@intentius/tsad-conformance 1.4.0 → 1.6.0

package/src/adapters/chant.ts

@@ -10,7 +10,8 @@ import { dirname, join } from "node:path";
 import { createRequire } from "node:module";
 import * as ts from "typescript";
 import * as chant from "@intentius/chant";
-import type { ConformanceAdapter, ProjectResult, ProjectVerdict } from "../adapter.js";
+import type { ConformanceAdapter, Finding, IsolationMode, ProjectResult, ProjectVerdict, RulePhase, Severity } from "../adapter.js";
+import type { ConformanceHost } from "../host.js";
 
 function exportInitializer(sf: ts.SourceFile, name: string): ts.Expression | undefined {
   for (const st of sf.statements) {
@@ -53,14 +54,197 @@ type ChantVerdict = {
   taintedBy?: { from: string; kind: "importer" | "capture" };
   exports?: ReadonlyMap<string, unknown>;
 };
+/**
+ * Whether the pinned chant takes `FoldProjectOptions.lexiconPackages`
+ * (chant#2438).
+ *
+ * Probed, not inferred from a version string. An older pin ignores an unknown
+ * option silently, so every hosted fixture would come back `run` and read as a
+ * real disagreement rather than as a missing feature. The probe is the smallest
+ * possible instance of the thing itself: one file importing one generated
+ * package. Memoized, since every hosted fixture asks.
+ */
+/** chant's post-synthesis engine, which is what runs the host's rules (#101). */
+const runChecks = (
+  chant as unknown as {
+    runPostSynthChecks?: (
+      checks: unknown[],
+      buildResult: { outputs: Map<string, string>; entities: Map<string, unknown> },
+    ) => Array<{ checkId: string; severity: string; message: string; entity?: string }>;
+  }
+).runPostSynthChecks;
+
+let hostPackageSupport: Promise<boolean> | undefined;
+
+function acceptsHostPackages(): Promise<boolean> {
+  hostPackageSupport ??= (async () => {
+    if (!projectFn) return false;
+    const root = mkdtempSync(join(tmpdir(), "tsad-probe-"));
+    try {
+      const dir = join(root, "node_modules", "@tsad", "probe");
+      mkdirSync(dir, { recursive: true });
+      writeFileSync(
+        join(dir, "package.json"),
+        JSON.stringify({ name: "@tsad/probe", version: "0.0.0", type: "module", main: "index.js" }),
+        "utf8",
+      );
+      writeFileSync(join(dir, "index.js"), "export const PROBE = 1;\n", "utf8");
+      const file = join(root, "probe.ts");
+      writeFileSync(file, 'import { PROBE } from "@tsad/probe";\nexport const p = PROBE;\n', "utf8");
+      const verdicts = await projectFn([file], [], { lexiconPackages: ["@tsad/probe"] });
+      return verdicts.get(file)?.verdict === "fold";
+    } catch {
+      return false;
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  })();
+  return hostPackageSupport;
+}
+
+/**
+ * Does this chant interpret a composite the HOST registered, under sandbox?
+ *
+ * chant#2442, fixed in chant-v0.72.1. Before it, `findCompositeDefinition`
+ * required `Composite` to be chant's own, so a host's registration form was
+ * never recognised; and recognising it was not enough on its own, because
+ * chant wrapped the host's members in its own `Composite`, whose member
+ * validation asks for chant's `Declarable` and refused an entity carrying a
+ * different marker.
+ *
+ * Both halves are exercised here: the fixture folds only if the form is
+ * recognised AND the host's own entity survives, and it runs under `sandbox`
+ * so a chant that fell through to invocation reports `run` rather than
+ * folding by the wrong route.
+ */
+let hostCompositeSupport: Promise<boolean> | undefined;
+
+function interpretsHostComposites(): Promise<boolean> {
+  hostCompositeSupport ??= (async () => {
+    if (!projectFn) return false;
+    const root = mkdtempSync(join(tmpdir(), "tsad-probe-composite-"));
+    try {
+      const dir = join(root, "node_modules", "@tsad", "probe-composite");
+      mkdirSync(dir, { recursive: true });
+      writeFileSync(
+        join(dir, "package.json"),
+        JSON.stringify({ name: "@tsad/probe-composite", version: "0.0.0", type: "module", main: "index.js" }),
+        "utf8",
+      );
+      writeFileSync(
+        join(dir, "index.js"),
+        [
+          "const MARK = Symbol.for('tsad.conformance.declarable');",
+          "export class Thing {",
+          "  constructor(props = {}) {",
+          "    this.entityType = 'Thing'; this.props = props;",
+          "    Object.defineProperty(this, MARK, { value: true, enumerable: false });",
+          "  }",
+          "}",
+          "export function Composite(factory, name) {",
+          "  const d = (props) => factory(props); d.compositeName = name; return d;",
+          "}",
+        ].join("\n") + "\n",
+        "utf8",
+      );
+      const defs = join(root, "defs.ts");
+      writeFileSync(
+        defs,
+        'import { Thing, Composite } from "@tsad/probe-composite";\n' +
+          'export const C = Composite(({ n }) => ({ t: new Thing({ n }) }), "C");\n',
+        "utf8",
+      );
+      const file = join(root, "probe.ts");
+      writeFileSync(file, 'import { C } from "./defs";\nexport const c = C({ n: "x" });\n', "utf8");
+      const verdicts = await projectFn([file], [], {
+        lexiconPackages: ["@tsad/probe-composite"],
+        sandbox: true,
+      });
+      return verdicts.get(file)?.verdict === "fold";
+    } catch {
+      return false;
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  })();
+  return hostCompositeSupport;
+}
+
 const projectFn = (
   chant as unknown as {
-    foldProject?: (files: readonly string[], intrinsics?: readonly unknown[]) => Promise<Map<string, ChantVerdict>>;
+    foldProject?: (
+      files: readonly string[],
+      intrinsics?: readonly unknown[],
+      options?: { lexiconPackages?: readonly string[]; sandbox?: boolean },
+    ) => Promise<Map<string, ChantVerdict>>;
   }
 ).foldProject;
 
+/**
+ * The key a generated host package reads its values back out of (#2438).
+ *
+ * A host's values are live JavaScript — classes revival must `new`, functions
+ * it must call — so the package written next to a fixture cannot be their
+ * source. It reads them off the process instead, which is sound because chant
+ * imports it in this same process.
+ */
+const HOST_VALUES = Symbol.for("tsad.conformance.hostValues");
+
+/**
+ * Write the host's packages into `root/node_modules`, so chant's own module
+ * resolution finds them from the fixture sources (#2438).
+ *
+ * Returns the specifiers written, which is what chant has to be told to follow
+ * a bare import into: its allowlist is `@intentius/chant-lexicon-*` unless a
+ * caller names a package outright, and `@tsad/shapes` is not that shape.
+ */
+function installHost(root: string, host: ConformanceHost): string[] {
+  const globals = (globalThis as Record<symbol, unknown>)[HOST_VALUES] as
+    | Map<string, ReadonlyMap<string, unknown>>
+    | undefined;
+  const registry = globals ?? new Map<string, ReadonlyMap<string, unknown>>();
+  (globalThis as Record<symbol, unknown>)[HOST_VALUES] = registry;
+
+  const specifiers: string[] = [];
+  for (const [specifier, values] of host.values) {
+    registry.set(specifier, values);
+    const dir = join(root, "node_modules", ...specifier.split("/"));
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(
+      join(dir, "package.json"),
+      JSON.stringify({ name: specifier, version: "0.0.0", type: "module", main: "index.js" }),
+      "utf8",
+    );
+    // One binding per export, read back from the process. `export const` with a
+    // computed initializer is still a static export, so a named import of it
+    // resolves exactly as it would from a hand-written module.
+    const lines = [
+      `const values = globalThis[Symbol.for(${JSON.stringify("tsad.conformance.hostValues")})].get(${JSON.stringify(specifier)});`,
+      ...[...values.keys()].map((name) => `export const ${name} = values.get(${JSON.stringify(name)});`),
+    ];
+    writeFileSync(join(dir, "index.js"), lines.join("\n") + "\n", "utf8");
+    specifiers.push(specifier);
+  }
+  return specifiers;
+}
+
+/** The host's registered intrinsics, in chant's own `IntrinsicDef` shape (#2438). */
+function hostIntrinsics(host: ConformanceHost): unknown[] {
+  return host.intrinsics.map((i) => ({
+    name: i.name,
+    isTag: i.isTag,
+    ...(i.foldsAsCall ? { foldsAsCall: true } : {}),
+    ...(i.foldsEagerly ? { foldsEagerly: true } : {}),
+    ...(i.outputKey ? { outputKey: i.outputKey } : {}),
+  }));
+}
+
 /** chant resolves modules from disk, so a fixture's sources are written out and the paths handed over. */
-async function foldOnDisk(files: Map<string, string>): Promise<ProjectResult> {
+async function foldOnDisk(
+  files: Map<string, string>,
+  host?: ConformanceHost,
+  mode?: IsolationMode,
+): Promise<ProjectResult> {
   const root = mkdtempSync(join(tmpdir(), "tsad-conformance-"));
   try {
     const paths: string[] = [];
@@ -70,7 +254,15 @@ async function foldOnDisk(files: Map<string, string>): Promise<ProjectResult> {
       writeFileSync(abs, source, "utf8");
       paths.push(abs);
     }
-    const verdicts = await projectFn!(paths, []);
+    const lexiconPackages = host ? installHost(root, host) : [];
+    const verdicts = await projectFn!(paths, host ? hostIntrinsics(host) : [], {
+      lexiconPackages,
+      // tsad#113 — `isolated` means "do not invoke". chant's `--sandbox`
+      // (chant#1093) is the setting that refuses to import project code, which
+      // is F-Call step 5 firing so step 6 never runs. It leaves interpretation
+      // alone, so the interpretable factories still fold.
+      ...(mode === "isolated" ? { sandbox: true } : {}),
+    });
     const out: ProjectResult = { verdicts: {}, tentative: {}, taintedBy: {} };
     const relOf = (abs: string) => abs.slice(root.length + 1).split(/[\\/]/).join("/");
     for (const [abs, v] of verdicts) {
@@ -88,6 +280,100 @@ async function foldOnDisk(files: Map<string, string>): Promise<ProjectResult> {
   }
 }
 
+/**
+ * The `shapes` host's two rules, as chant post-synthesis checks (#101, chant#2438).
+ *
+ * A rule is host code and the harness carries only its identifier, so an
+ * implementation supplies the code. These are written against chant's own
+ * `PostSynthCheck` contract and run through chant's own `runPostSynthChecks`,
+ * because that engine is where the rules contract was extracted from. Writing
+ * them against the fold output directly would re-implement the reference inside
+ * the adapter, and `F-Rule-Equivalence` would then be comparing this file with
+ * itself rather than two implementations.
+ *
+ * chant's engine has one phase where the specification has two, so the phase is
+ * expressed in the input each check is given rather than in the engine: the
+ * pre-synthesis rule is handed the folded namespace as `entities`, the
+ * post-synthesis rule the serialized artifact as `outputs`. The runner asks for
+ * each phase separately, so each gets a context built for it.
+ */
+interface ChantCheck {
+  id: string;
+  description: string;
+  check(ctx: { entities: Map<string, unknown>; outputs: Map<string, string> }): Array<{
+    checkId: string;
+    severity: string;
+    message: string;
+    entity?: string;
+  }>;
+}
+
+const isBucket = (v: unknown): v is { props?: Record<string, unknown> } =>
+  typeof v === "object" && v !== null && (v as { entityType?: unknown }).entityType === "Bucket";
+
+/**
+ * The namespace a rule sees, with callables removed.
+ *
+ * A callable is never a value (`F-Val-Callable`) and never reaches a serializer
+ * (`F-Val-Serializable`), so an exported function is not part of what a rule
+ * reads. chant exports a project-local function as a `FoldableFunction` marker
+ * carrying the AST it would interpret, so leaving them in also means the
+ * post-synthesis artifact cannot be serialized at all.
+ */
+function ruleNamespace(exports: Record<string, unknown>): Map<string, unknown> {
+  const isCallable = (chant as unknown as { isFoldableFunction?: (v: unknown) => boolean }).isFoldableFunction;
+  return new Map(
+    Object.entries(exports).filter(([, v]) => typeof v !== "function" && !(isCallable?.(v) ?? false)),
+  );
+}
+
+function shapesChecks(severityOf: (id: string) => Severity): Record<RulePhase, ChantCheck> {
+  return {
+    pre: {
+      id: "SHAPES001",
+      description: "every Bucket declares a BucketName",
+      check(ctx) {
+        const out = [];
+        for (const [name, value] of ctx.entities) {
+          if (isBucket(value) && !(value.props && "BucketName" in value.props)) {
+            out.push({
+              checkId: "SHAPES001",
+              severity: severityOf("SHAPES001"),
+              message: `Bucket ${name} declares no BucketName`,
+              entity: name,
+            });
+          }
+        }
+        return out;
+      },
+    },
+    post: {
+      id: "SHAPES002",
+      description: "the artifact declares at least one Bucket",
+      check(ctx) {
+        // The artifact, not the namespace: this reads the serialized form, which
+        // is what makes it a post-synthesis rule (F-Rule-Phase).
+        const declaresBucket = [...ctx.outputs.values()].some((doc) => {
+          const parsed = JSON.parse(doc) as Record<string, Record<string, unknown>>;
+          return Object.values(parsed).some((exports) => Object.values(exports).some(isBucket));
+        });
+        return declaresBucket
+          ? []
+          : [
+              {
+                checkId: "SHAPES002",
+                severity: severityOf("SHAPES002"),
+                // Nothing to attach it to, so the subject states what is absent
+                // (F-Rule-Finding, L11.5).
+                message: "the artifact declares no Bucket",
+                entity: "missing: Bucket",
+              },
+            ];
+      },
+    },
+  };
+}
+
 export const chantAdapter: ConformanceAdapter = {
   // Read from the installed package, never a literal: a hardcoded fallback
   // silently misreports the pin, and this name is what the paper's measurement
@@ -105,13 +391,78 @@ export const chantAdapter: ConformanceAdapter = {
     const { line, character } = sf.getLineAndCharacterOfPosition(v.node.getStart());
     return { accepted: false, rule: v.ruleId, line: line + 1, column: character + 1, message: v.message };
   },
-  async foldProject(files, host) {
+  async foldProject(files, host, mode) {
     if (!projectFn) return "unavailable";
-    // A named host's entity classes come from a package chant cannot resolve,
-    // and its entry takes an intrinsic registry rather than a whole host, so a
-    // host-dependent fixture is not answerable here.
-    if (host) return "unavailable";
-    return foldOnDisk(files);
+    // #2438 — a host used to make a fixture unanswerable here: its entity
+    // classes come from a package chant's allowlist could not name, and the
+    // entry took an intrinsic registry rather than a host. Both are addressed:
+    // the host's packages are written next to the sources and named to chant
+    // outright, and its registrations are translated. A chant too old for the
+    // `lexiconPackages` option would resolve none of it, so say so rather than
+    // report a wrong verdict.
+    if (host && !(await acceptsHostPackages())) return "unavailable";
+    // tsad#113 — `isolated` is answerable now, and it was not before.
+    //
+    // The two rules are close but not identical: isolated refuses to INVOKE,
+    // so F-Call step 5 fires and step 6 never imports, while chant's
+    // `--sandbox` refuses to import project code at all. Wiring them together
+    // used to trade one disagreement for another, because chant took the
+    // interpretable factories down with the rest: the four negatives agreed
+    // and `good.ts` and `named.ts` broke, reference `fold` against chant `run`.
+    // That was chant#2442 — a host's `Composite` was not recognised as the
+    // registration form, so nothing was interpreted and everything fell to the
+    // invocation arm the sandbox refuses.
+    //
+    // A chant without that fix would report exactly those wrong verdicts, so
+    // the probe is a behaviour test rather than a version comparison, the same
+    // posture as `acceptsHostPackages` above.
+    if (mode === "isolated" && !(await interpretsHostComposites())) return "unavailable";
+    return foldOnDisk(files, host, mode);
+  },
+
+  async rules(files, host, phase) {
+    if (!projectFn || !runChecks) return "unavailable";
+    if (!(await acceptsHostPackages())) return "unavailable";
+
+    // Every rule the host names must be one this implementation carries, and at
+    // the phase the host declared. A host naming a rule chant has no code for
+    // is reported unavailable and the fixture is skipped visibly, rather than
+    // answered with a silence that would read as "no findings".
+    const declared = host.rules ?? [];
+    if (declared.length === 0) return "unavailable";
+    const checks = shapesChecks((id) => declared.find((r) => r.id === id)?.severity ?? "error");
+    if (!declared.every((r) => checks[r.phase]?.id === r.id)) return "unavailable";
+
+    const folded = await foldOnDisk(files, host);
+    const wanted = declared.filter((r) => r.phase === phase);
+    if (wanted.length === 0) return [];
+
+    const out: Finding[] = [];
+    for (const rule of wanted) {
+      const check = checks[rule.phase];
+      // A file that ran has no folded namespace, so no rule sees it
+      // (F-Rule-Input). Pre runs per file, so a finding carries the file whose
+      // namespace holds its subject; post reads one artifact over the whole
+      // build and carries none.
+      const folds = Object.entries(folded.verdicts).filter(([, v]) => v.kind === "fold");
+      if (phase === "pre") {
+        for (const [file, verdict] of folds) {
+          const entities = ruleNamespace((verdict as { exports: Record<string, unknown> }).exports);
+          for (const d of runChecks([check as never], { outputs: new Map(), entities } as never)) {
+            out.push({ rule: d.checkId, severity: d.severity as Severity, subject: d.entity ?? "", message: d.message, file });
+          }
+        }
+        continue;
+      }
+      const artifact = Object.fromEntries(
+        folds.map(([file, v]) => [file, Object.fromEntries(ruleNamespace((v as { exports: Record<string, unknown> }).exports))]),
+      );
+      const outputs = new Map([["artifact", JSON.stringify(artifact)]]);
+      for (const d of runChecks([check as never], { outputs, entities: new Map() } as never)) {
+        out.push({ rule: d.checkId, severity: d.severity as Severity, subject: d.entity ?? "", message: d.message });
+      }
+    }
+    return out;
   },
   foldExport(source, exportName) {
     const sf = parse(source); const init = exportInitializer(sf, exportName);

package/src/adapters/rust.ts

@@ -0,0 +1,77 @@
+/**
+ * The adapter for `evaluators/rust`, the evaluator with no JavaScript
+ * runtime (#86). It is a binary that speaks JSON on stdin and stdout; this
+ * adapter spawns it per call and decodes the two things JSON cannot carry,
+ * `undefined` and a non-finite number, from the tagged objects the binary
+ * writes. Nothing here folds anything.
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import type { ConformanceAdapter, ConformanceHost } from "../index.js";
+
+/** The binary, from `TSAD_RUST_EVAL` or the crate's release build; `undefined` when neither exists. */
+export function rustEvaluatorPath(root = process.cwd()): string | undefined {
+  const env = process.env.TSAD_RUST_EVAL;
+  if (env) return existsSync(env) ? env : undefined;
+  const built = join(root, "evaluators", "rust", "target", "release", "tsad-eval");
+  return existsSync(built) ? built : undefined;
+}
+
+function decode(v: unknown): unknown {
+  if (Array.isArray(v)) return v.map(decode);
+  if (v && typeof v === "object") {
+    const o = v as Record<string, unknown>;
+    if (o.$tsad === "undefined") return undefined;
+    if (o.$tsad === "number") return Number(o.text);
+    if (o.$tsad === "function" || o.$tsad === "host") return o;
+    return Object.fromEntries(Object.entries(o).map(([k, e]) => [k, decode(e)]));
+  }
+  return v;
+}
+
+/** The inverse of decode, for a value the harness sends in (generate's namespace). */
+function encode(v: unknown): unknown {
+  if (v === undefined) return { $tsad: "undefined" };
+  if (typeof v === "number" && !Number.isFinite(v)) return { $tsad: "number", text: String(v) };
+  if (Array.isArray(v)) return v.map(encode);
+  if (v && typeof v === "object") return Object.fromEntries(Object.entries(v).map(([k, e]) => [k, encode(e)]));
+  return v;
+}
+
+function hostDescription(h?: ConformanceHost) {
+  // F-Profile-DataHost: the host is a description, the registry and the trust set.
+  return h ? { intrinsics: h.intrinsics, ownedSpecifierPrefixes: h.ownedSpecifierPrefixes } : {};
+}
+
+export function rustAdapter(binary: string): ConformanceAdapter {
+  const call = (req: Record<string, unknown>): Record<string, unknown> => {
+    const out = execFileSync(binary, [], { input: JSON.stringify(req), encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+    const r = JSON.parse(out) as Record<string, unknown>;
+    if (r.error) throw new Error(`tsad-eval: ${r.error}`);
+    return r;
+  };
+  const version = call({ op: "version" }) as { specVersion: string; name: string };
+  return {
+    name: version.name,
+    specVersion: version.specVersion,
+    shape(source, exportName) {
+      const r = call({ op: "shape", files: { "input.ts": source }, entry: "input.ts", export: exportName }) as { accepted: boolean; rule?: string; line: number; column: number; message: string };
+      return r.accepted ? { accepted: true } : { accepted: false, rule: r.rule, line: r.line, column: r.column, message: r.message };
+    },
+    foldExport(source, exportName) {
+      const r = call({ op: "foldExport", files: { "input.ts": source }, entry: "input.ts", export: exportName }) as { ok: boolean; value?: unknown; rule?: string; line: number; column: number; message: string };
+      return r.ok ? { ok: true, value: decode(r.value) } : { ok: false, rule: r.rule, line: r.line, column: r.column, message: r.message };
+    },
+    foldProject(files, host) {
+      const r = call({ op: "foldProject", files: Object.fromEntries(files), host: hostDescription(host) }) as { verdicts: Record<string, { kind: "fold"; exports: Record<string, unknown> } | { kind: "run"; rule?: string; reason: string }> };
+      const verdicts: Record<string, { kind: "fold"; exports: Record<string, unknown> } | { kind: "run"; rule?: string; reason: string }> = {};
+      for (const [path, v] of Object.entries(r.verdicts)) verdicts[path] = v.kind === "fold" ? { kind: "fold", exports: decode(v.exports) as Record<string, unknown> } : v;
+      return { verdicts };
+    },
+    generate(namespace, host) {
+      const r = call({ op: "generate", namespace: encode(namespace), host: hostDescription(host) }) as { source?: string; unavailable?: string };
+      return r.source ?? "unavailable";
+    },
+  };
+}

package/src/chant-agreement.test.ts

@@ -10,13 +10,33 @@ import { referenceAdapter } from "@intentius/tsad-reference";
 // (S-ExportDefault, which full keeps under S-Disqualify until chant admits it)
 // is not chant's to answer.
 const all = loadFixtures(join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "spec", "fixtures")).filter((f) => f.profiles.includes("full"));
-// chant's classifier rejects every project-local call the build folds
-// (chant#2435), the direction F-Direction forbids; spec 1.2's S-CallLocal
-// names the form. Fixtures citing it are held out of the shape comparison,
-// and only that: their fold half is still compared below.
-const knownShapeDivergence = new Set(["S-CallLocal"]);
-const heldOut = all.filter((f) => f.rules.some((r) => knownShapeDivergence.has(r)));
-const fixtures = all.filter((f) => !heldOut.includes(f));
+// chant#2435 held S-CallLocal out of the shape half from spec 1.2 until
+// chant-v0.72.0 admitted a project-local call in its classifier (#2437);
+// nothing is held out of the shape comparison now, and a future hold-out
+// needs a chant issue as its reason, the way this one had.
+//
+// chant#2441 — chant evaluates a helper or intrinsic call inside a folded
+// function body, which F-Div-Depth (L3.16) says the folder must refuse, and
+// produces the envelope the fixture's own note warns about. Unlike every other
+// F-Div row this is not a fallback, so it is a chant bug rather than a
+// tolerated divergence; these three are held out of the whole-build comparison
+// by name until it is fixed, and by name rather than by rule so a new fixture
+// citing F-Div-Depth is compared rather than silently excused.
+const foldsAtDepth = new Set([
+  "F-Eval-CallIntrinsic/inside-function-body",
+  "F-Eval-CallHelper/inside-function-body",
+  "F-Div-Provenance/helper-name-from-project-import",
+]);
+
+// chant#2446 — chant has the three counters F-Obs-Counters names, in
+// fold-import.ts's FoldExecutionCounts, and its public entry exports neither
+// the snapshot nor the reset, so the adapter cannot report them through the
+// pinned package. The fixture is skipped there ("counters unavailable") rather
+// than failed, and held out by name until a release exports them.
+const countersNotPublic = new Set(["F-Obs-Counters/a-build-reports-its-counts"]);
+
+const heldOut = new Set([...foldsAtDepth, ...countersNotPublic]);
+const fixtures = all.filter((f) => !heldOut.has(f.id));
 
 describe("chant cross-check (#11)", () => {
   test("chant passes every fixture through its public fold API", async () => {
@@ -27,32 +47,57 @@ describe("chant cross-check (#11)", () => {
     const dis = await compareAdapters(referenceAdapter, chantAdapter, fixtures);
     expect(dis, dis.join("\n")).toEqual([]);
   });
-  test("the whole-build fixtures reach chant, or say why not (#62)", async () => {
-    // Two reasons a project fixture can be skipped, and both must be visible.
-    // An older pin has no whole-build entry at all (chant#2408); a fixture
-    // naming a host asks for entity classes from a package chant cannot
-    // resolve. Anything else has to be answered.
+  test("every whole-build fixture reaches chant (#62)", async () => {
+    // This used to allow a skip when the fixture named a host, because a host's
+    // entity classes came from a package chant's allowlist could not name
+    // (chant#2408, chant#2438), and later because chant could not answer in
+    // `isolated` at all (chant#2442). Both are fixed and the allowance is gone:
+    // every project fixture is answered, so a skip is a failure rather than an
+    // excuse. Three fixtures moved from skipped to answered when chant-v0.72.1
+    // shipped, and the count is asserted so a silent return to "unavailable"
+    // fails here instead of reading as agreement.
     const projects = projectFixtures(fixtures);
     expect(projects.length).toBeGreaterThan(0);
     const reports = await Promise.all(projects.map((f) => runProjectFixture(chantAdapter, f)));
     const skipped = reports.filter((r) => r.skipped).map((r) => r.fixture);
-    const hosted = new Set(projects.filter((f) => f.host).map((f) => f.id));
-    const unexpected = skipped.filter((id) => !hosted.has(id));
-    expect(unexpected, `skipped without a host to explain it:\n${unexpected.join("\n")}`).toEqual([]);
-    // The pin carries the entry, so "unavailable" everywhere would mean the
-    // comparison silently stopped happening. Asserted, not assumed.
-    expect(skipped.length, "every hostless whole-build fixture must reach chant").toBeLessThan(projects.length);
+    expect(skipped, `chant answered none of these:\n${skipped.join("\n")}`).toEqual([]);
   });
 
   test("chant and the reference agree on every whole-build fixture chant can answer (#62)", async () => {
     const dis = await compareAdapters(referenceAdapter, chantAdapter, projectFixtures(fixtures));
     expect(dis, dis.join("\n")).toEqual([]);
   });
-  test("the held-out fixtures still agree on the fold half, and the hold-out is not empty (chant#2435)", () => {
-    expect(heldOut.length).toBeGreaterThan(0);
-    for (const f of expressionFixtures(heldOut)) {
-      const a = referenceAdapter.foldExport(f.input, f.exportName), b = chantAdapter.foldExport(f.input, f.exportName);
-      expect(a.ok, `${f.id}: reference ${a.ok ? "folds" : "runs"}, chant ${b.ok ? "folds" : "runs"}`).toBe(b.ok);
+
+  test("every held-out fixture exists and still disagrees, so neither list outlives its reason", async () => {
+    // A hold-out that quietly outlived its cause would be worse than the cause.
+    // Run per list rather than over the union, so each empties itself on its
+    // own event, so one reason cannot go on excusing another's fixtures.
+    // (tsad#110's list emptied when spec 1.6 gave J1 F-Eval-CallHost.)
+    for (const [reason, names] of [["chant#2441", foldsAtDepth]] as const) {
+      const held = projectFixtures(all).filter((f) => names.has(f.id));
+      expect(held.map((f) => f.id).sort(), `${reason}: a held-out fixture no longer exists`).toEqual([...names].sort());
+
+      // A skip is not agreement. `compareAdapters` reports nothing when one
+      // side answers "unavailable", so without this a chant that had stopped
+      // answering hosted fixtures at all would read as "these now agree, drop
+      // the hold-out" — exactly the false signal this guard exists to prevent,
+      // one level up.
+      const reports = await Promise.all(held.map((f) => runProjectFixture(chantAdapter, f)));
+      const skipped = reports.filter((r) => r.skipped).map((r) => r.fixture);
+      expect(skipped, `${reason}: chant answered none of these, so agreement cannot be read from them:\n${skipped.join("\n")}`).toEqual([]);
+
+      const dis = await compareAdapters(referenceAdapter, chantAdapter, held);
+      expect(dis.length, `${reason} looks settled — drop its hold-out`).toBeGreaterThan(0);
+    }
+    // The other kind of hold-out: chant does not disagree, it cannot answer.
+    // The guard is the skip itself; once a release exports the counters and
+    // the adapter reports them, this fails and the hold-out retires.
+    for (const [reason, names] of [["chant#2446", countersNotPublic]] as const) {
+      const held = projectFixtures(all).filter((f) => names.has(f.id));
+      expect(held.map((f) => f.id).sort(), `${reason}: a held-out fixture no longer exists`).toEqual([...names].sort());
+      const reports = await Promise.all(held.map((f) => runProjectFixture(chantAdapter, f)));
+      const notSkipped = reports.filter((r) => r.skipped !== "counters unavailable").map((r) => `${r.fixture}: ${r.skipped ?? (r.pass ? "answered" : r.failures.join("; "))}`);
+      expect(notSkipped, `${reason} looks settled — drop its hold-out`).toEqual([]);
     }
   });
   test("chant's shape classifier is available (chant-v0.64.0+, chant#2362) and agrees on every fixture", async () => {

package/src/corpus.test.ts

@@ -34,6 +34,18 @@ describe.skipIf(!checkout)("the corpus against both implementations (#25)", () =
     }
   }, 600_000);
 
+  test("the data-host column is present and agrees (#86, #116)", () => {
+    // A missing evaluator must not read as a clean pass: the column is asserted
+    // unless a local run opts out of it by name, and then the report says so.
+    if (!summary.dataHost) {
+      expect(process.env.TSAD_CORPUS_NO_RUST, "no data-host column: build evaluators/rust (cargo build --release) or set TSAD_CORPUS_NO_RUST=1 to run the two-implementation comparison only").toBeTruthy();
+      return;
+    }
+    const dis = summary.dataHost.disagreements.map((d) => `${d.entry}/${d.file}: reference ${d.dataHost!.reference}, evaluator ${d.dataHost!.rust} ${d.dataHost!.diff ?? ""}`);
+    expect(dis, dis.join("\n")).toEqual([]);
+    expect(summary.dataHost.files).toBe(summary.files);
+  });
+
   test("the corpus is the whole one, not a fragment of it", () => {
     // A checkout whose dependencies are not installed, or a corpus discovery
     // that quietly returned less, would otherwise read as a clean run.