@ecoma-io/archkeep 0.21.0 → 0.22.1

package/cli.mjs

@@ -923,13 +923,20 @@ async function runDiff(options, { cwd, env }) {
     // the mechanism and the threat it closes.
     const reportText = report.endsWith("\n") ? report : `${report}\n`;
     if (!writeOutputReport(options.output, reportText, env, cwd, options.config)) return EXIT.error;
-    env.err(`archkeep: diff complete → ${options.output}`);
+    // A refused run still writes the report — but "diff complete" would deny
+    // the refusal that report carries (#608).
+    if (result.status === "no-verdict") {
+      env.err(`archkeep: no verdict — the coverage refusal is in the report → ${options.output}`);
+    } else {
+      env.err(`archkeep: diff complete → ${options.output}`);
+    }
   } else {
     env.out(report);
   }
 
-  // Diff is descriptive: 0 when it completes, never 1.
-  return EXIT.ok;
+  // Diff is descriptive: 0 when it completes, never 1 — and an incomplete
+  // head is the structured no-verdict envelope's exit 3, not a clean 0 (#608).
+  return result.status === "ok" ? EXIT.ok : EXIT.error;
 }
 
 /**
@@ -1003,19 +1010,31 @@ async function runDelta(options, { cwd, env }) {
     return usageError ? EXIT.usage : EXIT.error;
   }
 
+  // A coverage-refused compare (#608) answers every `--format` with the
+  // envelope: a withheld verdict has no findings, so there is no SARIF log
+  // and no text table to render — and `result.report.sarif` does not even
+  // exist on the refusal, which would crash the ternary below into a
+  // TypeError where the contract says exit 3.
   const report =
-    options.format === "json"
+    result.status === "no-verdict"
       ? result.report.json
-      : options.format === "sarif"
-        ? result.report.sarif
-        : result.report.text;
+      : options.format === "json"
+        ? result.report.json
+        : options.format === "sarif"
+          ? result.report.sarif
+          : result.report.text;
 
   if (options.output) {
     // Atomic, symlink-safe write — `writeOutputReport`'s own docstring owns
-    // the mechanism and the threat it closes.
+    // the mechanism and the threat it closes. A refused run still writes the
+    // report — but "delta complete" would deny the refusal it carries (#608).
     const reportText = report.endsWith("\n") ? report : `${report}\n`;
     if (!writeOutputReport(options.output, reportText, env, cwd, options.config)) return EXIT.error;
-    env.err(`archkeep: delta complete → ${options.output}`);
+    if (result.status === "no-verdict") {
+      env.err(`archkeep: no verdict — the coverage refusal is in the report → ${options.output}`);
+    } else {
+      env.err(`archkeep: delta complete → ${options.output}`);
+    }
   } else {
     env.out(report);
   }
@@ -1023,8 +1042,10 @@ async function runDelta(options, { cwd, env }) {
   // The event the run recorded, when `--event-out` was given — the store's
   // own `duplicate` answer, so a rerun over the same transition says so
   // instead of implying a second event was appended. Capture mode refuses the
-  // flag upstream; this line runs only for a compare.
-  if (result.eventWrite !== null) {
+  // flag upstream; this line runs only for a compare. Truthy, not `!== null`:
+  // a coverage-refused run (#608) returns no `eventWrite` key at all, and a
+  // truthiness test is the one form that reads both shapes safely.
+  if (result.eventWrite) {
     env.err(
       `archkeep: evolution event ${
         result.eventWrite.duplicate ? "duplicate, already recorded" : "recorded"
@@ -1105,16 +1126,24 @@ async function runDrift(options, { cwd, env }) {
     // `drift` has no `--config` flag (`DRIFT_FLAG_HELP`) — there is no
     // override to pass, only the workspace's un-overridden default to guard.
     if (!writeOutputReport(options.output, reportText, env, cwd, null)) return EXIT.error;
-    env.err(
-      `archkeep: ${result.drift.observed.projects} projects, ${result.drift.observed.edges} edges ` +
-        `→ ${options.output}`,
-    );
+    // A refused run carries no `drift` payload to summarize — the numbers
+    // would be `undefined` — so the stderr line names the refusal instead.
+    if (result.status === "no-verdict") {
+      env.err(`archkeep: no verdict — the coverage refusal is in the report → ${options.output}`);
+    } else {
+      env.err(
+        `archkeep: ${result.drift.observed.projects} projects, ${result.drift.observed.edges} edges ` +
+          `→ ${options.output}`,
+      );
+    }
   } else {
     env.out(report);
   }
 
-  // Drift is descriptive: 0 when the comparison completes, never 1.
-  return EXIT.ok;
+  // Drift is descriptive: 0 when the comparison completes, never 1 — and an
+  // incomplete analysis is the structured no-verdict envelope's exit 3
+  // (#608), not a clean 0.
+  return result.status === "ok" ? EXIT.ok : EXIT.error;
 }
 
 /**
@@ -1212,16 +1241,22 @@ async function runReconcile(options, { cwd, env }) {
     // `reconcile` has no `--config` flag (`RECONCILE_FLAG_HELP`) — there is no
     // override to pass, only the workspace's un-overridden default to guard.
     if (!writeOutputReport(options.output, reportText, env, cwd, null)) return EXIT.error;
-    env.err(
-      `archkeep: ${result.reconcile.observed.projects} projects, ${result.reconcile.observed.edges} edges ` +
-        `→ ${options.output}`,
-    );
+    // A refused run carries no `reconcile` payload to summarize (#608).
+    if (result.status === "no-verdict") {
+      env.err(`archkeep: no verdict — the coverage refusal is in the report → ${options.output}`);
+    } else {
+      env.err(
+        `archkeep: ${result.reconcile.observed.projects} projects, ${result.reconcile.observed.edges} edges ` +
+          `→ ${options.output}`,
+      );
+    }
   } else {
     env.out(report);
   }
 
-  // Reconcile is descriptive: 0 when the comparison completes, never 1.
-  return EXIT.ok;
+  // Reconcile is descriptive: 0 when the comparison completes, never 1 — and
+  // an incomplete analysis is the no-verdict envelope's exit 3 (#608).
+  return result.status === "ok" ? EXIT.ok : EXIT.error;
 }
 
 /**
@@ -1320,12 +1355,18 @@ async function runChange(options, { cwd, env }) {
     // the mechanism and the threat it closes.
     const reportText = report.endsWith("\n") ? report : `${report}\n`;
     if (!writeOutputReport(options.output, reportText, env, cwd, options.config)) return EXIT.error;
-    env.err(
-      `archkeep: change ${result.changeIntent.reconciliation.verdict} ` +
-        `(+${result.changeIntent.reconciliation.matched.length} matched, ` +
-        `!${result.changeIntent.reconciliation.unexpected.length} undeclared, ` +
-        `?${result.changeIntent.reconciliation.missingExpected.length} unfulfilled) → ${options.output}`,
-    );
+    // A coverage-refused run carries no `changeIntent` payload to summarize
+    // (#608) — the refusal's own clause list is in the written report.
+    if (result.status === "no-verdict") {
+      env.err(`archkeep: no verdict — the coverage refusal is in the report → ${options.output}`);
+    } else {
+      env.err(
+        `archkeep: change ${result.changeIntent.reconciliation.verdict} ` +
+          `(+${result.changeIntent.reconciliation.matched.length} matched, ` +
+          `!${result.changeIntent.reconciliation.unexpected.length} undeclared, ` +
+          `?${result.changeIntent.reconciliation.missingExpected.length} unfulfilled) → ${options.output}`,
+      );
+    }
   } else {
     env.out(report);
   }
@@ -1396,22 +1437,29 @@ async function runWaivers(options, { cwd, env }) {
     // only glances at this confirmation must not see "N waivers on the
     // table" and conclude that is the whole surface when a
     // `boundarySuppressions` row with no `expiresAt` is hiding something the
-    // file --output just wrote down.
-    const suppressionNote =
-      result.waivers.suppressions.length > 0
-        ? `, ${result.waivers.suppressions.length} permanent suppression` +
-          `${result.waivers.suppressions.length === 1 ? "" : "s"}`
-        : "";
-    env.err(
-      `archkeep: ${result.waivers.waivers.length} waivers${suppressionNote} on the table ` +
-        `→ ${options.output}`,
-    );
+    // file --output just wrote down. A coverage-refused run carries no
+    // `waivers` payload at all (#608) — the line names the refusal instead.
+    if (result.status === "no-verdict") {
+      env.err(`archkeep: no verdict — the coverage refusal is in the report → ${options.output}`);
+    } else {
+      const suppressionNote =
+        result.waivers.suppressions.length > 0
+          ? `, ${result.waivers.suppressions.length} permanent suppression` +
+            `${result.waivers.suppressions.length === 1 ? "" : "s"}`
+          : "";
+      env.err(
+        `archkeep: ${result.waivers.waivers.length} waivers${suppressionNote} on the table ` +
+          `→ ${options.output}`,
+      );
+    }
   } else {
     env.out(report);
   }
 
-  // Waivers is descriptive: 0 when the surface could be read, never 1.
-  return EXIT.ok;
+  // Waivers is descriptive: 0 when the surface could be read, never 1 — and
+  // an incomplete analysis is the no-verdict envelope's exit 3 (#608), the
+  // same tree `check` refuses.
+  return result.status === "ok" ? EXIT.ok : EXIT.error;
 }
 
 /**
@@ -1469,11 +1517,16 @@ async function runFitness(options, { cwd, env }) {
     // the mechanism and the threat it closes.
     const reportText = report.endsWith("\n") ? report : `${report}\n`;
     if (!writeOutputReport(options.output, reportText, env, cwd, options.config)) return EXIT.error;
-    env.err(
-      `archkeep: ${result.fitness.functions.length} fitness function` +
-        `${result.fitness.functions.length === 1 ? "" : "s"} judged (${result.fitness.verdict}) ` +
-        `→ ${options.output}`,
-    );
+    // A coverage-refused run carries no `fitness` payload to summarize (#608).
+    if (result.status === "no-verdict") {
+      env.err(`archkeep: no verdict — the coverage refusal is in the report → ${options.output}`);
+    } else {
+      env.err(
+        `archkeep: ${result.fitness.functions.length} fitness function` +
+          `${result.fitness.functions.length === 1 ? "" : "s"} judged (${result.fitness.verdict}) ` +
+          `→ ${options.output}`,
+      );
+    }
   } else {
     env.out(report);
   }
@@ -1535,18 +1588,24 @@ async function runImpact(options, { cwd, env }) {
     // the mechanism and the threat it closes.
     const reportText = report.endsWith("\n") ? report : `${report}\n`;
     if (!writeOutputReport(options.output, reportText, env, cwd, options.config)) return EXIT.error;
-    env.err(
-      `archkeep: ${result.impact.dependents.length} project` +
-        `${result.impact.dependents.length === 1 ? "" : "s"}` +
-        `${result.impact.dependents.length === 1 ? " depends" : " depend"} on ${projectName} ` +
-        `→ ${options.output}`,
-    );
+    // A coverage-refused run carries no `impact` payload to summarize (#608).
+    if (result.status === "no-verdict") {
+      env.err(`archkeep: no verdict — the coverage refusal is in the report → ${options.output}`);
+    } else {
+      env.err(
+        `archkeep: ${result.impact.dependents.length} project` +
+          `${result.impact.dependents.length === 1 ? "" : "s"}` +
+          `${result.impact.dependents.length === 1 ? " depends" : " depend"} on ${projectName} ` +
+          `→ ${options.output}`,
+      );
+    }
   } else {
     env.out(report);
   }
 
-  // Impact is descriptive: 0 when it completes, never 1.
-  return EXIT.ok;
+  // Impact is descriptive: 0 when it completes, never 1 — and an incomplete
+  // analysis is the no-verdict envelope's exit 3 (#608).
+  return result.status === "ok" ? EXIT.ok : EXIT.error;
 }
 /**
  * `scenario`'s `run`: resolves the command context, reads the scenario file,
@@ -1606,13 +1665,20 @@ async function runScenario(options, { cwd, env }) {
 
   if (options.output) {
     if (!writeOutputReport(options.output, report, env, cwd, options.config)) return EXIT.error;
-    env.err(`archkeep: scenario for "${projectName}" complete → ${options.output}`);
+    // A refused run still writes the report — but "complete" would deny the
+    // refusal that report carries (#608).
+    if (result.status === "no-verdict") {
+      env.err(`archkeep: no verdict — the coverage refusal is in the report → ${options.output}`);
+    } else {
+      env.err(`archkeep: scenario for "${projectName}" complete → ${options.output}`);
+    }
   } else {
     env.out(report);
   }
 
-  // Scenario is descriptive: 0 when it completes, never 1.
-  return EXIT.ok;
+  // Scenario is descriptive: 0 when it completes, never 1 — and an incomplete
+  // analysis is the no-verdict envelope's exit 3 (#608).
+  return result.status === "ok" ? EXIT.ok : EXIT.error;
 }
 
 /**
@@ -2259,16 +2325,22 @@ async function runDebt(options, { cwd, env }) {
     // the mechanism and the threat it closes.
     const reportText = report.endsWith("\n") ? report : `${report}\n`;
     if (!writeOutputReport(options.output, reportText, env, cwd, options.config)) return EXIT.error;
-    env.err(
-      `archkeep: ${result.ledger.total} debt entr` +
-        `${result.ledger.total === 1 ? "y" : "ies"} → ${options.output}`,
-    );
+    // A coverage-refused run carries no `ledger` payload to summarize (#608).
+    if (result.status === "no-verdict") {
+      env.err(`archkeep: no verdict — the coverage refusal is in the report → ${options.output}`);
+    } else {
+      env.err(
+        `archkeep: ${result.ledger.total} debt entr` +
+          `${result.ledger.total === 1 ? "y" : "ies"} → ${options.output}`,
+      );
+    }
   } else {
     env.out(report);
   }
 
-  // Debt is descriptive: 0 when the ledger completes, never 1.
-  return EXIT.ok;
+  // Debt is descriptive: 0 when the ledger completes, never 1 — and an
+  // incomplete analysis is the no-verdict envelope's exit 3 (#608).
+  return result.status === "ok" ? EXIT.ok : EXIT.error;
 }
 
 /**
@@ -2330,10 +2402,27 @@ async function runDiscover(options, { cwd, env }) {
   }
 
   if (options.writeIntent) {
+    // The one write that can turn a proposal into the law `check` gates on,
+    // so it refuses to replace: a file already at the target is a law (or a
+    // candidate someone holds), and silently overwriting it with a proposal
+    // is the adoption this command must never perform by itself. Move or
+    // delete the file first — a step a human reviews.
+    if (existsSync(options.writeIntent)) {
+      env.err(
+        `archkeep: ${options.writeIntent} already exists, and a proposal must never ` +
+          `silently replace what is there. Move or delete the file first, then run this again.`,
+      );
+      return EXIT.error;
+    }
     try {
       const intentJson = JSON.stringify(proposalToIntent(result.proposal), null, 2) + "\n";
-      writeFileSync(options.writeIntent, intentJson, "utf-8");
+      // `wx` refuses the file materializing between the check above and this
+      // write, so the refusal above cannot be raced past.
+      writeFileSync(options.writeIntent, intentJson, { encoding: "utf-8", flag: "wx" });
       env.err(`archkeep: proposed architecture written to ${options.writeIntent}`);
+      env.err(
+        "archkeep: this file is a proposal, not the law — review it as a diff before it governs anything.",
+      );
     } catch (error) {
       env.err(`archkeep: failed to write intent file: ${error.message}`);
       return EXIT.error;
@@ -2799,8 +2888,9 @@ const DISCOVER_FLAG_HELP = Object.freeze([
     describe: Object.freeze([
       "Write the proposed components and rules to a valid",
       "architecture-intent.json file. Only valid with --propose;",
-      "the file is a candidate for drift/reconcile and must be",
-      "reviewed before use",
+      "refuses to overwrite a file that already exists — the file",
+      "is a candidate for drift/reconcile and must be reviewed",
+      "before use",
     ]),
   }),
   Object.freeze({

package/gate-attestation.mjs

@@ -0,0 +1,23 @@
+/**
+ * The gate-attestation verifier's public face — what a consumer imports from
+ * this package's `./gate-attestation` subpath to validate an attestation with
+ * the version it actually installed.
+ *
+ * It holds no logic on purpose, the same bargain `./commands` (`commands.mjs`)
+ * and `./nx` (`nx.mjs`) make: a named entry that is a re-export, so the
+ * verifier can grow under `src/` without a second copy of any decision
+ * appearing beside it.
+ *
+ * ```js
+ * import { validateGateAttestation, readGateAttestation }
+ *   from "@ecoma-io/archkeep/gate-attestation";
+ * ```
+ */
+export {
+  ATTESTED_PACKAGE,
+  GATE_ATTESTATION_SCHEMA_VERSION,
+  readGateAttestation,
+  reachesCheckVerdict,
+  validateGateAttestation,
+  verifiedAdopters,
+} from "./src/verify-gate-attestation.mjs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ecoma-io/archkeep",
-  "version": "0.21.0",
+  "version": "0.22.1",
   "description": "Architecture enforcement for polyglot repositories — dependency graphs and module boundaries for Go, Rust, Python, TypeScript, JavaScript, Vue, Java and Kotlin",
   "keywords": [
     "architecture",
@@ -29,6 +29,7 @@
     ".": "./index.mjs",
     "./nx": "./nx.mjs",
     "./commands": "./commands.mjs",
+    "./gate-attestation": "./gate-attestation.mjs",
     "./presets/*.json": "./presets/*.json",
     "./package.json": "./package.json"
   },
@@ -36,6 +37,7 @@
     "index.mjs",
     "nx.mjs",
     "commands.mjs",
+    "gate-attestation.mjs",
     "cli.mjs",
     "lsp.mjs",
     "src/",

package/src/analysis/analyze.mjs

@@ -121,6 +121,12 @@ export { LANGUAGE_BY_EXTENSION, languageOf };
  *   the file as a whole rather than one position.
  * @property {number|null} column 1-based, or `null`.
  * @property {string} reason Human-readable; written to be read in a report.
+ * @property {true} [dynamic] The site's target is computed at runtime — the
+ *   language itself declines a static answer. Disclosed without withholding
+ *   (`isDynamicSiteFailure`).
+ * @property {true} [external] The site names the external dependency universe
+ *   rather than the governed graph. Disclosed without withholding
+ *   (`isExternalSiteFailure`); every analyzer sets it (#603).
  */
 
 /**

package/src/analysis/contract.md

@@ -160,16 +160,36 @@ which one it was:
 - A **literal package import that names no declared project** — an uninstalled
   third-party package, a dependency of some other workspace — is a normal,
   permanent state: a workspace with packages is not a missing workspace edge.
-  It stays a POSITIONED failure (`line`/`column` set), the "blind spot" that
-  does not fail the run.
+  It stays a POSITIONED failure (`line`/`column` set), the "blind spot", and
+  it carries `external: true`: the specifier asked the external dependency
+  universe, not the governed graph, and its resolvability is a property of
+  the installed dependency tree a workspace legitimately may not have (a
+  fresh clone, a trimmed install, the native self-check's `git archive`
+  copy). Disclosed, verdict-neutral — withholding over it would make a tree
+  permanently un-green over dependencies nobody crossed.
+- A **literal that references the workspace's own surface and still fails to
+  resolve** — a path-like specifier (`./`, `../`, `/`), a `#` subpath, a
+  `paths` alias — is the other positioned class, and the one that withholds
+  the run's verdict since the loud-coverage contract (#595): the resolver was
+  asked a concrete question about the governed graph and could not answer,
+  and #595's own reported shape (`#canary-review/index.mjs`, a subpath naming
+  a declared project) is exactly this class — `packageNameOf` keeps the `#`,
+  so the whole-file name test cannot catch it. `check` exits 3 over it
+  rather than reading as a pass.
 - A **dynamic import with a non-literal argument** — `import(somePath)`, or an
   `import()` whose argument is a template literal interpolating a variable — is
   the recurring permanent case. The site is real, the target is not knowable
   statically, and the honest answer is one record with `kind: "dynamic"`, the
   source text of the argument as `specifier`, and a POSITIONED failure
-  (`line`/`column` set). The rest of the file's imports were still judged; a
-  reader can see this one site in the report's blind-spot section and the run
-  does not fail on it.
+  (`line`/`column` set) carrying `dynamic: true`. The rest of the file's
+  imports were still judged; a reader can see this one site in the report's
+  blind-spot section. It does not withhold the verdict: a non-literal argument
+  is the language itself declaring the target computed at runtime, a limit
+  static analysis cannot close, so the run's pass claim covers the statically
+  judgeable surface. The `dynamic` field is what keeps the envelope builder
+  from reading this row as unjudged work (`report/json.mjs`'s completeness
+  law) — the permanent classes are disclosed alike and judged differently,
+  and the fields are the only things that tell them apart.
 
 Silently dropping any of them is how a boundary gets bypassed.
 
@@ -207,6 +227,13 @@ fails loudly rather than reporting an empty result that reads as "clean".
 
 `failures` carries `{ sourceFile, line, column, reason }`; `line`/`column` are
 `null` when the failure is about the file as a whole rather than one position.
+A positioned failure produced from a non-literal `import()`/`require()`
+argument additionally carries `dynamic: true`, and one produced from an
+unresolvable bare-package specifier carries `external: true` — the fields the
+verdict and envelope layers read to tell the declared dynamic limit and the
+external dependency universe apart from an unresolvable specifier that
+references the workspace's own surface, which is the class that withholds the
+verdict.
 Both arrays are always present and always arrays — a consumer never has to
 check for `undefined` before iterating.
 

package/src/analysis/csharp.mjs

@@ -429,6 +429,24 @@ export function analyzeCSharp({ sourceFile, text, workspace }) {
             external: true,
             packageName: site.importableName,
           };
+          // The bare-coordinate class the contract discloses without
+          // withholding (#603): the namespace names the external dependency
+          // universe, not the governed graph, so the site is DISCLOSED — a
+          // positioned row carrying `external: true`
+          // (`isExternalSiteFailure`), the run's verdict untouched — rather
+          // than swallowed, the same classification the TypeScript analyzer
+          // already emits. A name a tracked namespace claims resolved through
+          // the index above and never reaches this branch; the split-package
+          // branch below keeps withholding. The `importableName === null`
+          // arm above is the extern-alias construct, not an unresolvable
+          // coordinate, and stays unfailed.
+          result.failures.push({
+            sourceFile,
+            line,
+            column,
+            reason: `C# cannot resolve '${site.importableName}' from '${sourceFile}'`,
+            external: true,
+          });
         } else if (resolved.ambiguous) {
           resolution = null;
           result.failures.push({

package/src/analysis/go.mjs

@@ -704,6 +704,24 @@ export function analyzeGo({ sourceFile, text, workspace }) {
           packageName: target === null ? site.specifier : null,
         },
       });
+      // The bare-module class the contract discloses without withholding
+      // (#603): the import names the external dependency universe, not the
+      // governed graph, so the site is DISCLOSED — a positioned row carrying
+      // `external: true` (`isExternalSiteFailure`), the run's verdict
+      // untouched — rather than swallowed. An empty blind-spot list must mean
+      // "nothing to disclose", and a workspace whose imports reach outside it
+      // has things to disclose. An import naming a declared module resolved
+      // above and never reaches this branch; the same classification the
+      // TypeScript analyzer already emits.
+      if (target === null) {
+        result.failures.push({
+          sourceFile,
+          line,
+          column,
+          reason: `Go cannot resolve '${site.specifier}' from '${sourceFile}'`,
+          external: true,
+        });
+      }
     }
   } catch (cause) {
     result.failures.push(fileFailure(sourceFile, `Go analysis failed: ${cause?.message ?? cause}`));

package/src/analysis/java.mjs

@@ -235,6 +235,21 @@ export function analyzeJava({ sourceFile, text, workspace }) {
           external: true,
           packageName: site.importableName,
         };
+        // The bare-coordinate class the contract discloses without withholding
+        // (#603): the dotted name names the external dependency universe, not
+        // the governed graph, so the site is DISCLOSED — a positioned row
+        // carrying `external: true` (`isExternalSiteFailure`), the run's
+        // verdict untouched — rather than swallowed, the same classification
+        // the TypeScript analyzer already emits. A name a tracked package
+        // prefix claims resolved through the index above and never reaches
+        // this branch; the split-package branch below keeps withholding.
+        result.failures.push({
+          sourceFile,
+          line,
+          column,
+          reason: `Java cannot resolve '${site.importableName}' from '${sourceFile}'`,
+          external: true,
+        });
       } else if (resolved.ambiguous) {
         // Split package: unresolvable by static reading, so `resolved` is
         // null WITH a positioned failure naming every claimant — the Python

package/src/analysis/kotlin.mjs

@@ -184,6 +184,21 @@ export function analyzeKotlin({ sourceFile, text, workspace }) {
           external: true,
           packageName: site.importableName,
         };
+        // The bare-coordinate class the contract discloses without withholding
+        // (#603): the dotted name names the external dependency universe, not
+        // the governed graph, so the site is DISCLOSED — a positioned row
+        // carrying `external: true` (`isExternalSiteFailure`), the run's
+        // verdict untouched — rather than swallowed, the same classification
+        // the TypeScript analyzer already emits. A name a tracked package
+        // prefix claims resolved through the index above and never reaches
+        // this branch; the split-package branch below keeps withholding.
+        result.failures.push({
+          sourceFile,
+          line,
+          column,
+          reason: `Kotlin cannot resolve '${site.importableName}' from '${sourceFile}'`,
+          external: true,
+        });
       } else if (resolved.ambiguous) {
         resolution = null;
         result.failures.push({

package/src/analysis/python.mjs

@@ -1243,10 +1243,15 @@ export function analyzePython({ sourceFile, text, workspace }) {
           continue;
         }
         if (!site.literal) {
-          fail(
-            `dynamic import of '${site.specifier}' has a non-literal argument, ` +
+          result.failures.push({
+            sourceFile,
+            line,
+            column,
+            reason:
+              `dynamic import of '${site.specifier}' has a non-literal argument, ` +
               `so its target is not knowable statically`,
-          );
+            dynamic: true,
+          });
           continue;
         }
 
@@ -1293,6 +1298,23 @@ export function analyzePython({ sourceFile, text, workspace }) {
             external: true,
             packageName: absolute.split(".")[0],
           };
+          // The bare-package class the contract discloses without withholding
+          // (#603): every layout is modelled and the name still reaches no
+          // tracked package, so the external answer is the language's, and the
+          // site is DISCLOSED — a positioned row carrying `external: true`
+          // (`isExternalSiteFailure`), the run's verdict untouched — rather
+          // than swallowed, the same classification the TypeScript analyzer
+          // already emits. The unmodelled branch above keeps withholding,
+          // because there the external answer is NOT the language's; the
+          // relative-import and ambiguous branches keep withholding because
+          // those names the workspace's own surface.
+          result.failures.push({
+            sourceFile,
+            line,
+            column,
+            reason: `Python cannot resolve '${site.specifier}' from '${sourceFile}'`,
+            external: true,
+          });
         } else if (resolution.ambiguous) {
           fail(
             `'${site.specifier}' resolves through the namespace package '${resolution.prefix}', which ` +

package/src/analysis/rust.mjs

@@ -804,6 +804,24 @@ export function analyzeRust({ sourceFile, text, workspace }) {
           // so a `bannedExternalImports` glob is written against this form.
           packageName: target === null ? site.root : null,
         };
+        // The bare-crate class the contract discloses without withholding
+        // (#603): the `use` names the external dependency universe, not the
+        // governed graph, so the site is DISCLOSED — a positioned row carrying
+        // `external: true` (`isExternalSiteFailure`), the run's verdict
+        // untouched — rather than swallowed, the same classification the
+        // TypeScript analyzer already emits. A name a workspace crate declares
+        // resolved above and never reaches this branch; the brace-group
+        // malformation above keeps withholding, because there the name itself
+        // was never read.
+        if (target === null) {
+          result.failures.push({
+            sourceFile,
+            line,
+            column,
+            reason: `Rust cannot resolve '${site.specifier}' from '${sourceFile}'`,
+            external: true,
+          });
+        }
       }
       result.imports.push({
         sourceFile,