@nebulacomponents/citable 0.1.0

package/src/detectors/arch.js

@@ -0,0 +1,154 @@
+import { defineDetector, indexTargets, pageSubject, entrySubject, sitePageFor } from './framework.js';
+
+const D = [];
+
+D.push(defineDetector({
+  id: 'ARCH-001', name: 'Orphan page', namespace: 'ARCH',
+  description: 'An index-target page receives no internal links from any other audited page.',
+  discipline: ['seo', 'aeo'], severity: 'high', deterministic: true, requires: ['site'],
+  impact: { retrieval: 'high', ranking: 'medium' },
+  applicable_requirement: 'SEO §3 no orphan pages; AEO §9 eliminate orphan pages',
+  remediation: 'Link the page from its topic hub and at least one relevant contextual page.',
+  verification: 'Rebuild the internal link graph and confirm at least one inbound link.',
+  check(ctx) {
+    const root = ctx.site.normalize(new URL('/', ctx.site.baseUrl).href);
+    return indexTargets(ctx)
+      .filter((p) => ctx.site.normalize(p.url) !== root)
+      .filter((p) => (ctx.site.inbound.get(ctx.site.normalize(p.url)) || []).length === 0)
+      .map((p) => ({
+        subject: pageSubject(p),
+        summary: 'Page has no inbound internal links (orphan)',
+        evidence: ['0 inbound internal links in audited link graph'],
+      }));
+  },
+}));
+
+D.push(defineDetector({
+  id: 'ARCH-002', name: 'Dead-end page', namespace: 'ARCH',
+  description: 'A page has no outbound internal links; users and crawlers cannot continue anywhere.',
+  discipline: ['seo'], severity: 'medium', deterministic: true, requires: ['site'],
+  impact: { ranking: 'low', conversion: 'medium' },
+  applicable_requirement: 'SEO §3 internal links: link upward, laterally, and to the commercial next step',
+  remediation: 'Add links to the topic hub, related material, and the relevant commercial next step.',
+  verification: 'Confirm at least one outbound internal link.',
+  check(ctx) {
+    return indexTargets(ctx)
+      .filter((p) => p.status === 200 && (ctx.site.outbound.get(ctx.site.normalize(p.url)) || []).length === 0)
+      .map((p) => ({
+        subject: pageSubject(p),
+        summary: 'Page has no outbound internal links (dead end)',
+        evidence: ['0 outbound internal links in audited link graph'],
+      }));
+  },
+}));
+
+D.push(defineDetector({
+  id: 'ARCH-003', name: 'Excessive crawl depth', namespace: 'ARCH',
+  description: 'An index-target page requires more than the configured number of clicks from the home page.',
+  discipline: ['seo'], severity: 'medium', deterministic: true, requires: ['site'],
+  impact: { retrieval: 'medium', ranking: 'medium' },
+  applicable_requirement: 'SEO §3 shallow access to important pages',
+  remediation: 'Add hub or navigation links to reduce click depth for important pages.',
+  verification: 'Recompute shortest-path depth from the home page.',
+  check(ctx) {
+    const max = ctx.config?.audit?.max_crawl_depth ?? 4;
+    return indexTargets(ctx)
+      .filter((p) => {
+        const d = ctx.site.depth.get(ctx.site.normalize(p.url));
+        return d !== undefined && d > max;
+      })
+      .map((p) => ({
+        subject: pageSubject(p),
+        summary: `Page is ${ctx.site.depth.get(ctx.site.normalize(p.url))} clicks from home (max ${max})`,
+        evidence: [`crawl depth: ${ctx.site.depth.get(ctx.site.normalize(p.url))}`],
+      }));
+  },
+}));
+
+D.push(defineDetector({
+  id: 'ARCH-004', name: 'Duplicate query target', namespace: 'ARCH',
+  description: 'Two or more registry pages target the same query — internal competition for one intent.',
+  discipline: ['seo', 'aeo'], severity: 'high', deterministic: true, requires: ['registries'],
+  impact: { ranking: 'high', citation: 'medium' },
+  applicable_requirement: 'SEO §3 one canonical URL per primary intent; AEO §9 one clear canonical answer page per question',
+  remediation: 'Consolidate the overlapping pages or re-target one of them; record the decision in the page registry.',
+  verification: 'Each query_id appears in target_queries of at most one active page.',
+  check(ctx) {
+    const byQuery = new Map();
+    for (const p of ctx.registries.pages?.entries || []) {
+      if (p.status === 'retired') continue;
+      for (const q of p.target_queries || []) {
+        if (!byQuery.has(q)) byQuery.set(q, []);
+        byQuery.get(q).push(p.page_id);
+      }
+    }
+    return [...byQuery.entries()]
+      .filter(([, pages]) => pages.length > 1)
+      .map(([q, pages]) => ({
+        subject: { type: 'query', identifier: q },
+        summary: `Query ${q} is targeted by ${pages.length} pages: ${pages.join(', ')}`,
+        evidence: pages.map((p) => `pages/${p} targets ${q}`),
+      }));
+  },
+}));
+
+D.push(defineDetector({
+  id: 'ARCH-005', name: 'Overlapping primary intent', namespace: 'ARCH',
+  description: 'Two active registry pages declare the same primary intent and share a primary entity.',
+  discipline: ['seo'], severity: 'medium', deterministic: true, requires: ['registries'],
+  impact: { ranking: 'medium' },
+  applicable_requirement: 'SEO §3 consolidated duplicate or overlapping pages; §9 detectors: overlapping intent',
+  remediation: 'Differentiate the intents explicitly or consolidate the pages.',
+  verification: 'No two active pages share identical primary_intent and a primary entity.',
+  check(ctx) {
+    const entries = (ctx.registries.pages?.entries || []).filter((p) => p.status !== 'retired' && p.primary_intent);
+    const hits = [];
+    for (let i = 0; i < entries.length; i++) {
+      for (let j = i + 1; j < entries.length; j++) {
+        const a = entries[i], b = entries[j];
+        if (a.primary_intent === b.primary_intent && (a.primary_entities || []).some((e) => (b.primary_entities || []).includes(e))) {
+          hits.push({
+            subject: entrySubject('pages', `${a.page_id}+${b.page_id}`),
+            summary: `Pages ${a.page_id} and ${b.page_id} share primary intent "${a.primary_intent}" and a primary entity`,
+            evidence: [`${a.page_id}: intent=${a.primary_intent}, entities=${(a.primary_entities || []).join('/')}`, `${b.page_id}: intent=${b.primary_intent}, entities=${(b.primary_entities || []).join('/')}`],
+          });
+        }
+      }
+    }
+    return hits;
+  },
+}));
+
+D.push(defineDetector({
+  id: 'ARCH-006', name: 'Page without topic-hub relationship', namespace: 'ARCH',
+  description: 'A non-hub content page has no internal link to any hub/category page.',
+  discipline: ['seo', 'aeo'], severity: 'low', deterministic: true, requires: ['site', 'registries'],
+  impact: { ranking: 'medium' },
+  applicable_requirement: 'SEO §3 clear hub-and-spoke relationships; AEO §9 link back to canonical topic hubs',
+  remediation: 'Add an upward link from the page to its topic hub.',
+  verification: 'Page links to at least one page registered as hub/category.',
+  check(ctx) {
+    const hubs = new Set(
+      (ctx.registries.pages?.entries || [])
+        .filter((p) => ['hub', 'category', 'home'].includes(p.page_type))
+        .map((p) => ctx.site.normalize(new URL(p.url, ctx.site.baseUrl).href))
+    );
+    if (hubs.size === 0) return [];
+    const hits = [];
+    for (const reg of (ctx.registries.pages?.entries || []).filter((p) => !['hub', 'category', 'home', 'legal', 'policy', 'contact'].includes(p.page_type) && p.status !== 'retired')) {
+      const page = sitePageFor(ctx, reg);
+      if (!page) continue;
+      const out = ctx.site.outbound.get(ctx.site.normalize(page.url)) || [];
+      if (!out.some((e) => hubs.has(e.to))) {
+        hits.push({
+          subject: pageSubject(page),
+          summary: `Page ${reg.page_id} has no link to any registered topic hub`,
+          evidence: [`outbound internal links: ${out.length}; none targets a hub/category/home page`],
+        });
+      }
+    }
+    return hits;
+  },
+}));
+
+export default D;

package/src/detectors/claim.js

@@ -0,0 +1,230 @@
+import { defineDetector, indexTargets, pageSubject, entrySubject } from './framework.js';
+import { isPastDate } from '../shared/io.js';
+
+const D = [];
+
+const SUPERLATIVE_RX = /\b(the (best|leading|top|most (advanced|powerful|trusted|secure)|fastest|#?1|number one|first and only)|world[- ]class|industry[- ]leading|unmatched|unrivalled|unrivaled|best[- ]in[- ]class)\b/i;
+
+function evidenceById(ctx) {
+  return new Map((ctx.registries.evidence?.entries || []).map((e) => [e.evidence_id, e]));
+}
+
+D.push(defineDetector({
+  id: 'CLAIM-001', name: 'Verified claim without evidence', namespace: 'CLAIM',
+  description: 'A claim is marked verified but references no evidence entries.',
+  discipline: ['aeo', 'geo'], severity: 'critical', deterministic: true, requires: ['registries'],
+  impact: { legal: 'high', reputational: 'high', citation: 'medium' },
+  applicable_requirement: 'Premise 3.5: owned claims require evidence; acceptance criterion 11: claims cannot become verified without evidence',
+  remediation: 'Attach verified evidence or downgrade the claim to insufficient_evidence.',
+  verification: 'Every verified claim lists at least one evidence id.',
+  check(ctx) {
+    return (ctx.registries.claims?.entries || [])
+      .filter((c) => ['verified', 'verified_narrowed'].includes(c.status) && (c.evidence || []).length === 0)
+      .map((c) => ({
+        subject: entrySubject('claims', c.claim_id),
+        summary: `Claim "${truncate(c.claim)}" is marked ${c.status} with no evidence`,
+        evidence: [`claims/${c.claim_id}: status=${c.status}, evidence=[]`],
+      }));
+  },
+}));
+
+D.push(defineDetector({
+  id: 'CLAIM-002', name: 'Verified claim depends on expired or revoked evidence', namespace: 'CLAIM',
+  description: 'All evidence supporting a verified claim is expired, stale, revoked, or inaccessible.',
+  discipline: ['aeo', 'geo'], severity: 'high', deterministic: true, requires: ['registries'],
+  impact: { legal: 'high', reputational: 'high' },
+  applicable_requirement: 'Acceptance criterion 12: expired evidence invalidates dependent claims; §8.5 substantiate outcomes',
+  remediation: 'Re-validate with current evidence or downgrade the claim status.',
+  verification: 'At least one supporting evidence entry is verified/reviewed and unexpired.',
+  check(ctx) {
+    const ev = evidenceById(ctx);
+    const hits = [];
+    for (const c of (ctx.registries.claims?.entries || []).filter((c) => ['verified', 'verified_narrowed'].includes(c.status) && (c.evidence || []).length > 0)) {
+      const statuses = (c.evidence || []).map((id) => {
+        const e = ev.get(id);
+        if (!e) return `${id}: missing`;
+        if (['revoked', 'stale', 'inaccessible'].includes(e.verification_status)) return `${id}: ${e.verification_status}`;
+        if (isPastDate(e.valid_until, ctx.refDate)) return `${id}: expired ${e.valid_until}`;
+        return null;
+      });
+      if (statuses.every((s) => s !== null)) {
+        hits.push({
+          subject: entrySubject('claims', c.claim_id),
+          summary: `Claim "${truncate(c.claim)}" remains ${c.status} but no supporting evidence is currently valid`,
+          evidence: statuses,
+        });
+      }
+    }
+    return hits;
+  },
+}));
+
+D.push(defineDetector({
+  id: 'CLAIM-003', name: 'Claim active after expiry', namespace: 'CLAIM',
+  description: 'A claim has passed its expires date but is not marked expired/retired.',
+  discipline: ['aeo', 'geo'], severity: 'high', deterministic: true, requires: ['registries'],
+  impact: { legal: 'high' },
+  applicable_requirement: 'Detector spec (lifecycle): claim remains active after expiry',
+  remediation: 'Re-verify and extend, narrow, or expire the claim.',
+  verification: 'No non-expired status on claims past their expires date.',
+  check(ctx) {
+    return (ctx.registries.claims?.entries || [])
+      .filter((c) => isPastDate(c.expires, ctx.refDate) && !['expired', 'retired', 'prohibited'].includes(c.status))
+      .map((c) => ({
+        subject: entrySubject('claims', c.claim_id),
+        summary: `Claim "${truncate(c.claim)}" passed expiry ${c.expires} but status is still "${c.status}"`,
+        evidence: [`expires: ${c.expires}; status: ${c.status}`],
+      }));
+  },
+}));
+
+D.push(defineDetector({
+  id: 'CLAIM-004', name: 'Quantitative or comparative claim without evidence', namespace: 'CLAIM',
+  description: 'A performance or comparative claim (any status except prohibited/retired) has no supporting evidence recorded.',
+  discipline: ['seo', 'aeo', 'geo'], severity: 'high', deterministic: true, requires: ['registries'],
+  impact: { legal: 'high', reputational: 'medium' },
+  applicable_requirement: 'Detector spec: unsupported quantitative claim, comparative claim without evidence; SEO §4 defensible claims',
+  remediation: 'Gather methodology-backed evidence, or mark the claim insufficient_evidence and remove it from publication surfaces.',
+  verification: 'Performance/comparative claims all reference evidence.',
+  check(ctx) {
+    return (ctx.registries.claims?.entries || [])
+      .filter((c) => ['performance', 'comparative'].includes(c.claim_type) && !['prohibited', 'retired', 'expired'].includes(c.status) && (c.evidence || []).length === 0)
+      .map((c) => ({
+        subject: entrySubject('claims', c.claim_id),
+        summary: `${c.claim_type} claim "${truncate(c.claim)}" has no supporting evidence`,
+        evidence: [`claims/${c.claim_id}: claim_type=${c.claim_type}, evidence=[]`],
+      }));
+  },
+}));
+
+D.push(defineDetector({
+  id: 'CLAIM-005', name: 'Opinion or aspiration represented as verified fact', namespace: 'CLAIM',
+  description: 'An opinion, position, or aspirational claim carries a "verified" status, flattening the claim hierarchy.',
+  discipline: ['geo'], severity: 'medium', deterministic: true, requires: ['registries'],
+  impact: { representation: 'high', legal: 'medium' },
+  applicable_requirement: 'GEO §4 claim hierarchy: engines may flatten distinctions, your content must not; §6.4 prevent opinion/aspiration silently becoming fact',
+  remediation: 'Keep opinion/position/aspirational claims in their own status track (active, not verified); label them as positions on publication surfaces.',
+  verification: 'No opinion/position/aspirational claim holds a verified status.',
+  check(ctx) {
+    return (ctx.registries.claims?.entries || [])
+      .filter((c) => ['opinion', 'position', 'aspirational'].includes(c.claim_type) && ['verified', 'verified_narrowed'].includes(c.status))
+      .map((c) => ({
+        subject: entrySubject('claims', c.claim_id),
+        summary: `${c.claim_type} claim "${truncate(c.claim)}" is marked "${c.status}" — opinions and aspirations cannot be verified facts`,
+        evidence: [`claim_type=${c.claim_type}, status=${c.status}`],
+      }));
+  },
+}));
+
+D.push(defineDetector({
+  id: 'CLAIM-006', name: 'Regulated claim without required review', namespace: 'CLAIM',
+  description: 'A legal/regulatory, security, or commercial claim has no legal_status assessment.',
+  discipline: ['aeo', 'geo'], severity: 'high', deterministic: true, requires: ['registries'],
+  impact: { legal: 'high' },
+  applicable_requirement: '§8.4: human review required for regulated, contractual, security, financial claims',
+  remediation: 'Route the claim to legal/subject-matter review and record legal_status.',
+  verification: 'Regulated claim types carry a legal_status other than not_assessed.',
+  check(ctx) {
+    return (ctx.registries.claims?.entries || [])
+      .filter((c) => ['legal_regulatory', 'security', 'commercial'].includes(c.claim_type) && !['prohibited', 'retired'].includes(c.status))
+      .filter((c) => !c.legal_status || c.legal_status === 'not_assessed')
+      .map((c) => ({
+        subject: entrySubject('claims', c.claim_id),
+        summary: `${c.claim_type} claim "${truncate(c.claim)}" has no legal/SME review recorded`,
+        evidence: [`legal_status: ${c.legal_status ?? 'missing'}`],
+      }));
+  },
+}));
+
+D.push(defineDetector({
+  id: 'CLAIM-007', name: 'Unbounded superlative in page text', namespace: 'CLAIM',
+  description: 'Page text contains a superlative ("best", "industry-leading", "#1") with no registered comparative claim covering that page.',
+  discipline: ['seo', 'aeo', 'geo'], severity: 'medium', deterministic: false, requires: ['site', 'registries'],
+  impact: { legal: 'medium', reputational: 'medium', citation: 'low' },
+  applicable_requirement: 'Detector spec: superlative without comparison set; SEO §4 no unsupported claims of superiority; anti-pattern: unbounded superlatives',
+  false_positive_conditions: ['superlatives inside quotations from attributed third parties'],
+  remediation: 'Remove the superlative, or register a comparative claim with a defined comparison set and evidence.',
+  verification: 'Superlatives on the page map to registered, evidenced comparative claims.',
+  check(ctx) {
+    const claims = ctx.registries.claims?.entries || [];
+    const hits = [];
+    for (const p of indexTargets(ctx)) {
+      if (p.status !== 200) continue;
+      const m = p.text.match(SUPERLATIVE_RX);
+      if (!m) continue;
+      const covered = claims.some((c) => c.claim_type === 'comparative' && (c.evidence || []).length > 0 && (c.publication_surfaces || []).some((s) => p.url.includes(s) || s.includes(new URL(p.url).pathname)));
+      if (!covered) {
+        hits.push({
+          subject: pageSubject(p),
+          summary: `Superlative "${m[0]}" with no registered comparative claim for this page`,
+          evidence: [`matched: "${m[0]}"`, 'no comparative claim lists this page as a publication surface'],
+          confidence: 'high',
+        });
+      }
+    }
+    return hits;
+  },
+}));
+
+D.push(defineDetector({
+  id: 'CLAIM-008', name: 'Published claim missing from page text (surface drift)', namespace: 'CLAIM',
+  description: 'A claim lists a page as a publication surface, but the page no longer contains recognizably similar text.',
+  discipline: ['geo'], severity: 'low', deterministic: false, requires: ['site', 'registries'],
+  impact: { representation: 'medium', maintainability: 'medium' },
+  applicable_requirement: '§6.4 publication_surfaces tracking; contradiction management',
+  false_positive_conditions: ['legitimate paraphrase beyond token-overlap detection'],
+  remediation: 'Update the claim’s publication_surfaces, or restore the claim text on the page.',
+  verification: 'Claim key terms appear on each listed surface.',
+  check(ctx) {
+    const hits = [];
+    for (const c of (ctx.registries.claims?.entries || []).filter((c) => (c.publication_surfaces || []).length > 0 && !['retired', 'expired'].includes(c.status))) {
+      const keywords = (c.claim.toLowerCase().match(/[a-z][a-z-]{4,}/g) || []).slice(0, 8);
+      if (keywords.length < 3) continue;
+      for (const surface of c.publication_surfaces) {
+        const page = ctx.site.pages.find((p) => p.url.includes(surface) || surface.includes(new URL(p.url).pathname));
+        if (!page) continue;
+        const text = page.text.toLowerCase();
+        const present = keywords.filter((k) => text.includes(k)).length;
+        if (present / keywords.length < 0.4) {
+          hits.push({
+            subject: entrySubject('claims', c.claim_id),
+            summary: `Claim "${truncate(c.claim)}" lists ${surface} as a surface but only ${present}/${keywords.length} key terms appear there`,
+            evidence: [`surface: ${surface}`, `key-term overlap: ${present}/${keywords.length}`],
+            confidence: 'medium',
+          });
+        }
+      }
+    }
+    return hits;
+  },
+}));
+
+D.push(defineDetector({
+  id: 'CLAIM-009', name: 'Verified claim without semantic support assessment', namespace: 'CLAIM',
+  description: 'A claim holds verified status without a recorded assessment that the evidence semantically supports the claim as worded (entailment, not just linkage). Valid evidence references, dates, and owners do not establish that the wording matches what the evidence proves.',
+  discipline: ['aeo', 'geo'], severity: 'high', deterministic: true, requires: ['registries'],
+  impact: { legal: 'high', representation: 'high' },
+  applicable_requirement: 'Premise 3.5 + evidence-strength rubric: verified status requires semantic adequacy review, not only deterministic linkage',
+  remediation: 'Run the evidence-strength rubric with a named assessor; record support_assessment (status, assessor, method, supporting passages). Downgrade to review_required until directly_supported or partially_supported.',
+  verification: 'Verified claims carry support_assessment.status of directly_supported or partially_supported with a named assessor.',
+  check(ctx) {
+    return (ctx.registries.claims?.entries || [])
+      .filter((c) => ['verified', 'verified_narrowed'].includes(c.status))
+      .filter((c) => {
+        const sa = c.support_assessment;
+        return !sa || !['directly_supported', 'partially_supported'].includes(sa.status) || !sa.assessor;
+      })
+      .map((c) => ({
+        subject: entrySubject('claims', c.claim_id),
+        summary: `Verified claim "${truncate(c.claim)}" has no adequate semantic support assessment (${c.support_assessment ? `status: ${c.support_assessment.status}${c.support_assessment.assessor ? '' : ', no assessor'}` : 'absent'})`,
+        evidence: [`claims/${c.claim_id}: status=${c.status}; support_assessment=${c.support_assessment ? JSON.stringify({ status: c.support_assessment.status, assessor: c.support_assessment.assessor ?? null }) : 'missing'}`],
+      }));
+  },
+}));
+
+function truncate(s, n = 70) {
+  s = String(s).replace(/\s+/g, ' ').trim();
+  return s.length > n ? s.slice(0, n) + '…' : s;
+}
+
+export default D;

package/src/detectors/crawl.js

@@ -0,0 +1,143 @@
+import { defineDetector, entrySubject } from './framework.js';
+import { isAllowed } from '../crawler/robots.js';
+import { isPastDate } from '../shared/io.js';
+
+const D = [];
+
+D.push(defineDetector({
+  id: 'CRAWL-001', name: 'robots.txt contradicts crawler policy decision', namespace: 'CRAWL',
+  description: 'The deployed robots.txt outcome for a crawler differs from the decision recorded in the crawler policy registry.',
+  discipline: ['seo', 'aeo', 'geo'], severity: 'high', deterministic: true, requires: ['site', 'registries'],
+  impact: { retrieval: 'high', legal: 'medium' },
+  applicable_requirement: 'GEO §2 crawler-policy matrix; premise 3.3 crawler access managed by crawler and purpose',
+  remediation: 'Align robots.txt with the registry decision, or update the registry with a new decision, owner, and rationale.',
+  verification: 'Evaluate robots.txt for the crawler user-agent against / and compare with the registry decision.',
+  check(ctx) {
+    if (!ctx.site?.robots) return [];
+    const hits = [];
+    for (const c of ctx.registries.crawlers?.entries || []) {
+      if (c.decision === 'undecided' || c.status === 'retired') continue;
+      const verdict = isAllowed(ctx.site.robots, c.user_agent, '/');
+      const deployed = verdict.allowed ? 'allow' : 'block';
+      if (deployed !== c.decision) {
+        hits.push({
+          subject: entrySubject('crawlers', c.crawler_id),
+          summary: `Registry decision for ${c.user_agent} is "${c.decision}" but robots.txt effectively "${deployed}s" it`,
+          evidence: [`registry decision: ${c.decision} (purpose: ${c.purpose})`, `robots.txt evaluation at /: ${deployed}${verdict.rule ? ` via ${verdict.rule}` : ' (no matching rule)'}`],
+          captured: deployed, expected: c.decision,
+        });
+      }
+    }
+    return hits;
+  },
+}));
+
+D.push(defineDetector({
+  id: 'CRAWL-002', name: 'Training-purpose access not decided separately', namespace: 'CRAWL',
+  description: 'A vendor has an allow decision for search discovery, but no separate recorded decision for its model-training crawler.',
+  discipline: ['geo'], severity: 'medium', deterministic: true, requires: ['registries'],
+  impact: { legal: 'high', representation: 'low' },
+  applicable_requirement: 'Premise 3.3: crawler access for search is not permission for model training; GEO §2 access layers must not be conflated',
+  remediation: 'Record an explicit allow/block decision, owner, and legal rationale for each training-purpose crawler of vendors whose search crawlers are allowed.',
+  verification: 'Confirm a crawler registry entry with purpose model_training exists for the vendor.',
+  check(ctx) {
+    const entries = ctx.registries.crawlers?.entries || [];
+    const hits = [];
+    const vendors = new Set(entries.filter((e) => ['search_indexing', 'ai_search_discovery'].includes(e.purpose) && e.decision === 'allow').map((e) => e.vendor).filter(Boolean));
+    for (const v of vendors) {
+      const training = entries.filter((e) => e.vendor === v && e.purpose === 'model_training');
+      if (training.length === 0) {
+        hits.push({
+          subject: { type: 'crawler', identifier: v },
+          summary: `Vendor "${v}" has search-crawler access allowed but no recorded model-training decision`,
+          evidence: [`crawlers registry contains no purpose=model_training entry for vendor ${v}`],
+        });
+      } else {
+        for (const t of training.filter((t) => t.decision === 'undecided')) {
+          hits.push({
+            subject: entrySubject('crawlers', t.crawler_id),
+            summary: `Model-training decision for ${t.user_agent} is still "undecided" while search access is allowed`,
+            evidence: [`entry ${t.crawler_id}: decision=undecided, purpose=model_training`],
+          });
+        }
+      }
+    }
+    return hits;
+  },
+}));
+
+D.push(defineDetector({
+  id: 'CRAWL-003', name: 'robots.txt missing', namespace: 'CRAWL',
+  description: 'No robots.txt was found; crawler access is uncontrolled and sitemap discovery is weakened.',
+  discipline: ['seo', 'aeo', 'geo'], severity: 'medium', deterministic: true, requires: ['site'],
+  impact: { retrieval: 'medium' },
+  applicable_requirement: 'SEO §2 crawl controls; GEO §2 crawler-policy matrix',
+  remediation: 'Publish robots.txt implementing the crawler policy registry, including a Sitemap directive.',
+  verification: 'Fetch /robots.txt and confirm 200 with expected rules.',
+  check(ctx) {
+    if (ctx.site.robotsText != null) return [];
+    return [{
+      subject: { type: 'site', identifier: ctx.site.baseUrl, url: ctx.site.baseUrl },
+      summary: 'robots.txt not found',
+      evidence: ['no robots.txt in audited output'],
+    }];
+  },
+}));
+
+D.push(defineDetector({
+  id: 'CRAWL-004', name: 'robots.txt parse problems', namespace: 'CRAWL',
+  description: 'robots.txt contains unparseable or misplaced directives.',
+  discipline: ['seo'], severity: 'medium', deterministic: true, requires: ['site'],
+  impact: { retrieval: 'medium' },
+  applicable_requirement: 'SEO §2 explicit control over robots.txt',
+  remediation: 'Fix the malformed lines; regenerate robots.txt from the crawler policy registry.',
+  verification: 'Re-parse robots.txt and confirm zero errors.',
+  check(ctx) {
+    if (!ctx.site.robots || ctx.site.robots.errors.length === 0) return [];
+    return [{
+      subject: { type: 'site', identifier: `${ctx.site.baseUrl}/robots.txt`, url: `${ctx.site.baseUrl}/robots.txt` },
+      summary: `robots.txt has ${ctx.site.robots.errors.length} parse problem(s)`,
+      evidence: ctx.site.robots.errors.slice(0, 10),
+    }];
+  },
+}));
+
+D.push(defineDetector({
+  id: 'CRAWL-005', name: 'Crawler policy review overdue', namespace: 'CRAWL',
+  description: 'A crawler policy decision has passed its next review date.',
+  discipline: ['seo', 'aeo', 'geo'], severity: 'low', deterministic: true, requires: ['registries'],
+  impact: { legal: 'medium', maintainability: 'medium' },
+  applicable_requirement: 'Registry §6.7 review_date/next_review_date; lifecycle premise',
+  remediation: 'Re-review the crawler decision against current vendor documentation and update review dates.',
+  verification: 'Confirm next_review_date is in the future.',
+  check(ctx) {
+    return (ctx.registries.crawlers?.entries || [])
+      .filter((c) => c.status !== 'retired' && isPastDate(c.next_review_date, ctx.refDate))
+      .map((c) => ({
+        subject: entrySubject('crawlers', c.crawler_id),
+        summary: `Crawler policy for ${c.user_agent} review overdue (due ${c.next_review_date})`,
+        evidence: [`next_review_date: ${c.next_review_date}`],
+      }));
+  },
+}));
+
+D.push(defineDetector({
+  id: 'CRAWL-006', name: 'Undecided crawler with observed governance relevance', namespace: 'CRAWL',
+  description: 'A crawler policy entry remains "undecided" — access is currently whatever robots.txt happens to say, not a governed decision.',
+  discipline: ['geo'], severity: 'low', deterministic: true, requires: ['registries'],
+  impact: { legal: 'medium' },
+  applicable_requirement: 'GEO §2: decision required per crawler and purpose',
+  remediation: 'Record an explicit allow/block decision with owner and business and legal rationale.',
+  verification: 'Registry entry decision is allow or block.',
+  check(ctx) {
+    return (ctx.registries.crawlers?.entries || [])
+      .filter((c) => c.decision === 'undecided' && c.status === 'active')
+      .map((c) => ({
+        subject: entrySubject('crawlers', c.crawler_id),
+        summary: `No decision recorded for ${c.user_agent} (${c.purpose})`,
+        evidence: [`entry ${c.crawler_id}: decision=undecided`],
+      }));
+  },
+}));
+
+export default D;