@vantageos/backend-doctor 0.1.2 → 0.1.3

package/README.md

@@ -81,7 +81,7 @@ A `could-not-judge` rule is an **abstention** — a human verdict is owed, never
 
 Every input is pinned and, where it is a vendored document, proven byte-identical to its upstream git blob (an un-hashable vendored doc is an authority granted to oneself).
 
-**The single authority for which standard fixture is active is the loader constant** `STANDARD_FILE` in [`src/detectors/standard/_doc.ts`](./src/detectors/standard/_doc.ts) — currently `backend-standard-4265226e.md` (49 rules — adds R-50, org isolation on a subscribed read is a typed empty result, never an uncaught throw; canonical source: ElPi-Corp `analysis/vantagepeers/backend-standard/backend-standard.md`). Everything else is provenance, NOT the active pin: `PINS.txt` and any other `fixtures/backend-standard-<sha>.md` still in the tree (e.g. the superseded `backend-standard-a9d7877b.md`, 47 rules — it lacks R-48) are kept only to show what was scored before. If any of them disagrees with `STANDARD_FILE`, `STANDARD_FILE` wins. Read the active pin from `STANDARD_FILE`, never from `PINS.txt` or a number typed elsewhere — following a stale `PINS.txt` would silently score the superseded 47-rule document and never surface R-48. See [`PINS.txt`](./PINS.txt) for the engine, backend snapshot, and MCP-family doc + VR inventory pins.
+**The single authority for which standard fixture is active is the loader constant** `STANDARD_FILE` in [`src/detectors/standard/_doc.ts`](./src/detectors/standard/_doc.ts) — currently `backend-standard-dcec1ba.md` (49 rules — adds R-50, org isolation on a subscribed read is a typed empty result, never an uncaught throw; canonical source: ElPi-Corp `analysis/vantagepeers/backend-standard/backend-standard.md`). Everything else is provenance, NOT the active pin: `PINS.txt` and any other `fixtures/backend-standard-<sha>.md` still in the tree (e.g. the superseded `backend-standard-a9d7877b.md`, 47 rules — it lacks R-48) are kept only to show what was scored before. If any of them disagrees with `STANDARD_FILE`, `STANDARD_FILE` wins. Read the active pin from `STANDARD_FILE`, never from `PINS.txt` or a number typed elsewhere — following a stale `PINS.txt` would silently score the superseded 47-rule document and never surface R-48. See [`PINS.txt`](./PINS.txt) for the engine, backend snapshot, and MCP-family doc + VR inventory pins.
 
 ## Discipline (how a detector is proven)
 

package/dist/coverage.d.ts

@@ -4,7 +4,7 @@
  * canonical 48-rule standard (51ec7af1) to 2bb402f7, which closes R-7/R-8/R-37/R-40
  * as a written-justification-token control (§23) — the paired standard PR the four
  * decisive detectors below track. Still 48 rules; the pin moves forward with them. */
-export declare const STANDARD_SHA = "4265226eb6698c7dfbae3ced77df564e877908ad";
+export declare const STANDARD_SHA = "dcec1ba31091accfe9b8840fab736815306307c5";
 export declare const VENDORED_STANDARD_PATH: string;
 /**
  * Derive the full rule list R-1..R-42 from the VENDORED standard fixture —

package/dist/coverage.js

@@ -18,8 +18,8 @@ const here = dirname(fileURLToPath(import.meta.url));
  * canonical 48-rule standard (51ec7af1) to 2bb402f7, which closes R-7/R-8/R-37/R-40
  * as a written-justification-token control (§23) — the paired standard PR the four
  * decisive detectors below track. Still 48 rules; the pin moves forward with them. */
-export const STANDARD_SHA = "4265226eb6698c7dfbae3ced77df564e877908ad";
-export const VENDORED_STANDARD_PATH = join(here, "..", "fixtures", "backend-standard-4265226e.md");
+export const STANDARD_SHA = "dcec1ba31091accfe9b8840fab736815306307c5";
+export const VENDORED_STANDARD_PATH = join(here, "..", "fixtures", "backend-standard-dcec1ba.md");
 /**
  * Derive the full rule list R-1..R-42 from the VENDORED standard fixture —
  * never typed, never a git show against a local repo. Reads the `**R-NN`

package/dist/detectors/oracle-axis1.js

@@ -29,7 +29,7 @@ export const VR_ORACLE_PATH = join(here, "..", "..", "fixtures", "vr-by-tool-day
  * §2 [shared] contract columns are DERIVED from this file, never hardcoded.
  * Defined locally (not imported from coverage.ts) to avoid a registry ↔ coverage
  * import cycle. */
-export const VENDORED_STANDARD_PATH = join(here, "..", "..", "fixtures", "backend-standard-4265226e.md");
+export const VENDORED_STANDARD_PATH = join(here, "..", "..", "fixtures", "backend-standard-dcec1ba.md");
 /** Load any backend inventory CSV generically from its OWN header — the shared
  * fields are DERIVED from these real headers, never a prose illustration. */
 export function loadInventory(path) {

package/dist/detectors/source/write-isolation.d.ts

@@ -0,0 +1,5 @@
+import type { Detector } from "../../engine-types.js";
+import { type Scan, type SourceDetectorEntry, type SrcFile } from "./_scan.js";
+export declare function scanR51(files: SrcFile[]): Scan;
+export declare const R51: Detector;
+export declare const SOURCE_WRITE_ISOLATION_DETECTORS: SourceDetectorEntry[];

package/dist/detectors/source/write-isolation.js

@@ -0,0 +1,198 @@
+import { code, emptyScan, isJudgeable, SOURCE_STANDARD_PIN, srcDetector, } from "./_scan.js";
+const CUSTOM_MUTATION_OPEN = /(?:export\s+)?const\s+([A-Za-z0-9_]+)\s*=\s*customMutation\s*\(/;
+const CUSTOM_QUERY_DEF = /(?:export\s+)?const\s+([A-Za-z0-9_]+)\s*=\s*customQuery\s*\(/;
+const FIRST_IDENT = /([A-Za-z_][A-Za-z0-9_]*)/;
+const BASE_PUBLIC_MUTATION = "mutation";
+const BASE_INTERNAL_MUTATION = "internalMutation";
+// A no-org throw a write inherits: an org-keyed ConvexError, or a write/org gate
+// helper that throws when no org is resolved.
+const ORG_THROW = /throw\b[^;]*\b(?:NO_ORG|ORG_REQUIRED|RBAC_DENIED|no org|missing org|organization is required|not in (?:an )?org)/i;
+const WRITE_GATE_HELPER = /\b(?:requireWriteAccess|requireWorkspaceId|requireOrgId|getEffectiveWorkspaceId|getOrgIdOrThrow|ensureCurrentOrg)\s*\(/;
+// a gate helper generally (any require*/ensure*/assert* access check in a wrapper).
+const GATE_HELPER = /\b(?:require|ensure|assert)[A-Z][A-Za-z0-9_]*\s*\(/;
+// a TYPED unauthorized RESULT — the write returns a shape instead of throwing.
+const TYPED_UNAUTH_RETURN = /return\s+\{[^}]*\b(?:unauthorized|forbidden|noOrg|no_org|denied|ok\s*:\s*false)\b/i;
+const CONTRACT_MARKER = /write-contract:|client-must-not-write-before-org|isolation-contract:/i;
+function discoverWriteBuilders(files) {
+    const b = {
+        publicMutation: new Set([BASE_PUBLIC_MUTATION]),
+        nonSubject: new Set([
+            BASE_INTERNAL_MUTATION,
+            "query",
+            "internalQuery",
+            "action",
+            "internalAction",
+            "httpAction",
+        ]),
+        gated: new Map(),
+        ambiguous: [],
+    };
+    for (const f of files) {
+        if (!isJudgeable(f))
+            continue;
+        const codeLines = f.lines.filter(code);
+        const allLines = f.lines;
+        for (let i = 0; i < codeLines.length; i++) {
+            const l = codeLines[i];
+            // a customQuery wrapper is a READ builder — not R-51's subject.
+            if (CUSTOM_QUERY_DEF.test(l.raw))
+                continue;
+            const cm = CUSTOM_MUTATION_OPEN.exec(l.raw);
+            if (!cm)
+                continue;
+            const name = cm[1];
+            const afterOpen = l.raw.slice((cm.index ?? 0) + cm[0].length);
+            let base = FIRST_IDENT.exec(afterOpen)?.[1];
+            for (let j = i + 1; !base && j < codeLines.length && j <= i + 4; j++) {
+                base = FIRST_IDENT.exec(codeLines[j].raw)?.[1];
+            }
+            if (base === BASE_PUBLIC_MUTATION) {
+                b.publicMutation.add(name);
+                const codeRegion = codeLines
+                    .slice(i, i + 10)
+                    .map((x) => x.raw)
+                    .join("\n");
+                const startAbs = allLines.indexOf(l);
+                const rawRegion = startAbs >= 0
+                    ? allLines
+                        .slice(Math.max(0, startAbs - 3), startAbs + 14)
+                        .map((x) => x.raw)
+                        .join("\n")
+                    : codeRegion;
+                const gates = ORG_THROW.test(codeRegion) ||
+                    WRITE_GATE_HELPER.test(codeRegion) ||
+                    GATE_HELPER.test(codeRegion);
+                if (gates && !CONTRACT_MARKER.test(rawRegion))
+                    b.gated.set(name, { rel: f.rel, n: l.n });
+            }
+            else if (base === BASE_INTERNAL_MUTATION)
+                b.nonSubject.add(name);
+            else
+                b.ambiguous.push({
+                    rel: f.rel,
+                    n: l.n,
+                    name,
+                    base: base ?? "<unresolved>",
+                });
+        }
+    }
+    return b;
+}
+function definitionOpener(raw, set) {
+    const names = [...set].sort((a, z) => z.length - a.length);
+    const alt = names.map((n) => n.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+    const re = new RegExp(`(?:export\\s+)?const\\s+([A-Za-z0-9_]+)\\s*=\\s*(${alt})\\s*\\(`);
+    const m = re.exec(raw);
+    return m ? { name: m[1], builder: m[2] } : null;
+}
+function mutationBlock(lines, i) {
+    let depth = 0;
+    let seenOpen = false;
+    const body = [];
+    for (let j = i; j < lines.length; j++) {
+        const l = lines[j];
+        body.push(l);
+        for (const ch of l.raw) {
+            if (ch === "{") {
+                depth += 1;
+                seenOpen = true;
+            }
+            else if (ch === "}")
+                depth -= 1;
+        }
+        if (seenOpen && depth <= 0)
+            return { lines: body, unterminated: false };
+    }
+    return { lines: body, unterminated: seenOpen };
+}
+export function scanR51(files) {
+    const scan = emptyScan();
+    const builders = discoverWriteBuilders(files);
+    for (const a of builders.ambiguous) {
+        scan.cnj.push({
+            rel: a.rel,
+            n: a.n,
+            note: `write builder "${a.name}" = customMutation(${a.base}, …) — its base "${a.base}" resolves to neither \`mutation\` nor \`internalMutation\`, so whether definitions using it are public writes cannot be enumerated; R-51 refuses rather than certify a surface it cannot see`,
+        });
+    }
+    for (const [name, at] of builders.gated) {
+        let deps = 0;
+        for (const f of files) {
+            if (!isJudgeable(f))
+                continue;
+            for (const l of f.lines) {
+                if (!code(l))
+                    continue;
+                if (definitionOpener(l.raw, new Set([name])))
+                    deps += 1;
+            }
+        }
+        scan.cnj.push({
+            rel: at.rel,
+            n: at.n,
+            note: `customMutation builder "${name}" gates every write built from it in its customCtx (requireWriteAccess/an org gate that can throw), and ${deps} public write(s) route through it — whether a client can reach one BEFORE an org is resolved (so the no-org throw is an uncaught Server Error, not a refusal) is not decidable from convex/. R-51 refuses (a human confirms the shell cannot issue these pre-org, or the write returns a typed unauthorized result / carries a write-contract marker) — never a silent PASS`,
+        });
+    }
+    for (const f of files) {
+        if (!isJudgeable(f))
+            continue;
+        const lines = f.lines;
+        for (let i = 0; i < lines.length; i++) {
+            if (!code(lines[i]))
+                continue;
+            const opener = definitionOpener(lines[i].raw, builders.publicMutation);
+            if (!opener)
+                continue;
+            // a write built through a GATED customMutation wrapper is covered by the
+            // builder-level refusal above — skip the per-handler pass.
+            if (builders.gated.has(opener.builder))
+                continue;
+            const block = mutationBlock(lines, i);
+            i += block.lines.length - 1;
+            const fn = opener.name;
+            if (block.unterminated) {
+                scan.cnj.push({
+                    rel: f.rel,
+                    n: block.lines[0].n,
+                    note: `${fn}: a public mutation block could not be delimited (unbalanced braces) — whether its no-org path throws or returns a typed unauthorized result is not statically decidable; a human must judge (never a silent PASS)`,
+                });
+                continue;
+            }
+            const blockText = block.lines
+                .filter(code)
+                .map((l) => l.raw)
+                .join("\n");
+            const blockAll = block.lines.map((l) => l.raw).join("\n");
+            const throwsOnNoOrg = ORG_THROW.test(blockText) || WRITE_GATE_HELPER.test(blockText);
+            const typedUnauth = TYPED_UNAUTH_RETURN.test(blockText);
+            const hasMarker = CONTRACT_MARKER.test(blockAll);
+            if (!throwsOnNoOrg && !typedUnauth && !hasMarker)
+                continue; // not a subject
+            if (hasMarker || (typedUnauth && !throwsOnNoOrg)) {
+                scan.conform.push({
+                    rel: f.rel,
+                    n: block.lines[0].n,
+                    note: `${fn}: public mutation returns a typed unauthorized result on the no-org path (or documents a write-contract) — a pre-org client receives a shape it can render, not an uncaught Server Error`,
+                });
+            }
+            else if (throwsOnNoOrg) {
+                // The React shell is not in convex/, so the doctor CANNOT decide whether a
+                // client reaches this write BEFORE an org (an R-51 uncaught-Server-Error
+                // crash) or only an imperative caller does (an R-16 refusal it catches).
+                // It therefore REFUSES (could-not-judge) naming the write — never a silent
+                // PASS, and never a false `violate` on a server-side R-16 refusal. Pi's
+                // spec: "doctor refuses (CNJ) when it cannot judge the client; CNJ != vert".
+                scan.cnj.push({
+                    rel: f.rel,
+                    n: block.lines[0].n,
+                    note: `${fn}: public mutation throws on the missing-org path (org-keyed ConvexError or requireWriteAccess/requireWorkspaceId) with no typed-unauthorized return and no documented contract. Whether a client shell issues this write BEFORE an org is resolved (an uncaught Server Error — the R-51 defect) or only an imperative caller reaches it (an R-16 refusal it catches) is not decidable from convex/. R-51 refuses (return a typed unauthorized result, or a write-contract marker if a client cannot reach it pre-org) — never a silent PASS`,
+                });
+            }
+        }
+    }
+    return scan;
+}
+export const R51 = srcDetector("R-51", "R-51 a public mutation returns a typed unauthorized result on the no-org path, never an uncaught throw a pre-org client shell cannot render", "a public write either returns a typed unauthorized result / documents its client contract, or a human confirms a pre-org client cannot reach it — it never throws NO_ORG on a path an ordinary render can hit", scanR51, "R-51: no public mutation matched in the scanned tree — no write to certify. NOT a clean bill.");
+export const SOURCE_WRITE_ISOLATION_DETECTORS = [
+    { detector: R51, ruleId: "R-51", standardPin: SOURCE_STANDARD_PIN },
+];

package/dist/detectors/standard/_doc.d.ts

@@ -1,6 +1,6 @@
 import type { Detector, DetectorResult } from "../../engine-types.js";
 /** The vendored-fixture basename used as the anchor file for every doc site. */
-export declare const STANDARD_FILE = "backend-standard-4265226e.md";
+export declare const STANDARD_FILE = "backend-standard-dcec1ba.md";
 export declare const VENDORED_STANDARD_PATH: string;
 /** The standard all four are pinned against (short hash a9d7877b). */
 export declare const STANDARD_DOC_PIN = "analysis/vantagepeers/backend-standard/backend-standard.md @ a9d7877b4947ed8ae61d234433debb2182a2ba44 (elpiarthera/ElPi-Corp) \u00A714/\u00A711/\u00A710/\u00A73";

package/dist/detectors/standard/_doc.js

@@ -2,7 +2,7 @@
 // detectors that read THE STANDARD ITSELF as their material — R-42, R-15, R-32,
 // R-39. Unlike the source-tree detectors (which read convex/ via `tree.files`)
 // and the oracle detectors (which read the CSV), these read the VENDORED standard
-// fixture `fixtures/backend-standard-4265226e.md` — the material at the pin. The
+// fixture `fixtures/backend-standard-dcec1ba.md` — the material at the pin. The
 // engine's contract types are DERIVED from engine-types.ts, never re-spelled.
 //
 // THE LAW (the one that caught R-5): every predicate is derived from the ACTUAL
@@ -13,7 +13,7 @@ import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 /** The vendored-fixture basename used as the anchor file for every doc site. */
-export const STANDARD_FILE = "backend-standard-4265226e.md";
+export const STANDARD_FILE = "backend-standard-dcec1ba.md";
 /** The vendored standard at the pin — DATA on the same footing as the oracle CSV.
  * Resolved locally (not via coverage.ts) so this module carries no import cycle
  * with registry.ts. Same file coverage.ts's VENDORED_STANDARD_PATH points at. */

package/dist/not-checkable.js

@@ -16,7 +16,7 @@
 // gentler word — it was emptied.
 import { STANDARD_FILE } from "./detectors/standard/_doc.js";
 export const NOT_MECHANICALLY_CHECKABLE = {
-    "R-48": "R-48 authority-totality detector pending — task k17chpr4kzp399j3s7r7edpm4s8cscbz; text pinned at 4265226e so coverage cannot pretend 47 is complete. No mechanical control yet; R-48 is enumerated and visible, never silently dropped.",
+    "R-48": "R-48 authority-totality detector pending — task k17chpr4kzp399j3s7r7edpm4s8cscbz; text pinned at dcec1ba so coverage cannot pretend 47 is complete. No mechanical control yet; R-48 is enumerated and visible, never silently dropped.",
 };
 /**
  * One `could-not-judge` DetectorResult per NOT_MECHANICALLY_CHECKABLE rule, so

package/dist/registry.d.ts

@@ -1,6 +1,6 @@
 import type { Detector } from "./engine-types.js";
 /** The standard both pins the whole wave against. */
-export declare const STANDARD_PIN = "analysis/vantagepeers/backend-standard/backend-standard.md @ 4265226eb6698c7dfbae3ced77df564e877908ad (elpiarthera/ElPi-Corp)";
+export declare const STANDARD_PIN = "analysis/vantagepeers/backend-standard/backend-standard.md @ dcec1ba31091accfe9b8840fab736815306307c5 (elpiarthera/ElPi-Corp)";
 export interface RegistryEntry {
     detector: Detector;
     ruleId: string;

package/dist/registry.js

@@ -14,13 +14,14 @@ import { SOURCE_LIFECYCLE_DETECTORS } from "./detectors/source/lifecycle.js";
 import { SOURCE_READBUDGET_DETECTORS } from "./detectors/source/readbudget.js";
 import { SOURCE_REFUSAL_DETECTORS } from "./detectors/source/refusal.js";
 import { SOURCE_SECURITY_DETECTORS } from "./detectors/source/security.js";
+import { SOURCE_WRITE_ISOLATION_DETECTORS } from "./detectors/source/write-isolation.js";
 import { SOURCE_WRITESAFETY_DETECTORS } from "./detectors/source/writesafety.js";
 import { R41, SIBLING_PIN } from "./detectors/standard/r41-frontier.js";
 import { R46_STANDARD_PIN, STANDARD_SOURCE_DETECTORS, } from "./detectors/standard/r46-returns-validator.js";
 import { STANDARD_DOC_DETECTORS } from "./detectors/standard/standard-doc.js";
 import { makeR14, makeR38 } from "./detectors/structural.js";
 /** The standard both pins the whole wave against. */
-export const STANDARD_PIN = "analysis/vantagepeers/backend-standard/backend-standard.md @ 4265226eb6698c7dfbae3ced77df564e877908ad (elpiarthera/ElPi-Corp)";
+export const STANDARD_PIN = "analysis/vantagepeers/backend-standard/backend-standard.md @ dcec1ba31091accfe9b8840fab736815306307c5 (elpiarthera/ElPi-Corp)";
 export const REGISTRY = [
     ...PER_ROW_PREDICATES.map((spec) => ({
         detector: makeOracleDetector(spec),
@@ -108,6 +109,12 @@ export const REGISTRY = [
         // workspaces:ensureCurrent + prefs:sidebar). Extends the R-11 isolation
         // family; a mutation refusing an unauthorized write (R-16) is out of scope.
         ...SOURCE_ISOLATION_DETECTORS,
+        // R-51 — the WRITE counterpart of R-50: a public mutation whose no-org path
+        // throws NO_ORG (requireWriteAccess/getEffectiveWorkspaceId) into a pre-org
+        // client shell is a VIOLATION unless it returns a typed unauthorised result or
+        // documents a client contract; a gated customMutation wrapper (writeMutation) is
+        // refused (could-not-judge) since client reachability is not visible from convex/.
+        ...SOURCE_WRITE_ISOLATION_DETECTORS,
         ...SOURCE_CONTRACT_DETECTORS,
         ...IDENTITY_DETECTORS,
         // The four STANDARD-DOCUMENT detectors (R-42/R-15/R-32/R-39): each reads the

package/fixtures/{backend-standard-4265226e.md → backend-standard-dcec1ba.md}

@@ -334,6 +334,7 @@ The five: **production-ready · enterprise-grade · highly secure · token-effic
 | R-47 an incompletable read refuses, never returns a partial set | production-ready · highly secure |
 | R-48 authority total over its rows; a declared tier unused does not exist | highly secure · multi-organisation multi-tenant · enterprise-grade |
 | R-50 org isolation on a subscribed read is a typed empty result, never an uncaught throw | highly secure · multi-organisation multi-tenant · production-ready |
+| R-51 a public write returns a typed unauthorised result on no-org, never an uncaught throw into a pre-org client | highly secure · multi-organisation multi-tenant · production-ready |
 
 **Deletion candidates — rules serving none of the five: none.**
 
@@ -649,7 +650,10 @@ R-5 and R-10 make each mutation ask the right question caller-by-caller — *may
 **Detector spec.** *control kind:* static (+ delivery gate on the tier-usage half). *reads:* per governed table (derived from `schema.ts`), the set of caller tiers each mutation on it accepts, derived from the delivered mutation code — never a list the check keeps about itself; and the R-5 tier vocabulary from the pinned standard. *red:* a table whose union of accepting tiers cannot reach a row created by a non-actor (a `"system"`/webhook/migration/scheduler creator with no tier that governs it); OR a tier declared in the pinned vocabulary and used by zero mutations. *green:* every governed table has at least one tier reaching all its rows including non-actor-created ones, and every declared tier is used by at least one mutation. *kind:* judgement — deriving each mutation's accepting tiers and the tier-usage census is mechanical; whether a table's rows are genuinely all reachable (the non-actor-creator case, and whether an unreachable row is an accepted deliberate lock) is human, so the detector names the unreachable-row tables and the unused tiers as a work list and returns could-not-judge on the disposition, never present/absent by vacuity. **Coverage fails on itself:** the table list is derived from the schema; every table is ANALYSED or SKIPPED-with-a-written-reason; a table neither analysed nor exempted, or one the check cannot parse, FAILS — the whole point of this rule is a defect that reports nothing.
 
 **R-50 — org isolation on a reactively-subscribed read is a TYPED EMPTY / UNAUTHORISED RESULT, never an uncaught throw.** A public `query` a client subscribes to reactively (a layout's `useQuery`) that resolves the caller's organisation and, on the missing-org path, **throws** — an org-keyed `ConvexError`, or a `requireOrgId`/`requireWorkspaceId`/`ensureCurrent` helper that throws — hands the subscribing client an **uncaught Server Error** it has no imperative call site to catch. The isolation is correct in intent and wrong in shape: a subscription cannot `try/catch` a query the way a mutation's caller can, so the throw surfaces as a crashed render. Such a read returns a **typed empty / unauthorised result** the client can render (the fail-closed org resolver — VP's `withOrgScope` returns an empty scope on no identity, never throws), or it documents that the layout must not subscribe. This is the 2026-08-30 vCRM-Preview incident: `workspaces:ensureCurrent` and `prefs:sidebar` threw `ConvexError` uncaught while the app shell subscribed, and the page rendered "NoOrg copy, no org button" over an unhandled throw — the operator saw a broken screen, not a refusal. **Frontier — this EXTENDS the R-11 isolation family, it does not restate it.** **R-11** governs *where* the scope key is applied — an in-query index predicate, never a post-query `.filter` — a correctness/cost property of a query that already knows its org. R-50 governs the case *before* that: the caller has **no** org, and the question is the **shape of the answer**, not the locus of the predicate — a query fully R-11-conformant still fails R-50 if its no-org branch throws into a subscription. **R-16** is the error contract for a read that *may* refuse: R-50 is the narrower law that a **reactively-subscribed** read may not refuse by *throwing at all* — because its consumer is a subscription, the only honest refusal is a typed unauthorised *value*, not an exception. And R-50 is deliberately **narrower than "any org throw"**: a **mutation** that refuses an unauthorised write via `requireOrgAdmin` throwing `RBAC_DENIED` is **correct** and out of scope — a write refusal is caught by its imperative caller, never surfaced as an uncaught subscription error. Conflating the two would flag every legitimate admin-gated mutation; R-50 governs reactive reads only. *(Source: the 2026-08-30 vCRM-Preview operator report — `workspaces:ensureCurrent` + `prefs:sidebar` uncaught `ConvexError` on a subscribed layout; and VP's own `convex/lib/auth.ts` `withOrgScope`, the fail-closed non-throwing resolver that returns an empty scope rather than throw, the shape this rule requires.)*
-**Detector spec.** *control kind:* static (source scan over the public query surface). *reads:* the target's `convex/` source; every public `query` opener (not `internalQuery`, not `mutation`/`action`) and its brace-delimited handler body. *red:* a public query whose body throws on the missing-org path (an org-keyed `ConvexError` — `NO_ORG`/`ORG_REQUIRED`/`RBAC_DENIED` — or a throw-on-no-org helper) with **no** fail-closed non-throwing resolver (`withOrgScope`) and **no** documented isolation contract marker in the same handler. *green:* a public query that carries the fail-closed resolver or a documented client contract — the subscribing client always receives a typed shape. *out of scope:* a `mutation`/`action` (imperative caller can catch) and a query that does neither org-throw nor fail-closed resolve (not this rule's subject). *kind:* mechanical — the presence of an org-isolation throw and the presence of a fail-closed resolver / contract marker are both read from the delivered source; `could-not-judge` is reserved for a query block whose braces cannot be delimited, never for "a person should read this". **Coverage fails on itself:** a tree with no public query returns could-not-judge naming the empty scan, never a clean bill.
+**Detector spec.** *control kind:* static (source scan over the public query surface). *reads:* the target's `convex/` source; every public `query` opener (not `internalQuery`, not `mutation`/`action`) and its brace-delimited handler body. *red:* a public query whose body throws on the missing-org path (an org-keyed `ConvexError` — `NO_ORG`/`ORG_REQUIRED`/`RBAC_DENIED` — or a throw-on-no-org helper) with **no** fail-closed non-throwing resolver (`withOrgScope`) and **no** documented isolation contract marker in the same handler. *green:* a public query that carries the fail-closed resolver or a documented client contract — the subscribing client always receives a typed shape. *out of scope:* a `mutation`/`action` (imperative caller can catch — but see **R-51** for the write a client shell issues before an org exists) and a query that does neither org-throw nor fail-closed resolve (not this rule's subject). *kind:* mechanical — the presence of an org-isolation throw and the presence of a fail-closed resolver / contract marker are both read from the delivered source; `could-not-judge` is reserved for a query block whose braces cannot be delimited, never for "a person should read this". **Coverage fails on itself:** a tree with no public query returns could-not-judge naming the empty scan, never a clean bill.
+
+**R-51 — a public MUTATION whose no-org path throws NO_ORG into a pre-org client is a VIOLATION, not a refusal.** The write counterpart of R-50. A signed-in product write (`companies.create`, `contacts.create`, `fields.createDefinition`, `ask.send`) that resolves the org through `getEffectiveWorkspaceId` / `requireWriteAccess` and **throws** `ConvexError` NO_ORG when no org is resolved hands the client an **uncaught Server Error** on an ordinary render path — because the app **shell can issue the write before an org exists**. In the 2026-08-30 vCRM incident the reads were typed-empty (R-50 clean), so `/app` looked alive, and then every write on it threw NO_ORG: the second half of the same crash, which R-50 could not name because it excluded mutations. Such a write returns a **typed unauthorised result** the client can render, or it documents (a `write-contract:` marker) that a client cannot reach it before an org. **Frontier — R-51 is NOT R-16 and NOT R-50.** **R-16** is the error contract for a write that legitimately **refuses a chosen unauthorised action** — a `{code,field/scope,message}` throw is correct there, because an imperative caller catches it. R-51 is the narrower case where the caller is the **shell's ordinary render**, reaching the write **before** an org is resolved: the throw is then not a refusal of a chosen action but a crash, and the honest shape is a typed value, not an exception (or the write is specified unreachable pre-org). **R-50** is the same defect on the READ side (a subscribed query); R-51 is the WRITE side R-50's own frontier pointed at ("a `mutation`/`action` … out of scope"), so no gap-table cell is left blank. Because the React shell is **not in `convex/`**, the detector cannot see whether a client reaches a write pre-org, so it **never silent-PASSes a throwing write**: it refuses (could-not-judge) naming the write / its `customMutation` wrapper when it cannot judge the client obligation, and is red only on a bare throw with no typed-unauthorised return and no contract. *(Source: the 2026-08-30 vCRM operator report — four signed-in writes throwing `ConvexError` NO_ORG through `convex/model/access.ts` `requireWriteAccess` + `getEffectiveWorkspaceId`, while R-50-clean reads made the page look alive.)*
+**Detector spec.** *control kind:* static (source scan over the public mutation surface). *reads:* the target's `convex/` source; every public `mutation` opener and every write built through a `customMutation` wrapper (the `writeMutation = customMutation(mutation, customCtx(requireWriteAccess))` idiom), and its brace-delimited handler / the wrapper's `customCtx`. *red:* a bare public mutation whose no-org path throws (an org-keyed `ConvexError` or `requireWriteAccess`/`requireWorkspaceId`/`getEffectiveWorkspaceId`) with **no** typed-unauthorised return and **no** documented `write-contract` marker. *green:* a public mutation that returns a typed unauthorised result on the no-org path, or carries a documented client contract. *could-not-judge (never a silent PASS):* a write built through a **gated** `customMutation` wrapper (its `customCtx` runs a throwing write/org gate) — the throw lives in the shared wrapper and client reachability is not visible from `convex/`, so the detector names the wrapper and counts its dependent writes; also an unresolvable-base wrapper, and an undelimitable block. *out of scope:* a `query` (that is R-50), and a `customMutation(internalMutation, …)` wrapper. *kind:* mechanical. **Coverage fails on itself:** a tree with no public mutation returns could-not-judge naming the empty scan, never a clean bill.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/backend-doctor",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "A conformance instrument that measures the VantagePeers backend against the pinned backend standard. The THIRD doctor built ON the @vantageos/mcp-doctor engine — never a third engine. It consumes runDoctor/renderTable and adds only detectors.",
   "type": "module",
   "main": "./dist/cli.js",