@vantageos/backend-doctor 0.2.0 → 0.3.0

package/dist/detectors/source/writesafety.js

@@ -131,20 +131,33 @@ export function scanR18(files) {
 //       them into one mutation "would game the regex without changing atomicity"
 //       (okfBundleNode importOkfBundle shape).
 // An action that would be flagged non-conforming may carry an `atomicity-exception:`
-// marker naming EXACTLY ONE of those two shapes. Per Eta's three conditions:
-//   COND 1 — the disposition is COULD-NOT-JUDGE, never conform. A marker records a
-//     CLAIM that reaches a human reviewer; it never closes the rule green (same as
-//     the R-51 marker, #141).
-//   COND 2 — the marker MUST name which shape it claims, because the two are checked
-//     differently and the reviewer must know which question to ask.
+// marker naming EXACTLY ONE of those two shapes. Per Eta's three conditions
+// (superseded on the disposition axis by task k179jnhx, §23 — judgement retired
+// as an acceptance kind, 2026-09-02):
+//   COND 1 — originally "the disposition is COULD-NOT-JUDGE, never conform: a
+//     marker records a CLAIM that reaches a human reviewer" (Eta ruling
+//     2026-08-31, mirroring the R-51 marker #141). The standard's §23 rewrite
+//     retires that disposition: a well-formed, COMPLETE claim (COND 2 + COND 3
+//     both satisfied — the shape named, and its checkable sub-conditions all
+//     present) IS the written justification the marker was always meant to
+//     record, exactly as JUSTIFIÉ:/JUSTIFIED: is elsewhere — so it now decides
+//     mechanically to PRESENT, never could-not-judge. An INCOMPLETE claim still
+//     buys nothing (COND 3, unchanged): the site stays non-conforming until the
+//     claim is well-formed.
+//   COND 2 — the marker MUST name which shape it claims, because the three are
+//     checked differently and the check must know which sub-conditions to ask for.
 //   COND 3 — the dangerous shape is (2): "unbounded loop, each write independently
 //     atomic" is a sentence anyone can write about a split invariant. So shape (2)
 //     is only honoured when the region ALSO names the loop (for/for-of/.forEach/.map)
 //     AND states the independence (no invariant spans two writes). A shape-(2) marker
 //     that names neither the loop nor the independence is INCOMPLETE — it does not buy
-//     could-not-judge; the site stays non-conforming until the claim is well-formed.
-// A well-formed marker → could-not-judge (the reviewer verifies the per-site claim).
-// No marker, an unknown shape, or an incomplete shape-(2) claim → non-conforming.
+//     present; the site stays non-conforming until the claim is well-formed.
+// A well-formed, COMPLETE marker → present (the claim itself is the recorded
+// justification; the control decides on the claim's structural completeness,
+// never on a person's opinion of whether it is sound).
+// No marker, an unknown shape, or an incomplete claim → non-conforming.
+// could-not-judge is reserved for a site the instrument could not read (never
+// reached here — every site below either parsed a marker or did not).
 // ---------------------------------------------------------------------------
 const ACTION_OPEN = /export\s+const\s+(\w+)\s*=\s*action\s*\(/;
 const NEXT_EXPORT = /export\s+const\s+\w+\s*=/;
@@ -232,16 +245,16 @@ export function scanR29(files) {
                             ? shapeReingest
                             : false;
                 if (shape && shapeComplete) {
-                    // COND 1: a well-formed marker yields COULD-NOT-JUDGE, never conform —
-                    // the claim is deferred to the reviewer, who verifies it per site.
-                    scan.cnj.push({
+                    // COND 1 (§23 rewrite, task k179jnhx): a well-formed, COMPLETE marker
+                    // is itself the written justification — decided mechanically, present.
+                    scan.conform.push({
                         rel: f.rel,
                         n: firstMut || openLine,
-                        note: `action ${inAction} issues ${count} ctx.runMutation calls AND carries an atomicity-exception marker claiming shape "${shape}" — ${shape === SHAPE_PER_ITEM_LOOP
+                        note: `action ${inAction} issues ${count} ctx.runMutation calls AND carries a COMPLETE atomicity-exception marker claiming shape "${shape}" — ${shape === SHAPE_PER_ITEM_LOOP
                             ? "the region names its loop and states the per-item writes are independently atomic (no invariant spans two)"
                             : shape === SHAPE_GATE_REINGEST
                                 ? "a leading gate runMutation, a supersede/dedup keyed on a stable namespace, and a recovering re-insert loop, with the convergence stated explicitly — a re-ingest of the same stable key converges on one current set"
-                                : "exactly two runMutations, the first a gate (require*/assert*/bind*) preceding a single atomic write, which R-29's <=1 bar has no room for"}. R-29 refuses (a reviewer verifies the claim per site) — never a silent green (Eta ruling 2026-08-31)`,
+                                : "exactly two runMutations, the first a gate (require*/assert*/bind*) preceding a single atomic write, which R-29's <=1 bar has no room for"}. The marker's structural completeness IS the written justification (§23) — decided by the claim's presence, never a person's opinion of it`,
                     });
                 }
                 else if (shape === SHAPE_GATE_REINGEST) {

package/dist/detectors/standard/_doc.d.ts

@@ -1,6 +1,6 @@
 import type { Detector, DetectorResult } from "../../engine-types.js";
 /** The vendored-fixture basename used as the anchor file for every doc site. */
-export declare const STANDARD_FILE = "backend-standard-4bcd605.md";
+export declare const STANDARD_FILE = "backend-standard-2825122.md";
 export declare const VENDORED_STANDARD_PATH: string;
 /** The standard all four are pinned against (short hash a9d7877b). */
 export declare const STANDARD_DOC_PIN = "analysis/vantagepeers/backend-standard/backend-standard.md @ a9d7877b4947ed8ae61d234433debb2182a2ba44 (elpiarthera/ElPi-Corp) \u00A714/\u00A711/\u00A710/\u00A73";

package/dist/detectors/standard/_doc.js

@@ -2,7 +2,7 @@
 // detectors that read THE STANDARD ITSELF as their material — R-42, R-15, R-32,
 // R-39. Unlike the source-tree detectors (which read convex/ via `tree.files`)
 // and the oracle detectors (which read the CSV), these read the VENDORED standard
-// fixture `fixtures/backend-standard-4bcd605.md` — the material at the pin. The
+// fixture `fixtures/backend-standard-2825122.md` — the material at the pin. The
 // engine's contract types are DERIVED from engine-types.ts, never re-spelled.
 //
 // THE LAW (the one that caught R-5): every predicate is derived from the ACTUAL
@@ -12,8 +12,9 @@
 import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { itemCount, withCount } from "../../violation-count.js";
 /** The vendored-fixture basename used as the anchor file for every doc site. */
-export const STANDARD_FILE = "backend-standard-4bcd605.md";
+export const STANDARD_FILE = "backend-standard-2825122.md";
 /** The vendored standard at the pin — DATA on the same footing as the oracle CSV.
  * Resolved locally (not via coverage.ts) so this module carries no import cycle
  * with registry.ts. Same file coverage.ts's VENDORED_STANDARD_PATH points at. */
@@ -136,12 +137,12 @@ export function decideDoc(ruleId, id, check, scan, emptyReason) {
         .map((x) => `${STANDARD_FILE}:${x.n} (${x.note})`)
         .join("; ");
     if (nV > 0) {
-        return {
+        return withCount({
             id,
             anchor: `${STANDARD_FILE}:${scan.violate[0].n}`,
             state: "non-conforming",
             verdict: `${ruleId}: ${nV} STATIC violation(s) in the standard document (${check}). ${breakdown} Violations: ${fmt(scan.violate)}.${nC ? ` Conform: ${fmt(scan.conform)}.` : ""}`,
-        };
+        }, itemCount(nV));
     }
     if (nJ > 0) {
         const reason = `${ruleId}: static half clean (${nC} conform); ${nJ} site(s) owe a human/gate verdict — ${fmt(scan.cnj)}. This is NOT a clean bill: GREEN is the gate half surfaced per site, not the detection running. ${breakdown}`;

package/dist/detectors/standard/r41-frontier.js

@@ -24,6 +24,7 @@
 import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { itemCount, withCount } from "../../violation-count.js";
 import { readStandard, STANDARD_FILE, toLines } from "./_doc.js";
 /** prefix → { the sibling fixture basename, its recorded upstream blob hash }.
  * The blob hash is the PINS.txt record — a vendored document that cannot be
@@ -154,12 +155,12 @@ export function decideR41(r) {
         const deadList = r.dead
             .map((c) => `${c.id} (cited ${site(c)}) not defined in ${SIBLING[c.prefix].file}`)
             .join("; ");
-        return {
+        return withCount({
             id: R41_ID,
             anchor: site(r.dead[0]),
             state: "non-conforming",
             verdict: `R-41: ${r.dead.length} DEAD POINTER(S) — a cited frontier id resolves to no definition in its sibling (a dead pointer is a red, not a note). ${counts} Dead: ${deadList}. Cited: ${citedList}.`,
-        };
+        }, itemCount(r.dead.length));
     }
     return {
         id: R41_ID,

package/dist/detectors/standard/r46-returns-validator.js

@@ -37,6 +37,7 @@
 //      (non-conforming / could-not-judge / present / absent) — no fifth state,
 //      no second mechanism: the detector reads the tree the engine hands it.
 import * as ts from "typescript";
+import { siteCount, withCount } from "../../violation-count.js";
 /** The standard this detector is pinned against (the re-pinned instrument pin). */
 export const R46_STANDARD_PIN = "analysis/vantagepeers/backend-standard/backend-standard.md @ a9d7877b4947ed8ae61d234433debb2182a2ba44 (elpiarthera/ElPi-Corp) §16 R-46";
 // ---------------------------------------------------------------------------
@@ -456,12 +457,12 @@ export function decideR46(cov) {
     }
     if (missing.length > 0) {
         const first = missing[0];
-        return {
+        return withCount({
             id: R46_ID,
             anchor: `${first.rel}:${first.line}`,
             state: "non-conforming",
             verdict: `R-46: ${missing.length} returns validator(s) enumerate a stored document but OMIT a schema-declared field with NO written projection reason (${R46_CHECK}). ${breakdown}\n=== coverage inventory ===\n${inventory}\n=== end inventory ===`,
-        };
+        }, siteCount(missing));
     }
     if (cov.findings.length > 0) {
         const first = cov.findings[0];

package/dist/detectors/structural.d.ts

@@ -1,14 +1,13 @@
 import type { Detector } from "../engine-types.js";
-import { type OracleRow } from "../oracle.js";
+import { type OracleRow, type WriterTierTable } from "../oracle.js";
 /**
  * R-14 — inventory-schema parity, contract → inventory, one direction.
  * A merged reader/writer authority column is "non-conforming by construction"
- * (§12). The oracle's column 9 `rbac_qui` is that single merged column.
+ * (§12). Writer authority is a separate column only when the side-car declares it.
  */
-export declare function makeR14(columns?: readonly string[]): Detector;
+export declare function makeR14(columns?: readonly string[], rowsProvider?: () => OracleRow[], sideCar?: () => WriterTierTable): Detector;
 /**
- * R-38 — the completeness gate over the thirteen §2 fields. The oracle cannot
- * satisfy the contract because reader and writer authority are not two separate
- * fields (both map to `rbac_qui`).
+ * R-38 — the completeness gate over the thirteen §2 fields. Writer authority is
+ * complete only when the side-car records a tier for every write tool.
  */
-export declare function makeR38(columns?: readonly string[], rowsProvider?: () => OracleRow[]): Detector;
+export declare function makeR38(columns?: readonly string[], rowsProvider?: () => OracleRow[], sideCar?: () => WriterTierTable): Detector;

package/dist/detectors/structural.js

@@ -1,54 +1,80 @@
 // The two STRUCTURAL detectors — R-14 and R-38. They judge the inventory SCHEMA
-// against the §2 contract, not a single row. Run against THIS oracle they MUST
-// return `non-conforming`, because §2 splits authority into two distinct fields
-// (reader R-5, writer R-10) and the oracle carries a SINGLE merged `rbac_qui`
-// column. Agreeing with the oracle here would be certifying the defect the
-// instrument exists to find — so these are NOT tuned to pass.
-import { CONTRACT_FIELDS, READER_AUTHORITY_COLUMN, WRITER_AUTHORITY_COLUMN, authorityIsMerged } from "../contract.js";
-import { ORACLE_COLUMNS, oracleLabel, readOracle, refuseWithoutOracle, requireOracle, } from "../oracle.js";
+// against the §2 contract, not a single row.
+//
+// §2 splits authority into two contract fields (reader R-5, writer R-10). The
+// oracle carries ONE authority column, `rbac_qui`; writer authority has a column
+// of its own only through the writer-tier side-car (`writer_tier`, joined on
+// `outil` — see resolveAuthoritySplit in src/contract.ts). So:
+//   side-car absent, or missing a write tool -> non-conforming (merged/omitted)
+//   side-car unreadable                      -> could-not-judge
+//   side-car complete over every write tool  -> the split is declared
+// An oracle alone is never green here: agreeing with a merged column would be
+// certifying the defect the instrument exists to find.
+import { CONTRACT_FIELDS, READER_AUTHORITY_COLUMN, resolveAuthoritySplit, SPLIT_WRITER_AUTHORITY_COLUMN, } from "../contract.js";
+import { isInventoryRow, ORACLE_COLUMNS, oracleLabel, readOracle, readWriterTier, refuseWithoutOracle, requireOracle, } from "../oracle.js";
+import { itemCount, withCount } from "../violation-count.js";
+import { WRITE_VERBS } from "./shared.js";
 const csvAnchor = () => `${oracleLabel()} col#9 rbac_qui`;
+function splitFor(rows, sideCar) {
+    const writeTools = rows
+        .filter(isInventoryRow)
+        .filter((r) => WRITE_VERBS.has(r.by.crud))
+        .map((r) => r.by.outil);
+    return resolveAuthoritySplit(writeTools, sideCar());
+}
+function unjudgeable(id, reason) {
+    const verdict = `${id.split(" ")[0]}: could not judge — ${reason}.`;
+    return { id, anchor: csvAnchor(), state: "could-not-judge", verdict, reason: verdict };
+}
 /**
  * R-14 — inventory-schema parity, contract → inventory, one direction.
  * A merged reader/writer authority column is "non-conforming by construction"
- * (§12). The oracle's column 9 `rbac_qui` is that single merged column.
+ * (§12). Writer authority is a separate column only when the side-car declares it.
  */
-export function makeR14(columns = ORACLE_COLUMNS) {
+export function makeR14(columns = ORACLE_COLUMNS, rowsProvider = readOracle, sideCar = readWriterTier) {
+    const id = "R-14 inventory-schema parity";
     return {
-        id: "R-14 inventory-schema parity",
+        id,
         // The verdict is about the oracle's schema, so with no oracle bound there is
         // no subject: refuse (could-not-judge), never a verdict on the tool's own constant.
-        run: () => refuseWithoutOracle("R-14 inventory-schema parity", () => {
+        run: () => refuseWithoutOracle(id, () => {
             requireOracle();
-            const authorityColumns = columns.filter((c) => c === "rbac_qui");
-            if (authorityIsMerged() || authorityColumns.length < 2) {
-                return {
-                    id: "R-14 inventory-schema parity",
+            const missing = CONTRACT_FIELDS.flatMap((f) => f.columns.filter((c) => !columns.includes(c)).map((c) => `${f.field}→${c}`));
+            const split = splitFor(rowsProvider(), sideCar);
+            if (split.kind === "unjudgeable")
+                return unjudgeable(id, split.reason);
+            if (split.kind === "merged" || missing.length > 0) {
+                return withCount({
+                    id,
                     anchor: csvAnchor(),
                     state: "non-conforming",
-                    verdict: "R-14: the inventory holds a SINGLE merged authority column `rbac_qui` (col#9), " +
-                        "but §2 splits authority into two distinct contract fields — reader authority (R-5) " +
-                        "and writer authority (R-10). A merged authority column is non-conforming by construction: " +
-                        "the reader/writer divergence R-10 and R-7 exist to record cannot be written in it.",
-                };
+                    verdict: "R-14: §2 splits authority into two distinct contract fields — reader authority (R-5) " +
+                        `and writer authority (R-10) — but the inventory's only authority column is \`${READER_AUTHORITY_COLUMN}\` (col#9)` +
+                        (split.kind === "merged" ? `: ${split.reason}. ` : ". ") +
+                        "A merged authority column is non-conforming by construction: the reader/writer divergence " +
+                        "R-10 and R-7 exist to record cannot be written in it." +
+                        (missing.length ? ` Also missing: ${missing.join(", ")}.` : ""),
+                }, itemCount(1));
             }
             return {
-                id: "R-14 inventory-schema parity",
-                anchor: oracleLabel(),
+                id,
+                anchor: `${oracleLabel()} + ${split.sideCar}`,
                 state: "present",
-                verdict: "R-14: every §2 contract field present; reader and writer authority are two separate columns.",
+                verdict: `R-14: every §2 contract field present; reader authority is \`${READER_AUTHORITY_COLUMN}\`, writer authority is ` +
+                    `\`${SPLIT_WRITER_AUTHORITY_COLUMN}\` in ${split.sideCar}, recorded for all ${split.writeTools} write tools.`,
             };
         }),
     };
 }
 /**
- * R-38 — the completeness gate over the thirteen §2 fields. The oracle cannot
- * satisfy the contract because reader and writer authority are not two separate
- * fields (both map to `rbac_qui`).
+ * R-38 — the completeness gate over the thirteen §2 fields. Writer authority is
+ * complete only when the side-car records a tier for every write tool.
  */
-export function makeR38(columns = ORACLE_COLUMNS, rowsProvider = readOracle) {
+export function makeR38(columns = ORACLE_COLUMNS, rowsProvider = readOracle, sideCar = readWriterTier) {
+    const id = "R-38 thirteen-field completeness";
     return {
-        id: "R-38 thirteen-field completeness",
-        run: () => refuseWithoutOracle("R-38 thirteen-field completeness", () => {
+        id,
+        run: () => refuseWithoutOracle(id, () => {
             requireOracle();
             const colSet = new Set(columns);
             const missing = [];
@@ -58,29 +84,35 @@ export function makeR38(columns = ORACLE_COLUMNS, rowsProvider = readOracle) {
                         missing.push(`${f.field}→${col}`);
                 }
             }
-            const authorityMerged = READER_AUTHORITY_COLUMN === WRITER_AUTHORITY_COLUMN && colSet.has(READER_AUTHORITY_COLUMN);
-            if (authorityMerged || missing.length > 0) {
-                const rows = rowsProvider();
+            const rows = rowsProvider();
+            const split = splitFor(rows, sideCar);
+            if (split.kind === "unjudgeable")
+                return unjudgeable(id, split.reason);
+            if (split.kind === "merged" || missing.length > 0) {
+                const uncovered = split.kind === "merged" ? new Set(split.uncovered) : new Set();
                 const sample = rows
-                    .filter((r) => !r.malformed && r.by.rbac_qui && r.by.table !== "TOTAL")
+                    .filter((r) => isInventoryRow(r) && r.by.rbac_qui && (uncovered.size === 0 || uncovered.has(r.by.outil)))
                     .slice(0, 3)
                     .map((r) => `row#${r.n} "${r.by.outil || r.by.table}" rbac_qui="${r.by.rbac_qui}"`)
                     .join("; ");
-                return {
-                    id: "R-38 thirteen-field completeness",
+                return withCount({
+                    id,
                     anchor: csvAnchor(),
                     state: "non-conforming",
-                    verdict: `R-38: the oracle cannot satisfy the thirteen-field §2 contract — reader authority (R-5) and ` +
-                        `writer authority (R-10) are not two separate fields; both map to the single column ` +
-                        `\`rbac_qui\` (col#9).${missing.length ? ` Also missing: ${missing.join(", ")}.` : ""} ` +
-                        `Evidence: ${sample}.`,
-                };
+                    verdict: "R-38: the oracle cannot satisfy the thirteen-field §2 contract — reader authority (R-5) and " +
+                        `writer authority (R-10) are not two separate fields for every tool; writer authority falls back to ` +
+                        `\`${READER_AUTHORITY_COLUMN}\` (col#9)` +
+                        (split.kind === "merged" ? `: ${split.reason}.` : ".") +
+                        (missing.length ? ` Also missing: ${missing.join(", ")}.` : "") +
+                        ` Evidence: ${sample}.`,
+                }, itemCount(1));
             }
             return {
-                id: "R-38 thirteen-field completeness",
-                anchor: oracleLabel(),
+                id,
+                anchor: `${oracleLabel()} + ${split.sideCar}`,
                 state: "present",
-                verdict: "R-38: all thirteen §2 contract fields present per table, each within its vocabulary.",
+                verdict: "R-38: all thirteen §2 contract fields present per table; writer authority is " +
+                    `\`${SPLIT_WRITER_AUTHORITY_COLUMN}\` in ${split.sideCar} for all ${split.writeTools} write tools.`,
             };
         }),
     };

package/dist/not-checkable.d.ts

@@ -1,3 +1,4 @@
+import type { DetectorResult } from "./engine-types.js";
 /**
  * The deferral bucket. R-1..R-47 each carry an executable control (registry.ts),
  * so none is deferred to "a human decides". R-48 (authority-totality, the #130
@@ -9,7 +10,6 @@
  * moves to registry.ts and this entry is removed. The export is consumed by
  * coverage.ts / coverage-cli.ts / cli.ts.
  */
-import type { DetectorResult } from "./engine-types.js";
 export declare const NOT_MECHANICALLY_CHECKABLE: Record<string, string>;
 /**
  * One `could-not-judge` DetectorResult per NOT_MECHANICALLY_CHECKABLE rule, so

package/dist/not-checkable.js

@@ -15,6 +15,17 @@
 // input is vendored. They were built, not relabelled. The bucket was not renamed to a
 // gentler word — it was emptied.
 import { STANDARD_FILE } from "./detectors/standard/_doc.js";
+/**
+ * The deferral bucket. R-1..R-47 each carry an executable control (registry.ts),
+ * so none is deferred to "a human decides". R-48 (authority-totality, the #130
+ * class) was added to the standard at the 51ec7af1 re-pin AFTER its detector; its
+ * text is now pinned so coverage enumerates 48, but no detector exists yet — so it
+ * is reported here as NOT_MECHANICALLY_CHECKABLE with a written reason rather than
+ * silently omitted, which would let coverage pretend 47 is the whole document. The
+ * detector is task k17chpr4kzp399j3s7r7edpm4s8cscbz (after D5); when it lands, R-48
+ * moves to registry.ts and this entry is removed. The export is consumed by
+ * coverage.ts / coverage-cli.ts / cli.ts.
+ */
 export const NOT_MECHANICALLY_CHECKABLE = {
     "R-48": "R-48 authority-totality detector pending — task k17chpr4kzp399j3s7r7edpm4s8cscbz; text pinned at 4bcd605 so coverage cannot pretend 47 is complete. No mechanical control yet; R-48 is enumerated and visible, never silently dropped.",
 };

package/dist/registry.d.ts

@@ -1,6 +1,6 @@
 import type { Detector } from "./engine-types.js";
 /** The standard both pins the whole wave against. */
-export declare const STANDARD_PIN = "analysis/vantagepeers/backend-standard/backend-standard.md @ 4bcd605656ceff52d4f1593a9176cd6b988471be (elpiarthera/ElPi-Corp)";
+export declare const STANDARD_PIN = "vantagepeers/backend-standard/backend-standard.md @ 2825122a3ab1e4ddb4b955cfb136b7e8ab04f8f3 (elpiarthera/ElPi-Corp, merge of PR #228 on origin/main, after #226 at 9f7d789)";
 export interface RegistryEntry {
     detector: Detector;
     ruleId: string;

package/dist/registry.js

@@ -7,7 +7,9 @@ import { PER_ROW_PREDICATES } from "./detectors/predicates.js";
 import { makeOracleDetector } from "./detectors/shared.js";
 import { SOURCE_BACKFILL_DETECTORS } from "./detectors/source/backfill.js";
 import { SOURCE_CONTRACT_DETECTORS } from "./detectors/source/contract.js";
+import { SOURCE_CROSS_TENANT_WRITE_DETECTORS } from "./detectors/source/cross-tenant-write.js";
 import { IDENTITY_DETECTORS } from "./detectors/source/identity.js";
+import { SOURCE_IDENTITY_BY_ID_DETECTORS } from "./detectors/source/identity-by-id.js";
 import { SOURCE_ISOLATION_DETECTORS } from "./detectors/source/isolation.js";
 import { SOURCE_JOBS_DETECTORS } from "./detectors/source/jobs.js";
 import { SOURCE_LIFECYCLE_DETECTORS } from "./detectors/source/lifecycle.js";
@@ -21,8 +23,9 @@ import { R46_STANDARD_PIN, STANDARD_SOURCE_DETECTORS, } from "./detectors/standa
 import { STANDARD_DOC_DETECTORS } from "./detectors/standard/standard-doc.js";
 import { makeR14, makeR38 } from "./detectors/structural.js";
 import { STATE_RANK } from "./state-rank.js";
+import { countOf, sumCounts, withCount } from "./violation-count.js";
 /** The standard both pins the whole wave against. */
-export const STANDARD_PIN = "analysis/vantagepeers/backend-standard/backend-standard.md @ 4bcd605656ceff52d4f1593a9176cd6b988471be (elpiarthera/ElPi-Corp)";
+export const STANDARD_PIN = "vantagepeers/backend-standard/backend-standard.md @ 2825122a3ab1e4ddb4b955cfb136b7e8ab04f8f3 (elpiarthera/ElPi-Corp, merge of PR #228 on origin/main, after #226 at 9f7d789)";
 /**
  * Merge two detectors that judge halves of the SAME rule into one result: the
  * worst state wins (non-conforming > could-not-judge > absent > present, the
@@ -40,7 +43,7 @@ export function mergeHalves(ruleId, a, b) {
             const reasons = [ra, rb]
                 .filter((r) => r.state === "could-not-judge")
                 .map((r) => r.reason ?? r.verdict);
-            return {
+            const merged = {
                 id: b.id,
                 anchor: decider.anchor,
                 state: decider.state,
@@ -49,6 +52,13 @@ export function mergeHalves(ruleId, a, b) {
                     ? { reason: reasons.join(" || ") }
                     : {}),
             };
+            // The per-rule count of a red merge is the sum over its RED halves — the
+            // halves whose `N site(s) VIOLATE` the merged verdict prints. An abstaining
+            // half contributes nothing; a red half with no count leaves it uncounted.
+            if (merged.state !== "non-conforming")
+                return merged;
+            const c = sumCounts([ra, rb].filter((r) => r.state === "non-conforming").map(countOf));
+            return c === undefined ? merged : withCount(merged, c);
         },
     };
 }
@@ -61,7 +71,9 @@ export const REGISTRY = [
     { detector: makeR14(), ruleId: "R-14", standardPin: STANDARD_PIN },
     { detector: makeR38(), ruleId: "R-38", standardPin: STANDARD_PIN },
     // Axis-2 coherence detectors (R-7/R-8/R-37): each performs its mechanical half
-    // IN FULL and returns could-not-judge, naming the sites a human verdict is owed.
+    // IN FULL and decides on the written justification token's PRESENCE in the
+    // remediation cell (task k179jnhx, §23) — non-conforming without the token,
+    // present with it; could-not-judge only on a row the instrument cannot read.
     {
         detector: makeOracleDetector(r7),
         ruleId: "R-7",
@@ -145,6 +157,18 @@ export const REGISTRY = [
         // documents a client contract; a gated customMutation wrapper (writeMutation) is
         // refused (could-not-judge) since client reachability is not visible from convex/.
         ...SOURCE_WRITE_ISOLATION_DETECTORS,
+        // R-52 — a write that reaches a row carrying no tenant value through a
+        // caller-choosable key (an argument, or a stored field the caller set
+        // through a public write) is dominated by a guard reading a server-stamped
+        // tenant. Reads schema.ts tenant columns and every public mutation/action
+        // handler on the AST (the vantage-peers 45e40c8 tasks.complete auto-link).
+        ...SOURCE_CROSS_TENANT_WRITE_DETECTORS,
+        // R-53 — an actor and a target are identified by ID through
+        // @vantageos/cloud-identity: per public write door, the principal's
+        // source (a), the admission predicate (b), the unresolved branch (c);
+        // per helper / MCP gate, a local identity layer (d). Reads convex/ and
+        // mcp-server/src (the PR #1464 ten doors + org-less bulk_complete path).
+        ...SOURCE_IDENTITY_BY_ID_DETECTORS,
         ...SOURCE_CONTRACT_DETECTORS,
         ...IDENTITY_DETECTORS,
         // The four STANDARD-DOCUMENT detectors (R-42/R-15/R-32/R-39): each reads the

package/dist/rule-class.d.ts

@@ -0,0 +1,85 @@
+import type { State } from "./engine-types.js";
+export declare const RULE_CLASS_PATH: string;
+export type GateClass = "mechanical" | "judgement";
+export interface RuleClassFile {
+    standard_sha: string;
+    standard_kind_to_class: Record<string, string>;
+    rules: Record<string, {
+        class: string;
+        basis: string;
+    }>;
+}
+export declare function loadRuleClassFile(path?: string): RuleClassFile;
+/**
+ * The build kind the PINNED STANDARD itself states per rule: every row of the
+ * section 15 table (`| R-N | mechanical|judgement|process | … |`), then, for a rule the
+ * table does not list, the `*kind:* <word>` token inside that rule's own text (up
+ * to the next rule definition). A rule the standard classifies nowhere is absent
+ * from the map — classifyRules reports it as unclassified.
+ */
+export declare function parseStandardKinds(path?: string): Map<string, string>;
+export interface Unclassified {
+    id: string;
+    reason: string;
+}
+export interface Classification {
+    classOf: Map<string, GateClass>;
+    basisOf: Map<string, string>;
+    /** could-not-judge: rules the classification cannot place. Never defaulted. */
+    unclassified: Unclassified[];
+    /** sidecar entries naming no rule of this run — reported, a stale sidecar. */
+    stale: string[];
+}
+/**
+ * Place every id in exactly one class, or name it unclassified with its reason.
+ * `ids` is the derived rule set PLUS the doctor-owned ids (CR-1). An R- id is
+ * cross-checked against the standard; a non-R id (CR-1) is not in the standard and
+ * stands on the sidecar alone.
+ */
+export declare function classifyRules(ids: readonly string[], file?: RuleClassFile, standardKinds?: Map<string, string>, standardSha?: string): Classification;
+export interface MechanicalCount {
+    /** the gate's count, or `null` when it cannot be certified (could-not-judge). */
+    count: number | null;
+    mechanicalViolations: string[];
+    judgementViolations: string[];
+    /** could-not-judge rule states — NOT violations; reported, never folded into 0. */
+    mechanicalAbstentions: string[];
+    judgementAbstentions: string[];
+    unclassified: Unclassified[];
+    /** every reason the count is null (empty when it is an integer). */
+    cannotCertify: string[];
+}
+/**
+ * Count the non-conforming rules whose class is mechanical. The count is `null`
+ * — never 0 — when any rule is unclassified (its violation, present or future,
+ * could be mechanical) or when the instrument names a self-defect that voids the
+ * run (`instrumentDefects`, e.g. incomplete coverage or a dirty judged tree).
+ */
+export declare function countMechanical(ruleState: ReadonlyMap<string, State>, classification: Classification, instrumentDefects?: readonly string[]): MechanicalCount;
+/** The human line printed next to the VERDICT line. */
+export declare function mechanicalLine(m: MechanicalCount): string;
+/** The deploy hook's evidence schema, key for key and nothing else. */
+export interface Evidence {
+    sha: string;
+    cli_commit: string;
+    convex_path: string;
+    exit_code: number;
+    checked: number;
+    total: number;
+    mechanical_violations: number | null;
+    /**
+     * Each RED mechanical rule -> the non-conforming count its report line prints
+     * (sites for a source rule, rows for an oracle rule). Its key count equals
+     * `mechanical_violations`; null whenever that is null or a red rule carries no
+     * count (src/violation-count.ts). Additive: the seven keys above are unchanged.
+     */
+    mechanical_rule_counts: Record<string, number> | null;
+    /**
+     * Per site-based red mechanical rule: module -> count, where a convex/ file's
+     * module is its basename without extension and any other file's is its path
+     * without extension (`mcp-server/src/tools`). Values sum to that rule's
+     * `mechanical_rule_counts` entry. Row-based rules are absent. Null with the above.
+     */
+    mechanical_rule_module_counts: Record<string, Record<string, number>> | null;
+}
+export declare function buildEvidence(e: Evidence): Evidence;