@kavishdua/proctor 1.0.0 → 1.2.0

package/dist/cli.js

@@ -57,15 +57,169 @@ var init_judge = __esm({
   }
 });
 
+// src/dynamic/runner.ts
+var runner_exports = {};
+__export(runner_exports, {
+  runDynamic: () => runDynamic
+});
+import { spawn as spawn2 } from "child_process";
+import { mkdtempSync, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, rmSync } from "fs";
+import { join as join14 } from "path";
+import { tmpdir as tmpdir2 } from "os";
+async function runDynamic(options) {
+  const started = Date.now();
+  const skipped = (reason) => ({ status: "skipped", reason, findings: [], runs: [], notes: [], elapsedMs: Date.now() - started });
+  const timeout = options.timeoutMs ?? 6e4;
+  if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 2147483647) return skipped("timeout must be an integer from 1 to 2147483647 milliseconds");
+  if (process.env["PROCTOR_DYNAMIC_ACTIVE"]) return skipped("nested dynamic check");
+  if (process.platform !== "linux") {
+    return skipped("not run: this prototype needs Linux and bubblewrap for write and network isolation");
+  }
+  let scratch;
+  try {
+    scratch = mkdtempSync(join14(tmpdir2(), "proctor-dynamic-"));
+  } catch {
+    return skipped("cannot create scratch directory");
+  }
+  const clean = () => {
+    try {
+      rmSync(scratch, { recursive: true, force: true });
+    } catch {
+    }
+  };
+  try {
+    mkdirSync2(join14(scratch, "tmp"));
+    writeFileSync2(join14(scratch, "input.json"), JSON.stringify({ ...options, files: options.files.map(({ from, to }) => ({ from, to })) }));
+    const env = {
+      PATH: process.env["PATH"],
+      HOME: scratch,
+      TMPDIR: join14(scratch, "tmp"),
+      TMP: join14(scratch, "tmp"),
+      TEMP: join14(scratch, "tmp"),
+      LANG: "C.UTF-8",
+      CI: "true",
+      NO_COLOR: "1",
+      PROCTOR_DYNAMIC_ACTIVE: "1",
+      PYTHONDONTWRITEBYTECODE: "1",
+      PYTEST_DISABLE_PLUGIN_AUTOLOAD: "1",
+      npm_config_offline: "true",
+      npm_config_audit: "false",
+      npm_config_update_notifier: "false",
+      npm_config_cache: join14(scratch, "npm-cache")
+    };
+    const remaining = timeout - (Date.now() - started);
+    if (remaining <= 0) return skipped(`overall timeout (${timeout}ms)`);
+    return await new Promise((resolve4) => {
+      const namespaceArgs = [
+        "--die-with-parent",
+        "--unshare-net",
+        "--unshare-pid",
+        "--ro-bind",
+        "/",
+        "/",
+        "--bind",
+        scratch,
+        scratch,
+        "--proc",
+        "/proc",
+        "--dev",
+        "/dev",
+        "--",
+        process.execPath,
+        options.workerPath,
+        join14(scratch, "input.json")
+      ];
+      const child = spawn2("bwrap", namespaceArgs, {
+        cwd: scratch,
+        env,
+        detached: true,
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      const kill = () => {
+        if (child.pid) {
+          try {
+            process.kill(-child.pid, "SIGKILL");
+          } catch {
+          }
+        }
+      };
+      const onExit = () => {
+        kill();
+        clean();
+      };
+      const onInt = () => {
+        onExit();
+        process.exit(130);
+      };
+      const onTerm = () => {
+        onExit();
+        process.exit(143);
+      };
+      process.once("exit", onExit);
+      process.once("SIGINT", onInt);
+      process.once("SIGTERM", onTerm);
+      let stdout = "", stderr = "", reason = "";
+      const timer = setTimeout(() => {
+        reason = `overall timeout (${timeout}ms)`;
+        kill();
+      }, remaining);
+      child.stdout.on("data", (data) => {
+        stdout += data.toString();
+        if (stdout.length > 4 * 1024 * 1024) {
+          reason = "worker output limit";
+          kill();
+        }
+      });
+      child.stderr.on("data", (data) => {
+        stderr = (stderr + data.toString()).slice(-2e3);
+      });
+      child.once("error", (err) => {
+        reason = `cannot start isolated worker: ${err.message}`;
+      });
+      child.once("close", (code) => {
+        clearTimeout(timer);
+        kill();
+        process.removeListener("exit", onExit);
+        process.removeListener("SIGINT", onInt);
+        process.removeListener("SIGTERM", onTerm);
+        if (reason) {
+          resolve4(skipped(reason));
+          return;
+        }
+        if (code !== 0) {
+          resolve4(skipped(stderr.trim() || `isolated worker exited ${code}`));
+          return;
+        }
+        try {
+          const result = JSON.parse(stdout);
+          result.elapsedMs = Date.now() - started;
+          resolve4(result);
+        } catch {
+          resolve4(skipped("isolated worker returned no usable result"));
+        }
+      });
+    });
+  } catch (err) {
+    return skipped(`cannot prepare isolated worker: ${String(err).replace(/^Error: /, "")}`);
+  } finally {
+    clean();
+  }
+}
+var init_runner = __esm({
+  "src/dynamic/runner.ts"() {
+    "use strict";
+  }
+});
+
 // src/cli.ts
 import { Command } from "commander";
-import { resolve as resolve3, join as join14 } from "path";
+import { resolve as resolve3, join as join15 } from "path";
 import { homedir } from "os";
 
 // package.json
 var package_default = {
   name: "@kavishdua/proctor",
-  version: "1.0.0",
+  version: "1.2.0",
   description: "Catch AI agents gaming their test suites: deleted tests, skipped tests, weakened assertions, hardcoded outputs",
   homepage: "https://github.com/catfish-1234/proctor#readme",
   bugs: {
@@ -126,6 +280,7 @@ var package_default = {
   },
   dependencies: {
     "@anthropic-ai/sdk": "^0.132.0",
+    acorn: "^8.19.0",
     "brace-expansion": "^5.0.12",
     commander: "^14.0.3",
     "parse-diff": "0.12.0",
@@ -653,7 +808,9 @@ var WI_CHECKS = [
   "WI112",
   "WI113"
 ];
-var DEFAULT_ENABLED = RH_CHECKS;
+var DEFAULT_WI_CHECKS = ["WI101", "WI102", "WI105", "WI108", "WI109", "WI110"];
+var DEFAULT_CHECKS = [...RH_CHECKS, ...DEFAULT_WI_CHECKS];
+var DEFAULT_ENABLED = DEFAULT_CHECKS;
 var VALID_SEVERITIES = /* @__PURE__ */ new Set(["error", "warn", "info"]);
 function normalizeConfig(config) {
   const out = { ...config };
@@ -717,6 +874,14 @@ function normalizeConfig(config) {
     warn(`config 'aiModel' must be a string; ignoring it`);
     delete out.aiModel;
   }
+  if (config.dynamic !== void 0 && typeof config.dynamic !== "boolean") {
+    warn("config 'dynamic' must be a boolean; ignoring it");
+    delete out.dynamic;
+  }
+  if (config.dynamicTimeoutMs !== void 0 && (!Number.isSafeInteger(config.dynamicTimeoutMs) || config.dynamicTimeoutMs < 1 || config.dynamicTimeoutMs > 2147483647)) {
+    warn("config 'dynamicTimeoutMs' must be an integer from 1 to 2147483647; ignoring it");
+    delete out.dynamicTimeoutMs;
+  }
   return out;
 }
 async function buildContext(cwd, files, opts) {
@@ -814,7 +979,9 @@ async function buildContext(cwd, files, opts) {
     approvedTestChanges: config.approvedTestChanges,
     commitMessage,
     snapshotGlobs,
-    aiModel
+    aiModel,
+    ...config.dynamic !== void 0 ? { dynamic: config.dynamic } : {},
+    ...config.dynamicTimeoutMs !== void 0 ? { dynamicTimeoutMs: config.dynamicTimeoutMs } : {}
   };
 }
 
@@ -923,8 +1090,9 @@ function withoutTrailingComment(text) {
   return text.replace(/\s*(?:\/\/|#|--\s).*$/, "").replace(/\s*\/\*.*\*\/\s*$/, "");
 }
 function hasExplanation(text) {
-  const comment = /(?:\/\/|#(?!\!)|--|\/\*|\*)\s*(.+)$/.exec(text);
+  const comment = /(?:\/\/|#(?!\!)|--(?=\s)|\/\*|\*)\s*(.+)$/.exec(text);
   if (!comment) return false;
+  if (/^proctor-ignore\s*:/.test(comment[1].trim())) return false;
   const words = comment[1].replace(/\*\/\s*$/, "").trim();
   if (/^(?:todo|fixme|xxx|hack|noqa|nosec|eslint-disable\S*|prettier-ignore)\b\W*$/i.test(words)) return false;
   return words.split(/\s+/).filter(Boolean).length >= 3;
@@ -956,6 +1124,155 @@ function codeLines(chunk) {
   return added.filter((line, i) => !templated.has(i) && !isCommentLine(line.text));
 }
 
+// src/verifiers/structure.ts
+function maskCode(text, pythonOrRuby = false, preserveDelimiters = false) {
+  const out = text.split("");
+  let quote = "";
+  let block = false;
+  let line = false;
+  let previous = "";
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    const next = text[i + 1];
+    if (ch === "\n") {
+      line = false;
+      continue;
+    }
+    if (line) {
+      out[i] = " ";
+      continue;
+    }
+    if (block) {
+      out[i] = " ";
+      if (ch === "*" && next === "/") {
+        out[++i] = " ";
+        block = false;
+      }
+      continue;
+    }
+    if (quote) {
+      out[i] = " ";
+      if (ch === "\\") {
+        if (i + 1 < text.length) out[++i] = " ";
+      } else if (text.startsWith(quote, i)) {
+        for (let k = 0; k < quote.length; k++) out[i + k] = preserveDelimiters ? quote[k] : " ";
+        i += quote.length - 1;
+        quote = "";
+      }
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      out[i] = out[++i] = " ";
+      block = true;
+    } else if (!pythonOrRuby && ch === "/" && next === "/" || pythonOrRuby && ch === "#") {
+      out[i] = " ";
+      line = true;
+    } else if (ch === '"' || ch === "'" || ch === "`") {
+      quote = pythonOrRuby && text.startsWith(ch.repeat(3), i) ? ch.repeat(3) : ch;
+      out[i] = preserveDelimiters ? ch : " ";
+      for (let k = 1; k < quote.length; k++) out[i + k] = preserveDelimiters ? ch : " ";
+      i += quote.length - 1;
+      previous = "v";
+    } else if (!pythonOrRuby && ch === "/" && /^(?:$|[(,=:[!&|?{};+*%~^<>-])$/.test(previous)) {
+      let end = i + 1;
+      let inClass = false;
+      for (; end < text.length && text[end] !== "\n"; end++) {
+        if (text[end] === "\\") end++;
+        else if (text[end] === "[") inClass = true;
+        else if (text[end] === "]") inClass = false;
+        else if (text[end] === "/" && !inClass) break;
+      }
+      if (text[end] === "/") {
+        for (let cursor = i; cursor <= end; cursor++) out[cursor] = " ";
+        i = end;
+        previous = "v";
+      } else previous = ch;
+    } else if (!/\s/.test(ch)) previous = ch;
+  }
+  return out.join("");
+}
+function sourceView(chunk, side, pythonOrRuby = false) {
+  const selected = chunk.changes.map((change, position) => ({ change, position })).filter(({ change }) => change.type !== (side === "after" ? "del" : "add"));
+  const starts = [];
+  let text = "";
+  for (const { change } of selected) {
+    starts.push(text.length);
+    text += body(change.content) + "\n";
+  }
+  const indexAt = (offset) => {
+    let lo = 0;
+    let hi = starts.length;
+    while (lo + 1 < hi) {
+      const mid = lo + hi >>> 1;
+      if (starts[mid] <= offset) lo = mid;
+      else hi = mid;
+    }
+    return lo;
+  };
+  return {
+    text,
+    code: maskCode(text, pythonOrRuby),
+    signatures: maskCode(text, pythonOrRuby, true),
+    offsetAtLine: (line) => {
+      const index = selected.findIndex(({ change }) => (change.type === "normal" ? side === "before" ? change.ln1 : change.ln2 : change.ln) === line);
+      return index < 0 ? void 0 : starts[index];
+    },
+    lineAt: (offset) => {
+      const change = selected[indexAt(offset)]?.change;
+      return change ? change.type === "normal" ? side === "before" ? change.ln1 : change.ln2 : change.ln : chunk.newStart;
+    },
+    touched: (start, end) => {
+      const first = selected[indexAt(start)];
+      const last = selected[indexAt(end)];
+      return !!first && !!last && chunk.changes.slice(first.position, last.position + 1).some((c) => c.type !== "normal");
+    }
+  };
+}
+function closingDelimiter(code, open, left = "{", right = "}") {
+  let depth = 0;
+  for (let i = open; i < code.length; i++) {
+    if (code[i] === left) depth++;
+    else if (code[i] === right && --depth === 0) return i;
+  }
+  return -1;
+}
+var compact = (text) => text.replace(/\s+/g, "");
+function callables(view) {
+  const result = [];
+  const header = /\b(?:function\s+|fn\s+|func\s+)([A-Za-z_$][\w$]*)\s*\([^{}]*\)[^{;]*\{/g;
+  for (const match of view.code.matchAll(header)) {
+    const start = match.index;
+    const open = start + match[0].length - 1;
+    const end = closingDelimiter(view.code, open);
+    if (end < 0) continue;
+    result.push({ name: match[1], header: compact(match[0]), start, open, end, body: view.code.slice(open + 1, end) });
+  }
+  return result;
+}
+function testBodies(view) {
+  const result = [];
+  for (const match of view.code.matchAll(/\b(?:it|test)(?:\.(?!each\b)\w+)*\s*\(/g)) {
+    const openArgs = match.index + match[0].length - 1;
+    const endArgs = closingDelimiter(view.code, openArgs, "(", ")");
+    if (endArgs < 0) continue;
+    const title = /^\s*(['"`])((?:\\.|[^\\])*?)\1/.exec(view.text.slice(openArgs + 1, endArgs));
+    if (!title) continue;
+    let depth = 0;
+    let last = openArgs + 1;
+    for (let i = openArgs + 1; i < endArgs; i++) {
+      if ("({[".includes(view.code[i])) depth++;
+      else if (")}]".includes(view.code[i])) depth--;
+      else if (view.code[i] === "," && depth === 0) last = i + 1;
+    }
+    const callback = /^\s*(?:async\s+)?(?:\([^)]*\)|[A-Za-z_$][\w$]*)\s*=>\s*\{|^\s*(?:async\s+)?function\s*\([^)]*\)\s*\{/.exec(view.code.slice(last, endArgs));
+    if (!callback) continue;
+    const open = last + callback[0].length - 1;
+    const end = closingDelimiter(view.code, open);
+    if (end >= 0) result.push({ key: title[2], open, end, body: view.code.slice(open + 1, end) });
+  }
+  return result;
+}
+
 // src/verifiers/rh001.ts
 var JS_TS_DEL = /^-\s*(?:it|test|describe)(?:\.\w+)?\s*\(/;
 var PY_DEL = /^-\s*(?:async\s+)?def test_/;
@@ -1032,6 +1349,28 @@ function testsRelocated(file, files, ctx) {
   if (relocated.size !== removed.size) return false;
   return assertionsGained >= assertionCount(file, "del");
 }
+function removedFeature(context, testPath, testCode) {
+  const unit = (path9) => (path9.split("/").pop() ?? "").replace(/\.(?:test|spec)\.[^.]+$|\.[^.]+$/, "").replace(/^test_/, "").replace(/_test$/, "").replace(/^_+/, "");
+  const declaration = /\b(?:function|def|class)\s+([A-Za-z_$][\w$]*)/g;
+  for (const candidate of context.files) {
+    const path9 = candidate.from ?? candidate.to ?? "";
+    if (context.isTestFile(path9) || unit(path9) !== unit(testPath)) continue;
+    const before = candidate.chunks.map((chunk) => sourceView(chunk, "before", path9.endsWith(".py")));
+    const after = candidate.chunks.map((chunk) => sourceView(chunk, "after", path9.endsWith(".py")));
+    for (const view of before) for (const match of view.code.matchAll(declaration)) {
+      const name = match[1];
+      if (!view.touched(match.index, match.index + match[0].length)) continue;
+      if (after.some((next) => [...next.code.matchAll(/\b(?:function|def|class|const|let|var)\s+([A-Za-z_$][\w$]*)/g)].some((declaration2) => declaration2[1] === name))) continue;
+      for (const reference of testCode.matchAll(/[A-Za-z_$][\w$]*/g)) {
+        if (reference[0] !== name) continue;
+        let next = reference.index + reference[0].length;
+        while (/\s/.test(testCode[next] ?? "") && next < testCode.length) next++;
+        if (testCode[reference.index - 1] === "." || testCode[next] === "(") return true;
+      }
+    }
+  }
+  return false;
+}
 function run(context) {
   const files = context.files;
   const ctx = context;
@@ -1082,6 +1421,28 @@ function run(context) {
         if (change.type !== "del") continue;
         if (templateLines.has(changeIndex)) continue;
         if (hasReconcilingAdd) continue;
+        const before = sourceView(chunk, "before", from.endsWith(".py"));
+        const start = before.offsetAtLine(change.ln);
+        if (start !== void 0) {
+          let end = before.code.length;
+          if (from.endsWith(".py")) {
+            const indent = /^\s*/.exec(change.content.slice(1))[0].length;
+            const nextLine = before.code.indexOf("\n", start);
+            const rest = before.code.slice(nextLine + 1);
+            const boundary = /^( *)(\S)/gm;
+            for (const match of rest.matchAll(boundary)) if (match[1].length <= indent) {
+              end = nextLine + 1 + match.index;
+              break;
+            }
+          } else {
+            const open = before.code.indexOf("(", start);
+            if (open >= 0) {
+              const close = closingDelimiter(before.code, open, "(", ")");
+              if (close >= 0) end = close + 1;
+            }
+          }
+          if (removedFeature(ctx, from, before.code.slice(start, end))) continue;
+        }
         if (JS_TS_DEL.test(change.content)) {
           const name = extractTestName(change.content);
           findings.push({
@@ -1196,7 +1557,7 @@ var WEAK_PATTERNS = [
 ];
 var ORDERING_WEAK = /\.toBe(?:GreaterThan|LessThan)(?:OrEqual)?\(/;
 var SOLE_ANYTHING = /\.(?:toBe|toEqual|toStrictEqual)\(\s*expect\.anything\(\)\s*\)/;
-var CONTAINMENT_WEAK = /\.(?:toContain|toContainEqual|toMatch|toHaveProperty)\(/;
+var CONTAINMENT_WEAK = /\.(?:toContain|toContainEqual|toMatch|toHaveProperty|toBeCloseTo)\(/;
 var GROUP_B_STRONG = [
   { ext: /\.(?:pl|pm|t)$/i, re: /\bis(?:_deeply)?\s*\(/ },
   { ext: /\.r$/i, re: /\bexpect_(?:equal|identical)\s*\(/ },
@@ -1581,6 +1942,29 @@ function run2(context) {
   for (const file of files) {
     const filePath = file.to ?? file.from ?? "";
     for (const chunk of file.chunks) {
+      if (context.isTestFile(filePath) && /\.[cm]?[jt]sx?$/.test(filePath)) {
+        const before = sourceView(chunk, "before");
+        const after = sourceView(chunk, "after");
+        const priorTests = testBodies(before);
+        for (const next of testBodies(after)) {
+          const prior = priorTests.find((test) => test.key === next.key);
+          if (!prior || !after.touched(next.open, next.end)) continue;
+          for (const assertion of prior.body.matchAll(/\bexpect\s*\(\s*([A-Za-z_$][\w$]*)\s*\)\s*\.(?:toBe|toEqual|toStrictEqual|toBeCloseTo)\s*\(/g)) {
+            const subject = assertion[1];
+            const computesSubject = (code) => [...code.matchAll(/\b(?:const|let)\s+([A-Za-z_$][\w$]*)\s*=\s*([^;\n]+)/g)].some((binding) => binding[1] === subject && /[^\s(]+\s*\(/.test(binding[2]));
+            if (!computesSubject(prior.body) || !computesSubject(next.body)) continue;
+            if ([...next.body.matchAll(/[A-Za-z_$][\w$]*/g)].filter((token) => token[0] === subject).length !== 1) continue;
+            findings.push({
+              verifierId: "RH002",
+              severity: "error",
+              file: filePath,
+              line: after.lineAt(next.open),
+              message: "A computed test result is still assigned, but its value assertion was removed and the value is no longer used.",
+              suggestion: "Restore the result assertion or replace it with an equivalent check of that value."
+            });
+          }
+        }
+      }
       const dels = chunk.changes.filter((c) => c.type === "del");
       const adds = chunk.changes.filter((c) => c.type === "add");
       const at = new Map(chunk.changes.map((c, i) => [c, i]));
@@ -1632,6 +2016,41 @@ function run2(context) {
           suggestion: "Restore the specific value assertion to preserve test coverage strength."
         });
       }
+      if (context.isTestFile(filePath)) for (const added of adds) {
+        if (reported.has(added.ln) || hasExplanation(added.content)) continue;
+        const next = body(added.content);
+        const nextSubject = extractSubject(next);
+        const prior = dels.find((del) => {
+          if (!nearby(del, added)) return false;
+          const old = body(del.content);
+          const subject = extractSubject(old);
+          if (subject && subject === nextSubject) {
+            const a = /\.toBeCloseTo\(\s*([^,]+),\s*(\d+)\s*\)/.exec(old);
+            const b = /\.toBeCloseTo\(\s*([^,]+),\s*(\d+)\s*\)/.exec(next);
+            if (a && b && compact(a[1]) === compact(b[1]) && Number(b[2]) < Number(a[2])) return true;
+          }
+          if (subject && isStrongAssertion(old, filePath) && /\.toHaveBeenCalled(?:Times|With)?\(/.test(next)) {
+            return !chunk.changes.some((c) => c.type !== "del" && extractSubject(c.content) === subject && isStrongAssertion(c.content, filePath));
+          }
+          if (filePath.endsWith(".py")) {
+            const pattern = /\bassert\s+(.+?)==\s*pytest\.approx\(\s*([^,]+),\s*(abs|rel)\s*=\s*([0-9.eE+-]+)\s*\)/;
+            const a = pattern.exec(old);
+            const b = pattern.exec(next);
+            return !!a && !!b && compact(a[1]) === compact(b[1]) && compact(a[2]) === compact(b[2]) && a[3] === b[3] && Number(b[4]) > Number(a[4]);
+          }
+          return false;
+        });
+        if (!prior) continue;
+        reported.add(added.ln);
+        findings.push({
+          verifierId: "RH002",
+          severity: "error",
+          file: filePath,
+          line: added.ln,
+          message: "A result assertion was replaced by a wider tolerance or an assertion on mock interactions.",
+          suggestion: "Preserve the result contract and its precision, or document the specification change."
+        });
+      }
       for (const del of dels) {
         if (!ALMOST_EQUAL.test(del.content)) continue;
         const delPlaces = del.content.match(/places\s*=\s*(\d+)/);
@@ -2293,6 +2712,22 @@ function isSkipPattern(content, flags) {
       return JS_PATTERNS.some((re) => re.test(content));
   }
 }
+function skipIdentity(text) {
+  const match = /\b((?:it|test|describe)(?:\.\w+)*)\s*\(\s*(['"`])((?:\\.|[^\\])*?)\2/.exec(text);
+  return match ? match[1] + ":" + match[3] : void 0;
+}
+function nativeReason(text) {
+  const match = /\breason\s*=\s*(['"])/.exec(text);
+  if (!match) return false;
+  const start = match.index + match[0].length;
+  let end = start;
+  for (; end < text.length; end++) {
+    if (text[end] === "\\") end++;
+    else if (text[end] === match[1]) break;
+  }
+  const reason = text.slice(start, end).trim();
+  return reason.split(/\s+/).length >= 3 || /^https?:\/\/\S+/.test(reason);
+}
 function run3(context) {
   const files = context.files;
   const ctx = context;
@@ -2313,10 +2748,77 @@ function run3(context) {
     const luaTestFile = ext === "lua" && isLuaTestFile(filePath);
     const batsFile = ext === "bats" && isBatsFile(filePath);
     if (!isPython && !isNewLang && !ctx.isTestFile(filePath)) continue;
+    const previousSkips = new Set(file.chunks.flatMap((chunk) => chunk.changes).filter((c) => c.type === "del" && isSkipPattern(c.content, { ext, pyTestModule, goTestFile, rubyTestFile, kotlinTestFile, cTestFile, scalaTestFile, rTestFile, haskellTestFile, luaTestFile, batsFile })).map((c) => skipIdentity(c.content)).filter(Boolean));
     for (const chunk of file.chunks) {
+      const lines = afterLines(chunk);
+      const view = sourceView(chunk, "after", isPython);
+      const signatureLines = view.signatures.split("\n");
+      const maskedLines = view.code.split("\n");
+      if (ctx.isTestFile(filePath) && !isPython && chunk.changes.some((change) => change.type === "add" && body(change.content).includes("/*"))) {
+        const before = sourceView(chunk, "before");
+        const surviving = new Set(testBodies(view).map((test) => test.key));
+        for (const prior of testBodies(before)) {
+          if (surviving.has(prior.key)) continue;
+          const oldLine = before.lineAt(prior.open);
+          const unchanged = chunk.changes.find((change) => change.type === "normal" && change.ln1 === oldLine);
+          if (!unchanged || unchanged.type !== "normal") continue;
+          const offset = view.offsetAtLine(unchanged.ln2);
+          if (offset === void 0) continue;
+          const end = view.code.indexOf("\n", offset);
+          if (view.code.slice(offset, end < 0 ? void 0 : end).trim()) continue;
+          findings.push({
+            verifierId: "RH003",
+            severity: "error",
+            file: filePath,
+            line: unchanged.ln2,
+            message: "An existing named test is now inside a block comment and no longer executes.",
+            suggestion: "Restore the executable test or remove the feature and its tests deliberately."
+          });
+        }
+      }
+      if (ctx.isTestFile(filePath)) {
+        const after = sourceView(chunk, "after", isPython);
+        for (const match of after.code.matchAll(/\bif\s*\([^\n;{}]*\)\s*(?:\{\s*)?return\s*;|^([ \t]*)if\s+[^:\n]+:\s*return\s*$/gm)) {
+          if (!after.touched(match.index, match.index + match[0].length)) continue;
+          const offset = match.index;
+          const inTest = isPython ? /\bdef\s+test_\w+\s*\(/.test(after.code.slice(0, offset)) : testBodies(after).some((test) => offset > test.open && offset < test.end && !/=>|\bfunction\b/.test(after.code.slice(test.open + 1, offset)));
+          if (!inTest) continue;
+          const line = after.lineAt(offset);
+          const raw = after.text.slice(match.index, match.index + match[0].length);
+          if (hasExplanation(raw)) continue;
+          const later = after.code.slice(match.index + match[0].length);
+          if (!/\bexpect\s*\(|\bassert\b/.test(later)) continue;
+          findings.push({
+            verifierId: "RH003",
+            severity: "error",
+            file: filePath,
+            line,
+            message: "A new conditional return can bypass the assertions in a test that still reports success.",
+            suggestion: "Run the assertions on every supported path, or document and report an explicit test skip."
+          });
+        }
+      }
       for (const change of chunk.changes) {
         if (change.type !== "add") continue;
-        if (!isSkipPattern(change.content, {
+        const text = body(change.content);
+        const identity = skipIdentity(text);
+        if (identity && previousSkips.has(identity)) continue;
+        const index = lines.findIndex((line) => line.line === change.ln && line.added);
+        const offset = lines.slice(0, index).reduce((sum, line) => sum + line.text.length + 1, 0);
+        const open = view.code.indexOf("(", offset);
+        const end = open < 0 ? -1 : closingDelimiter(view.code, open, "(", ")");
+        const invocation = end < 0 ? text : view.text.slice(offset, end + 1);
+        const previousComment = index > 0 ? lines[index - 1].text : "";
+        if (!/\.only\b|\[\s*['"]only['"]\s*\]|\b(?:fit|fdescribe)\s*\(/.test(text) && (nativeReason(invocation) || /^\s*(?:\/\/|#)/.test(previousComment) && /\breason\s*:/i.test(previousComment) && hasExplanation(previousComment))) continue;
+        if (!/\.only\b|\[\s*['"]only['"]\s*\]|\b(?:fit|fdescribe)\s*\(/.test(text) && (/\breason\s*:/i.test(text) && hasExplanation(text) || /\breason\s*=\s*['"][^'"]*\S+\s+\S+\s+\S+[^'"]*['"]/.test(text))) continue;
+        const lexical = "+" + (signatureLines[index] ?? "");
+        const masked = "+" + (maskedLines[index] ?? "");
+        const bracketApi = [...change.content.matchAll(new RegExp(BRACKET_SKIP, "g"))].some((match) => {
+          const root = /^(?:it|test|describe)/.exec(match[0])[0];
+          return masked.slice(match.index, match.index + root.length) === root;
+        });
+        const commentedDeclaration = COMMENTED_JS_TEST.test(change.content) || COMMENTED_PY_TEST.test(change.content);
+        if (!isSkipPattern(commentedDeclaration || bracketApi ? change.content : lexical, {
           ext,
           pyTestModule,
           goTestFile,
@@ -2408,10 +2910,86 @@ function extractLiterals(line) {
   }
   return result;
 }
+function assertionPairs(context) {
+  const pairs = /* @__PURE__ */ new Map();
+  const pattern = new RegExp(`expect\\(\\s*([A-Za-z_$][\\w$]*)\\(\\s*(${LITERAL_TOKEN})\\s*\\)\\s*\\)\\.(?:toBe|toEqual|toStrictEqual)\\(\\s*(${LITERAL_TOKEN})\\s*\\)`, "g");
+  for (const file of context.files) {
+    if (!context.isTestFile(pathOf(file))) continue;
+    for (const chunk of file.chunks) {
+      const view = sourceView(chunk, "after");
+      for (const match of view.text.matchAll(pattern)) {
+        if (!view.code.slice(match.index, match.index + 6).startsWith("expect")) continue;
+        const set = pairs.get(match[1]) ?? /* @__PURE__ */ new Set();
+        set.add(match[2].trim() + ":" + match[3].trim());
+        pairs.set(match[1], set);
+      }
+    }
+  }
+  return pairs;
+}
+function structuralHardcodes(context) {
+  const findings = [];
+  const pairs = assertionPairs(context);
+  if (!pairs.size) return findings;
+  for (const file of context.files) {
+    const filePath = pathOf(file);
+    if (!isWatchedSource(context, filePath)) continue;
+    for (const chunk of file.chunks) {
+      const before = sourceView(chunk, "before");
+      const after = sourceView(chunk, "after");
+      const oldFunctions = callables(before);
+      for (const fn of callables(after)) {
+        const evidence = pairs.get(fn.name);
+        const old = oldFunctions.find((candidate) => candidate.header === fn.header);
+        if (!evidence || !old) continue;
+        const raw = after.text.slice(fn.open + 1, fn.end);
+        const branch = new RegExp(`\\bif\\s*\\(\\s*[A-Za-z_$][\\w$]*\\s*===?\\s*(${LITERAL_TOKEN})\\s*\\)\\s*\\{\\s*return\\s+(${LITERAL_TOKEN})\\s*;?\\s*\\}`, "g");
+        for (const match of raw.matchAll(branch)) {
+          if (!evidence.has(match[1].trim() + ":" + match[2].trim())) continue;
+          const offset = fn.open + 1 + match.index;
+          if (!after.code.slice(offset, offset + 2).startsWith("if")) continue;
+          if (!after.touched(offset, offset + match[0].length)) continue;
+          const open = after.code.indexOf("{", offset);
+          const close = closingDelimiter(after.code, open);
+          const rest = after.code.slice(fn.open + 1, offset) + after.code.slice(close + 1, fn.end);
+          if (compact(rest) !== compact(old.body)) continue;
+          findings.push({
+            verifierId: "RH004",
+            severity: "error",
+            file: filePath,
+            line: after.lineAt(offset),
+            message: "A literal-input branch returns the matching test expectation while leaving the general computation unchanged.",
+            suggestion: "Implement the behavior generally rather than adding a branch for one asserted example."
+          });
+        }
+        if (!/\breturn\s+[^;]+\(/.test(old.body) || /\breturn\s+[^;]+\(/.test(fn.body)) continue;
+        const lookup = /\breturn\s+([A-Za-z_$][\w$]*)\s*\[\s*([A-Za-z_$][\w$]*)\s*\]/.exec(fn.body);
+        if (!lookup) continue;
+        const table = [...fn.body.matchAll(/\b(?:const|let)\s+([A-Za-z_$][\w$]*)\s*=\s*\{/g)].find((binding) => binding[1] === lookup[1]);
+        if (!table) continue;
+        const literalEntry = new RegExp(`\\[?\\s*(${LITERAL_TOKEN})\\s*\\]?\\s*:\\s*(${LITERAL_TOKEN})`, "g");
+        const tableOpen = fn.open + 1 + table.index + table[0].length - 1;
+        const tableEnd = closingDelimiter(after.code, tableOpen);
+        if (tableEnd < 0) continue;
+        const entries = after.text.slice(tableOpen + 1, tableEnd);
+        if (![...entries.matchAll(literalEntry)].some((entry) => evidence.has(entry[1].trim() + ":" + entry[2].trim()))) continue;
+        findings.push({
+          verifierId: "RH004",
+          severity: "error",
+          file: filePath,
+          line: after.lineAt(fn.open),
+          message: "A computed return was replaced by a lookup containing the same literal input and output as a test assertion.",
+          suggestion: "Restore the computation. A finite domain table needs a stated specification and complete domain coverage."
+        });
+      }
+    }
+  }
+  return findings;
+}
 async function run4(context) {
   const files = context.files;
   const ctx = context;
-  const findings = [];
+  const findings = structuralHardcodes(context);
   const fuzzyCandidates = [];
   for (const file of files) {
     const filePath = file.to ?? file.from ?? "";
@@ -2455,6 +3033,7 @@ async function run4(context) {
         const branchMatch = add.content.match(BRANCH_LITERAL_RE) ?? add.content.match(PY_BRANCH_LITERAL_RE);
         if (!branchMatch) continue;
         if (EMPTINESS_GUARD_RE.test(add.content) || TYPEOF_GUARD_RE.test(add.content)) continue;
+        if (/^(['"`])[^\w\s]\1$/.test(branchMatch[1])) continue;
         findings.push({
           verifierId: "RH004",
           severity: "error",
@@ -2619,6 +3198,22 @@ async function run5(context) {
       const adds = chunk.changes.filter((c) => c.type === "add" && !isMoved(moved, c.content));
       const near = (a, b) => Math.abs((at.get(a) ?? 0) - (at.get(b) ?? 0)) <= PAIRING_DISTANCE;
       if (!isTest) {
+        const beforeView = sourceView(chunk, "before");
+        const afterView = sourceView(chunk, "after");
+        const previous = callables(beforeView);
+        for (const fn of callables(afterView)) {
+          if (fn.body.trim() || !afterView.touched(fn.start, fn.end)) continue;
+          const prior = previous.find((old) => old.header === fn.header);
+          if (!prior || !/\b(?:return|await)\b|\w\s*\(/.test(prior.body)) continue;
+          findings.push({
+            verifierId: "RH005",
+            severity: "error",
+            file: filePath,
+            line: afterView.lineAt(fn.open),
+            message: "An existing function lost its executable body and is now empty.",
+            suggestion: "Restore the implementation or remove the feature and its callers deliberately."
+          });
+        }
         const shrank = adds.length <= dels.length;
         for (const add of adds) {
           if (!isGuttedAdd(add.content)) continue;
@@ -2729,6 +3324,7 @@ var rh006 = { id: "RH006", severity: "warn", run: run6 };
 
 // src/verifiers/rh007.ts
 import path from "path";
+import picomatch4 from "picomatch";
 var CONFIG_FILE_RE = /(?:jest|vitest|vite)\.config\.(?:[mc]?[jt]s|json)$|(?:^|\/)jest\.config\.json$|tsconfig(?:\.[^/]*)?\.json$|(?:pytest\.ini|setup\.cfg|pyproject\.toml|conftest\.py)$|(?:^|\/)pom\.xml$|(?:^|\/)build\.gradle(?:\.kts)?$|(?:^|\/)Cargo\.toml$|(?:^|\/)\.rspec$|(?:^|\/)phpunit\.xml(?:\.dist)?$|\.runsettings$|(?:^|\/)CMakeLists\.txt$|\.xctestplan$|(?:^|\/)dart_test\.yaml$|(?:^|\/)build\.sbt$|(?:^|\/)\.Rbuildignore$|\.cabal$|(?:^|\/)test_helper\.exs$|(?:^|\/)\.busted$|(?:^|\/)project\.clj$/;
 var PACKAGE_JSON_RE = /(?:^|\/)package\.json$/;
 var JEST_EXCLUSION_KEY_RE = /"(testPathIgnorePatterns)"\s*:/;
@@ -2803,8 +3399,8 @@ function narrowsSelection(changes, added) {
   if (!key) return false;
   const prior = changes.find((c) => c.type === "del" && c.content.includes(key));
   if (!prior) return false;
-  const kept = new Set(patternsIn(added.content));
-  return patternsIn(prior.content).some((p) => !kept.has(p));
+  const kept = patternsIn(added.content);
+  return patternsIn(prior.content).some((p) => !kept.some((next) => next === p || key === "testMatch" && !/[?*{[]/.test(p) && picomatch4(next)(p) || key === "testMatch" && next.startsWith("**/") && picomatch4(next.slice(3))(p.split("/").pop() ?? p)));
 }
 var EXCLUSION_PATTERNS = [
   { re: /testPathIgnorePatterns/, key: "testPathIgnorePatterns", severity: "error", langs: ["js"] },
@@ -2995,6 +3591,16 @@ function run7(context) {
       const testSuiteNameMatch = chunk.changes.map((c) => c.content.match(/\btest-suite\s+([A-Za-z0-9_-]+)/i)).find((m) => m !== null);
       for (const change of chunk.changes) {
         if (change.type !== "add") continue;
+        if (lang === "js" && /\bpassWithNoTests\s*:\s*true\b|"passWithNoTests"\s*:\s*true\b/.test(change.content) && !chunk.changes.some((c) => c.type === "del" && /passWithNoTests["']?\s*:\s*true\b/.test(c.content))) {
+          findings.push({
+            verifierId: "RH007",
+            severity: "error",
+            file: filePath,
+            line: change.ln,
+            message: "Test discovery now succeeds when it finds no tests.",
+            suggestion: "Keep empty test discovery failing so an accidentally detached suite cannot report success."
+          });
+        }
         const matched = matchExclusion(change.content, lang);
         if (!matched) continue;
         const { pattern, afterMatch } = matched;
@@ -3403,7 +4009,9 @@ function isJustified(content) {
     (m) => m !== null
   );
   if (!match) return false;
-  return JUSTIFICATION_RE.test(content.slice(match.index + match[0].length));
+  const tail = content.slice(match.index + match[0].length);
+  if (/^\s*(?:\/\/|\/\*)\s*@ts-(?:expect-error|ignore)\b/.test(body(content)) && tail.trim().split(/\s+/).filter(Boolean).length >= 3) return true;
+  return JUSTIFICATION_RE.test(tail);
 }
 function isFilewideSuppression(content) {
   return FILEWIDE_ESLINT_DISABLE_RE.test(content) || FILEWIDE_FLAKE8_NOQA_RE.test(content) || FILEWIDE_TS_NOCHECK_RE.test(content) || FILEWIDE_MYPY_RE.test(content) || FILEWIDE_RUST_ALLOW_RE.test(content) || FILEWIDE_KOTLIN_SUPPRESS_RE.test(content) || FILEWIDE_PHPCS_IGNOREFILE_RE.test(content) || FILEWIDE_SWIFTLINT_ALL_RE.test(content) || FILEWIDE_DART_IGNOREFILE_RE.test(content) || FILEWIDE_HLINT_RE.test(content) || FILEWIDE_CREDO_FILE_RE.test(content);
@@ -3428,8 +4036,20 @@ function run11(context) {
     if (DOC_FILE_RE.test(filePath)) continue;
     if (VENDORED_PATH_RE.test(filePath.replace(/\\/g, "/"))) continue;
     const occurrences = [];
+    const identity = (text) => body(text).trim().replace(/\s*(?:\/\/|#)\s+(?:for|because|reason:)\b.*$/, "").trim();
+    const removed = /* @__PURE__ */ new Map();
+    for (const change of file.chunks.flatMap((chunk) => chunk.changes).filter((c) => c.type === "del")) {
+      const key = identity(change.content);
+      removed.set(key, (removed.get(key) ?? 0) + 1);
+    }
     for (const chunk of file.chunks) {
       for (const add of chunk.changes.filter((c) => c.type === "add")) {
+        const key = identity(add.content);
+        const remaining = removed.get(key) ?? 0;
+        if (remaining > 0) {
+          removed.set(key, remaining - 1);
+          continue;
+        }
         const line = add.ln;
         if (filewideInCode(add.content)) {
           findings.push({
@@ -3533,10 +4153,13 @@ var COMMAND_KEYS = /* @__PURE__ */ new Set(["run", "script", "command", "command
 function isCommandLine(text) {
   if (/^\s*#/.test(text)) return false;
   const key = /^[ \t]*(?:-[ \t]*)?([A-Za-z_][\w.-]*)[ \t]*:/.exec(text);
+  if (/^[ \t]*(?:-[ \t]*)?\{/.test(text)) return false;
   return key === null || COMMAND_KEYS.has(key[1].toLowerCase());
 }
 function commandKey(content) {
-  return stripDiffPrefix2(content).replace(/^-\s*/, "").replace(/^(?:run|script|command)\s*:\s*/, "").replace(/['"]/g, "").replace(/\s+/g, " ").trim().toLowerCase();
+  const command = stripDiffPrefix2(content);
+  const invocation = TEST_COMMAND_RE.exec(command);
+  return (invocation ? command.slice(invocation.index) : command).replace(/^-\s*/, "").replace(/^(?:run|script|command)\s*:\s*/, "").replace(/['"]/g, "").replace(/\s+/g, " ").trim().toLowerCase();
 }
 var RETRY_ACTION_RE = /uses\s*:\s*[\w-]+\/(?:retry|action-retry|retry-action)@/i;
 var RETRY_ATTEMPTS_RE = /max_attempts\s*:\s*([2-9]|\d{2,})/;
@@ -3740,45 +4363,83 @@ function withoutLeadingSlice(text) {
 function withoutFilter(text) {
   return withoutTrailingComment(text).replace(/\.filter\([^)]*\)/, "").replace(/\s+/g, " ").trim();
 }
-var PARAMETERIZED_RUNNER_RE = /\b(?:it|test)\.each\s*\(|pytest\.mark\.parametrize\b/;
-var TABLE_ROW_RE = /^\s*\[[^\]]+\],?\s*$/;
 var LOOP_BOUND_RE = /\bfor\s*\([^;]*;\s*([A-Za-z_$][\w$]*)\s*<\s*(\d+)\s*;/;
-function inlineRowCount(text) {
-  return [...withoutTrailingComment(text).matchAll(/\[[^\[\]]+\]/g)].length;
+function elements(view, open, end) {
+  let depth = 0;
+  let start = open + 1;
+  let count = 0;
+  const present = (from, to) => !!view.code.slice(from, to).trim() || /^\s*['"`]/.test(view.text.slice(from, to));
+  for (let i = start; i < end; i++) {
+    const ch = view.code[i];
+    if ("[{(".includes(ch)) depth++;
+    else if ("]})".includes(ch)) depth--;
+    else if (ch === "," && depth === 0) {
+      if (present(start, i)) count++;
+      start = i + 1;
+    }
+  }
+  return count + Number(present(start, end));
+}
+function parameterTables(view) {
+  const tables = [];
+  const runner = /\b(?:it|test)\.each\s*\(|\bpytest\.mark\.parametrize\s*\(/g;
+  for (const match of view.code.matchAll(runner)) {
+    const args = match.index + match[0].length - 1;
+    const argsEnd = closingDelimiter(view.code, args, "(", ")");
+    if (argsEnd < 0) continue;
+    let open = args + 1;
+    while (/\s/.test(view.code[open] ?? "") && open < argsEnd) open++;
+    let key = "";
+    if (match[0].includes("parametrize")) {
+      const comma = view.code.indexOf(",", open);
+      if (comma < 0 || comma >= argsEnd) continue;
+      key = "python:" + view.text.slice(open, comma).replace(/\s+/g, "");
+      if (key === "python:") continue;
+      open = comma + 1;
+      while (/\s/.test(view.code[open] ?? "") && open < argsEnd) open++;
+    } else {
+      const reference = /^[A-Za-z_$][\w$]*/.exec(view.code.slice(open, argsEnd));
+      if (reference) {
+        key = "binding:" + reference[0];
+        const binding = [...view.code.matchAll(/\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*\[/g)].find((binding2) => binding2[1] === reference[0]);
+        if (!binding) continue;
+        open = binding.index + binding[0].length - 1;
+      } else {
+        const title = /^\s*\(\s*(['"`])([^'"`]+)\1/.exec(view.text.slice(argsEnd + 1));
+        if (!title) continue;
+        key = "inline:" + title[2];
+      }
+    }
+    const left = view.code[open];
+    if (left !== "[" && left !== "(") continue;
+    const end = closingDelimiter(view.code, open, left, left === "[" ? "]" : ")");
+    if (end < 0) continue;
+    tables.push({ key, count: elements(view, open, end), start: open, end });
+  }
+  return tables;
 }
 function run14(context) {
   const findings = [];
   for (const file of context.files) {
     const filePath = pathOf(file);
     if (!context.isTestFile(filePath)) continue;
-    const allChanges = file.chunks.flatMap((chunk) => chunk.changes);
-    const parameterized = allChanges.some((change) => PARAMETERIZED_RUNNER_RE.test(change.content));
-    if (parameterized) {
-      const removedRows = file.chunks.flatMap(deletedLines).filter((line) => TABLE_ROW_RE.test(line.text));
-      const addedRows = file.chunks.flatMap(addedLines).filter((line) => TABLE_ROW_RE.test(line.text));
-      const netRemoved = removedRows.filter((row) => !addedRows.some((next) => next.text.trim() === row.text.trim()));
-      if (netRemoved.length > addedRows.filter((row) => !removedRows.some((prior) => prior.text.trim() === row.text.trim())).length) {
-        findings.push({
-          verifierId: "RH014",
-          severity: "error",
-          file: filePath,
-          line: netRemoved[0].line,
-          message: "Test workload reduced: a row was removed from a parameterized test table while the test itself still runs.",
-          suggestion: "Restore the removed case and fix the behavior it exposed."
-        });
-      }
-      for (const added of file.chunks.flatMap(addedLines)) {
-        const nextCount = inlineRowCount(added.text);
-        if (nextCount === 0) continue;
-        const prior = file.chunks.flatMap(deletedLines).find((line) => inlineRowCount(line.text) > nextCount);
-        if (!prior || hasExplanation(added.text)) continue;
+    if (file.deleted) continue;
+    for (const chunk of file.chunks) {
+      const before = sourceView(chunk, "before", filePath.endsWith(".py"));
+      const after = sourceView(chunk, "after", filePath.endsWith(".py"));
+      const old = parameterTables(before);
+      for (const next of parameterTables(after)) {
+        const prior = old.find((table) => table.key === next.key);
+        if (!prior || next.count >= prior.count || !after.touched(next.start, next.end)) continue;
+        if (after.text.slice(next.start, next.end).split("\n").some(hasExplanation)) continue;
+        const inline = !after.text.slice(next.start, next.end).includes("\n");
         findings.push({
           verifierId: "RH014",
           severity: "error",
           file: filePath,
-          line: added.line,
-          message: `Test workload reduced: an inline parameter table fell from ${inlineRowCount(prior.text)} cases to ${nextCount}.`,
-          suggestion: "Restore the removed inline cases and fix the behavior they expose."
+          line: after.lineAt(next.start),
+          message: inline ? `Test workload reduced: an inline parameter table fell from ${prior.count} cases to ${next.count}.` : "Test workload reduced: a row was removed from a parameterized test table while the test itself still runs.",
+          suggestion: inline ? "Restore the removed inline cases and fix the behavior they expose." : "Restore the removed case and fix the behavior it exposed."
         });
       }
     }
@@ -3965,6 +4626,128 @@ function bareCall(text) {
   );
   return match?.[1]?.replace(/\s+/g, "");
 }
+function handlers(view, indented) {
+  const result = [];
+  const opener = indented ? /^([ \t]*)(?:except\b[^:\n]*:|rescue\b[^\n]*)/gm : /\bcatch\s*(?:\([^)]*\))?\s*\{|\bif\s+([A-Za-z_]\w*)\s*!=\s*nil\s*\{/g;
+  for (const match of view.code.matchAll(opener)) {
+    const start = match.index;
+    const bodyStart = start + match[0].length;
+    let end;
+    if (!indented) end = closingDelimiter(view.code, bodyStart - 1);
+    else {
+      end = view.code.length;
+      const indent = match[1].replace(/\n/g, "").length;
+      const tail = view.code.slice(bodyStart);
+      const boundary = /\n([ \t]*)(\S)/g;
+      for (const line of tail.matchAll(boundary)) {
+        if (line[1].length <= indent) {
+          end = bodyStart + line.index + 1;
+          break;
+        }
+      }
+    }
+    if (end < 0) continue;
+    result.push({ start, end, key: compact(match[0]), code: view.code.slice(bodyStart, end), raw: view.text.slice(start, end + 1) });
+  }
+  if (!indented) for (const match of view.code.matchAll(/\.catch\s*\(\s*(?:\([^)]*\)|[A-Za-z_$][\w$]*)\s*=>\s*/g)) {
+    const start = match.index;
+    const bodyStart = start + match[0].length;
+    const open = view.code.indexOf("(", start);
+    const end = closingDelimiter(view.code, open, "(", ")");
+    if (end < 0) continue;
+    const code = view.code.slice(bodyStart, end).replace(/^\{([\s\S]*)\}$/, "$1");
+    result.push({ start, end, key: compact(match[0]), code, raw: view.text.slice(start, end + 1) });
+  }
+  return result;
+}
+function discardedHandler(code) {
+  let rest = code;
+  const logging = /\b(?:(?:console|logger|logging|log|Console|System\.err)\.(?:error|warn|warning|info|debug|trace|log|Print|Printf|Println|WriteLine|println)|error_log)\s*\(/g;
+  const ranges = [];
+  for (const match of rest.matchAll(logging)) {
+    const open = match.index + match[0].lastIndexOf("(");
+    const end = closingDelimiter(rest, open, "(", ")");
+    if (end < 0) return false;
+    ranges.push([match.index, end + 1]);
+  }
+  for (const [start, end] of ranges.reverse()) rest = rest.slice(0, start) + rest.slice(end);
+  return /^(?:\s|;|pass\b)*$/.test(rest);
+}
+function structuralSwallows(context) {
+  const findings = [];
+  for (const file of context.files) {
+    const path9 = pathOf(file);
+    if (!isWatchedSource(context, path9) || !/\.(?:[cm]?[jt]sx?|py|go|rs|java|rb|cs|php|sh|bash)$/.test(path9)) continue;
+    const indented = /\.(?:py|rb)$/.test(path9);
+    for (const chunk of file.chunks) {
+      const before = sourceView(chunk, "before", indented);
+      const after = sourceView(chunk, "after", indented);
+      const prior = handlers(before, indented);
+      for (const handler of handlers(after, indented)) {
+        if (!after.touched(handler.start, handler.end) || !discardedHandler(handler.code)) continue;
+        if (handler.raw.split("\n").some(hasExplanation)) continue;
+        if (indented && /^[ \t]*\r?\n?[ \t]*else[ \t]*:/.test(after.text.slice(handler.end))) continue;
+        const retainedOpener = chunk.changes.find((change) => change.type === "normal" && change.ln2 === after.lineAt(handler.start));
+        const previous = retainedOpener?.type === "normal" ? prior.filter((old) => before.lineAt(old.start) === retainedOpener.ln1) : prior;
+        if (previous.some((old) => old.key === handler.key && discardedHandler(old.code))) continue;
+        findings.push({
+          verifierId: "WI101",
+          severity: "error",
+          file: path9,
+          line: after.lineAt(handler.start),
+          message: "Error handling was added or changed to an empty or logging-only handler, so failures no longer propagate.",
+          suggestion: "Return an error, retry, or propagate the failure. Document a specific, deliberate fallback."
+        });
+      }
+      const removed = deletedLines(chunk);
+      for (const added of addedLines(chunk)) {
+        if (isCommentLine(added.text) || hasExplanation(added.text)) continue;
+        let discarded = false;
+        if (path9.endsWith(".rs")) {
+          const operation = (text) => compact(text.replace(/^\s*(?:let\s+[^=]+\s*=|return\s+)/, "").replace(/\?\s*;?\s*$/, "").replace(/;\s*$/, ""));
+          const lost = removed.filter((line) => /\?\s*;?\s*$/.test(line.text));
+          const replacement = added.text.replace(/^\s*let\s+_\s*=\s*/, "").replace(/\.unwrap_or_default\(\)/, "");
+          discarded = /\blet\s+_\s*=|\.unwrap_or_default\(\)/.test(added.text) && lost.some((line) => operation(line.text) === operation(replacement));
+        } else if (path9.endsWith(".go")) {
+          const assignment = /^\s*([^:=]+)(?::=|=)\s*(.+?)\s*;?\s*$/;
+          const next = assignment.exec(added.text);
+          if (next && next[1].split(",").some((binding) => binding.trim() === "_")) {
+            discarded = removed.some((line) => {
+              const old = assignment.exec(line.text);
+              if (!old || compact(old[2]) !== compact(next[2])) return false;
+              const names = old[1].split(",").map((binding) => binding.trim());
+              const slots = next[1].split(",").map((binding) => binding.trim());
+              return names.some((name, i) => slots[i] === "_" && name !== "_" && [...before.code.matchAll(/\bif\s+([A-Za-z_]\w*)\s*!=\s*nil\b/g)].some((check) => check[1] === name));
+            });
+          }
+        } else if (/\.(?:sh|bash)$/.test(path9)) {
+          const swallow = /\s*\|\|\s*(?:true|:|exit\s+0)\s*$/.exec(added.text);
+          discarded = !!swallow && removed.some((line) => compact(line.text) === compact(added.text.slice(0, swallow.index)));
+        }
+        if (discarded) findings.push({
+          verifierId: "WI101",
+          severity: "error",
+          file: path9,
+          line: added.line,
+          message: "A previously propagated operation failure is now discarded or replaced with a default.",
+          suggestion: "Preserve the operation failure or handle it explicitly instead of converting it to success."
+        });
+      }
+    }
+  }
+  return findings;
+}
+function followedByElse(lines, index) {
+  if (index < 0) return false;
+  const indent = (text) => text.length - text.trimStart().length;
+  const base = indent(lines[index].text);
+  for (const line of lines.slice(index + 1)) {
+    if (!line.text.trim()) continue;
+    if (indent(line.text) > base) continue;
+    return indent(line.text) === base && /^\s*else\s*:/.test(line.text);
+  }
+  return false;
+}
 function run15(context) {
   const findings = [];
   for (const file of context.files) {
@@ -3988,6 +4771,7 @@ function run15(context) {
     }
     for (const chunk of file.chunks) {
       const after = afterLines(chunk);
+      const lexicalLines = sourceView(chunk, "after", /\.(?:py|rb)$/.test(filePath)).code.split("\n");
       const addedInOrder = addedLines(chunk);
       const templated = insideTemplateLiteral(addedInOrder);
       const removedLoud = deletedLines(chunk).filter((line) => ERROR_DIAGNOSTIC_RE.test(line.text));
@@ -4022,7 +4806,10 @@ function run15(context) {
         if (templated.has(index)) continue;
         if (hasExplanation(added.text)) continue;
         if (isCommentLine(added.text)) continue;
+        const lexicalIndex = after.findIndex((line) => line.line === added.line && line.added);
+        if (lexicalIndex >= 0 && !lexicalLines[lexicalIndex]?.trim()) continue;
         const code = withoutLiterals(added.text);
+        if (/^\s*except\b/.test(code) && followedByElse(after, after.findIndex((l) => l.line === added.line && l.added))) continue;
         const inline = INLINE_SIGNATURES.find((sig) => sig.opener.test(code));
         if (inline) {
           findings.push({
@@ -4065,7 +4852,8 @@ function run15(context) {
       }
     }
   }
-  return findings;
+  const combined = [...findings, ...structuralSwallows(context)];
+  return combined.filter((finding, index) => !combined.slice(0, index).some((prior) => prior.file === finding.file && prior.line === finding.line && prior.severity === finding.severity));
 }
 var wi101 = { id: "WI101", severity: "error", run: run15 };
 
@@ -4878,6 +5666,7 @@ function assertionKey(text) {
 var TABLE_RUNNER_RE = /\.each\b|\bit_each\b|@pytest\.mark\.parametrize|@ParameterizedTest\b|\[InlineData\b|\[Theory\]|\bfor\s+(?:const|let|var)?\s*[\w[\],{} ]+\s+(?:of|in)\s+\w*(?:case|test|table|fixture|sample|scenario|example)\w*\b|\bfor\s+\w+,\s*\w+\s*:=\s*range\b|\.forEach\s*\(|\btests\s*:?=\s*\[\]struct\b/i;
 function isDataRow(text) {
   const stripped = withoutTrailingComment(text);
+  if (/^\s*[A-Za-z_$][\w$.]*\s*\(/.test(stripped) && !TABLE_RUNNER_RE.test(stripped)) return false;
   if (!/[[{]/.test(stripped)) return false;
   const literals = stripped.match(/-?\d+(?:\.\d+)?|'[^']*'|"[^"]*"|`[^`]*`|\btrue\b|\bfalse\b|\bTrue\b|\bFalse\b/g);
   return (literals?.length ?? 0) >= 2;
@@ -4915,12 +5704,20 @@ function run23(context) {
   for (const file of context.files) {
     const filePath = pathOf(file);
     if (!filePath || !context.isTestFile(filePath)) continue;
-    const hasTableRunner = file.chunks.some(
-      (chunk) => chunk.changes.some((change) => TABLE_RUNNER_RE.test(change.content.replace(/^[+\- ]/, "")))
-    );
+    const hasTableRunner = file.chunks.some((chunk) => TABLE_RUNNER_RE.test(sourceView(chunk, "after", /\.(?:py|rb)$/.test(filePath)).code));
     for (const chunk of file.chunks) {
-      const removedBindings = deletedLines(chunk).map((line) => expectedBinding(line.text)).filter((binding) => binding !== void 0);
-      for (const added of addedLines(chunk)) {
+      const before = sourceView(chunk, "before", /\.(?:py|rb)$/.test(filePath));
+      const after = sourceView(chunk, "after", /\.(?:py|rb)$/.test(filePath));
+      const codeAt = (view, line) => {
+        const offset = view.offsetAtLine(line);
+        if (offset === void 0) return "";
+        const end = view.code.indexOf("\n", offset);
+        return view.code.slice(offset, end < 0 ? void 0 : end);
+      };
+      const removedLines = deletedLines(chunk).filter((line) => codeAt(before, line.line).trim());
+      const additions = addedLines(chunk).filter((line) => codeAt(after, line.line).trim());
+      const removedBindings = removedLines.map((line) => expectedBinding(line.text)).filter((binding) => binding !== void 0);
+      for (const added of additions) {
         const binding = expectedBinding(added.text);
         if (!binding) continue;
         const prior = removedBindings.find((old) => old.name === binding.name && old.value !== binding.value);
@@ -4934,9 +5731,9 @@ function run23(context) {
           suggestion: "Change the implementation, not the expected/want binding. If the specification changed, record that reason and update the implementation in the same reviewable change."
         });
       }
-      const removed = deletedLines(chunk).map((l) => ({ line: l, value: expectedLiteral(l.text), key: assertionKey(l.text) })).filter((x) => x.value !== void 0);
+      const removed = removedLines.map((l) => ({ line: l, value: expectedLiteral(l.text), key: assertionKey(l.text) })).filter((x) => x.value !== void 0);
       if (removed.length > 0) {
-        for (const added of addedLines(chunk)) {
+        for (const added of additions) {
           const value = expectedLiteral(added.text);
           if (value === void 0) continue;
           const key = assertionKey(added.text);
@@ -4953,8 +5750,9 @@ function run23(context) {
         }
       }
       if (!hasTableRunner) continue;
-      const removedRows = deletedLines(chunk).filter((line) => isDataRow(line.text));
-      for (const added of addedLines(chunk).filter((line) => isDataRow(line.text))) {
+      const removedRows = removedLines.filter((line) => isDataRow(line.text));
+      const removedTexts = new Set(removedLines.map((line) => line.text.trim()));
+      for (const added of additions.filter((line) => isDataRow(line.text) && !removedTexts.has(line.text.trim()))) {
         const pair = removedRows.map((prior) => changedTableExpectation(prior.text, added.text)).find((value) => value !== void 0);
         if (!pair) continue;
         findings.push({
@@ -4976,7 +5774,7 @@ var wi109 = { id: "WI109", severity: "error", run: run23 };
 import path6 from "path";
 var TASK_FILE_RE = /(?:^|\/)package\.json$|(?:^|\/)Makefile$|(?:^|\/)Taskfile\.ya?ml$|(?:^|\/)justfile$|(?:^|\/)pyproject\.toml$|(?:^|\/)Rakefile$|(?:^|\/)composer\.json$/i;
 var VERIFICATION_SCRIPT_RE = /"(test|tests|check|lint|typecheck|type-check|tsc|verify|validate|ci|coverage|audit)[\w:-]*"\s*:/i;
-var REAL_VERIFIER_RE = /\b(?:vitest|jest|mocha|ava|pytest|tox|nox|rspec|phpunit|cargo\s+test|go\s+test|dotnet\s+test|mvn|gradle|swift\s+test|mix\s+test|bats|busted|prove|tsc|eslint|ruff|flake8|mypy|pylint|clippy|rubocop|phpstan|stylelint|biome)\b|\bnpm\s+(?:run\s+)?(?:test|\w+)|\bpytest\b/;
+var REAL_VERIFIER_RE = /\b(?:vitest|jest|mocha|ava|pytest|tox|nox|rspec|phpunit|cargo\s+test|go\s+test|dotnet\s+test|mvn|gradle|swift\s+test|mix\s+test|bats|busted|prove|tsc|eslint|ruff|flake8|mypy|pylint|clippy|rubocop|phpstan|stylelint|biome)\b|\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|check|lint|build|typecheck|verify|coverage|audit)[\w:-]*\b|\bnode\s+--test\b/;
 var NO_OP_COMMAND_RE = /^\s*(?:echo\b|true\b|:\s*$|exit\s+0\b|#|node\s+-e\s+["']["']|cd\s+\.)/;
 var NEUTERING_SIGNATURES = [
   {
@@ -5032,8 +5830,8 @@ var SNAPSHOT_UPDATE_RE = /(?:^|\s)(?:-u|--update|--updateSnapshot)\b/;
 function verifierTool(text) {
   return /\b(vitest|jest|mocha|ava|pytest|tox|nox|rspec|phpunit|cargo\s+test|go\s+test|dotnet\s+test)\b/.exec(text)?.[1] ?? (/\bnpm\s+(?:run\s+)?test\b/.test(text) ? "npm test" : void 0);
 }
-var PROPAGATED_EXIT_RE = /\b(?:process\.exit|sys\.exit|os\.exit|os\._exit)\s*\(\s*([^)]+?)\s*\)|^\s*exit\s+(\$\{?\w+\}?)\s*(?:#.*)?$/;
-var FORCED_EXIT_ZERO_RE = /\b(?:process\.exit|sys\.exit|os\.exit|os\._exit)\s*\(\s*0\s*\)|^\s*exit\s+0\s*(?:#.*)?$/;
+var PROPAGATED_EXIT_RE = /\b(?:process\.exit|sys\.exit|os\.(?:exit|_exit|Exit)|(?:std::)?process::exit|System\.exit|Environment\.Exit|exit|die)\s*\(\s*([^)]+?)\s*\)|^\s*exit\s+(\$\{?\w+\}?)\s*(?:#.*)?$/;
+var FORCED_EXIT_ZERO_RE = /\b(?:process\.exit|sys\.exit|os\.(?:exit|_exit|Exit)|(?:std::)?process::exit|System\.exit|Environment\.Exit|exit|die)\s*\(\s*0\s*\)|^\s*exit\s+0\s*(?:#.*)?$/;
 var PROPAGATED_EXIT_CODE_RE = /\bprocess\.exitCode\s*=\s*([^;]+?)\s*;?\s*$/;
 var FORCED_EXIT_CODE_ZERO_RE = /\bprocess\.exitCode\s*=\s*0\s*;?\s*$/;
 function exitStatus(text) {
@@ -5045,9 +5843,9 @@ function exitStatus(text) {
   return (m[1] ?? m[2])?.trim();
 }
 function laundersStatus(text, status) {
-  const compact = withoutTrailingComment(text).replace(/\s+/g, "");
+  const compact3 = withoutTrailingComment(text).replace(/\s+/g, "");
   const value = status.replace(/\s+/g, "");
-  return compact.includes(`process.exit(${value}?0:${value})`) || compact.includes(`process.exitCode=Math.min(${value},0)`);
+  return compact3.includes(`process.exit(${value}?0:${value})`) || compact3.includes(`process.exitCode=Math.min(${value},0)`);
 }
 function scriptCommand(text) {
   const m = /"[\w:-]+"\s*:\s*"([^"]*)"/.exec(text);
@@ -5108,7 +5906,7 @@ function run24(context) {
         });
       }
       const after = afterLines(chunk);
-      const afterRunsVerification = after.some((line) => REAL_VERIFIER_RE.test(line.text));
+      const afterRunsVerification = after.some((line) => !isCommentLine(line.text) && REAL_VERIFIER_RE.test(line.text));
       const failFastShell = after.some((line) => /\bset\s+-[a-z]*e\b/.test(line.text));
       const backgroundStatusPropagated = after.some((line) => /^\s*wait\b/.test(line.text)) && after.some((line) => /^\s*exit\s+\$\?\s*$/.test(line.text));
       for (const line of added) {
@@ -5238,7 +6036,29 @@ function run24(context) {
         });
         if (!newEntry) continue;
         const newCommand = scriptCommand(newEntry.text) ?? "";
-        const dropped = oldSteps.filter((s) => REAL_VERIFIER_RE.test(s) && !newCommand.includes(s));
+        const entries = new Map(file.chunks.flatMap(afterLines).flatMap((line) => scriptEntries(line.text)).map((entry) => [entry.name, entry.command]));
+        const expand2 = (command, seen = /* @__PURE__ */ new Set()) => {
+          let expanded = command;
+          for (const call of command.matchAll(/\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?([\w:-]+)/g)) {
+            const name = call[1];
+            if (seen.has(name) || seen.size >= 20) continue;
+            const target = entries.get(name);
+            if (target) expanded += " && " + expand2(target, /* @__PURE__ */ new Set([...seen, name]));
+          }
+          return expanded;
+        };
+        const expandedCommand = expand2(newCommand);
+        const dropped = oldSteps.filter((s) => {
+          const invocation = REAL_VERIFIER_RE.exec(s);
+          if (!invocation || expandedCommand.includes(s)) return false;
+          const tail = s.slice(invocation.index);
+          if (expandedCommand.includes(tail)) return false;
+          const testTool = (command) => /\b(?:vitest|jest|mocha|ava|pytest|tox|rspec|phpunit)\b|\bnode\s+--test\b/.exec(command)?.[0];
+          const priorTool = testTool(s);
+          const nextTool = testTool(newCommand);
+          const importsMigrated = context.files.some((candidate) => candidate.chunks.some((change) => deletedLines(change).some((line) => /\bimport\b|\brequire\s*\(/.test(line.text) && !!priorTool && line.text.includes(priorTool)) && addedLines(change).some((line) => /\bimport\b|\brequire\s*\(/.test(line.text) && /['"](?:node:test|vitest|jest|mocha|ava)['"]/.test(line.text))));
+          return !(priorTool && nextTool && priorTool !== nextTool && importsMigrated);
+        });
         if (dropped.length === 0) continue;
         findings.push({
           verifierId: "WI110",
@@ -5543,7 +6363,7 @@ var VERIFIERS = [
 ];
 
 // src/engine.ts
-import picomatch4 from "picomatch";
+import picomatch5 from "picomatch";
 var norm = (p) => p.replace(/\\/g, "/");
 async function runChecks(context) {
   const activeVerifiers = VERIFIERS.filter((v) => context.enabled.includes(v.id));
@@ -5583,7 +6403,7 @@ function applySuppression(findings, files) {
 var GLOB_OPTIONS = { dot: true };
 function applyIgnorePatterns(findings, patterns) {
   if (patterns.length === 0 || findings.length === 0) return findings;
-  const matchesIgnoredPath = picomatch4(patterns, GLOB_OPTIONS);
+  const matchesIgnoredPath = picomatch5(patterns, GLOB_OPTIONS);
   return findings.filter((f) => !matchesIgnoredPath(norm(f.file)));
 }
 function applyApprovals(findings, approvals) {
@@ -5591,7 +6411,7 @@ function applyApprovals(findings, approvals) {
   return findings.map((f) => {
     const path9 = norm(f.file);
     const match = approvals.find(
-      (a) => a.rule === f.verifierId && (norm(a.file) === path9 || picomatch4(norm(a.file), GLOB_OPTIONS)(path9))
+      (a) => a.rule === f.verifierId && (norm(a.file) === path9 || picomatch5(norm(a.file), GLOB_OPTIONS)(path9))
     );
     if (!match) return f;
     return { ...f, severity: "info", approved: true, approvalReason: match.reason };
@@ -5660,6 +6480,24 @@ function jsonReport(findings) {
 
 // src/reporters/sarif.ts
 import { createHash } from "crypto";
+
+// src/dynamic/metadata.ts
+var DYNAMIC_METADATA = Object.fromEntries([
+  ["DY001", "OriginalTestRegression", "Previously passing original tests fail on new code"],
+  ["DY002", "NumericBranchContradiction", "A literal branch contradicts an executed numeric, string or boolean reference"],
+  ["DY003", "ExpectedLiteralContradiction", "An expectation-only edit changes a test outcome on unchanged code"],
+  ["DY004", "SurvivingSourceMutation", "A changed statement in a called function can be mutated without a failing test"],
+  ["DY005", "InconsistentRepeatedTest", "A test with a new sleep or retry has inconsistent outcomes"]
+].map(([id, name, description]) => [id, {
+  name,
+  shortDescription: description,
+  fullDescription: `${description}. Opt-in runtime evidence is heuristic and cannot establish intent. See README for the exact scope and limits.`,
+  defaultLevel: "warning",
+  fix: "Review the named commands and results, correct the behavior or test, and add a focused regression test.",
+  helpUri: "https://github.com/catfish-1234/proctor#dynamic-checks"
+}]));
+
+// src/reporters/sarif.ts
 function levelFor(severity) {
   if (severity === "error") return "error";
   if (severity === "warn") return "warning";
@@ -5669,7 +6507,7 @@ function fingerprint(verifierId, file, line) {
   return createHash("sha256").update(`${verifierId}:${file}:${line}`).digest("hex");
 }
 function sarifReport(findings) {
-  const rules = Object.entries(RULE_METADATA).map(([id, meta]) => ({
+  const rules = Object.entries({ ...RULE_METADATA, ...Object.fromEntries(Object.entries(DYNAMIC_METADATA).filter(([id]) => findings.some((f) => f.verifierId === id))) }).map(([id, meta]) => ({
     id,
     name: meta.name,
     shortDescription: { text: meta.shortDescription },
@@ -7181,13 +8019,13 @@ async function readStdin() {
 }
 var program = new Command();
 program.name("proctor").description("AI agent test-tampering guard").version(package_default.version);
-program.command("check [path]").description("Check staged, unstaged, and untracked changes for test tampering").option("--staged", "analyze only staged changes").option("--uncommitted", "explicitly analyze the default scope: staged, unstaged, and untracked changes together").option("--base <ref>", "analyze changes against a base ref (e.g. origin/main or a commit SHA) instead of staged/working-tree changes, for CI, where nothing is staged in a fresh checkout").option("--ci", "show only errors in the text report; warnings do not affect the exit code").option("--json", "output findings as JSON to stdout").option("--sarif", "output SARIF 2.1.0 JSON to stdout").option("--ai", "enable the networked LLM judge (requires ANTHROPIC_API_KEY)").option("--rules <ids>", "comma-separated list of verifier IDs to run (narrows the enabled set, e.g. RH001,RH003)").option("--wi", "also run the beta work-integrity family (WI1xx), which is opt-in by default").option("--all-checks", "alias for --wi: add the beta WI family to the configured checks").option("--explain <id>", "print the full explanation for a verifier ID and exit, no diff analysis").option("--fix", "with --explain, print what an honest fix looks like instead of the rule description").option("--markdown <file>", 'also write a Markdown summary to this file, e.g. --markdown "$GITHUB_STEP_SUMMARY"').action(async (pathArg, options) => {
+program.command("check [path]").description("Check staged, unstaged, and untracked changes for test tampering").option("--staged", "analyze only staged changes").option("--uncommitted", "explicitly analyze the default scope: staged, unstaged, and untracked changes together").option("--base <ref>", "analyze changes against a base ref (e.g. origin/main or a commit SHA) instead of staged/working-tree changes, for CI, where nothing is staged in a fresh checkout").option("--ci", "show only errors in the text report; warnings do not affect the exit code").option("--json", "output findings as JSON to stdout").option("--sarif", "output SARIF 2.1.0 JSON to stdout").option("--dynamic", "run isolated extra checks using the project tests (opt-in)").option("--dynamic-timeout <ms>", "overall dynamic budget in milliseconds (default 60000)").option("--ai", "enable the networked LLM judge (requires ANTHROPIC_API_KEY)").option("--rules <ids>", "comma-separated list of verifier IDs to run (narrows the enabled set, e.g. RH001,RH003)").option("--wi", "also run the remaining opt-in work-integrity checks (WI1xx)").option("--all-checks", "alias for --wi: add the entire WI family to the configured checks").option("--explain <id>", "print the full explanation for a verifier ID and exit, no diff analysis").option("--fix", "with --explain, print what an honest fix looks like instead of the rule description").option("--markdown <file>", 'also write a Markdown summary to this file, e.g. --markdown "$GITHUB_STEP_SUMMARY"').action(async (pathArg, options) => {
   if (options.fix && !options.explain) {
     process.stderr.write("proctor: --fix only applies with --explain, e.g. proctor check --explain RH001 --fix\n");
     process.exit(2);
   }
   if (options.explain) {
-    const meta = RULE_METADATA[options.explain];
+    const meta = RULE_METADATA[options.explain] ?? DYNAMIC_METADATA[options.explain];
     if (!meta) {
       process.stderr.write(`proctor: unknown verifier ID '${options.explain}'
 `);
@@ -7237,6 +8075,10 @@ Honest fix: proctor check --explain ${options.explain} --fix
 `);
     process.exit(0);
   }
+  if (options.dynamicTimeout !== void 0 && (!Number.isSafeInteger(Number(options.dynamicTimeout)) || Number(options.dynamicTimeout) < 1 || Number(options.dynamicTimeout) > 2147483647)) {
+    process.stderr.write("proctor: --dynamic-timeout must be an integer from 1 to 2147483647 milliseconds\n");
+    process.exit(2);
+  }
   const selectedScopes = [options.base !== void 0, options.staged === true, options.uncommitted === true].filter(Boolean).length;
   if (selectedScopes > 1) {
     process.stderr.write("proctor: choose only one diff scope: --staged, --uncommitted, or --base <ref>\n");
@@ -7302,6 +8144,24 @@ Honest fix: proctor check --explain ${options.explain} --fix
     process.exitCode = 3;
     return;
   }
+  if (options.dynamic || ctx.dynamic === true) {
+    const { runDynamic: runDynamic2 } = await Promise.resolve().then(() => (init_runner(), runner_exports));
+    const dynamic = await runDynamic2({
+      cwd,
+      workerPath: fileURLToPath3(new URL("./dynamic-worker.js", import.meta.url)),
+      base: options.base,
+      staged: options.staged,
+      files,
+      testPathGlobs: ctx.testPathGlobs,
+      timeoutMs: options.dynamicTimeout !== void 0 ? Number(options.dynamicTimeout) : ctx.dynamicTimeoutMs
+    });
+    findings.push(...dynamic.findings);
+    process.stderr.write(dynamic.status === "skipped" ? `dynamic: skipped, ${dynamic.reason}
+` : `dynamic: completed, ${dynamic.runs.length} runs, ${dynamic.findings.length} findings, ${dynamic.elapsedMs}ms
+`);
+    for (const note of dynamic.notes) process.stderr.write(`dynamic: ${note}
+`);
+  }
   if (options.markdown) {
     try {
       await appendFile(options.markdown, markdownReport(findings) + "\n", "utf8");
@@ -7313,7 +8173,7 @@ Honest fix: proctor check --explain ${options.explain} --fix
   if (options.sarif) {
     const sarif = sarifReport(findings);
     const hasError2 = findings.some((f) => f.severity === "error");
-    const hasWarn2 = findings.some((f) => f.severity === "warn");
+    const hasWarn2 = findings.some((f) => f.severity === "warn" && !["DY002", "DY004"].includes(f.verifierId));
     await new Promise((resolve4) => {
       process.stdout.write(sarif + "\n", () => {
         process.exitCode = hasError2 ? 2 : hasWarn2 && !options.ci ? 1 : 0;
@@ -7332,7 +8192,7 @@ Honest fix: proctor check --explain ${options.explain} --fix
     if (receipt.status === "honest-pass" && receipt.approvedCount === 0 && !options.ci) process.stdout.write(badgeLine(receipt) + "\n");
   }
   const hasError = findings.some((f) => f.severity === "error");
-  const hasWarn = findings.some((f) => f.severity === "warn");
+  const hasWarn = findings.some((f) => f.severity === "warn" && !["DY002", "DY004"].includes(f.verifierId));
   process.exitCode = hasError ? 2 : hasWarn && !options.ci ? 1 : 0;
 });
 program.command("install-hook").description("Install git pre-commit hook").action(async () => {
@@ -7348,7 +8208,7 @@ program.command("stop-hook").description("Claude Code Stop hook: reads stdin JSO
   process.exit(exitCode);
 });
 program.command("install-claude-hook").description("Install Claude Code Stop hook").option("--global", "write to ~/.claude/settings.json").action(async (options) => {
-  const result = await installStopHook(options.global ? join14(homedir(), ".claude") : join14(process.cwd(), ".claude"));
+  const result = await installStopHook(options.global ? join15(homedir(), ".claude") : join15(process.cwd(), ".claude"));
   if (result.status === "invalid-json") {
     process.stderr.write(`proctor: ${result.path} exists but is not valid JSON; fix it manually and re-run
 `);
@@ -7380,7 +8240,7 @@ program.command("setup").description("One-command install: writes the ruleset to
     process.exitCode = 1;
   }
   if (targets.some((a) => a.id === "claude-code")) {
-    const stop = await installStopHook(join14(cwd, ".claude"));
+    const stop = await installStopHook(join15(cwd, ".claude"));
     if (stop.status === "invalid-json") {
       process.stderr.write(`proctor: ${stop.path} is not valid JSON, so the Stop hook was not installed; fix it and re-run
 `);
@@ -7593,7 +8453,7 @@ program.command("approve <rule> <file>").description("Record a genuine test chan
     process.stderr.write("proctor: --reason cannot be empty\n");
     process.exit(2);
   }
-  const configPath = join14(process.cwd(), "proctor.config.json");
+  const configPath = join15(process.cwd(), "proctor.config.json");
   let config = {};
   try {
     config = JSON.parse(await readFile11(configPath, "utf8"));