@blamejs/blamejs-shop 0.5.12 → 0.5.14

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -316,6 +316,7 @@ function _report(label, matches) {
 // unflagged. When you add a detector with a new allow-class, register it here.
 var VALID_ALLOW_CLASSES = {
   "ai-disclosure-on-request-without-requested-gate": 1,
+  "applydefaults-dropped-opt": 1,
   "archive-gz-without-safedecompress": 1,
   "archive-wrap-partial-recipient": 1,
   "backup-adapter-storage-without-posture-check": 1,
@@ -360,6 +361,7 @@ var VALID_ALLOW_CLASSES = {
   "silent-catch-stream-teardown": 1,
   "slsa-framework-action-not-sha-pinned": 1,
   "timer-no-unref-unrefed-below": 1,
+  "timer-no-unref-process-pinning": 1,
   "wildcard-suffix-match-without-single-label-check": 1,
 };
 
@@ -727,6 +729,76 @@ function testNoStrayConsoleCalls() {
     matches);
 }
 
+// class: applydefaults-dropped-opt
+//
+// validateOpts.applyDefaults(opts, DEFAULTS) whitelists the result to the
+// KEYS OF `DEFAULTS` — any opt absent from DEFAULTS is stripped. So reading
+// `cfg.someOpt` off that result, when `someOpt` is not a DEFAULTS key,
+// always yields undefined: the opt is silently dropped even though the
+// three-tier validator's ALLOWED_KEYS accepted it. That shipped a DEAD
+// documented security opt in static.js (safeAttachmentForRiskyMimes — the
+// drive-by-execution Content-Disposition defense). This gate cross-checks
+// every `VAR = applyDefaults(opts, DEFAULTS)` site: it flags a `VAR.<prop>`
+// read whose <prop> is not a key of the DEFAULTS object literal in the same
+// file. The fix is to read the opt straight from `opts` (or add it to
+// DEFAULTS); the allow marker is for a genuinely-dynamic prop access.
+function testNoApplyDefaultsDroppedOpt() {
+  function _defaultsKeys(src, ident) {
+    var re = new RegExp("(?:var|const|let)\\s+" +
+      ident.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") +
+      "\\s*=\\s*(?:Object\\.freeze\\()?\\{", "m");
+    var m = re.exec(src);
+    if (!m) return null;
+    var start = src.indexOf("{", m.index);
+    var depth = 0, i = start;
+    for (; i < src.length; i++) {
+      var c = src[i];
+      if (c === "{") depth++;
+      else if (c === "}") { depth--; if (depth === 0) break; }
+    }
+    var body = src.slice(start + 1, i);
+    var keys = {}, d = 0;
+    for (var j = 0; j < body.length; j++) {
+      var ch = body[j];
+      if (ch === "{" || ch === "[" || ch === "(") d++;
+      else if (ch === "}" || ch === "]" || ch === ")") d--;
+      else if (d === 0 && /[A-Za-z_$"']/.test(ch)) {
+        var mk = /^(?:"([^"]+)"|'([^']+)'|([A-Za-z_$][\w$]*))\s*:/.exec(body.slice(j));
+        if (mk) { keys[mk[1] || mk[2] || mk[3]] = true; j += mk[0].length - 1; }
+      }
+    }
+    return keys;
+  }
+  var callRe = /(?:var|const|let)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:validateOpts\.|_?)applyDefaults\(\s*([A-Za-z_$][\w$]*)\s*,\s*([A-Za-z_$][\w$.]*)\s*\)/g;
+  var matches = [];
+  var files = _libFiles();
+  for (var fi = 0; fi < files.length; fi++) {
+    var src;
+    try { src = fs.readFileSync(files[fi], "utf8"); } catch (_e) { continue; }
+    var rel = _relPath(files[fi]);
+    var m;
+    callRe.lastIndex = 0;
+    while ((m = callRe.exec(src)) !== null) {
+      var resVar = m[1], defIdent = m[3];
+      var keys = _defaultsKeys(src, defIdent.split(".").pop());
+      if (!keys) continue;                                  // defaults not a local object literal — can't verify
+      var propRe = new RegExp("\\b" + resVar + "\\.([A-Za-z_$][\\w$]*)", "g");
+      var pm, seen = {};
+      while ((pm = propRe.exec(src)) !== null) {
+        var prop = pm[1];
+        if (seen[prop]) continue;
+        seen[prop] = true;
+        if (keys[prop] || /^(hasOwnProperty|toString|constructor|prototype)$/.test(prop)) continue;
+        var line = src.slice(0, pm.index).split(/\r?\n/).length;
+        matches.push({ file: rel, line: line, content: resVar + "." + prop + " (not a key of " + defIdent + ")" });
+      }
+    }
+  }
+  matches = _filterMarkers(matches, "applydefaults-dropped-opt");
+  _report("no opt read off applyDefaults() result that is absent from its DEFAULTS " +
+    "(silently dropped — read it from opts directly or add it to DEFAULTS)", matches);
+}
+
 
 
 function testNoUnresolvedMarkers() {
@@ -853,6 +925,7 @@ function testParserPrimitivesHaveFuzzHarness() {
   var FUZZ_NOT_REQUIRED = {
     "lib/safe-async.js":     "runtime-control wrapper (not input-parsing)",
     "lib/safe-buffer.js":    "byte-level helper consumed only by other primitives, no operator-facing parse path",
+    "lib/safe-object.js":    "own-property get/set over an in-memory JS object; no bytes/string parser, no adversarial-input parse path",
     "lib/safe-redirect.js":  "post-validation redirect builder; the validation lives in safe-url which is fuzzed",
     "lib/safe-schema.js":    "schema-builder fluent API; takes operator-authored schema, not adversarial input",
     "lib/safe-sql.js":       "tagged-template helper; takes operator-authored fragments, not adversarial input",
@@ -882,6 +955,18 @@ function testParserPrimitivesHaveFuzzHarness() {
     "lib/parsers/safe-env.js":        ".env file loader takes a filepath (not adversarial in-process bytes); operator controls the file boundary, schema-validation gates the values",
     "lib/safe-path.js":               "operator-supplied path-segment validator over the existing guardFilename codepoint tables (reserved-name + bidi + overlong-UTF-8 inherited transitively); the per-segment regex set is deterministic + anchored + length-bounded by the caller-supplied rel, no adversarial-bytes parser surface",
   };
+  // Untrusted-BYTE parsers that are NOT named safe-*/guard-* (so the name walk
+  // below skips them) but consume adversarial bytes off the network / disk and
+  // need the same fuzz discipline -- the INPUT SURFACE is what matters, not the
+  // filename. asn1-der parses DER from peer TLS certificates, S/MIME, BIMI VMCs,
+  // CMS, ACME and TSA responses; cms-codec (b.cms) parses CMS on top of it;
+  // link-header (b.linkHeader.parse) parses an untrusted HTTP Link response
+  // header (RFC 8288) a server / SSRF-reachable origin controls.
+  var FUZZ_REQUIRED_EXTRA = [
+    "lib/asn1-der.js",
+    "lib/cms-codec.js",
+    "lib/link-header.js",
+  ];
   var fs   = require("node:fs");
   var path = require("node:path");
   var repoRoot = path.resolve(__dirname, "..", "..");
@@ -902,6 +987,9 @@ function testParserPrimitivesHaveFuzzHarness() {
     });
   }
   _walk(libDir);
+  FUZZ_REQUIRED_EXTRA.forEach(function (rel) {
+    if (libFiles.indexOf(rel) === -1) libFiles.push(rel);
+  });
   var hits = [];
   libFiles.forEach(function (rel) {
     if (FUZZ_NOT_REQUIRED[rel]) return;
@@ -944,7 +1032,28 @@ function testParserPrimitivesHaveFuzzHarness() {
     // mutator-only exploration. We DON'T report on it here; the
     // build script just skips the zip step when the dir is missing.
   });
-  _report("every lib/safe-*.js / lib/guard-*.js parser-or-validator has a fuzz/<name>.fuzz.js (or is allowlisted in FUZZ_NOT_REQUIRED)",
+  // The FUZZ_REQUIRED_EXTRA parsers are not name-matched by the cflite CI
+  // matrices (which are curated safe-*/guard-* subsets), so a harness for one
+  // would be BUILT but never RUN in-repo -- coverage claimed, not delivered.
+  // Require each to be listed in BOTH cflite matrices so the continuous-coverage
+  // claim is real. (OSS-Fuzz auto-discovers every harness via build.sh; this
+  // guards the in-repo PR + nightly signal for the parsers we explicitly promote.)
+  var cflitePr    = "";
+  var cfliteBatch = "";
+  try { cflitePr    = fs.readFileSync(path.join(repoRoot, ".github/workflows/cflite_pr.yml"), "utf8"); }    catch (_e1) { cflitePr = ""; }
+  try { cfliteBatch = fs.readFileSync(path.join(repoRoot, ".github/workflows/cflite_batch.yml"), "utf8"); } catch (_e2) { cfliteBatch = ""; }
+  FUZZ_REQUIRED_EXTRA.forEach(function (rel) {
+    var target = path.basename(rel).replace(/\.js$/, "");
+    var reEntry = new RegExp("^\\s*-\\s*" + target + "\\s*$", "m");
+    if (!reEntry.test(cflitePr) || !reEntry.test(cfliteBatch)) {
+      hits.push({
+        file: rel, line: 1,
+        content: "untrusted-byte parser has a fuzz harness + FUZZ_REQUIRED_EXTRA entry but its target `" + target +
+          "` is missing from a cflite matrix (.github/workflows/cflite_pr.yml AND cflite_batch.yml) -- the harness would be built but never run in-repo (add the target to both matrices)",
+      });
+    }
+  });
+  _report("every lib/safe-*.js / lib/guard-*.js parser-or-validator (plus the untrusted-byte parsers in FUZZ_REQUIRED_EXTRA) has a fuzz/<name>.fuzz.js (or is allowlisted in FUZZ_NOT_REQUIRED), and each FUZZ_REQUIRED_EXTRA parser is wired into both cflite CI matrices",
     hits);
 }
 
@@ -2705,6 +2814,13 @@ function testTimersUnref() {
     }
   }
   bad = _filterMarkers(bad, "timer-no-unref-unrefed-below");
+  // A timer whose deliberate JOB is to pin the process — a long-running
+  // supervisor / daemon that must outlive its children until an operator
+  // signal — is the message's advertised "process-pinning intent" exception:
+  // unref'ing it would defeat the primitive (e.g. `blamejs dev` must stay up
+  // across a watched-child crash). Such a timer carries this marker + the
+  // reason it must NOT unref.
+  bad = _filterMarkers(bad, "timer-no-unref-process-pinning");
   _report("setInterval timers call .unref() (or have allow marker for " +
           "process-pinning intent)",
     bad);
@@ -3107,6 +3223,85 @@ function testNoBareErrorThrows() {
     bad);
 }
 
+// ---- Pattern 38b: defineClass error constructed message-first ----
+//
+// defineClass() generates `constructor(code, message)` (it calls
+// `super(message, code)` against the base FrameworkError, whose own order
+// is the mirror). So EVERY `new <DefineClassError>(...)` must pass the
+// short code FIRST and the human message SECOND. A message-first call
+// (arg1 has whitespace — no code ever does — while arg2 is a bare short
+// token) buries the diagnostic in `.code` and hands the operator a bare
+// token as `.message`. Sound by construction: a whitespace first arg is
+// never a valid code, so a hit is always a swap, never a style choice.
+// Seen twice — safe-buffer `_throw` and security.assertProduction — hence
+// a structural guard, not just the behavioral test that ships with each.
+function testDefineClassErrorArgOrder() {
+  // class: define-class-error-arg-order
+  var files = _libFiles();
+  // 1. Collect every defineClass-generated error name across lib/.
+  var names = {};
+  for (var i = 0; i < files.length; i++) {
+    var c;
+    try { c = fs.readFileSync(files[i], "utf8"); } catch (_e) { continue; }
+    var dre = /defineClass\(\s*["']([A-Za-z0-9_]+)["']/g, dm;
+    while ((dm = dre.exec(c))) names[dm[1]] = true;
+  }
+  var nameList = Object.keys(names);
+  if (!nameList.length) { check("no defineClass error classes to check", true); return; }
+  var nameAlt = nameList.join("|");
+
+  // Split the first top-level args of a call starting just after '('.
+  function firstTwoArgs(src, start) {
+    var depth = 0, inStr = null, cur = "", out = [];
+    for (var k = start; k < src.length && out.length < 2; k++) {
+      var ch = src[k];
+      if (inStr) { cur += ch; if (ch === "\\") { cur += src[++k]; } else if (ch === inStr) inStr = null; continue; }
+      if (ch === '"' || ch === "'" || ch === "`") { inStr = ch; cur += ch; continue; }
+      if (ch === "(" || ch === "[" || ch === "{") { depth++; cur += ch; continue; }
+      if (ch === ")" || ch === "]" || ch === "}") { if (depth === 0) { out.push(cur); break; } depth--; cur += ch; continue; }
+      if (ch === "," && depth === 0) { out.push(cur); cur = ""; continue; }
+      cur += ch;
+    }
+    return out;
+  }
+  function leadingLiteral(arg) {
+    var m = arg.trim().match(/^"((?:[^"\\]|\\.)*)"|^'((?:[^'\\]|\\.)*)'/);
+    return m ? (m[1] != null ? m[1] : m[2]) : null;
+  }
+  function wholeCodeLiteral(arg) {
+    var m = arg.trim().match(/^"((?:[^"\\]|\\.)*)"$|^'((?:[^'\\]|\\.)*)'$/);
+    if (!m) return null;
+    var v = m[1] != null ? m[1] : m[2];
+    return (v.length > 0 && v.length <= 40 && !/\s/.test(v)) ? v : null;
+  }
+
+  var bad = [];
+  var callRe = new RegExp("new\\s+(" + nameAlt + ")\\s*\\(", "g");
+  for (var fi = 0; fi < files.length; fi++) {
+    var rel = _relPath(files[fi]);
+    var content;
+    try { content = fs.readFileSync(files[fi], "utf8"); } catch (_e2) { continue; }
+    callRe.lastIndex = 0;
+    var cm;
+    while ((cm = callRe.exec(content))) {
+      var lineNo = content.slice(0, cm.index).split(/\r?\n/).length;
+      var startLine = content.split(/\r?\n/)[lineNo - 1] || "";
+      if (/^\s*(\/\/|\*|\/\*)/.test(startLine)) continue;   // skip commented examples
+      var args = firstTwoArgs(content, cm.index + cm[0].length);
+      if (args.length < 2) continue;
+      var lead1 = leadingLiteral(args[0]);
+      var code2 = wholeCodeLiteral(args[1]);
+      if (lead1 && /\s/.test(lead1) && code2) {
+        bad.push({ file: rel, line: lineNo, content: ("new " + cm[1] + "(\"" + lead1.slice(0, 40) + "…\", \"" + code2 + "\")") });
+      }
+    }
+  }
+  bad = _filterMarkers(bad, "define-class-error-arg-order");
+  _report("defineClass error constructed (code, message) — not message-first " +
+          "(a whitespace first arg is never a valid code)",
+    bad);
+}
+
 // ---- Pattern 39: hand-rolled URL building ----
 
 function testNoHandrolledUrlBuild() {
@@ -3494,6 +3689,27 @@ async function testNoDuplicateCodeBlocks() {
   // so the audit trail records exactly which body of code shares the
   // shape.
   var KNOWN_CLUSTERS = [
+    {
+      // Own-property lookup guard — a JS language idiom, not shared behaviour.
+      // `if (!Object.prototype.hasOwnProperty.call(TABLE, key)) throw XError(
+      // code, msg + key); var v = TABLE[key];` is the framework's canonical way
+      // to reject an untrusted key before indexing a plain-object lookup table
+      // (the prototype-pollution / algorithm-confusion guard). mail-helo.evaluate
+      // and mail-rbl.create resolve a guard-family gate PROFILE
+      // (gateContract.resolveProfileName over the PROFILES table); sd-jwt-vc.present
+      // guards a HASH-ALG table (SUPPORTED_HASH_ALGS) against an attacker-controlled
+      // `_sd_alg`. The 50-token overlap is the guard idiom's skeleton, not shared
+      // logic — the three functions are in unrelated domains (SMTP HELO policy /
+      // DNSBL config / SD-JWT presentation) with no extractable 3-way primitive.
+      // (A dedicated own-property-lookup helper across the crypto alg-table sites
+      // is tracked as a deliberate follow-up, not forced by this coincidence.)
+      mode:  "family-subset",
+      files: [
+        "lib/auth/sd-jwt-vc.js:present",
+        "lib/mail-helo.js:evaluate",
+        "lib/mail-rbl.js:create",
+      ],
+    },
     {
       // Opts-passthrough / allow-list token run — shape-only. A run of
       // `<ident>: <ident>.<ident>,` assignments (jar.parse forwarding its
@@ -5827,6 +6043,270 @@ function testNoDeniedVendors() {
     bad);
 }
 
+// ---- Pattern 45: vendored bundles ship reviewable — unminified + eval-free ----
+
+// Dynamic-code-execution constructs a vendored artifact must never carry:
+// direct eval, indirect `(x, eval)` aliasing, the Function constructor,
+// module.createRequire, and process.binding. The only such tokens upstream
+// libraries ever shipped here were legacy global-object probes
+// (`Function("return this")` / indirect eval) that cannot execute on
+// supported Node versions; scripts/vendor-update.sh resolves
+// reflect-metadata to its `lite` entry so none remain in the bundles.
+var VENDOR_DYNAMIC_EXEC_RE =
+  /\beval\s*\(|,\s*eval\s*\)|\bnew\s+Function\b|\bFunction\s*\(|\bcreateRequire\b|process\.binding/;
+
+function testVendorBundlesReviewable() {
+  // lib/vendor/*.cjs are esbuild bundles of MANIFEST-pinned upstream
+  // libraries (scripts/vendor-update.sh). They ship UNMINIFIED so an
+  // operator can read them and diff them against upstream at the pinned
+  // version, and every vendored JS artifact must stay free of
+  // dynamic-code-execution constructs. This gate refuses a regression
+  // arriving through a future vendor refresh (e.g. --minify creeping
+  // back into a build command, or an upstream bump reintroducing a
+  // global-object eval probe).
+  //
+  // Minification check: average line length, .cjs bundles only.
+  // Unminified esbuild output of the current inputs measures 31-39
+  // chars/line; minified output of the same inputs measures 1223-3796.
+  // The 200 threshold has ~5x headroom above the unminified population
+  // and ~6x below the minified one, and is a whole-file statistic —
+  // not a layout-coupled bound on any single construct. The .data.js
+  // payload carriers are exempt from this leg (their signatureB64
+  // field is legitimately one multi-KB base64 line) but covered by the
+  // dynamic-exec leg on top of their four-layer load-time verification.
+  var vendorDir = path.join(__dirname, "..", "..", "lib", "vendor");
+  var bad = [];
+  var names = fs.readdirSync(vendorDir).sort();
+  for (var i = 0; i < names.length; i++) {
+    var name = names[i];
+    if (!/\.(cjs|js|mjs)$/.test(name)) continue;
+    var full = path.join(vendorDir, name);
+    if (!fs.statSync(full).isFile()) continue;
+    var content = fs.readFileSync(full, "utf8");
+    var lines = content.split(/\r?\n/);
+    var total = 0;
+    for (var li = 0; li < lines.length; li++) {
+      total += lines[li].length;
+      if (VENDOR_DYNAMIC_EXEC_RE.test(lines[li])) {
+        bad.push({
+          file:    "lib/vendor/" + name,
+          line:    li + 1,
+          content: "dynamic-code-execution construct in vendored artifact: " +
+                   lines[li].trim().slice(0, 80),
+        });
+      }
+    }
+    if (/\.cjs$/.test(name)) {
+      var avg = lines.length ? total / lines.length : 0;
+      if (avg > 200) {
+        bad.push({
+          file:    "lib/vendor/" + name,
+          line:    1,
+          content: "bundle looks minified (avg " + Math.round(avg) +
+                   " chars/line; unminified output measures 31-39) — rebuild " +
+                   "via scripts/vendor-update.sh, which bundles without --minify",
+        });
+      }
+    }
+  }
+  _report("vendored bundles ship reviewable — unminified .cjs + no " +
+          "dynamic-code-execution constructs in lib/vendor JS",
+    bad);
+}
+
+// ---- Pattern 46: scanner policy covers the shipped data-carrier shape ----
+
+function testScannerPolicyCoversVendorDataCarriers() {
+  // Package scanners' minified-code detectors fire on high-density files
+  // and compressed/embedded assets, not only on minified CODE. The signed
+  // vendored data carriers (lib/vendor/*.data.js) are exactly that shape
+  // by design: a 76-char-wrapped base64 payload plus one multi-KB
+  // signatureB64 line. While such carriers ship, socket.yml must keep the
+  // minifiedFile class dispositioned (`minifiedFile: false`) — omitted
+  // issueRules fall back to dashboard defaults, so dropping the entry
+  // re-reports the known-benign artifacts on every routine scan. The
+  // unminified property of CODE bundles is enforced by
+  // testVendorBundlesReviewable above; the scanner class is not the guard
+  // for that property.
+  var vendorDir = path.join(__dirname, "..", "..", "lib", "vendor");
+  var names = fs.readdirSync(vendorDir).sort();
+  var carriers = [];
+  for (var i = 0; i < names.length; i++) {
+    if (!/\.data\.js$/.test(names[i])) continue;
+    var content = fs.readFileSync(path.join(vendorDir, names[i]), "utf8");
+    var lines = content.split(/\r?\n/);
+    for (var li = 0; li < lines.length; li++) {
+      if (lines[li].length > 4096) { carriers.push(names[i]); break; }
+    }
+  }
+  var bad = [];
+  if (carriers.length > 0) {
+    var socketYml = "";
+    try {
+      socketYml = fs.readFileSync(path.join(__dirname, "..", "..", "socket.yml"), "utf8");
+    } catch (_e) { /* missing socket.yml handled below as a violation */ }
+    if (!/^\s*minifiedFile:\s*false\b/m.test(socketYml)) {
+      bad.push({
+        file:    "socket.yml",
+        line:    1,
+        content: "minifiedFile disposition missing while high-density data " +
+                 "carriers ship: " + carriers.join(", "),
+      });
+    }
+  }
+  _report("socket.yml keeps minifiedFile dispositioned while lib/vendor " +
+          "*.data.js payload carriers ship",
+    bad);
+}
+
+// ---- Pattern 48: every vendored MANIFEST component is attributed in NOTICE ----
+
+function testVendorComponentsAttributedInNotice() {
+  // A third-party component vendored under lib/vendor/ ships with license and
+  // attribution obligations. lib/vendor/MANIFEST.json is the authoritative list
+  // of what ships; NOTICE is the attribution surface. A component added to the
+  // manifest without a NOTICE entry (the exact drift that shipped @noble/curves
+  // and the Public Suffix List un-attributed until a downstream scanner flagged
+  // it) must fail here, before publish. Each manifest package key (and each
+  // components[] sub-key) must appear in NOTICE, unless it is a documented
+  // no-third-party-content exception.
+  var root = path.resolve(__dirname, "..", "..");
+  var manifest, notice;
+  try { manifest = JSON.parse(fs.readFileSync(path.join(root, "lib", "vendor", "MANIFEST.json"), "utf8")); }
+  catch (_e) { _report("NOTICE attributes every vendored MANIFEST component",
+    [{ file: "lib/vendor/MANIFEST.json", line: 1, content: "unreadable / not JSON" }]); return; }
+  try { notice = fs.readFileSync(path.join(root, "NOTICE"), "utf8"); }
+  catch (_e) { _report("NOTICE attributes every vendored MANIFEST component",
+    [{ file: "NOTICE", line: 1, content: "NOTICE file missing" }]); return; }
+
+  // Documented exceptions: a vendored entry that ships NO third-party content.
+  var NO_ATTRIBUTION_NEEDED = {
+    "bimi-trust-anchors": "operator-managed VMC/CMC trust anchors — the shipped default is empty-of-PEM, so there is no third-party content to attribute (operators populate per the file-header procedure)",
+  };
+  // NOTICE names a component differently from its manifest key.
+  var NOTICE_ALIAS = {
+    "SecLists-common-passwords-top-10000": "SecLists",
+  };
+
+  var pkgs = manifest.packages || {};
+  var bad = [];
+  Object.keys(pkgs).forEach(function (key) {
+    if (NO_ATTRIBUTION_NEEDED[key]) return;
+    var needles = [NOTICE_ALIAS[key] || key];
+    // Meta-bundle sub-components each carry their own attribution obligation.
+    var comps = pkgs[key].components;
+    if (comps && typeof comps === "object") {
+      Object.keys(comps).forEach(function (c) { needles.push(NOTICE_ALIAS[c] || c); });
+    }
+    needles.forEach(function (needle) {
+      if (notice.indexOf(needle) === -1) {
+        bad.push({
+          file:    "NOTICE",
+          line:    1,
+          content: "vendored component '" + needle + "' (from lib/vendor/MANIFEST.json" +
+                   (needle === key ? "" : " package '" + key + "'") +
+                   ") has no attribution entry in NOTICE",
+        });
+      }
+    });
+  });
+  _report("NOTICE attributes every vendored MANIFEST component", bad);
+}
+
+// ---- Pattern 47: documented script flags must exist in the script ----
+
+function testDocumentedScriptFlagsExist() {
+  // Error messages, file headers, and operator docs point people at
+  // maintenance commands like `vendor-update.sh --refresh-data`. A
+  // referenced flag the target script never implements strands the
+  // operator at the exact moment the reference fires (a verification
+  // failure, a stale-data gate). Every `<script>.sh --flag` /
+  // `<script>.js --flag` reference whose basename resolves into
+  // scripts/ must appear, whole-token, on a NON-COMMENT line of that
+  // script — a usage-header comment alone does not count as an
+  // implementation, and `--refresh` must not pass because
+  // `--refresh-data` exists. References to basenames not present in
+  // scripts/ are external tools and skipped, as is a script-shaped
+  // token that is itself the VALUE of a preceding flag (`--arg
+  // ./server.js --watch` is not a `server.js --watch` reference).
+  // Known coverage bounds: only the flag directly adjacent to the
+  // script name is checked (a `script.js subcommand --flag` or
+  // second-flag reference is out of matcher reach), and a flag quoted
+  // in a non-comment string of the target (an echo, an error message)
+  // satisfies the check.
+  var root = path.resolve(__dirname, "..", "..");
+  var scriptsDir = path.join(root, "scripts");
+  var vendorDir = path.join(root, "lib", "vendor");
+  var sources = _libFiles();
+  var i;
+  var vendorNames = fs.readdirSync(vendorDir).sort();
+  for (i = 0; i < vendorNames.length; i++) {
+    if (/\.data\.js$/.test(vendorNames[i])) sources.push(path.join(vendorDir, vendorNames[i]));
+  }
+  var scriptNames = fs.readdirSync(scriptsDir).sort();
+  for (i = 0; i < scriptNames.length; i++) {
+    if (/\.(js|sh)$/.test(scriptNames[i])) sources.push(path.join(scriptsDir, scriptNames[i]));
+  }
+  var docNames = ["README.md", "SECURITY.md", "CONTRIBUTING.md", "MIGRATING.md"];
+  for (i = 0; i < docNames.length; i++) {
+    var docPath = path.join(root, docNames[i]);
+    if (fs.existsSync(docPath)) sources.push(docPath);
+  }
+
+  var refRe = /\b([a-z0-9][a-z0-9-]*\.(?:sh|js))\s+(--[a-z][a-z0-9-]*)/g;
+  // The implementation surface of a target script: every line that is
+  // not a whole-line comment (# for .sh, // or a block-comment
+  // continuation * for .js).
+  var targetCache = {};
+  function targetImplLines(basename) {
+    if (!(basename in targetCache)) {
+      var full = path.join(scriptsDir, basename);
+      var raw;
+      try { raw = fs.readFileSync(full, "utf8"); }
+      catch (_e) { targetCache[basename] = null; return null; }
+      var commentRe = /\.sh$/.test(basename) ? /^\s*#/ : /^\s*(\/\/|\*|\/\*)/;
+      targetCache[basename] = raw.split(/\r?\n/).filter(function (l) {
+        return !commentRe.test(l);
+      }).join("\n");
+    }
+    return targetCache[basename];
+  }
+  function implementsFlag(implText, flag) {
+    var esc = flag.replace(/[-/\\^$*+?.()|[\]{}]/g, "\\$&");
+    return new RegExp("(^|[^A-Za-z0-9-])" + esc + "(?![A-Za-z0-9-])").test(implText);
+  }
+
+  var bad = [];
+  for (i = 0; i < sources.length; i++) {
+    var content;
+    try { content = fs.readFileSync(sources[i], "utf8"); }
+    catch (_e) { continue; }
+    var rel = path.relative(root, sources[i]).replace(/\\/g, "/");
+    var m;
+    refRe.lastIndex = 0;
+    while ((m = refRe.exec(content)) !== null) {
+      // Skip script-shaped tokens sitting in a flag's VALUE position
+      // (`--command node --arg ./server.js --watch`): the token is an
+      // argument to the preceding flag, not a command being invoked.
+      var before = content.slice(Math.max(0, m.index - 40), m.index);
+      if (/--[a-z][a-z0-9-]*(=|\s+)(\.\/)?$/.test(before)) continue;
+      var impl = targetImplLines(m[1]);
+      if (impl === null) continue;
+      if (implementsFlag(impl, m[2])) continue;
+      var line = content.slice(0, m.index).split("\n").length;
+      bad.push({
+        file:    rel,
+        line:    line,
+        content: "references `" + m[1] + " " + m[2] + "` but scripts/" +
+                 m[1] + " has no non-comment occurrence of " + m[2],
+      });
+    }
+  }
+  _report("script flags referenced from lib/, scripts/, and operator docs " +
+          "exist outside comments in the target script",
+    bad);
+}
+
 // ---- Pattern 42: state-stamps in user-facing docs (smoke test the wiki) ----
 
 function testStateStampScanningDeferred() {
@@ -5881,6 +6361,15 @@ var KNOWN_ANTIPATTERNS = [
     allowlist: ["lib/guard-auth.js"],
     reason: "v0.15.0 #103 — the guard sanitize/parse refuse-on-critical|high throw (err(issue.ruleId || '<x>.refused', 'guard<Name>.<op>: ' + issue.snippet)) is owned by gateContract.throwOnRefusalSeverity; 18 guards reuse it (this was the failing STRONG-DUP fp:f349a8d1f51b before extraction). A hand-rolled `issues[i].ruleId || '<x>.refused'` throw re-implements it. lib/guard-auth.js is the one genuine holdout (its message embeds issues[i].source: 'guardAuth.sanitize [<source>]:') pending task #104; the primitive itself uses a `fallback` variable (no .refused literal) so it does not match. Any other lib file with this shape must call gateContract.throwOnRefusalSeverity (the severities / op options cover the critical-only + parse variants).",
   },
+  {
+    id: "byte-cap-must-vet-type-before-measuring",
+    primitive: "b.safeBuffer.byteLengthOfIfMeasurable",
+    scanScope: "lib",
+    skipCommentLines: true,
+    regex: /typeof\s+\w+\.length\s*===\s*["']number["']\s*&&[^\n]*byteLengthOf\s*\(/,
+    allowlist: [],
+    reason: "A byte-size cap over untrusted metadata (the guard-family `{ bytes }` bag) must not gate safeBuffer.byteLengthOf on a hand-rolled `typeof X.length === 'number'` check: byteLengthOf accepts only string / Buffer / Uint8Array and THROWS on anything else, so that check admits a plain Array / array-like object and crashes the guard's documented never-throw-on-hostile-metadata inspection contract (the gate path fails closed, but a direct validate/sanitize caller throws). This shipped in BOTH guard-image and guard-pdf. The primitive is `safeBuffer.byteLengthOfIfMeasurable(x)` — it returns the byte length for a measurable value or `null` for a non-byte-carrier — so a guard writes `var n = safeBuffer.byteLengthOfIfMeasurable(bytes); if (n !== null && n > cap) refuse`; guard-image + guard-pdf compose it. Any new guard measuring a metadata bag must compose it instead of the raw typeof-length shape (magic detection reads only the leading bytes, so skipping the cap for an unmeasurable array-like cannot DoS). Empty allowlist — no legitimate instance of this coupling exists.",
+  },
   {
     id: "html-comment-scan-must-use-htmlCommentEnd",
     primitive: "b.markupTokenizer.htmlCommentEnd",
@@ -6249,6 +6738,53 @@ var KNOWN_ANTIPATTERNS = [
     allowlist: [],
     reason: "#114 — _blamejs_subject_restrictions declares sealedFields:[\"reason\"] but subject.js wrote the reason in clear via the raw sql.insert path. Seal on write (cryptoField.sealRow(RESTRICTIONS_TABLE, ...)); the reason is write-only (isRestricted reads only the PK) so there is no unseal site. Fires if the restriction insert lands without the seal.",
   },
+  {
+    id: "guard-scheme-extractor-must-strip-url-whitespace",
+    primitive: "a content guard that extracts a URL scheme for a denylist must fold the decoded value through codepointClass.stripUrlSchemeWhitespace, so a browser-stripped tab/newline or an entity-encoded leading space cannot push the scheme past the anchor and read as scheme-less",
+    scanScope: "lib",
+    regex: /function _extractScheme\b|DANGEROUS_SCHEME_RE\.test\b/,
+    requires: /stripUrlSchemeWhitespace\(/,
+    skipCommentLines: true,
+    allowlist: [],
+    reason: "guard-html / guard-svg (_extractScheme) and guard-markdown (DANGEROUS_SCHEME_RE.test) resolve a URL scheme against a denylist. The WHATWG URL parser removes tab/lf/cr from anywhere and trims a leading/trailing C0-control-or-space run before parsing; neither the C0-control strip (which excludes tab/lf/cr) nor a raw trim (which misses an entity-encoded space) covers that, so the decoded value MUST route through codepointClass.stripUrlSchemeWhitespace. Fires if a scheme extractor drops the shared normalizer, re-opening the java<TAB>script: / &#32;javascript: fail-open XSS.",
+  },
+  {
+    id: "guard-css-danger-check-must-decode-entities",
+    primitive: "a content guard's CSS-danger check must match the entity-decoded style value via codepointClass.decodeMarkupEntities, not the raw bytes -- a style attribute is character-reference-decoded before the CSS parser sees it",
+    scanScope: "lib",
+    regex: /CSS_DANGEROUS_PATTERNS\s*\[\s*\w+\s*\]\.test/,
+    requires: /decodeMarkupEntities\(/,
+    skipCommentLines: true,
+    allowlist: [],
+    reason: "guard-html / guard-svg test CSS_DANGEROUS_PATTERNS against a style value. The browser character-reference-decodes a style attribute before the CSS parser runs, so a raw-byte match lets ex&#x70;ression( / url(&#x6A;avascript:) / behavior&colon; bypass the denylist (fail-open CSS-injection XSS). The check MUST decode via codepointClass.decodeMarkupEntities first. Fires if a CSS-danger check drops the decode.",
+  },
+  {
+    id: "crypto-field-sealrow-must-not-skip-empty-string",
+    primitive: "cryptoField.sealRow must seal an empty string into an authenticated envelope, never skip it -- skipping stores a bare plaintext empty string that a DB-write attacker can forge or downgrade a ciphertext to undetected",
+    scanScope: "lib",
+    regex: /===\s*null\s*\|\|\s*out\[field\]\s*===\s*""/,
+    skipCommentLines: true,
+    allowlist: [],
+    reason: "cryptoField.sealRow must skip only null/undefined; an empty string is sealed (via _encodeTyped of the empty string -> a non-empty typed E: marker) so it becomes a real authenticated envelope. Re-adding an empty-string arm to the seal-skip (=== null || out[field] === empty) stores a bare plaintext empty string that unsealRow's falsy skip would accept, letting a DB-write attacker replace any sealed ciphertext with empty undetected (the sealed-column tamper-evidence hole). Fires if the empty-string skip returns to the seal path.",
+  },
+  {
+    id: "guard-css-danger-check-must-fold-url-whitespace",
+    primitive: "a guard's CSS-danger check must fold the URL-scheme whitespace a browser strips inside url(...) -- tab/lf/cr -- after entity-decoding (codepointClass.stripUrlSchemeWhitespace); a decode-only check misses an entity-hidden tab in a CSS URL scheme like url(java&Tab;script:)",
+    scanScope: "lib",
+    regex: /decodeMarkupEntities\(value\)\s*;/,
+    skipCommentLines: true,
+    allowlist: [],
+    reason: "guard-html / guard-svg _isCssDangerous entity-decode a style value, but a browser also strips tab/lf/cr from a URL inside url(...) before resolving its scheme, so url(java&Tab;script:) -> url(java<TAB>script:) must be folded with stripUrlSchemeWhitespace before matching the contiguous javascript: danger pattern. A decode-only codepointClass.decodeMarkupEntities(value); with no whitespace fold re-opens the CSS whitespace-scheme bypass. Fires if the fold is dropped.",
+  },
+  {
+    id: "i18n-messageformat-case-lookup-must-be-own-property",
+    primitive: "the MessageFormat renderer must look up a select/plural case via _ownCase (own-property only), never a bare node.cases[key] -- a select value is end-user supplied, so String(sv) can be __proto__ / constructor / toString and a bare index returns a truthy INHERITED Object.prototype member, bypassing the other fallback (output corruption or a _renderSequence-of-non-array request DoS)",
+    scanScope: "lib",
+    regex: /node\.cases\[/,
+    skipCommentLines: true,
+    allowlist: [],
+    reason: "lib/i18n-messageformat.js resolves a MessageFormat case by an end-user-controlled select key; a bare node.cases[key] reaches the prototype chain for __proto__ / constructor / toString and returns an inherited member, corrupting output or throwing a request DoS on render. Every case lookup must route through _ownCase (Object.prototype.hasOwnProperty guarded). Fires if a bare node.cases[...] index returns to the code.",
+  },
   {
     // Vault keypair rotation stages every output file (the re-encrypted
     // db, resealed vault/db keys, additional sealed files, derived-hash
@@ -8472,6 +9008,14 @@ var KNOWN_ANTIPATTERNS = [
 
   { id: "breach-clock-composes-incident-clock", primitive: "b.breach.deadline.createClock must compose b.incident.report.createDeadlineClock (one underlying timer) — it must NOT re-roll its own setInterval tick loop; the breach clock delegates the timer lifecycle to incident-report so there is a single tick source to drive + stop", scanScope: "lib", skipCommentLines: true, regex: /setInterval[\s\S]{0,8000}?breach\.deadline\.createClock|breach\.deadline\.createClock[\s\S]{0,8000}?setInterval/, allowlist: [], reason: "breach-deadline.createDeadlineClock wraps incidentReport().createDeadlineClock and forwards trackReport / acknowledgeSubmission / cancel / stop onto that inner clock; it owns no timer of its own. A setInterval inside breach-deadline.js means the tick loop was re-rolled instead of delegated — two independent timers drifting, and a stop() that no longer tears the real one down. File-scoped via co-occurrence of setInterval with the breach.deadline.createClock token unique to breach-deadline.js (incident-report.js owns the legitimate setInterval but never names breach.deadline.createClock, so it is not flagged). Empty allowlist — a timer here is the miswire." },
 
+  { id: "daemon-stop-sentinel-must-poll-not-watch", primitive: "lib/daemon.js's Windows cooperative-stop sentinel (_installStopSentinelWatcher) must detect the <pidFile>.stop sentinel with a synchronous existsSync poll on an unref'd interval — never a filesystem watch: fs.watch aborts libuv on an 8.3 short-name temp path (uncatchable), and fs.watchFile's StatWatcher stats via the libuv threadpool, starving under concurrent-fs load and missing the graceful-stop budget", scanScope: "lib", skipCommentLines: true, regex: /function _installStopSentinelWatcher[\s\S]{0,3000}?nodeFs\.watch(?:File)?\(/, allowlist: [], reason: "The daemon's win32 stop channel died in windows-CI as a libuv abort (src/win/fs-event.c '!_wcsnicmp(filename, dir, dirlen)') because it fs.watch'd the sentinel's DIRECTORY, whose CI-runner temp path (C:\\Users\\RUNNER~1\\...\\Temp) is an 8.3 short name — GetFinalPathNameByHandle returns the long form and the prefix assertion aborts the whole process, uncatchable, so the smoke worker vanished with no result line. Switching to fs.watchFile then regressed under parallel test load (StatWatcher's threadpool stat delayed detection past the stop budget). The channel now polls a synchronous nodeFs.existsSync on an unref'd setInterval (STOP_SENTINEL_POLL_MS) — main-thread, no fs-event.c handle, no threadpool. This is a STRUCTURAL guard precisely because the failure is environment-specific (an 8.3 short-name path a local host with 8.3 generation disabled cannot reproduce), so no behavioral test can assert it. Anchored on the _installStopSentinelWatcher function unique to daemon.js; any nodeFs.watch/watchFile reintroduced in its body co-occurs and trips. Empty allowlist — a filesystem watch on this sentinel is the regression." },
+
+  { id: "pid-liveness-probe-must-compose-pidProbe", primitive: "a signal-0 liveness probe (process.kill(pid, 0)) in lib/ must compose b.pidProbe.isLivePid (lib/pid-probe.js) — the shared EPERM-means-alive / ESRCH-means-dead classifier — not re-roll process.kill(pid, 0) inline", scanScope: "lib", skipCommentLines: true, regex: /process\.kill\([^,)]+,\s*0\s*\)/, allowlist: ["lib/pid-probe.js"], reason: "b.daemon and b.appShutdown.pidLock carried byte-identical signal-0 liveness probes (process.kill(pid, 0) → alive; EPERM → alive-but-unowned; ESRCH → dead) that were extracted to lib/pid-probe.js (isLivePid) so there is ONE classifier. A re-rolled inline process.kill(pid, 0) risks drifting the EPERM/ESRCH interpretation — e.g. treating EPERM (a running daemon owned by another uid) as dead, so it is misread as reap-able and its pidfile stolen. pid-probe.js owns the primitive and is allowlisted; any other lib file sending signal 0 must route through pidProbe.isLivePid. Extract-then-register per feedback_extract_then_register_catalog. Empty-but-for-the-owner allowlist — an inline signal-0 probe elsewhere is the re-duplication." },
+
+  { id: "static-confinement-must-compose-safepath-confineToBase", primitive: "lib/static.js's path-traversal barrier (_assertInsideRoot) must compose b.safePath.confineToBase for its lexical base-containment — not re-roll nodePath.join + a startsWith(root + sep) check, which drifts from the shared cross-platform-aware containment (the runtime nodePath misses a backslash traversal on a POSIX host)", scanScope: "lib", skipCommentLines: true, regex: /function _assertInsideRoot\b/, requires: /safePath\.confineToBase\(/, allowlist: [], reason: "static serving confines an operator-configured root against CWE-22 traversal. Its containment step (resolve the request path against root, confirm it stays strictly inside) is the SAME lexical check b.safePath.resolve layers its user-input strictness on top of — so static.js composes the extracted b.safePath.confineToBase rather than hand-rolling nodePath.join + startsWith(root + sep). It composes the containment CORE, NOT b.safePath.resolve, because static keeps containment and per-file basename validation as SEPARATE steps (its own b.guardFilename basename gate, calibrated for served content) — fusing resolve's all-segment user-input strictness into the barrier would double the basename checks and reject a legitimate colon-named intermediate directory the basename-only gate permits. A re-rolled join+startsWith containment in static.js also loses the shared cross-platform-aware resolve (the runtime path module treats the other platform's separator as an ordinary char and misses a backslash traversal on POSIX). Anchored on _assertInsideRoot, unique to static.js; the requires-companion trips if the confineToBase composition is removed. Empty allowlist." },
+
+  { id: "lib-fs-watch-must-normalize-shortname-path", primitive: "any lib/ fs.watch call (via nodeFs.watch) must first expand an 8.3 short-name component via realpathSync.native in the same file — otherwise fs.watch aborts libuv (uncatchable) on a Windows short-name path; a single-file watch should instead prefer the nodeFs.watchFile StatWatcher, which is immune", scanScope: "lib", skipCommentLines: true, regex: /nodeFs\.watch\(/, requires: /realpathSync\.native/, allowlist: [], reason: "fs.watch, via libuv ReadDirectoryChangesW, aborts the whole process — src/win/fs-event.c '!_wcsnicmp(filename, dir, dirlen)' — when the watched path is reached through a Windows 8.3 short-name component (GetFinalPathNameByHandle returns the long form; the prefix check fails). The daemon hit this in windows-CI on the runner's C:\\Users\\RUNNER~1\\...\\Temp path. b.watcher already guards it (root = nodeFs.realpathSync.native(root) before the recursive watch); bundler + dev now normalize inside their watchFn; flag-providers switched to the nodeFs.watchFile StatWatcher, which opens no directory-change handle and so does not match this detector's nodeFs.watch regex. The requires-companion clears a file once it realpath-normalizes; a new lib fs.watch with no realpathSync.native in the same file trips the gate. STRUCTURAL guard — the abort needs an 8.3 short-name path and cannot be reproduced where 8.3 generation is disabled, so no behavioral test can assert it. Empty allowlist." },
+
   { id: "bounded-chunk-collector-not-a-stream-consumer", primitive: "b.safeBuffer.boundedChunkCollector(opts) takes a SINGLE options object and returns a { push, result, bytesCollected } collector — it is not a stream consumer. To read a Readable (request body, upstream response) use b.safeBuffer.collectStream(stream, opts), which pumps the stream into a bounded collector and resolves a Buffer. A boundedChunkCollector(req, ...) call passes the stream as opts (maxBytes undefined → buffer/bad-arg throw) and then awaits / .then()s a non-Promise collector.", scanScope: "lib", skipCommentLines: true, regex: /boundedChunkCollector\s*\(\s*\w+\s*,/, allowlist: [], reason: "csp-report (413 on EVERY POST) and scim-server (every streamed body broke) both called safeBuffer.boundedChunkCollector(req, { maxBytes }) / (req, MAX, ErrClass, code): the request stream was passed as the opts argument (maxBytes undefined → synchronous buffer/bad-arg, surfaced as 413/500) and the returned push-collector was treated as a thenable. boundedChunkCollector has no (stream, opts) overload; b.safeBuffer.collectStream is the stream-reading sibling. The regex flags a call whose first argument is a bare identifier immediately followed by a comma (the multi-arg / stream-first misuse); single-object boundedChunkCollector({ ... }) and single-var boundedChunkCollector(opts) / boundedChunkCollector(opts || {}) calls do not match. Empty allowlist — there is no valid multi-arg form. This is the detector that would have caught both endpoints before smoke." },
 
   { id: "regex-polynomial-whitespace-in-repeated-group", primitive: "a regex literal must not place an optional-whitespace `\\s*` / `\\s+` at the END of a repeated group (the `(?:…\\s*)*` / `…\\s*)+` shape) — the same whitespace can be consumed either inside the group or by surrounding whitespace, so a crafted input backtracks polynomially (CWE-1333 ReDoS). Consume whitespace as a single disjoint alternative `(?:\\s|…)*` instead, and match block comments with the star-not-slash form, never a lazy `[\\s\\S]*?`.", scanScope: "lib", skipCommentLines: true, regex: /\\s[*+]\)[*+]/, allowlist: [], reason: "CodeQL js/polynomial-redos (alert 330) flagged lib/external-db.js's leading-keyword classifier `/^\\s*(?:\\/\\*…\\s*|--…\\s*)*([A-Za-z]+)/` — the `\\s*` both before AND at the tail of the repeated group gives two ways to consume the same whitespace run, so a SQL string of nested `/**/` or `*/--` comment runs backtracks polynomially; reused by the new OTel db.operation path it became a taint sink. Rewritten to `/^(?:\\s|\\/\\*(?:[^*]|\\*(?!\\/))*\\*\\/|--[^\\n]*\\n)*([A-Za-z]+)/` (disjoint single-char alternatives). codebase-patterns is a curated detector set, not a taint/ReDoS analyzer like CodeQL — this closes the specific shape locally so the next agent-authored comment-skip regex trips the gate before CI. Empty allowlist — a `\\s*)*` / `\\s+)+` tail in a lib regex is the ReDoS tell; allowlist a genuinely-anchored case with its structural reason." },
@@ -10260,6 +10804,25 @@ var KNOWN_ANTIPATTERNS = [
     allowlist: [],
     reason: "0.15.54 — self-update-standalone-verifier-ecdsa-encoding.test.js:189 asserted that a raw IEEE-P1363 P-384 signature's first byte was not the DER SEQUENCE tag 0x30, to prove it was not DER-encoded; that byte is r's high octet, which equals 0x30 ~1/256 of the time, so the setup assertion flaked and blocked the release's ubuntu smoke (the saml-mdq-wrapping release CI). The deterministic distinguisher is the fixed 96-byte (P-384) / 64-byte (P-256) raw length; the fix guards the byte check with a `|| sig.length === N` disjunction, matching sd-jwt-vc-ecdsa-p1363.test.js:51. Fires on a bare first-byte-not-0x30 check with no length disjunction on the same line; silent once guarded.",
   },
+  {
+    // A test helper that guards a value truthy with `!!x &&` on the LEFT of an
+    // && and then re-guards the SAME variable inside a sub-expression on the
+    // right (`!!x && f((x && x.prop) || …)`) has a redundant inner `x &&`:
+    // once `!!x` short-circuits true, x is truthy, so `x && x.prop` is just
+    // `x.prop`. Sound because the outer `!!x &&` gates the whole sub-expression
+    // — the temper on `||` excludes the shape where an intervening `||` breaks
+    // that guarantee (`!!x && a || b(x && x.y)` — there b's inner guard is real
+    // because x can be null on the right of `||`). A pure-redundancy code-smell
+    // the linters flag as an always-true conditional; a behavioral test can't
+    // assert it (both forms behave identically), so the detector is the guard.
+    id: "test-redundant-inner-truthy-guard",
+    primitive: "a redundant always-true inner guard — a value already proven truthy by a leading double-bang test is re-tested with a second and-guard inside the same guarded call, so the inner guard is dead; read the property directly instead",
+    scanScope: "test",
+    regex: /!!(\w+)\s*&&(?:(?!\|\|)[^\n])*\(\s*\1\s*&&\s*\1\./,
+    skipCommentLines: true,
+    allowlist: [],
+    reason: "0.16.15 — openid-federation.test.js `_rejects`/`_throws` re-tested `threw` inside the guarded `re.test(...)` even though the leading double-bang test on `threw` already proved it truthy, so the inner test was dead; the code-quality bot flagged it as a useless always-true conditional and blocked merge on thread-resolution (same class as the 0.16.10 agent-helper double-check). Fixed by reading `threw.code` directly. The `||` temper keeps only the sound shape — it does NOT fire on external-db-routing.test.js:297, where the same-variable inner guard is real because the value can be null on the right of an `||`. Fires when a double-bang guard is followed on one line, with no intervening `||`, by a parenthesized re-test of the same variable; silent once the inner guard is dropped.",
+  },
   {
     // A test file must invoke its run()/IIFE ONLY under
     // `if (require.main === module)`. The smoke worker REQUIRES each test
@@ -10340,6 +10903,11 @@ var KNOWN_ANTIPATTERNS = [
       // shadow-timeout posture. Not a condition-wait use; the
       // setTimeout IS the simulated latency itself.
       "test/layer-0-primitives/audit-use-store.test.js",
+      // gate-contract.test.js simulates a slow gate check (a Promise
+      // that resolves after 5s) to verify defineGate's maxRuntimeMs
+      // timeout fires first. Same shape as audit-use-store: the
+      // setTimeout IS the simulated latency, not a condition-wait.
+      "test/layer-0-primitives/gate-contract.test.js",
       // services.js implements the TCP/TLS/UDP probe primitives the
       // integration-test harness uses to detect whether a Docker
       // service is reachable. The setTimeout calls are the timeout
@@ -10918,6 +11486,67 @@ var KNOWN_ANTIPATTERNS = [
     allowlist: [],
     reason: "v0.14.7 — external-db credential-rejection audits (SQLSTATE 28000 / 28P01 / 42501) now carry attemptedTable, the relation the rejected identity tried to touch, extracted defensively from the SQL. The detector requires any file emitting an action:'db.auth.failed' audit to also name attemptedTable so a future emitter can't drop the forensic field.",
   },
+  {
+    id: "prometheus-exposition-escape-owned-by-metrics",
+    primitive: "b.metrics — _escapeLabelValue / _renderFamilyLines (one exposition encoder)",
+    scanScope: "lib",
+    skipCommentLines: true,
+    // Prometheus / OpenMetrics wire-format escaping (backslash, quote,
+    // newline in label values / help text) and labeled-sample line
+    // rendering are owned by lib/metrics.js — one encoder behind the
+    // live exposition(), the shadow registry, and snapshot.render. A
+    // hand-rolled backslash-doubling chain that ALSO escapes newline
+    // (`.replace(/\\/g,"\\\\")...replace(/\n/g,"\\n")`) is the Prometheus
+    // escape signature — a second exposition encoder growing in another
+    // lib file, whose escaping/ordering drifts from the canonical one.
+    // The two-step backslash+quote chains used by RFC 8941 sf-string /
+    // IMAP / Sieve / Link-header quoted-strings do not escape newline
+    // and are deliberately out of scope. The `{1,60}` bound on the
+    // optional intermediate replace is a ReDoS backstop, not precision.
+    regex: /\.replace\(\/\\\\\/g,\s*"\\{4}"\)(?:\.replace\([^)]{1,60}\))?\.replace\(\/\\n\/g,\s*"\\{2}n"\)/,
+    allowlist: ["lib/metrics.js"],
+    reason: "Prometheus exposition escaping is owned by lib/metrics.js (_escapeLabelValue for label values, the help-text escape in the snapshot family normalizer); every exposition surface routes through its shared family encoder. A second escape chain in another lib file means a duplicate encoder whose output can drift from the canonical exposition — compose the metrics encoder instead.",
+  },
+  {
+    id: "rfc-quoted-string-escape-owned-by-safeBuffer",
+    primitive: "b.safeBuffer.quoteString",
+    scanScope: "lib",
+    skipCommentLines: true,
+    // RFC quoted-string serialization (escape backslash + DQUOTE, wrap
+    // in DQUOTEs — sf-string / Link-header params / Authentication-
+    // Results reason / IMAP / ManageSieve strings) is owned by
+    // safeBuffer.quoteString. A hand-rolled backslash-doubling chain
+    // followed immediately by a DQUOTE escape is that serializer
+    // re-implemented inline; its escaping can drift (the pre-extraction
+    // copies disagreed on String() coercion) and a missed site is a
+    // parameter-smuggling seam. The Prometheus exposition chain escapes
+    // newline between the two steps, so it does not match here (it has
+    // its own detector + owner).
+    regex: /\.replace\(\/\\\\\/g,\s*"\\{4}"\)\.replace\(\/"\/g/,
+    allowlist: ["lib/safe-buffer.js"],
+    reason: "Backslash+DQUOTE quoted-string escaping is owned by safeBuffer.quoteString (RFC 8941 sf-string, RFC 8288 Link params, RFC 8601 reason, RFC 3501 IMAP, RFC 5804 ManageSieve all route through it). An inline `.replace(/\\\\/g,...).replace(/\"/g,...)` chain in another lib file is the serializer re-implemented — compose safeBuffer.quoteString instead. lib/safe-buffer.js is the primitive's home.",
+  },
+
+  {
+    id: "db-handle-hand-rolled-dml",
+    primitive: "b.sql",
+    scanScope: "lib",
+    skipCommentLines: true,
+    // A primitive holding a db handle (opts.db) that runs DML by passing an
+    // inline SQL string LITERAL to db.prepare/runSql —
+    // `db.prepare("SELECT ... FROM " + table + " WHERE ...")` — re-implements
+    // the identifier quoting, sealed-field rewrite and dialect handling that
+    // b.sql (the builder db.from() itself uses) already does, and drifts from
+    // it: the tenant-quota storage query did exactly this and accrued a run of
+    // parity defects (reserved-word names, schema-qualified "schema.table"
+    // names, sealed-column filtering). Build the query with b.sql and prepare
+    // the resulting string instead; a `db.prepare(built.sql)` with a VARIABLE
+    // argument does not match. DDL (CREATE / ALTER / PRAGMA) is not a b.sql
+    // DML verb and uses non-DML keywords, so it is out of scope here.
+    regex: /\bdb\.(?:prepare|runSql|exec|run)\(\s*(?:[A-Za-z_$][\w.$]*\(\s*)?["'\x60][^"'\x60]*\b(?:SELECT|INSERT|UPDATE|DELETE)\b/,
+    allowlist: [],
+    reason: "A db-handle primitive that hand-rolls DML by concatenating a SQL string literal into db.prepare/runSql re-implements b.sql's identifier quoting + sealed-field rewrite and drifts from db.from() — the tenant-quota storage query accrued reserved-word, schema-qualified and sealed-column parity defects across six review rounds doing exactly this. Compose `sql.select/insert/update/delete(table, { dialect: 'sqlite', quoteName: true }).….toSql()` and `db.prepare(built.sql)` instead (skip the unseal loop when you need raw on-disk bytes). Matches an inline SELECT/INSERT/UPDATE/DELETE literal passed to db.prepare/runSql (optionally wrapped in one helper call such as safeSql.assertSingleStatement); a db.prepare(<variable>) built by b.sql does not match, and DDL/PRAGMA is out of scope. See lib/tenant-quota.js and lib/dsr.js for the composed shape.",
+  },
 
 ];
 
@@ -13146,6 +13775,101 @@ function testEsbuildPinAgreesAcrossArtifacts() {
     bad);
 }
 
+// Fuzz-build invariant: the ClusterFuzzLite / OSS-Fuzz build script
+// (.clusterfuzzlite/build.sh) must (1) install @jazzer.js/core BEFORE
+// compile_javascript_fuzzer and (2) name each seed-corpus zip after the
+// COMPILED TARGET. compile_javascript_fuzzer emits a wrapper that execs
+// <project>/node_modules/@jazzer.js/core/dist/cli.js from a wholesale copy of
+// $SRC/blamejs, so the runtime must exist at the project-root node_modules at
+// compile time — with no `npm ci` first, every target references a runtime that
+// isn't present and cannot start. The helper names targets `basename -s .js`
+// (keeping `.fuzz`: guard-csv.fuzz), so a zip paired on the `.fuzz.js`-stripped
+// base (guard-csv_seed_corpus.zip) never associates with the target and the
+// engine bootstraps from an empty corpus. Both regressed silently: the build
+// exits 0 and CI (cflite_*.yml) invokes jazzer directly, never this script — so
+// the latent OSS-Fuzz-upstream spec built targets that couldn't run and fuzzed
+// from nothing.
+function testFuzzBuildWiresJazzerAndPairsCorpus() {
+  var buildPath = ".clusterfuzzlite/build.sh";
+  var src;
+  try { src = fs.readFileSync(buildPath, "utf8"); }
+  catch (_e) { return; }                                    // absent in this checkout — skip
+  if (src.indexOf("compile_javascript_fuzzer") < 0) return; // not the fuzz build
+
+  var bad = [];
+  var lines = src.split(/\r?\n/);
+  function isBuildComment(s) { return /^\s*#/.test(s); }
+
+  // (1) an install must precede the first compile_javascript_fuzzer.
+  var firstCompile = -1;
+  for (var i = 0; i < lines.length; i += 1) {
+    if (!isBuildComment(lines[i]) && /\bcompile_javascript_fuzzer\b/.test(lines[i])) { firstCompile = i; break; }
+  }
+  if (firstCompile >= 0) {
+    var hasInstallBefore = false;
+    for (var j = 0; j < firstCompile; j += 1) {
+      if (!isBuildComment(lines[j]) && /\bnpm\s+(ci|install|i)\b/.test(lines[j])) { hasInstallBefore = true; break; }
+    }
+    if (!hasInstallBefore) {
+      bad.push({ file: buildPath, line: firstCompile + 1,
+        content: "compile_javascript_fuzzer runs with no `npm ci`/`npm install` before it — " +
+                 "@jazzer.js/core is never installed, so every compiled target references a runtime " +
+                 "that isn't present and fails to start (the build still exits 0, so the gap is silent)" });
+    }
+  }
+
+  // (2) the seed-corpus zip must be named after the compiled target
+  // (basename -s .js, keeping `.fuzz`), never a var stripped with `.fuzz.js`.
+  for (var z = 0; z < lines.length; z += 1) {
+    if (isBuildComment(lines[z])) continue;
+    var zm = /zip\b[^\n]*\$\{?(\w+)\}?_seed_corpus\.zip/.exec(lines[z]);
+    if (!zm) continue;
+    var zipVar = zm[1];
+    var wrongStem = new RegExp("\\b" + zipVar + "\\s*=\\s*\\$\\(\\s*basename\\b[^)]*\\.fuzz\\.js\\s*\\)");
+    for (var a = 0; a < lines.length; a += 1) {
+      if (!isBuildComment(lines[a]) && wrongStem.test(lines[a])) {
+        bad.push({ file: buildPath, line: z + 1,
+          content: "seed-corpus zip named from $" + zipVar + " (=`basename ... .fuzz.js`, drops `.fuzz`); " +
+                   "the compiled target keeps `.fuzz` (basename -s .js), so the corpus never pairs — " +
+                   "derive the zip name from the target (basename -s .js)" });
+        break;
+      }
+    }
+  }
+
+  bad = _filterMarkers(bad, "fuzz-build-jazzer-runtime");
+  _report(".clusterfuzzlite/build.sh installs @jazzer.js/core before compile_javascript_fuzzer + " +
+          "names each seed-corpus zip after the compiled target so the engine pairs it",
+    bad);
+}
+
+// The wiki example depends on the framework via a file: link installed with
+// --install-links. If examples/wiki/package-lock.json's @blamejs/core node is
+// empty ({}) — as `pin-all --lockfiles` emits when it can't reach the linked
+// package — `npm ci --install-links` creates node_modules/@blamejs/ with NO
+// @blamejs/core, so every wiki CI job (e2e, comment-block) dies at
+// require.resolve("@blamejs/core") before a single test runs. Regenerate via
+// `cd examples/wiki && rm -rf node_modules package-lock.json && npm install
+// --install-links` (which restores the version + resolved:"file:../.." metadata).
+function testWikiLockfileHasFileLinkMetadata() {
+  var lockPath = "examples/wiki/package-lock.json";
+  var lock;
+  try { lock = JSON.parse(fs.readFileSync(lockPath, "utf8")); }
+  catch (_e) { return; }
+  var node = lock.packages && lock.packages["node_modules/@blamejs/core"];
+  var bad = [];
+  if (!node || typeof node.resolved !== "string" || node.resolved.indexOf("file:") !== 0) {
+    bad.push({ file: lockPath, line: 1,
+      content: "node_modules/@blamejs/core lockfile node lacks its file-link metadata " +
+               "(resolved: \"file:../..\"); npm ci --install-links then can't resolve @blamejs/core and " +
+               "every wiki job fails at require.resolve before tests start — regenerate with a full " +
+               "`rm -rf node_modules package-lock.json && npm install --install-links`" });
+  }
+  bad = _filterMarkers(bad, "wiki-lockfile-file-link");
+  _report("examples/wiki/package-lock.json carries the @blamejs/core file-link metadata (resolved: file:../..)",
+    bad);
+}
+
 // The test-detached-async-iife antipattern (scanScope: "test") covers *.test.js,
 // but the legacy single-layer entry files (test/00-primitives.js …
 // 50-integration.js) are required + run directly by smoke.js via _runLayer and
@@ -14013,6 +14737,7 @@ async function run() {
   testNumericOptsValidate();
   testHttp2TeardownPaired();
   testNoStrayConsoleCalls();
+  testNoApplyDefaultsDroppedOpt();
   testNoUnresolvedMarkers();
   testNoStaleDefers();
   testNoLiteralNulBytesInSource();
@@ -14077,6 +14802,7 @@ async function run() {
   testNoManualByteCompare();
   testNoOpenCodedLazyRequire();
   testNoBareErrorThrows();
+  testDefineClassErrorArgOrder();
   testNoHandrolledUrlBuild();
   testNoHandrolledRetryLoop();
   await testNoDuplicateCodeBlocks();
@@ -14086,6 +14812,10 @@ async function run() {
   testNoDenseWildcardRunsInLib();
   testNoUncappedSearchParamsObject();
   testNoDeniedVendors();
+  testVendorBundlesReviewable();
+  testScannerPolicyCoversVendorDataCarriers();
+  testVendorComponentsAttributedInNotice();
+  testDocumentedScriptFlagsExist();
   // v0.8.91 bug-class detectors — derived from the
   // mail-require-tls / fal.meets / cdn-cache-control / SRS fix-ups.
   testTrimBeforeControlByteScan();
@@ -14160,6 +14890,14 @@ async function run() {
   // step's port mapping + curl host.
   testWikiPortAgreesAcrossArtifacts();
   testEsbuildPinAgreesAcrossArtifacts();
+  // fuzz-build cross-artifact detector: .clusterfuzzlite/build.sh must install
+  // @jazzer.js/core before compile_javascript_fuzzer + pair each seed corpus by
+  // the compiled target name (both silently regressed the OSS-Fuzz spec).
+  testFuzzBuildWiresJazzerAndPairsCorpus();
+  // wiki file-link lockfile detector: examples/wiki/package-lock.json's
+  // @blamejs/core node must carry resolved:"file:../.." or npm ci --install-links
+  // can't resolve the framework and every wiki job dies before tests run.
+  testWikiLockfileHasFileLinkMetadata();
   testNoDetachedAsyncIifeInLegacyLayerFiles();
   testNoTrackedInternalNotes();
   testResidencyGatesWired();