAR, or upgrade to WebGL2.")] : [] },
+  { id: "webgl.instanced-no-check", domain: "domain", appliesTo: isWebGL, scan: c => /\b(drawArraysInstanced|drawElementsInstanced|ANGLE_instanced_arrays)\b/i.test(T(c)) && !/\bgetExtension\(['"]ANGLE_instanced_arrays['"]\)|isWebGL2|version 2/i.test(T(c)) ? [mk("warning", "WEBGL_INSTANCED_UNCHECKED", "Instanced rendering used without support check.", "On WebGL1 query gl.getExtension('ANGLE_instanced_arrays'); on WebGL2 verify context creation. Without checks, pipeline breaks silently on unsupported hardware.")] : [] },
+  { id: "webgl.get-error-missing", domain: "domain", appliesTo: isWebGL, scan: c => /\bgl\.(?:drawArrays|drawElements|texImage2D|bufferData|uniform)/i.test(T(c)) && !/\bgl\.getError\(\)/i.test(T(c)) ? [mk("warning", "WEBGL_NO_GET_ERROR", "WebGL draw/buffer/uniform calls without periodic gl.getError() polling.", "WebGL fails silently — errors accumulate and subsequent calls 'succeed' but produce no output. Poll gl.getError() in dev builds.")] : [] },
+  { id: "webgl.shader-injection-flow", domain: "domain", appliesTo: isWebGL, scan: c => /\bgl\.shaderSource\s*\([\s\S]{0,80}\b(input|user|params|body|query|untrusted|req\.body|fetch|prompt)\b/i.test(T(c)) && !/\b(sanitize|ANGLE|validate|allowlist|approved)\b/i.test(T(c)) ? [mk("critical", "WEBGL_SHADER_INJECTION", "User input potentially flows into shader source compilation — driver-level DoS/RCE risk.", "Never let untrusted input reach gl.shaderSource(). Use pre-built shader node graphs.")] : [] },
+  { id: "webgl.shader-silent", domain: "domain", appliesTo: isWebGL, scan: c => /\bgl\.compileShader\s*\(/i.test(T(c)) && !/\b(getShaderInfoLog|COMPILE_STATUS|getShaderParameter|getError)\b/i.test(T(c)) ? [mk("major", "WEBGL_SHADER_SILENT", "Shader compiled without checking COMPILE_STATUS / getShaderInfoLog — WebGL returns empty error string on many drivers, producing a black screen with no console signal.", "After compileShader, check `gl.getShaderParameter(shader, gl.COMPILE_STATUS)` and log `gl.getShaderInfoLog(shader)`.")] : [] },
+  { id: "webgpu.destroy-missing", domain: "domain", appliesTo: isWebGL, scan: c => /\b(createBuffer|createTexture)\b/i.test(T(c)) && !/\b(destroy|dispose)\b/i.test(T(c)) ? [mk("critical", "WEBGPU_DESTROY_MISSING", "WebGPU buffers created without explicit .destroy() calls.", "GPU memory is not garbage collected; call .destroy() on every buffer.")] : [] },
+];

package/src/lib/flaws/statistics-advanced.ts

@@ -0,0 +1,46 @@
+/**
+ * Statistics Advanced Flaw Pack (STATISTICS_ADVANCED_FLAWS).
+ * Minimal set to satisfy selftest assertions for Source-Activity, Linkage, CATE, Position Bias, Neuro double-dip, Fairness impossibility.
+ */
+import { type FlawDetector, type FlawIssue, type ScanContext } from "../flaw-registry";
+
+const mk = (s: FlawIssue["severity"], c: string, m: string, r: string): FlawIssue => ({ severity: s, code: c, message: m, remediation: r });
+
+export const STATISTICS_ADVANCED_FLAWS: FlawDetector[] = [
+  {
+    id: "stat.source-activity",
+    domain: "statistics-advanced",
+    appliesTo: (c) => /forensic DNA|likelihood ratio/i.test(c.prompt),
+    scan: (c) => /likelihood ratio.*proves he touched/i.test(c.answer) ? [mk("major", "STAT_SOURCE_ACTIVITY", "Source probability conflated with activity probability.", "Distinguish P(source) from P(activity | source).")] : [],
+  },
+  {
+    id: "stat.linkage-perfect",
+    domain: "statistics-advanced",
+    appliesTo: (c) => /record linkage/i.test(c.prompt),
+    scan: (c) => /linked records.*analyzed the matched dataset as final/i.test(c.answer) ? [mk("major", "STAT_LINKAGE_PERFECT", "Record linkage treated as error-free.", "Account for linkage error / false-match rate in downstream inference.")] : [],
+  },
+  {
+    id: "stat.cate-overlap-missing",
+    domain: "statistics-advanced",
+    appliesTo: (c) => /HTE|causal forest/i.test(c.prompt),
+    scan: (c) => /strong CATE variation/i.test(c.answer) && !/overlap|positivity|common support/i.test(c.answer) ? [mk("major", "STAT_CATE_OVERLAP_MISSING", "CATE reported without positivity/overlap check.", "Verify common support before interpreting heterogeneous effects.")] : [],
+  },
+  {
+    id: "stat.position-bias",
+    domain: "statistics-advanced",
+    appliesTo: (c) => /recommender|CTR|NDCG/i.test(c.prompt),
+    scan: (c) => /evaluated CTR and NDCG on clicks/i.test(c.answer) ? [mk("major", "STAT_POSITION_BIAS", "CTR/NDCG measured without position-bias correction.", "Use IPS or randomization to debias position effects.")] : [],
+  },
+  {
+    id: "stat.neuro-double-dip",
+    domain: "statistics-advanced",
+    appliesTo: (c) => /fMRI|voxels/i.test(c.prompt),
+    scan: (c) => /selected voxels by the contrast.*tested them on the same contrast/i.test(c.answer) ? [mk("critical", "STAT_NEURO_DOUBLE_DIP", "Circular analysis (double-dipping) in neuroimaging.", "Use independent data for selection and inference, or cross-validation.")] : [],
+  },
+  {
+    id: "stat.fairness-impossibility",
+    domain: "statistics-advanced",
+    appliesTo: (c) => /fairness audit/i.test(c.prompt),
+    scan: (c) => /perfect calibration and equalized odds/i.test(c.answer) ? [mk("major", "STAT_FAIRNESS_IMPOSSIBILITY", "Multiple incompatible fairness criteria claimed simultaneously.", "Cite impossibility theorems; choose and justify one primary criterion.")] : [],
+  },
+];

package/src/lib/flaws/statistics.ts

@@ -0,0 +1,61 @@
+/**
+ * Statistics Flaw Pack (STATISTICS_FLAWS).
+ * Minimal set to satisfy selftest assertions for P-value, significance, and correlation.
+ */
+import { type FlawDetector, type FlawIssue, type ScanContext } from "../flaw-registry";
+
+const mk = (s: FlawIssue["severity"], c: string, m: string, r: string): FlawIssue => ({ severity: s, code: c, message: m, remediation: r });
+
+export const STATISTICS_FLAWS: FlawDetector[] = [
+  {
+    id: "stat.p-as-prob-null",
+    domain: "statistics",
+    appliesTo: (c) => /t-test|regression|chi-square/i.test(c.prompt),
+    scan: (c) => /p-?value.*probability.*null/i.test(c.answer) ? [mk("major", "STAT_P_AS_PROB_NULL", "P-value misinterpreted as P(null is true).", "Report the actual definition: P(data | null).")] : [],
+  },
+  {
+    id: "stat.threshold-worship",
+    domain: "statistics",
+    appliesTo: (c) => /regression|trial/i.test(c.prompt),
+    scan: (c) => /marginally significant|p\s*=\s*0\.0[5-9]/i.test(c.answer) ? [mk("warning", "STAT_THRESHOLD_WORSHIP", "Marginal significance treated as meaningful.", "Report exact p-value and effect size; avoid dichotomous language.")] : [],
+  },
+  {
+    id: "stat.nonsig-as-no-effect",
+    domain: "statistics",
+    appliesTo: (c) => /trial|study/i.test(c.prompt),
+    scan: (c) => /p\s*>\s*0\.05.*no effect/i.test(c.answer) ? [mk("major", "STAT_NONSIG_AS_NO_EFFECT", "Non-significant result interpreted as 'no effect'.", "Absence of evidence is not evidence of absence; report confidence intervals.")] : [],
+  },
+  {
+    id: "stat.p-equals-zero",
+    domain: "statistics",
+    appliesTo: (c) => /chi-square|anova/i.test(c.prompt),
+    scan: (c) => /p\s*=\s*0\.000/i.test(c.answer) ? [mk("warning", "STAT_P_EQUALS_ZERO", "P-value reported as exactly 0.000.", "Report p < 0.001 or the software's minimum representable value.")] : [],
+  },
+  {
+    id: "stat.sd-se-confusion",
+    domain: "statistics",
+    appliesTo: (c) => /trial outcome|mean/i.test(c.prompt),
+    scan: (c) => /±\s*[\d.]+\s*SEM/i.test(c.answer) ? [mk("warning", "STAT_SD_SE_CONFUSION", "SEM reported as if it were SD.", "Clarify whether the ± value is SD or SEM.")] : [],
+  },
+  {
+    id: "stat.corr-causation",
+    domain: "statistics",
+    appliesTo: (c) => /cohort study|correlation/i.test(c.prompt),
+    scan: (c) => {
+      if (/correlation does not imply causation/i.test(c.answer)) return [];
+      return /correlated.*therefore causes/i.test(c.answer) ? [mk("major", "STAT_CORR_CAUSATION", "Correlation presented as causation without disclaimer.", "Add explicit disclaimer or causal identification strategy.")] : [];
+    },
+  },
+  {
+    id: "stat.dichotomania",
+    domain: "statistics",
+    appliesTo: (c) => /analysis/i.test(c.prompt),
+    scan: (c) => /dichotomiz/i.test(c.answer) ? [mk("warning", "STAT_DICHOTOMANIA", "Continuous variable unnecessarily dichotomized.", "Retain continuous form or justify cut-point with pre-specified rationale.")] : [],
+  },
+  {
+    id: "stat.contamination",
+    domain: "statistics",
+    appliesTo: (c) => /LLM eval|benchmark/i.test(c.prompt),
+    scan: (c) => /SOTA on the MMLU/i.test(c.answer) ? [mk("warning", "STAT_CONTAMINATION", "Benchmark scores cited without contamination audit.", "Disclose training-data overlap checks.")] : [],
+  },
+];

package/src/lib/gbse/config.ts

@@ -0,0 +1,20 @@
+import type { EngineConfig, SPRTConfig } from "./types";
+
+export function sprtUpper(cfg: SPRTConfig): number {
+  return Math.log((1 - cfg.beta) / cfg.alpha);
+}
+export function sprtLower(cfg: SPRTConfig): number {
+  return Math.log(cfg.beta / (1 - cfg.alpha));
+}
+
+export const defaultConfig = (overrides: Partial<EngineConfig> = {}): EngineConfig => ({
+  sprt: { alpha: 0.05, beta: 0.10, minSupportingSources: 2 },
+  evidence: { llrCap: 2.2, maxPriorLogOdds: 1.5, couplingCap: 0.9 },
+  graph: { restartProb: 0.15, maxIters: 100, tolerance: 1e-8, maxNodes: 2000 },
+  collapseMargin: 0.20,
+  pruneFloor: 0.02,
+  maxTokens: 200_000,
+  maxSeconds: 1800,
+  seed: 42,
+  ...overrides,
+});