@vantageos/backend-doctor 0.1.3 → 0.1.5

package/README.md

@@ -81,7 +81,7 @@ A `could-not-judge` rule is an **abstention** — a human verdict is owed, never
 
 Every input is pinned and, where it is a vendored document, proven byte-identical to its upstream git blob (an un-hashable vendored doc is an authority granted to oneself).
 
-**The single authority for which standard fixture is active is the loader constant** `STANDARD_FILE` in [`src/detectors/standard/_doc.ts`](./src/detectors/standard/_doc.ts) — currently `backend-standard-dcec1ba.md` (49 rules — adds R-50, org isolation on a subscribed read is a typed empty result, never an uncaught throw; canonical source: ElPi-Corp `analysis/vantagepeers/backend-standard/backend-standard.md`). Everything else is provenance, NOT the active pin: `PINS.txt` and any other `fixtures/backend-standard-<sha>.md` still in the tree (e.g. the superseded `backend-standard-a9d7877b.md`, 47 rules — it lacks R-48) are kept only to show what was scored before. If any of them disagrees with `STANDARD_FILE`, `STANDARD_FILE` wins. Read the active pin from `STANDARD_FILE`, never from `PINS.txt` or a number typed elsewhere — following a stale `PINS.txt` would silently score the superseded 47-rule document and never surface R-48. See [`PINS.txt`](./PINS.txt) for the engine, backend snapshot, and MCP-family doc + VR inventory pins.
+**The single authority for which standard fixture is active is the loader constant** `STANDARD_FILE` in [`src/detectors/standard/_doc.ts`](./src/detectors/standard/_doc.ts) — currently `backend-standard-4bcd605.md` (50 rules — R-50/R-51, org isolation on a subscribed read / a pre-org write is a typed empty/unauthorised result, never an uncaught throw; at this pin a gated `customQuery`/`customMutation` wrapper is JUDGED red/green from its readable `customCtx`, not could-not-judge; canonical source: ElPi-Corp `analysis/vantagepeers/backend-standard/backend-standard.md`). Everything else is provenance, NOT the active pin: `PINS.txt` and any other `fixtures/backend-standard-<sha>.md` still in the tree (e.g. the superseded `backend-standard-a9d7877b.md`, 47 rules — it lacks R-48) are kept only to show what was scored before. If any of them disagrees with `STANDARD_FILE`, `STANDARD_FILE` wins. Read the active pin from `STANDARD_FILE`, never from `PINS.txt` or a number typed elsewhere — following a stale `PINS.txt` would silently score the superseded 47-rule document and never surface R-48. See [`PINS.txt`](./PINS.txt) for the engine, backend snapshot, and MCP-family doc + VR inventory pins.
 
 ## Discipline (how a detector is proven)
 

package/dist/coverage.d.ts

@@ -4,7 +4,7 @@
  * canonical 48-rule standard (51ec7af1) to 2bb402f7, which closes R-7/R-8/R-37/R-40
  * as a written-justification-token control (§23) — the paired standard PR the four
  * decisive detectors below track. Still 48 rules; the pin moves forward with them. */
-export declare const STANDARD_SHA = "dcec1ba31091accfe9b8840fab736815306307c5";
+export declare const STANDARD_SHA = "4bcd605656ceff52d4f1593a9176cd6b988471be";
 export declare const VENDORED_STANDARD_PATH: string;
 /**
  * Derive the full rule list R-1..R-42 from the VENDORED standard fixture —

package/dist/coverage.js

@@ -18,8 +18,8 @@ const here = dirname(fileURLToPath(import.meta.url));
  * canonical 48-rule standard (51ec7af1) to 2bb402f7, which closes R-7/R-8/R-37/R-40
  * as a written-justification-token control (§23) — the paired standard PR the four
  * decisive detectors below track. Still 48 rules; the pin moves forward with them. */
-export const STANDARD_SHA = "dcec1ba31091accfe9b8840fab736815306307c5";
-export const VENDORED_STANDARD_PATH = join(here, "..", "fixtures", "backend-standard-dcec1ba.md");
+export const STANDARD_SHA = "4bcd605656ceff52d4f1593a9176cd6b988471be";
+export const VENDORED_STANDARD_PATH = join(here, "..", "fixtures", "backend-standard-4bcd605.md");
 /**
  * Derive the full rule list R-1..R-42 from the VENDORED standard fixture —
  * never typed, never a git show against a local repo. Reads the `**R-NN`

package/dist/detectors/oracle-axis1.js

@@ -29,7 +29,7 @@ export const VR_ORACLE_PATH = join(here, "..", "..", "fixtures", "vr-by-tool-day
  * §2 [shared] contract columns are DERIVED from this file, never hardcoded.
  * Defined locally (not imported from coverage.ts) to avoid a registry ↔ coverage
  * import cycle. */
-export const VENDORED_STANDARD_PATH = join(here, "..", "..", "fixtures", "backend-standard-dcec1ba.md");
+export const VENDORED_STANDARD_PATH = join(here, "..", "..", "fixtures", "backend-standard-4bcd605.md");
 /** Load any backend inventory CSV generically from its OWN header — the shared
  * fields are DERIVED from these real headers, never a prose illustration. */
 export function loadInventory(path) {

package/dist/detectors/source/isolation.js

@@ -91,8 +91,16 @@ function discoverBuilders(files) {
                 const gates = ORG_THROW.test(codeRegion) ||
                     ORG_THROW_HELPER.test(codeRegion) ||
                     GATE_HELPER.test(codeRegion);
-                if (gates && !CONTRACT_MARKER.test(rawRegion))
-                    b.gated.set(name, { rel: f.rel, n: l.n });
+                if (gates && !CONTRACT_MARKER.test(rawRegion)) {
+                    // The wrapper's customCtx body is READABLE — judge its no-org
+                    // disposition: a typed empty/unauthorized return means the
+                    // subscription receives a shape (conform); otherwise the gate
+                    // throws NO_ORG into every subscribed query built from it
+                    // (non-conforming). No CNJ on this class — the wrapper source is
+                    // visible, so R-50 judges it.
+                    const typedEmpty = TYPED_EMPTY_RETURN.test(codeRegion);
+                    b.gated.set(name, { rel: f.rel, n: l.n, throws: !typedEmpty });
+                }
             }
             else if (base === BASE_INTERNAL_QUERY)
                 b.nonSubject.add(name);
@@ -128,6 +136,77 @@ const ORG_THROW_HELPER = /\b(?:requireWorkspaceId|requireOrgId|requireOrgSlug|ge
 // subscribing client always receives a shape it can render.
 const SAFE_RESOLVER = /\bwithOrgScope\s*\(/;
 const CONTRACT_MARKER = /isolation-contract:|client-safe-empty|@client-must-not-subscribe/i;
+// A TYPED EMPTY / UNAUTHORIZED RETURN in a wrapper's customCtx (or a handler): the
+// no-org path returns a shape the subscribing client can render instead of throwing.
+const TYPED_EMPTY_RETURN = /return\s+\{[^}]*\b(?:unauthorized|forbidden|noOrg|no_org|denied|empty)\b|return\s+\{[^}]*\b(?:orgSlug|orgId)\s*:\s*null\b|return\s+\{\s*items\s*:\s*\[\s*\]/i;
+// A NO-ORG GUARD condition — an `if (!org…)` / `if (org === null)` shape that owns
+// the no-org branch of a handler. Used only by the domination heuristic below to
+// establish that a typed-empty return which precedes an org-throw plausibly owns the
+// no-org path (rather than sitting behind some unrelated condition).
+const NO_ORG_GUARD = /if\s*\(\s*!\s*(?:scope\.|ctx\.[A-Za-z0-9_.]*)?(?:org|orgId|orgSlug|workspaceId|workspace|identity)\b|if\s*\([^)]*\b(?:org|orgId|orgSlug|workspaceId)\s*(?:===|==)\s*null/i;
+// DOMINATION heuristic (Eta false-positive — a DOMINATED no-org throw). A public
+// query whose handler RETURNS a typed empty/unauthorized shape on the no-org branch
+// BEFORE it ever reaches the org-throw does NOT fire that throw into the subscription
+// on the no-org path — the throw guards an org-PRESENT path (a CRM `dashboard.ts`
+// shape: `if (!org) return { items: [], unauthorized: true }` at the top, then a
+// later `requireWorkspaceId(...)` / `throw` that only runs once an org IS present, so
+// the subscribing client never receives an uncaught Server Error). Judged TEXTUALLY
+// and CONSERVATIVELY — we never silently flip a real throw to green:
+//   "dominated"  a typed-empty return lexically precedes the first org-throw AND a
+//                no-org guard also precedes that throw → the early return plausibly
+//                owns the no-org path; the throw is unreachable when there is no org.
+//                → conform.
+//   "ambiguous"  a typed-empty return precedes the throw but NO no-org guard is
+//                visible before it → we cannot establish the return dominates the
+//                no-org path (interleaved/complex control flow) → could-not-judge,
+//                preferred over a false green (and over a false red the throw might
+//                not deserve).
+//   "none"       no typed-empty return precedes the throw → the throw IS the no-org
+//                behaviour; the existing verdict (violate) is unchanged.
+// The SECOND dominated form (Eta #20 REVISE — the CRM `dashboard.ts` actual shape):
+// the no-org branch is a VALUE returned from a helper CALL whose NAME marks the no-org
+// case, guarded on that same value —
+//   `const empty = typedEmptyIfNoWorkspace(ctx.workspaceId, EMPTY_DASHBOARD_SUMMARY);
+//    if (empty) return empty;`
+// then a later `requireWorkspaceId(...)` throw that only runs once a workspace IS
+// present. The inline matcher (a `return { … }` object literal behind `if (!org…)`)
+// misses this entirely. The widening is deliberately NARROW: the initializer must be a
+// CALL whose name marks the no-org/empty case (never any `return <identifier>`), AND the
+// guard must be on THAT bound value returning THAT value — the guard is bound to its
+// control, so an unrelated `const x = f(); if (x) return x;` cannot dominate.
+const NO_ORG_EMPTY_HELPER = /(?:typedEmpty|emptyIfNo|ifNoWorkspace|ifNoOrg|noWorkspace|noOrg|unauthorizedIf|whenNoOrg|whenNoWorkspace|emptyWhenNo)/i;
+function namedValueDomination(before) {
+    // `const VAR = [await] [ns.]<helper-whose-name-marks-no-org>( …`
+    const decl = /const\s+([A-Za-z0-9_]+)\s*=\s*(?:await\s+)?(?:[A-Za-z0-9_]+\.)*([A-Za-z0-9_]+)\s*\(/g;
+    let m;
+    // biome-ignore lint/suspicious/noAssignInExpressions: standard regex-exec loop
+    while ((m = decl.exec(before)) !== null) {
+        const varName = m[1];
+        const helperName = m[2];
+        if (!NO_ORG_EMPTY_HELPER.test(helperName))
+            continue;
+        // guarded on THAT value, returning THAT value: `if ([!]VAR) [{] return VAR`
+        const guard = new RegExp(`if\\s*\\(\\s*!?\\s*${varName}\\s*\\)\\s*(?:\\{\\s*)?return\\s+${varName}\\b`);
+        if (guard.test(before))
+            return true;
+    }
+    return false;
+}
+function throwDomination(blockText) {
+    const t1 = ORG_THROW.exec(blockText);
+    const t2 = ORG_THROW_HELPER.exec(blockText);
+    const throwIdx = Math.min(t1 ? t1.index : Number.POSITIVE_INFINITY, t2 ? t2.index : Number.POSITIVE_INFINITY);
+    if (!Number.isFinite(throwIdx))
+        return "none";
+    const before = blockText.slice(0, throwIdx);
+    // Form B (CRM helper-returned value, guard bound to the value) — decisive on its own.
+    if (namedValueDomination(before))
+        return "dominated";
+    // Form A (inline typed-empty object literal + a no-org guard).
+    if (!TYPED_EMPTY_RETURN.test(before))
+        return "none";
+    return NO_ORG_GUARD.test(before) ? "dominated" : "ambiguous";
+}
 /** delimit a function body from its opener at index i by matching braces. */
 function queryBlock(lines, i) {
     let depth = 0;
@@ -164,13 +243,14 @@ export function scanR50(files) {
             note: `builder "${a.name}" = customQuery(${a.base}, …) — its base "${a.base}" resolves to neither \`query\` (public) nor \`internalQuery\`, so whether definitions using it are subscribed queries cannot be enumerated; R-50 refuses rather than certify a surface it cannot see (never a silent green)`,
         });
     }
-    // A GATED public customQuery builder: its customCtx runs an auth/org gate that can
-    // throw, so every subscribed query built from it inherits that throw in the shared
-    // wrapper — invisible to a per-handler scan. REFUSE per builder (could-not-judge),
-    // naming it and counting its dependent subscribed queries, so a customQuery
-    // codebase never reads "R-50 clean" by the opener simply not looking into the
-    // wrapper. (The remedy a human confirms: the wrapper returns a typed empty/unauth
-    // context on the no-org path, or documents an isolation-contract on the builder.)
+    // A GATED public customQuery builder: its customCtx runs an auth/org gate, so
+    // every subscribed query built from it inherits that gate's no-org disposition in
+    // the shared wrapper. That disposition is READABLE in the wrapper's own customCtx
+    // body (unlike a bare handler, where "does a client reach it pre-org" is not
+    // visible), so R-50 JUDGES the builder — never CNJ on this class: a wrapper that
+    // throws NO_ORG with no typed-empty return fires an uncaught Server Error into
+    // every subscription (non-conforming); a wrapper that returns a typed empty/
+    // unauthorized context on the no-org path hands the subscription a shape (conform).
     for (const [name, at] of builders.gated) {
         let deps = 0;
         for (const f of files) {
@@ -184,11 +264,20 @@ export function scanR50(files) {
                     deps += 1;
             }
         }
-        scan.cnj.push({
-            rel: at.rel,
-            n: at.n,
-            note: `customQuery builder "${name}" gates every query built from it in its customCtx (an auth/org require*/throw), and ${deps} subscribed query(ies) route through it — whether that wrapper THROWS into a subscription or returns a typed empty/unauthorized context on the no-org path is not decidable from the query surface. R-50 refuses (a human confirms the wrapper's no-org shape, or the builder carries an isolation-contract marker) — never a silent green obtained by not looking into the wrapper`,
-        });
+        if (at.throws) {
+            scan.violate.push({
+                rel: at.rel,
+                n: at.n,
+                note: `customQuery builder "${name}" gates in its shared customCtx (an auth/org require*/throw) and returns NO typed-empty context on the no-org path — the throw fires into the ${deps} subscribed query(ies) that route through it as an uncaught Server Error the client cannot catch. Return a typed empty/unauthorized context from the wrapper's customCtx on no-org, or document an isolation-contract marker on the builder`,
+            });
+        }
+        else {
+            scan.conform.push({
+                rel: at.rel,
+                n: at.n,
+                note: `customQuery builder "${name}" gates in its shared customCtx but returns a typed empty/unauthorized context on the no-org path (no throw) — the ${deps} subscribed query(ies) built from it receive a shape the client can render, not an uncaught throw`,
+            });
+        }
     }
     for (const f of files) {
         if (!isJudgeable(f))
@@ -259,11 +348,36 @@ export function scanR50(files) {
                 });
             }
             else if (throwsOnNoOrg) {
-                scan.violate.push({
-                    rel: f.rel,
-                    n: block.lines[0].n,
-                    note: `${fn}: public query throws on the missing-org path (org-keyed ConvexError or a throw-on-no-org helper) with no documented contract${hasResolver ? " — a `withOrgScope` resolver is ALSO present, but a fail-closed resolver returning a typed empty scope does NOT rescue an explicit throw that still fires into the subscription (Eta #13 seam)" : ""}. A subscribing client receives an uncaught Server Error. Return a typed empty/unauthorized shape (do not throw), or document that the layout must not subscribe`,
-                });
+                const dom = throwDomination(blockText);
+                if (dom === "dominated") {
+                    // The no-org branch RETURNS a typed empty/unauthorized shape before
+                    // the throw is reached, and a no-org guard owns that branch — the
+                    // throw guards an org-PRESENT path and never fires on the no-org path
+                    // a subscribing client can hit. Conform (dominated throw).
+                    scan.conform.push({
+                        rel: f.rel,
+                        n: block.lines[0].n,
+                        note: `${fn}: public query returns a typed empty/unauthorized shape on the no-org branch (an early no-org guard) BEFORE the org-throw is reachable — the throw guards an org-present path and never fires into the subscription on the no-org path. The subscribing client receives a shape, not an uncaught Server Error`,
+                    });
+                }
+                else if (dom === "ambiguous") {
+                    // A typed-empty return precedes the throw but no no-org guard is visible
+                    // before it — whether the return dominates the no-org path (vs. sitting
+                    // behind an unrelated condition while the throw still fires on no-org)
+                    // is not statically decidable. Could-not-judge, never a silent green.
+                    scan.cnj.push({
+                        rel: f.rel,
+                        n: block.lines[0].n,
+                        note: `${fn}: a typed empty/unauthorized return precedes the org-throw but no no-org guard is visible ahead of the throw — whether the return dominates the no-org path or the throw still fires on it is not statically decidable; a human must judge (never a silent green)`,
+                    });
+                }
+                else {
+                    scan.violate.push({
+                        rel: f.rel,
+                        n: block.lines[0].n,
+                        note: `${fn}: public query throws on the missing-org path (org-keyed ConvexError or a throw-on-no-org helper) with no documented contract${hasResolver ? " — a `withOrgScope` resolver is ALSO present, but a fail-closed resolver returning a typed empty scope does NOT rescue an explicit throw that still fires into the subscription (Eta #13 seam)" : ""}. A subscribing client receives an uncaught Server Error. Return a typed empty/unauthorized shape (do not throw), or document that the layout must not subscribe`,
+                    });
+                }
             }
             else {
                 // hasResolver, no throw, no marker — the fail-closed resolver is the

package/dist/detectors/source/write-isolation.js

@@ -13,6 +13,62 @@ const GATE_HELPER = /\b(?:require|ensure|assert)[A-Z][A-Za-z0-9_]*\s*\(/;
 // a TYPED unauthorized RESULT — the write returns a shape instead of throwing.
 const TYPED_UNAUTH_RETURN = /return\s+\{[^}]*\b(?:unauthorized|forbidden|noOrg|no_org|denied|ok\s*:\s*false)\b/i;
 const CONTRACT_MARKER = /write-contract:|client-must-not-write-before-org|isolation-contract:/i;
+// A TYPED EMPTY / UNAUTHORIZED RETURN broad enough to catch the CRM no-org branch
+// shape `return { items: [], unauthorized: true }` / `{ orgId: null }` — mirrors
+// R-50's TYPED_EMPTY_RETURN. TYPED_UNAUTH_RETURN above matches the explicit
+// unauthorized/denied vocabulary anywhere in the block (the write-returns-a-shape
+// green); this broader form is used ONLY by the domination heuristic, to recognise a
+// typed-empty return that lexically DOMINATES a later org-throw on the no-org branch.
+const TYPED_EMPTY_RETURN = /return\s+\{[^}]*\b(?:unauthorized|forbidden|noOrg|no_org|denied|empty)\b|return\s+\{[^}]*\b(?:orgSlug|orgId)\s*:\s*null\b|return\s+\{\s*items\s*:\s*\[\s*\]|return\s+\{[^}]*\bok\s*:\s*false\b/i;
+// A NO-ORG GUARD condition owning the no-org branch — used by the domination
+// heuristic to establish that a typed-empty return preceding the org-throw plausibly
+// owns the no-org path.
+const NO_ORG_GUARD = /if\s*\(\s*!\s*(?:scope\.|ctx\.[A-Za-z0-9_.]*)?(?:org|orgId|orgSlug|workspaceId|workspace|identity)\b|if\s*\([^)]*\b(?:org|orgId|orgSlug|workspaceId)\s*(?:===|==)\s*null/i;
+// DOMINATION heuristic (mirror of R-50 — a DOMINATED no-org throw). A bare public
+// mutation whose handler RETURNS a typed empty/unauthorized shape on the no-org
+// branch BEFORE it reaches the org-throw is NOT the two-absence violation: the throw
+// guards an org-PRESENT path (the CRM shape `if (!org) return { items: [] }` at the
+// top, then a later `requireWorkspaceId(...)` / `throw` reachable only once an org
+// exists). Judged TEXTUALLY and CONSERVATIVELY — a real throw is never silently
+// flipped to green:
+//   "dominated"  a typed-empty return lexically precedes the first org-throw AND a
+//                no-org guard also precedes that throw → conform (dominated throw).
+//   "ambiguous"  a typed-empty return precedes the throw but NO no-org guard is
+//                visible before it → could-not-judge (domination not established),
+//                never a silent green and never a false red.
+//   "none"       no typed-empty return precedes the throw → unchanged (the existing
+//                two-absence violate / marker CNJ chain stands).
+// Form B (Eta #20 REVISE — a no-org VALUE returned from a helper CALL whose NAME marks
+// the no-org case, guarded on that same value: `const empty = typedEmptyIfNoWorkspace(…);
+// if (empty) return empty;`). NARROW: the initializer is a call whose name marks no-org
+// (never any `return <identifier>`), and the guard is bound to THAT value returning it.
+const NO_ORG_EMPTY_HELPER = /(?:typedEmpty|emptyIfNo|ifNoWorkspace|ifNoOrg|noWorkspace|noOrg|unauthorizedIf|whenNoOrg|whenNoWorkspace|emptyWhenNo)/i;
+function namedValueDomination(before) {
+    const decl = /const\s+([A-Za-z0-9_]+)\s*=\s*(?:await\s+)?(?:[A-Za-z0-9_]+\.)*([A-Za-z0-9_]+)\s*\(/g;
+    let m;
+    // biome-ignore lint/suspicious/noAssignInExpressions: standard regex-exec loop
+    while ((m = decl.exec(before)) !== null) {
+        if (!NO_ORG_EMPTY_HELPER.test(m[2]))
+            continue;
+        const guard = new RegExp(`if\\s*\\(\\s*!?\\s*${m[1]}\\s*\\)\\s*(?:\\{\\s*)?return\\s+${m[1]}\\b`);
+        if (guard.test(before))
+            return true;
+    }
+    return false;
+}
+function throwDomination(blockText) {
+    const t1 = ORG_THROW.exec(blockText);
+    const t2 = WRITE_GATE_HELPER.exec(blockText);
+    const throwIdx = Math.min(t1 ? t1.index : Number.POSITIVE_INFINITY, t2 ? t2.index : Number.POSITIVE_INFINITY);
+    if (!Number.isFinite(throwIdx))
+        return "none";
+    const before = blockText.slice(0, throwIdx);
+    if (namedValueDomination(before))
+        return "dominated";
+    if (!TYPED_EMPTY_RETURN.test(before))
+        return "none";
+    return NO_ORG_GUARD.test(before) ? "dominated" : "ambiguous";
+}
 function discoverWriteBuilders(files) {
     const b = {
         publicMutation: new Set([BASE_PUBLIC_MUTATION]),
@@ -62,8 +118,13 @@ function discoverWriteBuilders(files) {
                 const gates = ORG_THROW.test(codeRegion) ||
                     WRITE_GATE_HELPER.test(codeRegion) ||
                     GATE_HELPER.test(codeRegion);
-                if (gates && !CONTRACT_MARKER.test(rawRegion))
-                    b.gated.set(name, { rel: f.rel, n: l.n });
+                if (gates && !CONTRACT_MARKER.test(rawRegion)) {
+                    // The wrapper's customCtx is readable — judge its no-org disposition:
+                    // a typed unauthorized return means writes receive a shape (conform);
+                    // otherwise the gate throws NO_ORG into every write (non-conforming).
+                    const typedUnauth = TYPED_UNAUTH_RETURN.test(codeRegion);
+                    b.gated.set(name, { rel: f.rel, n: l.n, throws: !typedUnauth });
+                }
             }
             else if (base === BASE_INTERNAL_MUTATION)
                 b.nonSubject.add(name);
@@ -127,11 +188,20 @@ export function scanR51(files) {
                     deps += 1;
             }
         }
-        scan.cnj.push({
-            rel: at.rel,
-            n: at.n,
-            note: `customMutation builder "${name}" gates every write built from it in its customCtx (requireWriteAccess/an org gate that can throw), and ${deps} public write(s) route through it — whether a client can reach one BEFORE an org is resolved (so the no-org throw is an uncaught Server Error, not a refusal) is not decidable from convex/. R-51 refuses (a human confirms the shell cannot issue these pre-org, or the write returns a typed unauthorized result / carries a write-contract marker) — never a silent PASS`,
-        });
+        if (at.throws) {
+            scan.violate.push({
+                rel: at.rel,
+                n: at.n,
+                note: `customMutation builder "${name}" gates every write built from it in its shared customCtx (requireWriteAccess/an org gate that throws) and returns NO typed-unauthorized result on the no-org path — the throw fires into the ${deps} public write(s) that route through it as an uncaught Server Error a pre-org client shell cannot render. Return a typed unauthorized result from the wrapper's customCtx on no-org, or document a write-contract marker on the builder asserting a client cannot reach these pre-org`,
+            });
+        }
+        else {
+            scan.conform.push({
+                rel: at.rel,
+                n: at.n,
+                note: `customMutation builder "${name}" gates in its shared customCtx but returns a typed unauthorized result on the no-org path (no throw) — the ${deps} public write(s) built from it receive a shape a pre-org client can render, not an uncaught Server Error`,
+            });
+        }
     }
     for (const f of files) {
         if (!isJudgeable(f))
@@ -168,24 +238,59 @@ export function scanR51(files) {
             const hasMarker = CONTRACT_MARKER.test(blockAll);
             if (!throwsOnNoOrg && !typedUnauth && !hasMarker)
                 continue; // not a subject
-            if (hasMarker || (typedUnauth && !throwsOnNoOrg)) {
+            if (typedUnauth) {
+                // The write returns a shape on the no-org path — a pre-org client can render
+                // it, not an uncaught Server Error. Green.
+                scan.conform.push({
+                    rel: f.rel,
+                    n: block.lines[0].n,
+                    note: `${fn}: public mutation returns a typed unauthorized result on the no-org path — a pre-org client receives a shape it can render, not an uncaught Server Error`,
+                });
+            }
+            else if (throwsOnNoOrg && throwDomination(blockText) === "dominated") {
+                // The no-org branch RETURNS a typed empty/unauthorized shape (behind an
+                // early no-org guard) BEFORE the org-throw is reachable — the throw guards
+                // an org-PRESENT path and never fires on the no-org render path. Not the
+                // two-absence violation. Conform (dominated throw).
                 scan.conform.push({
                     rel: f.rel,
                     n: block.lines[0].n,
-                    note: `${fn}: public mutation returns a typed unauthorized result on the no-org path (or documents a write-contract) — a pre-org client receives a shape it can render, not an uncaught Server Error`,
+                    note: `${fn}: public mutation returns a typed empty/unauthorized shape on the no-org branch (an early no-org guard) BEFORE the org-throw is reachable — the throw guards an org-present path and never fires on the no-org render path. A pre-org client receives a shape, not an uncaught Server Error`,
                 });
             }
-            else if (throwsOnNoOrg) {
-                // The React shell is not in convex/, so the doctor CANNOT decide whether a
-                // client reaches this write BEFORE an org (an R-51 uncaught-Server-Error
-                // crash) or only an imperative caller does (an R-16 refusal it catches).
-                // It therefore REFUSES (could-not-judge) naming the write — never a silent
-                // PASS, and never a false `violate` on a server-side R-16 refusal. Pi's
-                // spec: "doctor refuses (CNJ) when it cannot judge the client; CNJ != vert".
+            else if (throwsOnNoOrg && throwDomination(blockText) === "ambiguous") {
+                // A typed-empty return precedes the throw but no no-org guard is visible
+                // ahead of it — whether the return dominates the no-org path is not
+                // statically decidable. Could-not-judge, never a silent green.
                 scan.cnj.push({
                     rel: f.rel,
                     n: block.lines[0].n,
-                    note: `${fn}: public mutation throws on the missing-org path (org-keyed ConvexError or requireWriteAccess/requireWorkspaceId) with no typed-unauthorized return and no documented contract. Whether a client shell issues this write BEFORE an org is resolved (an uncaught Server Error — the R-51 defect) or only an imperative caller reaches it (an R-16 refusal it catches) is not decidable from convex/. R-51 refuses (return a typed unauthorized result, or a write-contract marker if a client cannot reach it pre-org) — never a silent PASS`,
+                    note: `${fn}: a typed empty/unauthorized return precedes the org-throw but no no-org guard is visible ahead of the throw — whether the return dominates the no-org path or the throw still fires on it is not statically decidable; a human must judge (never a silent green)`,
+                });
+            }
+            else if (hasMarker) {
+                // A throwing write that CARRIES a write-contract marker: the marker is the
+                // author's recorded claim that a client cannot reach this write pre-org —
+                // a claim the reviewer verifies, not one convex/ can prove. could-not-judge
+                // (Eta #141 REVISE: CNJ is reserved for the marker-borne claim, not the
+                // bare accusation).
+                scan.cnj.push({
+                    rel: f.rel,
+                    n: block.lines[0].n,
+                    note: `${fn}: public mutation throws on the missing-org path AND carries a write-contract marker — the marker records a claim that a client cannot reach this write before an org exists, which convex/ cannot verify. R-51 refuses (a reviewer checks the marker's claim) — never a silent green`,
+                });
+            }
+            else {
+                // Bare throwing write: no typed-unauthorized return AND no write-contract
+                // marker — the two absences are both readable in convex/. The accusation
+                // stands (an uncaught Server Error on any pre-org render path) until the
+                // author returns a shape or records the unreachability claim. RED, never
+                // CNJ (Eta #141 REVISE: deleting this red deletes the only pressure to
+                // write the marker).
+                scan.violate.push({
+                    rel: f.rel,
+                    n: block.lines[0].n,
+                    note: `${fn}: public mutation throws on the missing-org path (org-keyed ConvexError or requireWriteAccess/requireWorkspaceId/getEffectiveWorkspaceId) with NO typed-unauthorized return and NO write-contract marker — both absences readable in convex/. A pre-org client shell issuing this write receives an uncaught Server Error. Return a typed unauthorized result, or record a write-contract marker if a client cannot reach it pre-org`,
                 });
             }
         }

package/dist/detectors/standard/_doc.d.ts

@@ -1,6 +1,6 @@
 import type { Detector, DetectorResult } from "../../engine-types.js";
 /** The vendored-fixture basename used as the anchor file for every doc site. */
-export declare const STANDARD_FILE = "backend-standard-dcec1ba.md";
+export declare const STANDARD_FILE = "backend-standard-4bcd605.md";
 export declare const VENDORED_STANDARD_PATH: string;
 /** The standard all four are pinned against (short hash a9d7877b). */
 export declare const STANDARD_DOC_PIN = "analysis/vantagepeers/backend-standard/backend-standard.md @ a9d7877b4947ed8ae61d234433debb2182a2ba44 (elpiarthera/ElPi-Corp) \u00A714/\u00A711/\u00A710/\u00A73";

package/dist/detectors/standard/_doc.js

@@ -2,7 +2,7 @@
 // detectors that read THE STANDARD ITSELF as their material — R-42, R-15, R-32,
 // R-39. Unlike the source-tree detectors (which read convex/ via `tree.files`)
 // and the oracle detectors (which read the CSV), these read the VENDORED standard
-// fixture `fixtures/backend-standard-dcec1ba.md` — the material at the pin. The
+// fixture `fixtures/backend-standard-4bcd605.md` — the material at the pin. The
 // engine's contract types are DERIVED from engine-types.ts, never re-spelled.
 //
 // THE LAW (the one that caught R-5): every predicate is derived from the ACTUAL
@@ -13,7 +13,7 @@ import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 /** The vendored-fixture basename used as the anchor file for every doc site. */
-export const STANDARD_FILE = "backend-standard-dcec1ba.md";
+export const STANDARD_FILE = "backend-standard-4bcd605.md";
 /** The vendored standard at the pin — DATA on the same footing as the oracle CSV.
  * Resolved locally (not via coverage.ts) so this module carries no import cycle
  * with registry.ts. Same file coverage.ts's VENDORED_STANDARD_PATH points at. */

package/dist/not-checkable.js

@@ -16,7 +16,7 @@
 // gentler word — it was emptied.
 import { STANDARD_FILE } from "./detectors/standard/_doc.js";
 export const NOT_MECHANICALLY_CHECKABLE = {
-    "R-48": "R-48 authority-totality detector pending — task k17chpr4kzp399j3s7r7edpm4s8cscbz; text pinned at dcec1ba so coverage cannot pretend 47 is complete. No mechanical control yet; R-48 is enumerated and visible, never silently dropped.",
+    "R-48": "R-48 authority-totality detector pending — task k17chpr4kzp399j3s7r7edpm4s8cscbz; text pinned at 4bcd605 so coverage cannot pretend 47 is complete. No mechanical control yet; R-48 is enumerated and visible, never silently dropped.",
 };
 /**
  * One `could-not-judge` DetectorResult per NOT_MECHANICALLY_CHECKABLE rule, so

package/dist/registry.d.ts

@@ -1,6 +1,6 @@
 import type { Detector } from "./engine-types.js";
 /** The standard both pins the whole wave against. */
-export declare const STANDARD_PIN = "analysis/vantagepeers/backend-standard/backend-standard.md @ dcec1ba31091accfe9b8840fab736815306307c5 (elpiarthera/ElPi-Corp)";
+export declare const STANDARD_PIN = "analysis/vantagepeers/backend-standard/backend-standard.md @ 4bcd605656ceff52d4f1593a9176cd6b988471be (elpiarthera/ElPi-Corp)";
 export interface RegistryEntry {
     detector: Detector;
     ruleId: string;

package/dist/registry.js

@@ -21,7 +21,7 @@ import { R46_STANDARD_PIN, STANDARD_SOURCE_DETECTORS, } from "./detectors/standa
 import { STANDARD_DOC_DETECTORS } from "./detectors/standard/standard-doc.js";
 import { makeR14, makeR38 } from "./detectors/structural.js";
 /** The standard both pins the whole wave against. */
-export const STANDARD_PIN = "analysis/vantagepeers/backend-standard/backend-standard.md @ dcec1ba31091accfe9b8840fab736815306307c5 (elpiarthera/ElPi-Corp)";
+export const STANDARD_PIN = "analysis/vantagepeers/backend-standard/backend-standard.md @ 4bcd605656ceff52d4f1593a9176cd6b988471be (elpiarthera/ElPi-Corp)";
 export const REGISTRY = [
     ...PER_ROW_PREDICATES.map((spec) => ({
         detector: makeOracleDetector(spec),