@cosyte/dicom 0.0.6 → 0.0.8

package/CHANGELOG.md

@@ -4,8 +4,372 @@ All notable changes to `@cosyte/dicom` will be documented in this file. The form
 
 ## [Unreleased]
 
+### Fixed
+
+- **The `attw` publish gate exited 0 on a tarball carrying no type declarations, so a broken publish
+  read as a pass** (`ATTW-FALSE-GREEN-PORT`). `pnpm attw` now runs `scripts/attw.mjs`, ported from
+  `@cosyte/terminology` (#28, `bf153cb`), where the defect was diagnosed; `typecheck:exports` runs
+  through the same wrapper with its `--profile node16` forwarded. The code ported, the measurements
+  were re-taken on this package rather than carried over.
+
+  **The cause is unconditional CLI semantics, not a lenient invocation and not concurrency.**
+  `getExitCode.js` in `@arethetypeswrong/cli@0.18.4` opens with `if (!analysis.types) return 0`,
+  returning before the problem list is read, because an untyped package is a legitimate npm package.
+  Reproduced here with **zero concurrency**: on a quiet box `rm -f dist/index.d.ts dist/index.d.cts
+&& pnpm attw` and `rm -rf dist && pnpm attw` both print "This package does not contain types." and
+  exit **0**. Concurrency only supplies the condition. `tsup` writes the JS bundles before the
+  declaration files, so every build of this package has a window in which `dist/` holds
+  `index.mjs`/`index.cjs` and no `index.d.ts`: measured over three clean `pnpm build` runs on an idle
+  box, polling every 25ms, at **1.06s, 1.23s and 1.43s** (JS at +4.83s to +5.36s, declarations at
+  +6.06s to +6.49s). That is why the remedy is not a lock, a lease or a build queue - a lock would
+  leave the defect intact on an idle box, and the gate is supposed to be able to say its own inputs
+  were missing whatever removed them.
+
+  **Two nets, which catch different things.** A **preflight** that every relative path
+  `package.json` promises (`main`, `module`, `types`, `typings`, and every string leaf of `exports`,
+  which here is `./dist/index.cjs`, `./dist/index.mjs`, `./dist/index.d.ts` and
+  `./dist/index.d.cts`) exists and is non-empty; it catches the build window and names the missing
+  file rather than leaving a reader to infer it from a sentence about types. And a **post-check**
+  that promotes `attw`'s untyped sentence to a failure, which the preflight structurally cannot see:
+  the declarations can be on disk and still be absent from the tarball because `files` or
+  `.npmignore` left them out. No instance of that second case is on record in this repo. **Neither
+  net covers the rest of `files`** (`README.md`, `LICENSE`, `TRADEMARKS.md`, `CHANGELOG.md`), stated
+  plainly rather than left to be discovered: `attw` analyses types and never looks at them.
+
+  **The post-check reads a string, so the routes that would hide that string are refused**, by option
+  and not by value. **Eleven were measured here** on a fixture whose tarball genuinely carries no
+  types, each restoring the exact exit-0 with the sentence unreadable: `--quiet`, `-q`,
+  `--format json`, `-f json`, `--format=json`, `-fjson`, `-qf json`, `-Pfjson`, a `.attw.json`
+  setting `quiet` or `format` (`readConfig()` applies config after argv), and **`--config-path`**
+  pointing at a file that sets one - that last is the difference from terminology's copy, which
+  refused it by inference and said so.
+
+  **The three cluster forms are why the predicate is not an exact-token set, and a first draft of
+  this change got that wrong.** It matched each whole argument, before any `=`, against a set of
+  exact spellings; commander lets a short option's value attach to it and lets shorts combine, so
+  `-f` is not visible as a token in `-fjson`. Measured on that draft, on the untyped fixture:
+  `-fjson` gave **exit 0 with the gate silent**. A single-dash argument is now refused if any
+  character in its cluster is `q` or `f`, which is sound because `-f` is `attw`'s only value-taking
+  short option.
+
+  Measured the other way too, and both directions are stated because the bound matters: `--format
+  table-flipped` and `--format ascii` still print the sentence and blind nothing, and are refused
+  anyway (value-parsing them would be a third moving part in the guard); while `--form json`,
+  `--quiet=true` and `-f=json` each look like a route and are not, because commander rejects them
+  outright with exit 1. **The over-strictness is bounded and nothing else is refused**: a forwarded
+  `--profile node16` or `-P` still reaches `attw`. A forwarded extra positional does not retarget the
+  run either - `--pack .` supplies the first positional and `attw` ignores the second, so the
+  analysis stays on this package.
+
+  `test/scripts/attw-gate.test.ts` pins both nets against the real binary: the upstream exit-0
+  itself, so an `attw` upgrade that fixes it or rewords the sentence reds instead of letting the net
+  go slack; the `tsup` window in this package's own dual ESM/CJS `exports` shape, asserting both that
+  bare `attw` passes it with exit 0 and that the wrapper reds naming `./dist/index.d.ts`; a negative
+  control on a well-formed package; that a real `attw` failure still fails with `attw`'s own status;
+  and that other arguments are still forwarded. **Proved non-vacuous by putting the bare invocation
+  back into the script: 15 of the 22 tests red**, re-measured on the file as it stands. The 7 that
+  survive are exactly the ones that must pass on both: the upstream exit-0 pin, the well-formed
+  negative control, the real-failure parity case, argument forwarding, and the three controls that
+  only ever invoke the bare tool.
+  `scripts/verify.sh` in the meta-repo needed no change and was not touched, and no lock, lease,
+  semaphore or queue was added (ADR 0015).
+
+### Changed
+
+- `format` and `format:check` now cover `scripts/**/*.mjs` as well as `scripts/**/*.ts`, so the new
+  gate script is actually format-gated. Exactly one pre-existing file entered that glob,
+  `scripts/sync-version.mjs`, and it was verified Prettier-clean before the glob widened, so nothing
+  is red-flagged retroactively. (The tree's other `.mjs` file, `test/smoke/esm/index.mjs`, is under
+  `test/` and is not covered by this glob or by the `test/**/*.ts` one.)
+
+  **`lint` was deliberately NOT widened the same way, and the reason is measured rather than
+  assumed.** ESLint applies no rules at all to `.mjs` here: the shared `@cosyte/eslint-config` rule
+  blocks are scoped to `**/*.ts`, so `eslint --print-config scripts/attw.mjs` returns only the
+  Prettier-conflict disables, and a deliberately seeded unused variable plus a missing semicolon in
+  `scripts/attw.mjs` produced **zero** findings. Widening the `lint` glob would have added a
+  gate-shaped thing that gates nothing, which is the exact failure this change exists to remove.
+  Making ESLint genuinely cover `.mjs` means changing the shared config, and that is its own slice.
+
 ### Security
 
+- **A symbolic link under `test/fixtures/` pointing at a PHI-bearing file scanned CLEAN on BOTH of
+  `scripts/phi-scan.ts`'s enumerating routes, so the commit gate passed it twice over**
+  (`PHI-SCAN-SYMLINK-BLIND-ON-BOTH-ROUTES`; pre-existing). Reproduced on `0f898be` with a synthetic
+  name-bearing payload outside the walk root and a link to it at `test/fixtures/leak.txt`: all-mode
+  exited **0** printing `OK - no hits`, `--staged` exited **0** after `git add`, and naming the
+  target explicitly exited **1** with three hits (the PN plus both dates). The payload was always
+  detectable; the two routes never looked at it.
+
+  **Two mechanisms, two fixes.** `walk()` enumerates `Dirent.isFile()`, which is an lstat answer, so
+  a link is neither a file nor a directory and fell out of the loop silently. `isDirectory()`
+  answers false for a **linked directory** too, so a whole subtree vanished the same way (measured:
+  a link to a directory holding the payload, exit 0). And `--staged` reads content with
+  `git show :<path>`, while git stores a link as its **target path** under mode `120000`, so that
+  route was handed the path text and never the target's bytes. `--staged` is this repo's
+  `pre-commit` hook.
+
+  **Neither route is made to follow the link.** Following would read bytes the enumeration does not
+  control (outside the repo, a loop, a device, a FIFO that blocks the gate forever), and git does not
+  carry those bytes anyway, so a hit on them would be a claim about something no commit contains.
+  The enumeration is narrowed instead: an **in-scope entry that is not a regular file refuses the
+  scan** (exit 2), naming every offender rather than the first. `--staged` now reads
+  `git diff --cached --raw -z` so the destination mode is visible; an unparseable `--raw` record
+  refuses too, because a silently shortened list is exactly what this scan must never report clean
+  over. **Be precise about which mode was blind:** `120000` was the leak. A staged **gitlink**
+  (`160000`) already exited 2 on the base scanner, because `git show :<path>` fails outright on one
+  (`fatal: bad object`, exit 128) and the read-error path caught it. Its refusal is now a named one
+  with a reason instead of a relayed git error, which is an improvement in the message, not the
+  closing of a hole.
+
+  **`--diff-filter=AMT`, not `AM`, and the one-letter difference is what makes the mode check
+  reachable.** Replacing a **tracked** fixture with a link is neither an add nor a modify: git raises
+  it as a typechange, `:100644 120000 <sha> <sha> T`. Measured on git 2.39.5, both
+  `git diff --cached --raw --diff-filter=AM` and `--name-only --diff-filter=AM` print **nothing** for
+  that stage, so the record died before any mode could be read and the hook would have passed a
+  mode-`120000` blob green while this entry claimed it refuses one. Typechange carries a single path,
+  exactly like `A` and `M`, so admitting it costs the two-field record stride nothing, and the
+  reverse typechange (a link replaced by a real file) is now scanned as the file it became.
+
+  **`--no-renames` as well, and the status filter alone was not enough - the gate's first pass
+  claimed otherwise and was refuted by measurement.** Rename detection is on by default, so
+  `git mv <link> test/fixtures/<name>` - an ordinary developer action, no crafted input - stages as
+  `:120000 120000 <sha> <sha> R100` with **two** paths, which `--diff-filter=AMT` then deletes
+  outright: the index held `120000 ... test/fixtures/toplink.txt` and this route printed
+  `OK - no hits` and exited **0**. The first pass disclosed that as out of scope on the grounds that
+  admitting a rename "needs the two-path record shape handled". It does not. With detection off the
+  destination arrives as an ordinary single-path `A` (`:000000 120000 0000000 <sha> A`) and the
+  source as a `D` the filter drops, so the two-field stride is untouched and the entry is refused.
+  It also makes that stride **structural rather than conditional**: with detection off, no `R` or `C`
+  record can be produced whatever the caller's `diff.renames` setting is. The cost is that the
+  destination of an ordinary clean rename into `test/fixtures/` is now scanned where it used to be
+  dropped, which is more coverage rather than less, and is pinned in both directions.
+
+  **The fixture root's own path is in scope too, not just what is under it.** A prefix test requiring
+  the trailing slash let a staged `test/fixtures` through (measured: mode `120000` at exactly that
+  path, exit 0) - the corpus root replaced by a link, so the whole corpus goes unscanned. Git records
+  no index entry for a directory, so that path can only mean a blob, a link or a gitlink, and it is
+  now refused. Only the "never a directory" half is load-bearing; the other three are all handled.
+
+  **A refusal names the entry's own repo-relative path and an engine-owned kind token, never the
+  link target**, which is working-tree text that can itself carry PHI. That is not hypothetical
+  here: on the base scanner, a link whose target filename carried a name and a date made `--staged`
+  exit **1** and print a hit whose value was **the date out of the filename** - a report about the
+  working tree's own text, not about anything the target contained. For the same reason the shape of
+  such a filename is written out in the scanner's docblock rather than exemplified: a diagnostic
+  about a PHI leak is itself a PHI surface, and that applies to the prose explaining it.
+
+  **Almost all of the scope is unchanged, and the two places it moved both admit MORE.** All-mode
+  still walks only `test/fixtures/` and still excludes a gitignored entry, by the same rule that
+  already excludes a gitignored fixture (`git check-ignore` does not answer for a tracked path, so
+  force-adding the link puts it back in scope, and that is pinned). `--staged` still covers only the
+  fixture path, and only the staged records git reports as added, modified or typechanged - a
+  deletion has no staged blob to scan and an unmerged path has no single one, both pre-existing and
+  both stated in the scanner's own banner rather than left to be inferred from the path prefix. The
+  two movements are the rename destination and the root path above; neither widens a route to a new
+  directory, and a link outside either boundary is still left alone, tested in both directions. The
+  `readme.md` exemption deliberately does **not** reach a link: that exemption is a judgement about a
+  file whose bytes the walk could have read, and a link's name is no evidence at all about what is on
+  the other side.
+
+  Pinned in `test/scripts/phi-scan.test.ts` with a synthetic name-bearing payload whose target
+  filename also carries a name, so the no-echo assertions cannot pass by fixture: **13 of the 31
+  cases are red on `0f898be`**, and the four cases covering the three corrections above are red on the
+  first pass of this change as well. The file also carries a negative control asserting the scanner
+  under test is this package's and not a sibling's.
+
+  **Not covered, deliberately, each measured rather than assumed.** Explicit-path mode already read
+  through a link and is unchanged. The **enumerate-then-read race** is untouched:
+  a file that vanishes between `walk()` and `readFileSync` aborts the whole sweep at exit 2, which
+  fails closed and is a different defect from this one. **There is still no rule refusing a scan that
+  observed nothing, and that has a measured instance worth naming rather than leaving abstract:** if
+  `test/fixtures` is itself a DANGLING link, `existsSync` follows it, answers false, and all-mode
+  prints `OK - no hits` and exits **0** over a corpus it never opened (identical on the base
+  scanner). If it is a link to a regular file, `readdirSync` raises an uncaught `ENOTDIR` - noisy and
+  fail-closed, but exit 1, which this contract reserves for "hits found". The `--staged` half of that
+  same shape is closed above; the all-mode half needs the observed-nothing rule, which is its own
+  slice. Also `--allow-fixture <path>` with no positional path still scans **nothing** and
+  prints `OK - no hits` even for a path that does not exist (measured), which makes this suite's
+  existing "honors `--allow-fixture` with an override-log entry" case vacuous. All pre-existing,
+  disclosed rather than fixed here.
+
+  No source, parser, de-identify or public API change.
+
+- **An element whose on-wire VR is not one of the 34 PS3.5 §6.2 defines was kept verbatim by
+  `deidentify()`, carrying a source `(0010,0020)` Patient ID into de-identified output next to the
+  `(0012,0062) PatientIdentityRemoved = YES` this library writes** (`DICOM-CARRIER-LEAF-LEAKS`,
+  mechanism 2; pre-existing, live on the published `0.0.6`, identical on both trees). Re-derived on
+  `scripts/measure-sq-bound-grid.ts` at `35adc2d` before anything changed: **19 leaking cells → 11**.
+  Negative control first - the grid run against `d1031f5`'s `src/` restored **1,174** leaking cells
+  and reproduced `#54`'s published 2,448-cell cost - plus a second control confirming the harness
+  fails outright when pointed at another package.
+
+  **This is the _under_-declare, not the swallow the entry below closed.** An under-declared Value
+  Length desynchronizes the reader: it finishes the short value early, reads the leftover bytes of
+  the value that was actually encoded as the next Data Element header, and consumes the element that
+  genuinely followed as that fabricated element's "value". Measured: a 14-byte carrier
+  under-declaring by 6 yields tag `(4156,554C)` with the VR bytes `"E "`, holding the Patient ID in
+  full, **silently** and with a clean report. It reaches **string** carriers as readily as binary
+  ones, so it is not bounded by the binary-VR story that frames the residual below.
+
+  **The remedy reads a field the parser already recorded, not the bytes.** PS3.5 2026c §6.2: "All
+  new VRs defined in future versions of DICOM shall be of the same Data Element Structure as defined
+  in [§7.1.2] with reserved bytes after the VR and a 32-bit unsigned integer VL". An unrecognized VR
+  is long-form by that rule while this parser reads it short-form (Postel's Law on the read path), so
+  its bytes are not a Value Field this library decoded under any VR and PS3.15 2026c §E.1.1's
+  obligation cannot be discharged inside them. Read from the vendored SHA-pinned documents, pins
+  re-derived, each sentence unique in its document. Such an element is **emptied**,
+  `report.undefinedVrElements` names the **byte offset** and the byte length dropped, and the new
+  `DICOM_DEIDENT_UNDEFINED_VR_NOT_AUDITABLE` is raised. **The finding names no tag, uniquely among
+  the report's findings**: the header _may_ have been fabricated out of the middle of some element's
+  value, in which case its four tag bytes are document content - on a synthetic `ST` carrier holding
+  `"MR BRAIN SMITHSON"` the tag renders as `48544F53`, four letters of the surname. An honestly
+  written unrecognized VR raises the same code with an ordinary tag, and the two are
+  indistinguishable here, so the tag is withheld either way.
+  `renderTag` shape-checks a tag and cannot refuse one, so the withholding happens at the call site.
+  An undefined-VR carrier whose bytes happened to tile was reported in `report.embeddedAttributes`
+  before and now reports here instead. The test is a set-membership check on
+  `el.vr`: O(1), **no scan**. The record is **capped at 64 across the run** and the emptying never is
+  - an undefined-VR element costs an attacker only an 8-byte header, so 1 MiB is 131,072 of them.
+
+  **No carve-out, and structurally so:** `keepOrEmpty` is the only path that keeps a source value
+  verbatim and the test sits at its top, so `RetainSafePrivate` does not exempt an element - pinned
+  by a test. **`UN` is untouched**, being one of the 34, and the rule cannot fire under Implicit VR
+  LE at all, where the VR comes from the dictionary; 0 Implicit VR LE cells moved.
+
+  **Cost, published rather than described:** 23 grid cells lose a marker from de-identified output,
+  **15 of which were not leaking**. On a file conformant to PS3.5 2026c the cost is zero.
+
+  **The root cause is a parse behaviour this slice does not touch, and it is disclosed rather than
+  implied fixed.** §6.2's note says informatively that an unrecognized VR may be handled "by applying
+  the rules stated in [§7.1.2]" - i.e. read long-form, value copied unchanged. This parser reads it
+  **short-form**. Emptying at the de-identify boundary is therefore compensation, not conformance.
+  `PRE-EXISTING`, its own slice. No claim is made here about what a §6.2-conformant future-VR file
+  does on either tree.
+
+  **Still leaking, measured, and now priced:** the 11 remaining cells are the over-declare swallow
+  into a **binary** carrier at `delta=18`. The one candidate remedy was built and measured - it
+  takes 11 to 0 and empties **all 5** conformant binary tiling controls, i.e. deletes a legal
+  `OB`/`UN` value because 8 of its bytes read as a zero-length `(0010,0020)`. That is a product
+  decision, not a bug fix, and it has its own item.
+
+- **A sequence the parser could not open was passed through `deidentify()` as raw bytes, so a
+  `(0010,0020)` Patient ID inside it reached de-identified output next to the
+  `(0012,0062) PatientIdentityRemoved = YES` this library writes** (`DICOM-DEIDENT-RAWBYTES-PASSTHROUGH`,
+  pre-existing and live on the published `0.0.6`). It is the larger half of the 2,127 leaking grid
+  cells the previous entry decomposed: **1,155 of the 6,348 cells that parse**, all Implicit VR LE,
+  all carrying exactly `["DICOM_SQ_NOT_DESCENDED"]`. Re-measured before anything was changed, with a
+  negative control (reverting the previous entry's call site restored exactly 2,127) so the harness
+  is known live rather than assumed.
+
+  When an element resolves to `SQ` from PS3.6 under Implicit VR LE and its defined-length value is
+  not a valid `(FFFE,E000)` item stream, the parser refuses the descent and keeps the declared span
+  on `Element.rawBytes` with `Element.items` undefined. That is right for a parser. It was not safe
+  for `deidentify()`, which recurses only into a sequence whose items exist: for a carrier such as
+  `(0008,1115)` with no Table E.1-1 row, the action table resolved "keep" and the span was re-emitted
+  verbatim, with the report naming nothing.
+
+  **The remedy reads the parser's recorded refusal, not the bytes.** PS3.5 2026c §7.5.1 "Item
+  Encoding Rules" states "Each Item Value shall contain a DICOM Data Set composed of Data Elements",
+  so an `SQ` value is never legitimately opaque the way an `OB` value is; PS3.15 2026c §E.1.1
+  "De-identifier" obliges an implementation claiming the Basic Profile to "protect or retain all
+  instances of the Attributes listed in [Table E.1-1], whether contained in the top level Data Set or
+  embedded in an Item of a Sequence of Items". Unable to enumerate the items, the obligation falls on
+  the carrier, which is the escalation §E.1.1 itself makes for a SOP Instance UID inside a Sequence.
+  Both sentences read from the vendored SHA-pinned documents, pins re-derived, each unique in its
+  document. A **standard** `SQ` with no items is therefore **emptied**,
+  `report.unauditableSequences` names the tag and the byte length dropped, and the new
+  `DICOM_DEIDENT_SEQUENCE_NOT_AUDITABLE` is raised. That record is **capped at 64 across the run**
+  (element count is attacker-chosen too, and `#48` bound every other consumer-controlled
+  diagnostic); the **emptying is never capped**, so an array exactly 64 long means "at least 64". A
+  listed sequence kept by a Retain Option takes the same branch and its audit line now reads
+  `emptied` rather than `kept` - previously it produced an empty sequence anyway while claiming the
+  attribute was retained.
+
+  **It costs content, and the number is published rather than described:** 2,448 grid cells lose a
+  value from their de-identified output, of which **1,293 were not leaking anything** and pay purely
+  for the guarantee. The accompanying `DICOM_SQ_NOT_DESCENDED` says why the parse refused, which is
+  _usually_ a sender defect - but **not always**: a conformant file nested deeper than this
+  library's own `NESTING_DEPTH_LIMIT` of 64 (ours; PS3.5 sets no nesting bound) is refused the same
+  way and loses that sequence too. Because the trigger is `items === undefined` rather than a
+  content test there is no scan, so no cost follows an attacker-chosen value length; the cost tests
+  use a carrier where **every even offset** is a tiling candidate and assert that property rather
+  than describing it, as a **forward tripwire** - this path never traverses those bytes.
+
+  **New surface:** `UnauditableSequenceFinding`, `DeidentifyReport.unauditableSequences`, and
+  `DICOM_DEIDENT_SEQUENCE_NOT_AUDITABLE` (**27 Tier-2 codes, was 26**; snapshot updated
+  deliberately). `DICOM_SQ_NOT_DESCENDED`'s message changed, since it said nested content was
+  invisible to de-identification.
+
+  **Not covered, and one of these is measured here for the first time.** An undefined-length `UN`
+  whose CP-246 descent was refused keeps `vr === "UN"`, and the rule cannot be extended to it because
+  every ordinary `UN` element also has no items - measured on a hand-built file, the identifier still
+  reaches output with no report entry. A **private** `SQ` under `RetainSafePrivate` plus a `Profile`
+  is still kept verbatim, deliberately - `keepsPrivate` decides first, so it never reaches this rule,
+  and measured on a synthetic vendor block the identifier does still reach output. Both carve-outs
+  are pinned by tests. And the **binary-VR carrier** residual the previous entry
+  disclosed but could not measure now has a number: the grid gained an over-declaring **leaf**
+  carrier dimension and finds **19 leaking cells, identical on both trees** - 11 at `delta=18` (the
+  swallow into `OB`/`OW`/`US`/`UN`, silent, with `LO`/`ST` controls on the identical fixture at 0)
+  and 8 at `delta=-6` (an _under_-declare, where leftover bytes are read as a Data Element header and
+  the identifier lands in a manufactured element with an unknown on-wire VR; this one hits string
+  carriers too and was not previously disclosed anywhere).
+
+  **Measured, on the now 76,599-cell grid against `d1031f5`:** sequence-sweep leaks 1,155 → **0**;
+  **0 cells differing in any parse respect**, now a printed count rather than an inference from
+  `changed`, because no parser file is touched; 0 new fatals, 0 lost parse values, 0 reports that
+  lose an attribute, 0 new strict fatals.
+
+- **An element that over-declared its own Value Length swallowed the next element into its value,
+  where the PS3.15 Annex E action table cannot see it, and `deidentify()` wrote the identifier into
+  its output with a clean report** (`DICOM-OVERDECLARE-SWALLOWS-INTO-VALUE`, pre-existing and live
+  on the published `0.0.6`). **No sequence is involved.** PS3.5 2026c defines Value Length as "The
+  length of the Value Field of the Data Element" - that element's own value. A sender that writes a
+  larger number produces a file that is not detectably broken: the reader consumes the declared
+  count, the bytes it over-consumes are the following element header and all, every subsequent
+  offset still lines up, and nothing on the wire says which length field lied. After the swallow
+  there is no `(0010,0020)` in the object for Table E.1-1 to match, only bytes inside some other
+  attribute's value, so de-identification passed over PHI it never recognised as an attribute.
+  Measured on the committed grid at `244a372`: **877 of the 6,348 cells that parse** wrote a source
+  value into de-identified output this way, on Explicit VR LE and Explicit VR BE, **871 of them with
+  no warning on either channel and no throw under `{ strict: true }`**.
+
+  **`parseDicom` is unchanged, deliberately.** The two readings - "the length is right and the value
+  is odd" and "the length lied and the next element was absorbed" - produce identical bytes, so a
+  parser cannot choose between them and this release does not pretend to. `deidentify()` answers a
+  strictly narrower question, and only about values it was about to **keep**: does this value's tail
+  decode, in the file's own transfer syntax, as a complete run of Data Elements ending exactly at the
+  end of the value, at least one of which this run would have acted on, and containing a byte the
+  carrier's VR cannot legally hold (PS3.5 §6.1.3 and Table 6.1-1 permit five C0 control characters in
+  DICOM text; **Table 6.2-1 decides which of the five each VR may hold**, in three tiers)? All three have to hold. If they do, the value is **emptied**
+  rather than kept, a new `DICOM_DEIDENT_EMBEDDED_ATTRIBUTE_REMOVED` warning appears on
+  `report.warnings`, and the new `report.embeddedAttributes` names the carrier, its VR and the tags
+  that were hiding inside it. PS3.15 §E.1 requires a de-identifier to "protect or retain all
+  instances of the Attributes listed in [Table E.1-1]"; §E.3.5 is the standard's own statement that
+  identifying information embedded **inside a string attribute's value** is in scope for removal.
+  Emptying is the fail-safe direction; keeping is not.
+
+  **What this does not cover, stated rather than implied.** Carriers are **string VRs only**, and the
+  residual is live rather than theoretical: the identical over-declare into an `OB`, `OW`, `UN` or
+  `US` carrier still writes the identifier into de-identified output, with **no warning and no report
+  entry**, exactly as before. Arbitrary bytes are what those VRs are for, so no content test can tell
+  a swallow from a legitimate value there, and scanning them would trade a measured guarantee for a
+  coin-flip that deletes real pixel and lookup-table data. The committed grid never puts a binary VR
+  in the over-declaring role, so this residual is **disclosed but unmeasured** and needs its own
+  item. (It was measured later in this same release cycle, by the entry above: **19 grid cells**,
+  once the grid gained an over-declaring leaf carrier.) A sequence the
+  parser declined to descend and kept as opaque bytes is a **different** defect with a different
+  remedy and is untouched here (1,155 grid cells, all Implicit VR LE, all carrying
+  `DICOM_SQ_NOT_DESCENDED`). And nothing here recovers the correct reading of a malformed file: the
+  carrier's parsed value still holds the absorbed bytes, and `ds.get("00100020")` still returns
+  nothing. This closes the leak, not the mis-read.
+
+  **Measured, on the same 76,293-cell grid, against `244a372`:** 2,127 leaking cells → 1,155; every
+  Explicit VR cell → **0**; and **0 cells whose parse differs in any respect** - reading, both
+  warning channels, `{ strict: true }`, and which values survive anywhere in the object are
+  byte-identical, because no parser file is touched. 0 new fatals, 0 lost values, 0 reports that lose
+  an attribute. `scripts/measure-sq-bound-grid.ts`, previously only on an unmerged branch, is
+  committed so every figure above is one command away.
+
 - **A defined-length sequence under Implicit VR Little Endian was never opened, so PHI nested inside
   one survived `deidentify()` into serialized output while the report said it had been removed**
   (`DICOM-IMPLICIT-SQ-NOT-DESCENDED`, pre-existing and live on the published `0.0.5`). The
@@ -249,6 +613,18 @@ All notable changes to `@cosyte/dicom` will be documented in this file. The form
 
 ### Added
 
+- **`UndefinedVrFinding`, `DeidentifyReport.undefinedVrElements` and
+  `DICOM_DEIDENT_UNDEFINED_VR_NOT_AUDITABLE`** (**28 Tier-2 codes, was 27**; the locked
+  `WARNING_CODES` snapshot was updated deliberately). `MAX_UNDEFINED_VR_FINDINGS` (64) caps the
+  record, never the emptying.
+
+- **A conformant-tiling control family in `scripts/measure-sq-bound-grid.ts`**
+  (`LEGIT_TILING_CARRIERS`) plus the `conformant tiling control emptied` counters in `--diff`. It
+  exists to price the remaining binary-carrier leak, which `LEAKING` structurally cannot: a rule that
+  empties every binary value whose tail tiles reads as `11 → 0` there and says nothing about what it
+  destroyed. Restricted to stride-0 VRs, because `buildDicom` byte-swaps `OW`/`US` values under
+  Explicit VR BE - a first draft included them and read 9 emptied rows where the honest number was 6.
+
 - **`DICOM_SQ_NOT_DESCENDED`**, a Tier-2 warning code (25 total, was 24). Public surface: the locked
   `WARNING_CODES` snapshot was updated deliberately, and a profile may `escalate` or `suppress` it
   like any other code.

package/README.md

@@ -207,6 +207,8 @@ const safe = serializeDicom(dataset); // safe to share: input dataset never muta
 
 report.attributes.length; // count of attributes acted on (each carries tag/keyword/action, no values)
 report.warnings; // e.g. DICOM_BURNED_IN_ANNOTATION_NOT_REMOVED
+report.unauditableSequences; // SQ elements emptied because their items could not be walked
+report.undefinedVrElements; // elements emptied because their on-wire VR is not a VR
 ```
 
 UIDs are remapped to deterministic `2.25` replacements that stay consistent across files, so a de-identified study still hangs together. Opt into any of the nine metadata-affecting Annex E Options to keep specific classes of attribute:
@@ -316,7 +318,7 @@ for (const w of ds.warnings) {
 }
 ```
 
-The 25 Tier-2 codes (`DICOM_MISSING_PREAMBLE`, `DICOM_FILE_META_GROUP_LENGTH_MISMATCH`, `DICOM_UN_PARSED_AS_SQ`, `DICOM_ODD_LENGTH_VALUE_PADDED`, `DICOM_PRIVATE_CREATOR_UNKNOWN`, `DICOM_VR_MISMATCH`, `DICOM_DA_LEGACY_FORMAT`, … ) live in [`src/parser/warnings.ts`](./src/parser/warnings.ts). Narrow on `w.code === WARNING_CODES.…` for typo-free comparisons, or pass `{ onWarning }` to `parseDicom` to stream them.
+The 26 Tier-2 codes (`DICOM_MISSING_PREAMBLE`, `DICOM_FILE_META_GROUP_LENGTH_MISMATCH`, `DICOM_UN_PARSED_AS_SQ`, `DICOM_ODD_LENGTH_VALUE_PADDED`, `DICOM_PRIVATE_CREATOR_UNKNOWN`, `DICOM_VR_MISMATCH`, `DICOM_DA_LEGACY_FORMAT`, … ) live in [`src/parser/warnings.ts`](./src/parser/warnings.ts). Narrow on `w.code === WARNING_CODES.…` for typo-free comparisons, or pass `{ onWarning }` to `parseDicom` to stream them.
 
 The 4 Tier-3 fatal codes (`NOT_DICOM_PART_10`, `INVALID_FILE_META`, `UNSUPPORTED_TRANSFER_SYNTAX`, `EMPTY_INPUT`) always throw a `DicomParseError`; they represent input the parser cannot meaningfully recover.
 
@@ -362,7 +364,9 @@ Thrown by `serializeDicom` for `MISSING_TRANSFER_SYNTAX` (the dataset names no t
 
 - **Pixel data.** No decode/decompression, no rendering, no measurements: Pixel Data is exposed as raw bytes. And v1 does not read a **compressed object at all**, not even structurally: a transfer syntax outside the four listed below is the fatal `UNSUPPORTED_TRANSFER_SYNTAX`, so JPEG / JPEG-LS / JPEG2000 / RLE / HTJ2K objects do not parse. → `@cosyte/dicom-pixel`.
 - **Burned-in PHI.** v1 **warns** it cannot remove burned-in annotation; a "de-identified" output is **metadata-de-identified only**.
-- **A sequence the parser could not open.** `deidentify()` recurses only into a sequence whose items the parser materialized, so anything nested inside one it could not read is neither cleaned nor listed in the report. Two shapes reach that state and **only one of them warns**: a defined-length Implicit VR LE value whose dictionary-resolved `SQ` is not an item stream raises `DICOM_SQ_NOT_DESCENDED`, while an undefined-length `UN` value the CP-246 descent could not read as a sequence is **silent** (it keeps `vr === "UN"` and raises nothing). So `ds.warnings` is worth reading but is not sufficient: the reliable test is `el.items === undefined` on an `SQ` or `UN` element you are trusting the report about.
+- **A sequence the parser could not open: content is dropped, not passed through.** `deidentify()` recurses only into a sequence whose items the parser materialized. A **standard** `SQ` element with no items is now **emptied**: its bytes are Data Sets by PS3.5 §7.5.1 and PS3.15 §E.1.1 obliges the de-identifier to reach the listed attributes inside them, so a run that cannot enumerate them must not ship them. `report.unauditableSequences` names the carrier and the byte length dropped (capped at 64 entries; the emptying itself is never capped), and `DICOM_DEIDENT_SEQUENCE_NOT_AUDITABLE` is raised. Expect **data loss** on such a file. The parse refusal is usually a sender-side encoding defect, but not always: a **conformant** file nested deeper than this library's own `NESTING_DEPTH_LIMIT` of 64 is refused the same way and loses that sequence too. **Two shapes are exempt and still leak.** A **private** `SQ` kept under `RetainSafePrivate` + a `Profile` is kept verbatim and unaudited, because the profile vouched for it. And an undefined-length **`UN`** the CP-246 descent could not read as a sequence keeps `vr === "UN"`, so the rule does not reach it and cannot be extended there: every ordinary `UN` element also has no items. For either, the reliable test remains `el.items === undefined` on the element itself.
+- **An element whose on-wire VR is not a VR: the value is dropped, not passed through.** Under an Explicit VR syntax the VR is two bytes the sender wrote and this parser trusts them. If those two bytes are not one of the 34 PS3.5 §6.2 defines, `deidentify()` **empties** the element: §6.2 requires every undefined VR to be long-form with a 32-bit VL, this parser reads it short-form, so those bytes are not a Value Field the library decoded and PS3.15 §E.1.1's obligation cannot be discharged inside them. `report.undefinedVrElements` names the **byte offset** and the byte length dropped (capped at 64 entries; the emptying itself is never capped) and `DICOM_DEIDENT_UNDEFINED_VR_NOT_AUDITABLE` is raised. It names **no tag**, deliberately and uniquely among the report's findings: this header _may_ have been fabricated out of the middle of some element's value, in which case its tag bytes are document content - and nothing distinguishes that case from an honestly-written unrecognized VR, so the tag is withheld either way. The usual cause is an **under**-declared Value Length earlier in the file, which desynchronizes the reader so that leftover value bytes are read as a Data Element header - and the element that genuinely followed becomes the fabricated element's value, which is how a `(0010,0020)` Patient ID used to reach de-identified output. **A file conformant to PS3.5 2026c never trips this**, and an Implicit VR LE file cannot: there the VR comes from the dictionary. (The edition matters: §6.2 exists precisely to say how a _future_ VR will be encoded.) `UN` is one of the 34 and is not affected. **There is no exemption** - unlike the sequence rule above, `RetainSafePrivate` does not keep such an element.
+- **An over-declared Value Length into a binary carrier still leaks, and it is a known trade.** The mirror case - an _over_-declared length that swallows the following element into an `OB`/`OW`/`US`/`UN` value - is **not** detected, and a `(0010,0020)` inside it reaches de-identified output with no warning and no report entry. Arbitrary bytes are exactly what those VRs are for, so no content test can decide it; the only candidate remedy was measured and empties conformant binary values (a legal LUT or blob deleted because 8 of its bytes read as a zero-length `(0010,0020)`). String carriers **are** covered, because there the same bytes are provably outside the VR's repertoire. If you accept files from a sender you do not control, treat a binary attribute's length as untrusted.
 - **Networking & web.** No DIMSE (C-STORE/FIND/MOVE, MWL, MPPS); no DICOMweb (QIDO/WADO/STOW). → `@cosyte/dicom-net`, `@cosyte/dicomweb`.
 - **Transcoding.** No transfer-syntax conversion. The serializer re-emits in the dataset's source syntax only.
 - **Terminology resolution.** Coded values are surfaced (designator + canonical source) but not validated against SNOMED/LOINC/etc.