@vantageos/backend-doctor 0.1.8 → 0.1.9

package/dist/detectors/source/isolation.js

@@ -410,11 +410,15 @@ export function scanR50(files) {
     // so the verdict is CNJ-with-sites, not a misleading empty abstain. Gated on "scan
     // otherwise empty" so a tree that already produced subjects (VP: 20 conform) is
     // byte-for-byte unchanged.
-    if (scan.conform.length + scan.violate.length + scan.cnj.length === 0 &&
-        ungated.length > 0) {
-        for (const u of ungated)
-            scan.cnj.push(u);
-    }
+    // A bare ungated public read (no throw / resolver / marker) is NEVER a silent
+    // clean bill — whether the scan is otherwise empty (a fully-ungated backend) OR
+    // mixed (bare reads alongside gated subjects). Surface EVERY such read as
+    // could-not-judge naming its site: never conformed, never dropped. (Eta mixed-tree
+    // follow-up: the prior "scan otherwise empty" guard silently dropped bare ungated
+    // reads whenever any gated subject also existed — a bare read hidden behind a
+    // conforming sibling. Removed: the disposition is per-def, not per-tree.)
+    for (const u of ungated)
+        scan.cnj.push(u);
     return scan;
 }
 export const R50 = srcDetector("R-50", "R-50 org isolation on a reactively-subscribed read returns a typed empty/unauthorized result, never an uncaught throw", "a public query that resolves org via a fail-closed non-throwing path or documents its client contract — it never throws on the missing-org path a subscribing client cannot catch", scanR50, "R-50: no public query matched in the scanned tree — no reactive read to certify. NOT a clean bill.");

package/dist/detectors/source/write-isolation.js

@@ -321,11 +321,16 @@ export function scanR51(files) {
     // abstain. Gated on "scan otherwise empty" so a tree that already produced
     // subjects (VP: 7 marker CNJ) is byte-for-byte unchanged — the bare-write
     // disposition in a mixed tree is out of this fix's scope.
-    if (scan.conform.length + scan.violate.length + scan.cnj.length === 0 &&
-        ungated.length > 0) {
-        for (const u of ungated)
-            scan.cnj.push(u);
-    }
+    // A bare ungated public write (no throw / typed-unauth / marker) is NEVER a silent
+    // clean bill — whether the scan is otherwise empty (a fully-ungated public-write
+    // surface) OR mixed (bare writes alongside gated/marker subjects). Surface EVERY
+    // such write as could-not-judge naming its site: never conformed, never dropped.
+    // (Eta mixed-tree follow-up: the prior "scan otherwise empty" guard silently
+    // dropped bare ungated writes whenever any gated/marker subject also existed — a
+    // bare write hidden behind a sibling that happened to produce a verdict. Removed:
+    // the disposition is per-def, not per-tree.)
+    for (const u of ungated)
+        scan.cnj.push(u);
     return scan;
 }
 export const R51 = srcDetector("R-51", "R-51 a public mutation returns a typed unauthorized result on the no-org path, never an uncaught throw a pre-org client shell cannot render", "a public write either returns a typed unauthorized result / documents its client contract, or a human confirms a pre-org client cannot reach it — it never throws NO_ORG on a path an ordinary render can hit", scanR51, "R-51: no public mutation matched in the scanned tree — no write to certify. NOT a clean bill.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/backend-doctor",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "A conformance instrument that measures the VantagePeers backend against the pinned backend standard. The THIRD doctor built ON the @vantageos/mcp-doctor engine — never a third engine. It consumes runDoctor/renderTable and adds only detectors.",
   "type": "module",
   "main": "./dist/cli.js",