@vantageos/mcp-doctor 0.3.0 → 0.3.2

package/dist/doctor.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/doctor.ts
-import { readFileSync as readFileSync19, realpathSync } from "fs";
+import { readFileSync as readFileSync12, realpathSync } from "fs";
 import { dirname as dirname11, join as join21, resolve as resolve2 } from "path";
 import { fileURLToPath } from "url";
 
@@ -230,8 +230,46 @@ function findRegisteredTools(tree) {
       }
     }
   }
+  for (const file of tree.files) {
+    for (let i = 0; i < file.lines.length; i++) {
+      const line = file.lines[i];
+      if (line.comment) continue;
+      const m = line.raw.match(DESCRIPTOR_KEY_RE);
+      if (!m) continue;
+      const indent = m[1];
+      const hasSchema = objectHasKey(file.lines, i, indent);
+      if (hasSchema) push(m[2], `${file.rel}:${line.n}`);
+    }
+  }
   return out;
 }
+var DESCRIPTOR_KEY_RE = new RegExp(`^(\\s*)name:\\s*["'\`](${NAME_LITERAL})["'\`]\\s*,?\\s*$`);
+var INPUT_SCHEMA_KEY_RE = /^(\s*)inputSchema\s*:/;
+function objectHasKey(lines, at, indent) {
+  for (const step of [1, -1]) {
+    for (let j = at + step; j >= 0 && j < lines.length; j += step) {
+      const l = lines[j];
+      if (l.comment || l.raw.trim() === "") continue;
+      const lead = l.raw.match(/^(\s*)/)[1];
+      if (lead.length < indent.length) break;
+      if (lead === indent && INPUT_SCHEMA_KEY_RE.test(l.raw)) return true;
+    }
+  }
+  return false;
+}
+var TOOL_SURFACE_RE = /\bListToolsRequestSchema\b|["'`]tools\/list["'`]|\binputSchema\s*:|\bToolDefinition\b/;
+function toolSurfaceAnchor(tree) {
+  for (const file of tree.files) {
+    for (const line of file.lines) {
+      if (line.comment) continue;
+      if (TOOL_SURFACE_RE.test(line.raw)) return `${file.rel}:${line.n}`;
+    }
+  }
+  return null;
+}
+function noToolsLocatedReason(tree, what) {
+  return `the tree serves MCP tools (tool-surface marker found) but no registered tool could be located: searched ${tree.files.length} .ts/.tsx file(s) under ${tree.root} (all directories except node_modules/dist/build/tests/fixtures) for registerTool/.tool( calls and declarative { name, inputSchema } descriptors \u2014 ${what}`;
+}
 var REGISTRATION_CALL_RE = /\b(?:s\.tool|\.tool|registerTool)\s*\(/;
 function findUnresolvedToolSites(tree) {
   const bindings = resolveNameBindings(tree);
@@ -1139,6 +1177,59 @@ var c13ContextCeiling = {
   }
 };
 
+// src/detectors/couldNotJudge.ts
+import { readFileSync as readFileSync2 } from "fs";
+function couldNotJudge(id, anchor, reason) {
+  return {
+    id,
+    anchor,
+    state: "could-not-judge",
+    reason,
+    verdict: `could not judge: ${reason}`
+  };
+}
+function settle(id, decided, unreadable) {
+  if (unreadable.length === 0) return decided;
+  const named = unreadable.map((u) => `${u.anchor}: ${u.reason}`).join("; ");
+  if (decided.state === "non-conforming") {
+    return { ...decided, verdict: `${decided.verdict} [also could not read: ${named}]` };
+  }
+  const judgedRest = decided.state === "could-not-judge" ? ` ${decided.reason ?? decided.verdict}` : ` The readable remainder judged ${decided.state}: ${decided.verdict}`;
+  return couldNotJudge(
+    id,
+    unreadable[0].anchor,
+    `${unreadable.length} input(s) present but unreadable \u2014 ${named}.${judgedRest}`
+  );
+}
+function readJsonObject(path) {
+  let value;
+  try {
+    value = JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return null;
+  }
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+  return value;
+}
+function guardUnreadablePackageJson(inner, opts) {
+  return {
+    ...inner,
+    run(tree) {
+      const decided = inner.run(tree);
+      const pkg = tree.packageJson;
+      if (!pkg?.unreadable) return decided;
+      const u = {
+        anchor: pkg.path,
+        reason: `package.json is present but could not be parsed (${pkg.unreadable})`
+      };
+      if (opts.authoritative && decided.state !== "could-not-judge") {
+        return couldNotJudge(inner.id, u.anchor, `${u.anchor}: ${u.reason}`);
+      }
+      return settle(inner.id, decided, [u]);
+    }
+  };
+}
+
 // src/detectors/c14-catalog-registration.ts
 var PIN3 = "a74a042b53c71a095ab88b3073bd47728eeda814";
 var REQUIRED_FIELDS = [
@@ -1180,7 +1271,7 @@ function c14PositiveControls() {
     rejectsPartial: missing(partial) !== void 0
   };
 }
-var c14CatalogRegistration = {
+var c14CatalogRegistrationInner = {
   id: "C14 catalog-registration",
   rule: "C-14",
   pin: PIN3,
@@ -1235,6 +1326,10 @@ var c14CatalogRegistration = {
     };
   }
 };
+var c14CatalogRegistration = guardUnreadablePackageJson(
+  c14CatalogRegistrationInner,
+  { authoritative: true }
+);
 
 // src/detectors/c15-annotations-untrusted.ts
 var AUTO_APPROVE_ACTION_RE = /\b(?:autoApprove|skipConfirm|autoRun|autoExecute)\w*\s*\(/;
@@ -1419,7 +1514,7 @@ var c16UntrustedOutput = {
 };
 
 // src/detectors/c17-supply-chain.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync3, readdirSync } from "fs";
 import { join as join2 } from "path";
 var PIN4 = "a74a042b53c71a095ab88b3073bd47728eeda814";
 var LOCKFILES = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb"];
@@ -1464,7 +1559,7 @@ function findProvenanceClaim(tree, root) {
     const path = join2(workflowsDir, name);
     let text;
     try {
-      text = readFileSync2(path, "utf8");
+      text = readFileSync3(path, "utf8");
     } catch {
       continue;
     }
@@ -1475,7 +1570,7 @@ function findProvenanceClaim(tree, root) {
   }
   return null;
 }
-var c17SupplyChain = {
+var c17SupplyChainInner = {
   id: "C17 supply-chain",
   rule: "C-17",
   pin: PIN4,
@@ -1512,9 +1607,12 @@ var c17SupplyChain = {
     };
   }
 };
+var c17SupplyChain = guardUnreadablePackageJson(c17SupplyChainInner, {
+  authoritative: true
+});
 
 // src/detectors/c18-structure-manifest.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
 import { join as join3 } from "path";
 var PIN5 = "a74a042b53c71a095ab88b3073bd47728eeda814";
 function manifestPath(root) {
@@ -1524,7 +1622,7 @@ function manifestPath(root) {
 }
 function readJson(path) {
   try {
-    return JSON.parse(readFileSync3(path, "utf8"));
+    return JSON.parse(readFileSync4(path, "utf8"));
   } catch {
     return null;
   }
@@ -1538,7 +1636,7 @@ function c18PositiveControls() {
     }
   };
 }
-var c18StructureManifest = {
+var c18StructureManifestInner = {
   id: "C18 structure-manifest",
   rule: "C-18",
   pin: PIN5,
@@ -1650,9 +1748,13 @@ var c18StructureManifest = {
     };
   }
 };
+var c18StructureManifest = guardUnreadablePackageJson(
+  c18StructureManifestInner,
+  { authoritative: false }
+);
 
 // src/scan.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4, readdirSync as readdirSync2, statSync } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync5, readdirSync as readdirSync2, statSync } from "fs";
 import { dirname, join as join4, relative } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
@@ -1699,7 +1801,7 @@ function walk(dir, out) {
   }
 }
 function loadFile(path, root) {
-  const raw = readFileSync4(path, "utf8");
+  const raw = readFileSync5(path, "utf8");
   const lines = raw.split("\n").map((r, i) => ({ n: i + 1, raw: r, comment: isCommentLine(r) }));
   return { path, rel: relative(root, path) || path, lines };
 }
@@ -1709,9 +1811,13 @@ function findPackageJson(startDir) {
     const candidate = join4(dir, "package.json");
     if (existsSync4(candidate)) {
       try {
-        return { path: candidate, json: JSON.parse(readFileSync4(candidate, "utf8")) };
-      } catch {
-        return { path: candidate, json: {} };
+        const parsed = JSON.parse(readFileSync5(candidate, "utf8"));
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+          return { path: candidate, json: {}, unreadable: "not a JSON object" };
+        }
+        return { path: candidate, json: parsed };
+      } catch (err) {
+        return { path: candidate, json: {}, unreadable: err.message };
       }
     }
     const parent = dirname(dir);
@@ -1787,6 +1893,20 @@ var c19ServedDescriptions = {
     }
     const sites = findRegisteredTools(tree);
     if (sites.length === 0) {
+      const surface = toolSurfaceAnchor(tree);
+      if (surface) {
+        const reason = noToolsLocatedReason(
+          tree,
+          "served descriptions cannot be judged without the tool list (C-19)"
+        );
+        return {
+          id: this.id,
+          anchor: surface,
+          state: "could-not-judge",
+          reason,
+          verdict: `could not judge: ${reason}`
+        };
+      }
       return {
         id: this.id,
         anchor: "-",
@@ -2044,7 +2164,7 @@ var c21ProgressiveDisclosure = {
 };
 
 // src/detectors/c22-test-ratio-gate.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
 import { join as join5 } from "path";
 var DOC_FILES2 = ["README.md", "README.fr.md", "CHANGELOG.md"];
 var RATIO_RE = /\b(?:coverage|ratio de tests?|test ratio|couverture)\b[^\n%]{0,40}?(\d{1,3}(?:\.\d+)?\s?%)/i;
@@ -2074,7 +2194,7 @@ function findRatioCitations(root) {
     if (!existsSync5(path)) continue;
     let text;
     try {
-      text = readFileSync5(path, "utf8");
+      text = readFileSync6(path, "utf8");
     } catch {
       continue;
     }
@@ -2382,7 +2502,7 @@ import { spawnSync } from "child_process";
 import {
   existsSync as existsSync6,
   mkdtempSync,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   readdirSync as readdirSync3,
   rmSync,
   statSync as statSync2,
@@ -2436,7 +2556,7 @@ function walkForConfigs(dir, depth, seen) {
 function resolveRailwayRootDirectory(configPath) {
   let text;
   try {
-    text = readFileSync6(configPath, "utf8");
+    text = readFileSync7(configPath, "utf8");
   } catch (err) {
     return {
       error: `could not read ${configPath}: ${err instanceof Error ? err.message : String(err)}`
@@ -2471,7 +2591,7 @@ function c26DeriveScope(root) {
     }
     if (site.configFile === "vercel.json") {
       try {
-        JSON.parse(readFileSync6(site.configPath, "utf8"));
+        JSON.parse(readFileSync7(site.configPath, "utf8"));
       } catch (err) {
         return {
           sites: [],
@@ -2539,8 +2659,8 @@ function nameDrift(lockfileName, siteDir, isolatedDir, stderr) {
   }
   if (lockfileName === "bun.lock" || lockfileName === "bun.lockb") {
     try {
-      const manifestText = readFileSync6(join6(isolatedDir, "package.json"), "utf8");
-      const lockText = readFileSync6(join6(isolatedDir, lockfileName), "utf8");
+      const manifestText = readFileSync7(join6(isolatedDir, "package.json"), "utf8");
+      const lockText = readFileSync7(join6(isolatedDir, lockfileName), "utf8");
       const drifted = nameBunDrift(manifestText, lockText);
       if (drifted.length > 0) return drifted.join(", ");
     } catch {
@@ -2571,8 +2691,8 @@ function gateSite(site) {
   }
   const isolated = mkdtempSync(join6(tmpdir(), "mcp-doctor-c26-"));
   try {
-    const manifestText = readFileSync6(pkgPath, "utf8");
-    const lockText = readFileSync6(join6(site.dir, lock.name), "utf8");
+    const manifestText = readFileSync7(pkgPath, "utf8");
+    const lockText = readFileSync7(join6(site.dir, lock.name), "utf8");
     writeFileSync(join6(isolated, "package.json"), manifestText);
     writeFileSync(join6(isolated, lock.name), lockText);
     let proc;
@@ -2749,6 +2869,21 @@ var d3 = {
           verdict: `could not judge: ${reason}`
         };
       }
+      const surface = toolSurfaceAnchor(tree);
+      if (surface) {
+        const located = findRegisteredTools(tree);
+        const reason = located.length > 0 ? `${located.length} tool(s) located but no hand-rolled list/read result builder found \u2014 result shaping and any resultType are delegated to wrappers/the transport and not statically readable in this tree` : noToolsLocatedReason(
+          tree,
+          "result shaping and resultType are not statically readable without the located tools"
+        );
+        return {
+          id: this.id,
+          anchor: surface,
+          state: "could-not-judge",
+          reason,
+          verdict: `could not judge: ${reason}`
+        };
+      }
       return {
         id: this.id,
         anchor: "-",
@@ -2793,6 +2928,21 @@ var d4 = {
           verdict: `could not judge: ${reason}`
         };
       }
+      const surface = toolSurfaceAnchor(tree);
+      if (surface) {
+        const located = findRegisteredTools(tree);
+        const reason = located.length > 0 ? `${located.length} tool(s) located but no hand-rolled list/read result builder found \u2014 result shaping and any ttlMs/cacheScope are delegated to wrappers/the transport and not statically readable in this tree` : noToolsLocatedReason(
+          tree,
+          "result shaping and any ttlMs/cacheScope are not statically readable without the located tools"
+        );
+        return {
+          id: this.id,
+          anchor: surface,
+          state: "could-not-judge",
+          reason,
+          verdict: `could not judge: ${reason}`
+        };
+      }
       return {
         id: this.id,
         anchor: "-",
@@ -2922,7 +3072,7 @@ function depListed(pkgJson) {
   }
   return false;
 }
-var d7 = {
+var d7Inner = {
   id: "D7 protocol-kit",
   run(tree) {
     const listed = depListed(tree.packageJson?.json);
@@ -2961,9 +3111,10 @@ var d7 = {
     };
   }
 };
+var d7 = guardUnreadablePackageJson(d7Inner, { authoritative: true });
 
 // src/detectors/d8.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7, statSync as statSync3 } from "fs";
+import { existsSync as existsSync7, statSync as statSync3 } from "fs";
 import { dirname as dirname2, join as join7, relative as relative3 } from "path";
 var POSITIVE_CONTROL2 = 'server.registerTool("list_items", { ... }, handler);';
 function d8PositiveControl() {
@@ -3016,6 +3167,20 @@ var d8 = {
           verdict: `could not judge: ${reason}`
         };
       }
+      const surface = toolSurfaceAnchor(tree);
+      if (surface) {
+        const reason = noToolsLocatedReason(
+          tree,
+          "eval coverage cannot be judged without the tool list"
+        );
+        return {
+          id: this.id,
+          anchor: surface,
+          state: "could-not-judge",
+          reason,
+          verdict: `could not judge: ${reason}`
+        };
+      }
       return {
         id: this.id,
         anchor: "-",
@@ -3034,19 +3199,15 @@ var d8 = {
     }
     const baseDir = resolveBaseDir(tree);
     const displayPath = relative3(baseDir, evalsPath) || evalsPath;
-    let cases;
-    try {
-      const raw = readFileSync7(evalsPath, "utf8");
-      const parsed = JSON.parse(raw);
-      if (!Array.isArray(parsed.cases)) {
-        throw new Error("`cases` is not an array");
-      }
-      cases = parsed.cases;
-    } catch (err) {
-      throw new Error(
-        `D8 could not parse ${displayPath}: ${err instanceof Error ? err.message : String(err)} \u2014 coverage verdict untrustworthy, fix the eval file`
+    const parsed = readJsonObject(evalsPath);
+    if (parsed === null || !Array.isArray(parsed.cases)) {
+      return couldNotJudge(
+        this.id,
+        displayPath,
+        `could not parse ${displayPath}: ${parsed === null ? "not readable as a JSON object" : "`cases` is not an array"} \u2014 coverage verdict untrustworthy, fix the eval file`
       );
     }
+    const cases = parsed.cases;
     const counts = /* @__PURE__ */ new Map();
     for (const t of tools) counts.set(t.name, 0);
     for (const c of cases) {
@@ -3131,7 +3292,7 @@ function d9PositiveControl() {
     matched: SEMVER_RE.test(POSITIVE_CONTROL3)
   };
 }
-var d9 = {
+var d9Inner = {
   id: "D9 semver+changelog",
   rule: "C-3",
   pin: "a74a042b53c71a095ab88b3073bd47728eeda814",
@@ -3143,13 +3304,22 @@ var d9 = {
       );
     }
     if (!tree.packageJson) {
-      throw new Error(
-        "D9 could not locate package.json anywhere above the scanned root \u2014 cannot verify SemVer/CHANGELOG"
-      );
+      const reason = "no package.json found anywhere above the scanned root \u2014 cannot verify SemVer/CHANGELOG";
+      return {
+        id: this.id,
+        anchor: "package.json",
+        state: "could-not-judge",
+        reason,
+        verdict: `could not judge: ${reason}`
+      };
     }
     const { path: pkgPath, json: pkgJson } = tree.packageJson;
     if (!pkgJson || Object.keys(pkgJson).length === 0) {
-      throw new Error(`D9 could not parse ${pkgPath} as JSON \u2014 cannot verify SemVer/CHANGELOG`);
+      return couldNotJudge(
+        this.id,
+        pkgPath.split("/").slice(-2).join("/"),
+        `could not parse ${pkgPath} as JSON \u2014 cannot verify SemVer/CHANGELOG`
+      );
     }
     const version = pkgJson.version;
     if (typeof version !== "string") {
@@ -3188,6 +3358,7 @@ var d9 = {
     };
   }
 };
+var d9 = guardUnreadablePackageJson(d9Inner, { authoritative: false });
 
 // src/detectors/d10.ts
 import { existsSync as existsSync9 } from "fs";
@@ -3239,7 +3410,7 @@ function scanSourceDescriptionFr(tree) {
   }
   return { present: false, anchor: null };
 }
-var d10 = {
+var d10Inner = {
   id: "D10 bilingual",
   rule: "C-1",
   pin: "a74a042b53c71a095ab88b3073bd47728eeda814",
@@ -3310,6 +3481,7 @@ var d10 = {
     };
   }
 };
+var d10 = guardUnreadablePackageJson(d10Inner, { authoritative: true });
 
 // src/detectors/d11.ts
 var ZOD_ANY_RE = /\bz\s*\.\s*any\s*\(\s*\)/;
@@ -3381,6 +3553,27 @@ var d11 = {
       }
     }
     if (toolCount === 0) {
+      const located = findRegisteredTools(tree);
+      if (located.length > 0) {
+        toolCount = located.length;
+        firstToolAnchor = located[0].anchor;
+      }
+    }
+    if (toolCount === 0) {
+      const surface = toolSurfaceAnchor(tree);
+      if (surface) {
+        const reason = noToolsLocatedReason(
+          tree,
+          "the outputSchema check cannot be judged without the tool list"
+        );
+        return {
+          id: this.id,
+          anchor: surface,
+          state: "could-not-judge",
+          reason,
+          verdict: `could not judge: ${reason}`
+        };
+      }
       return {
         id: this.id,
         anchor: "-",
@@ -3460,7 +3653,7 @@ function findHttpSite(tree) {
   }
   return null;
 }
-var d12 = {
+var d12Inner = {
   id: "D12 stdio-transport",
   run(tree) {
     const stdioControl = d12StdioPositiveControl();
@@ -3511,6 +3704,7 @@ var d12 = {
     };
   }
 };
+var d12 = guardUnreadablePackageJson(d12Inner, { authoritative: false });
 
 // src/detectors/d15.ts
 var HANDLE_ASSIGN_RE = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*[^;]*\.(?:registerTool|tool)\s*\(/;
@@ -4124,55 +4318,59 @@ var dDebugOptIn = {
         );
       }
     }
-    const computed = findAll(tree, COMPUTED_LEVEL_RE);
-    if (computed.length > 0) {
-      const sites = computed.map((h) => `${h.file.rel}:${h.line}`).join(", ");
-      throw new Error(
-        `DDebugOptIn cannot read the level of ${computed.length} computed-level log call(s): ${sites} \u2014 a bracket-indexed level hides whether it is debug (Server Rule 6). Fail-closed, not a silent present.`
-      );
-    }
-    const debugCalls = findAll(tree, DEBUG_CALL_RE);
-    if (debugCalls.length === 0) {
-      return {
-        id: this.id,
-        anchor: tree.files.length > 0 ? `${tree.files[0].rel}:1` : tree.root,
-        state: "absent",
-        verdict: "no debug output emitted (n/a for Server Rule 6 debug-half)"
-      };
-    }
-    const callAnchor = `${debugCalls[0].file.rel}:${debugCalls.map((h) => h.line).join(",")}`;
-    const debugFileRels = new Set(debugCalls.map((h) => h.file.rel));
-    const localGate = firstMatchInFiles2(tree, GATE_RE, debugFileRels);
-    if (localGate) {
-      return {
-        id: this.id,
-        anchor: callAnchor,
-        state: "present",
-        verdict: `debug output at ${callAnchor} gated by an env/config switch in the same file at ${localGate.file.rel}:${localGate.line} (Server Rule 6 debug-half)`
-      };
+    const unreadable = [];
+    for (const h of findAll(tree, COMPUTED_LEVEL_RE)) {
+      const anchor = `${h.file.rel}:${h.line}`;
+      unreadable.push({
+        anchor,
+        reason: `cannot read the level of the computed-level log call at ${anchor} \u2014 a bracket-indexed level hides whether it is debug (Server Rule 6)`
+      });
     }
-    const remoteGate = firstMatchInFiles2(tree, GATE_RE, new Set(tree.files.map((f) => f.rel)));
-    if (remoteGate) {
-      const reason = `debug output at ${callAnchor}; an env/config gate exists at ${remoteGate.file.rel}:${remoteGate.line} but in a DIFFERENT file from every debug call \u2014 whether the debug path is opt-in is unreadable statically (Server Rule 6 debug-half)`;
+    const decided = (() => {
+      const debugCalls = findAll(tree, DEBUG_CALL_RE);
+      if (debugCalls.length === 0) {
+        return {
+          id: this.id,
+          anchor: tree.files.length > 0 ? `${tree.files[0].rel}:1` : tree.root,
+          state: "absent",
+          verdict: "no debug output emitted (n/a for Server Rule 6 debug-half)"
+        };
+      }
+      const callAnchor = `${debugCalls[0].file.rel}:${debugCalls.map((h) => h.line).join(",")}`;
+      const debugFileRels = new Set(debugCalls.map((h) => h.file.rel));
+      const localGate = firstMatchInFiles2(tree, GATE_RE, debugFileRels);
+      if (localGate) {
+        return {
+          id: this.id,
+          anchor: callAnchor,
+          state: "present",
+          verdict: `debug output at ${callAnchor} gated by an env/config switch in the same file at ${localGate.file.rel}:${localGate.line} (Server Rule 6 debug-half)`
+        };
+      }
+      const remoteGate = firstMatchInFiles2(tree, GATE_RE, new Set(tree.files.map((f) => f.rel)));
+      if (remoteGate) {
+        const reason = `debug output at ${callAnchor}; an env/config gate exists at ${remoteGate.file.rel}:${remoteGate.line} but in a DIFFERENT file from every debug call \u2014 whether the debug path is opt-in is unreadable statically (Server Rule 6 debug-half)`;
+        return {
+          id: this.id,
+          anchor: callAnchor,
+          state: "could-not-judge",
+          reason,
+          verdict: `could not judge: ${reason}`
+        };
+      }
       return {
         id: this.id,
         anchor: callAnchor,
-        state: "could-not-judge",
-        reason,
-        verdict: `could not judge: ${reason}`
+        state: "non-conforming",
+        verdict: `debug output at ${callAnchor} with NO env/config gate -> debug is on by default; gate it behind process.env.*DEBUG* or a config switch (Server Rule 6 debug-half)`
       };
-    }
-    return {
-      id: this.id,
-      anchor: callAnchor,
-      state: "non-conforming",
-      verdict: `debug output at ${callAnchor} with NO env/config gate -> debug is on by default; gate it behind process.env.*DEBUG* or a config switch (Server Rule 6 debug-half)`
-    };
+    })();
+    return settle(this.id, decided, unreadable);
   }
 };
 
 // src/detectors/dExt1.ts
-import { readFileSync as readFileSync10, readdirSync as readdirSync4, statSync as statSync5 } from "fs";
+import { readdirSync as readdirSync4, statSync as statSync5 } from "fs";
 import { join as join12 } from "path";
 var IDENTIFIER_RE2 = /^[a-z0-9]+(\.[a-z0-9-]+)+\/[a-z0-9-]+$/;
 var IDENTIFIER_POSITIVE = "com.elpi/middleware-redact-pii";
@@ -4250,68 +4448,76 @@ var dExt1 = {
         `DExt1 identifier control FAILED: /${controls.identifier.pattern}/ accept(\`${IDENTIFIER_POSITIVE}\`)=${controls.identifier.positive} reject(\`${IDENTIFIER_NEGATIVE}\`)=${!controls.identifier.negative} \u2014 matcher broken, verdict untrustworthy`
       );
     }
-    const manifests = findExtensionManifests(tree.root);
-    for (const manifestPath2 of manifests) {
-      const shortPath = manifestPath2.split("/").slice(-2).join("/");
-      let parsed;
-      try {
-        parsed = JSON.parse(readFileSync10(manifestPath2, "utf8"));
-      } catch {
-        throw new Error(
-          `DExt1 could not parse ${shortPath} as JSON \u2014 a present manifest with an unreadable identifier cannot pass (Extension Rule 1). Fail-closed, not a silent present.`
-        );
+    const unreadable = [];
+    const decided = (() => {
+      const manifests = findExtensionManifests(tree.root);
+      for (const manifestPath2 of manifests) {
+        const shortPath = manifestPath2.split("/").slice(-2).join("/");
+        const parsed = readJsonObject(manifestPath2);
+        if (parsed === null) {
+          unreadable.push({
+            anchor: shortPath,
+            reason: `could not parse ${shortPath} as JSON \u2014 a present manifest with an unreadable identifier cannot pass (Extension Rule 1)`
+          });
+          continue;
+        }
+        const idValue = parsed.identifier;
+        if (typeof idValue !== "string") {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest ${shortPath} has no string "identifier" field (got ${typeof idValue}) -> declare a reverse-DNS identifier <reverse.dns>/<slug> e.g. com.elpi/redact-pii (Extension Rule 1)`
+          };
+        }
+        if (!IDENTIFIER_RE2.test(idValue)) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest identifier "${idValue}" is not reverse-DNS (positive-control OK) -> use <reverse.dns>/<slug> e.g. com.elpi/redact-pii (Extension Rule 1)`
+          };
+        }
       }
-      const idValue = parsed.identifier;
-      if (typeof idValue !== "string") {
-        throw new Error(
-          `DExt1 found a present manifest ${shortPath} with no string "identifier" field (got ${typeof idValue}) \u2014 Extension Rule 1 requires a reverse-DNS identifier. Fail-closed, not a silent present.`
-        );
+      const { sites, unresolved } = findTsIdentifiers(tree);
+      for (const anchor of unresolved) {
+        unreadable.push({
+          anchor,
+          reason: `cannot read the identifier at ${anchor} \u2014 value is computed/imported/template, reverse-DNS unverifiable (Extension Rule 1)`
+        });
       }
-      if (!IDENTIFIER_RE2.test(idValue)) {
-        return {
-          id: this.id,
-          anchor: shortPath,
-          state: "non-conforming",
-          verdict: `manifest identifier "${idValue}" is not reverse-DNS (positive-control OK) -> use <reverse.dns>/<slug> e.g. com.elpi/redact-pii (Extension Rule 1)`
-        };
+      for (const site of sites) {
+        if (!IDENTIFIER_RE2.test(site.value)) {
+          return {
+            id: this.id,
+            anchor: site.anchor,
+            state: "non-conforming",
+            verdict: `identifier "${site.value}" is not reverse-DNS (positive-control OK) -> use <reverse.dns>/<slug> e.g. com.elpi/redact-pii (Extension Rule 1)`
+          };
+        }
       }
-    }
-    const { sites, unresolved } = findTsIdentifiers(tree);
-    if (unresolved.length > 0) {
-      throw new Error(
-        `DExt1 cannot read the identifier at ${unresolved.length} TS site(s): ${unresolved.join(", ")} \u2014 value is computed/imported/template, reverse-DNS unverifiable (Extension Rule 1). Fail-closed, not a silent present.`
-      );
-    }
-    for (const site of sites) {
-      if (!IDENTIFIER_RE2.test(site.value)) {
+      const total = manifests.length + sites.length;
+      if (total === 0) {
         return {
           id: this.id,
-          anchor: site.anchor,
-          state: "non-conforming",
-          verdict: `identifier "${site.value}" is not reverse-DNS (positive-control OK) -> use <reverse.dns>/<slug> e.g. com.elpi/redact-pii (Extension Rule 1)`
+          anchor: tree.root.split("/").pop() ?? tree.root,
+          state: "absent",
+          verdict: "no extension identifier found (no extension.json manifest, no TS `identifier:` literal) -> declare a reverse-DNS identifier (Extension Rule 1)"
         };
       }
-    }
-    const total = manifests.length + sites.length;
-    if (total === 0) {
       return {
         id: this.id,
-        anchor: tree.root.split("/").pop() ?? tree.root,
-        state: "absent",
-        verdict: "no extension identifier found (no extension.json manifest, no TS `identifier:` literal) -> declare a reverse-DNS identifier (Extension Rule 1)"
+        anchor: sites.length > 0 ? sites[0].anchor : manifests[0].split("/").slice(-2).join("/"),
+        state: "present",
+        verdict: `${total} identifier(s) reverse-DNS conforming (manifest=${manifests.length}, ts=${sites.length}, positive-control OK)`
       };
-    }
-    return {
-      id: this.id,
-      anchor: sites.length > 0 ? sites[0].anchor : manifests[0].split("/").slice(-2).join("/"),
-      state: "present",
-      verdict: `${total} identifier(s) reverse-DNS conforming (manifest=${manifests.length}, ts=${sites.length}, positive-control OK)`
-    };
+    })();
+    return settle(this.id, decided, unreadable);
   }
 };
 
 // src/detectors/dExt2.ts
-import { readFileSync as readFileSync11, readdirSync as readdirSync5, statSync as statSync6 } from "fs";
+import { readdirSync as readdirSync5, statSync as statSync6 } from "fs";
 import { join as join13 } from "path";
 var TS_GD_TRUE_RE = /\bgracefulDegradation:\s*true\b/;
 var TS_GD_FALSE_RE = /\bgracefulDegradation:\s*false\b/;
@@ -4411,76 +4617,85 @@ var dExt2 = {
         `DExt2 graceful-degradation control FAILED: accept(\`${GD_POSITIVE}\`)=${controls.gracefulDegradation.acceptsTrue} reject(\`${GD_NEGATIVE}\`)=${controls.gracefulDegradation.rejectsFalse} \u2014 matcher broken, verdict untrustworthy`
       );
     }
-    const manifests = findExtensionManifests2(tree.root);
-    for (const manifestPath2 of manifests) {
-      const shortPath = manifestPath2.split("/").slice(-2).join("/");
-      let parsed;
-      try {
-        parsed = JSON.parse(readFileSync11(manifestPath2, "utf8"));
-      } catch {
-        throw new Error(
-          `DExt2 could not parse ${shortPath} as JSON \u2014 a present manifest silent on graceful degradation cannot pass (Extension Rule 2). Fail-closed, not a silent present.`
-        );
-      }
-      if (!("graceful_degradation" in parsed)) {
-        throw new Error(
-          `DExt2 found a present manifest ${shortPath} with no "graceful_degradation" field \u2014 Extension Rule 2 requires it to be true. Fail-closed, not a silent present.`
-        );
-      }
-      const gdValue = parsed.graceful_degradation;
-      if (gdValue !== true) {
-        return {
-          id: this.id,
-          anchor: shortPath,
-          state: "non-conforming",
-          verdict: `manifest "graceful_degradation" is ${JSON.stringify(gdValue)}, not true (positive-control OK) -> set "graceful_degradation": true, an extension never breaks the host server (Extension Rule 2)`
-        };
-      }
-    }
-    const sites = findTsFactorySites(tree);
-    for (const site of sites) {
-      if (site.state === "unresolved") {
-        throw new Error(
-          `DExt2 cannot read the gracefulDegradation value at ${site.anchor} (got \`${site.value}\`) \u2014 computed/imported/template, graceful degradation unverifiable (Extension Rule 2). Fail-closed, not a silent present.`
-        );
+    const unreadable = [];
+    const decided = (() => {
+      const manifests = findExtensionManifests2(tree.root);
+      for (const manifestPath2 of manifests) {
+        const shortPath = manifestPath2.split("/").slice(-2).join("/");
+        const parsed = readJsonObject(manifestPath2);
+        if (parsed === null) {
+          unreadable.push({
+            anchor: shortPath,
+            reason: `could not parse ${shortPath} as JSON \u2014 a present manifest silent on graceful degradation cannot pass (Extension Rule 2)`
+          });
+          continue;
+        }
+        if (!("graceful_degradation" in parsed)) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest ${shortPath} has no "graceful_degradation" field -> set "graceful_degradation": true, an extension never breaks the host server (Extension Rule 2)`
+          };
+        }
+        const gdValue = parsed.graceful_degradation;
+        if (gdValue !== true) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest "graceful_degradation" is ${JSON.stringify(gdValue)}, not true (positive-control OK) -> set "graceful_degradation": true, an extension never breaks the host server (Extension Rule 2)`
+          };
+        }
       }
-      if (site.state === "false") {
-        return {
-          id: this.id,
-          anchor: site.anchor,
-          state: "non-conforming",
-          verdict: "gracefulDegradation is false, not true (positive-control OK) -> an extension never breaks the host server (Extension Rule 2)"
-        };
+      const sites = findTsFactorySites(tree);
+      for (const site of sites) {
+        if (site.state === "unresolved") {
+          unreadable.push({
+            anchor: site.anchor,
+            reason: `cannot read the gracefulDegradation value at ${site.anchor} (got \`${site.value}\`) \u2014 computed/imported/template, graceful degradation unverifiable (Extension Rule 2)`
+          });
+          continue;
+        }
+        if (site.state === "false") {
+          return {
+            id: this.id,
+            anchor: site.anchor,
+            state: "non-conforming",
+            verdict: "gracefulDegradation is false, not true (positive-control OK) -> an extension never breaks the host server (Extension Rule 2)"
+          };
+        }
+        if (site.state === "absent") {
+          return {
+            id: this.id,
+            anchor: site.anchor,
+            state: "non-conforming",
+            verdict: "defineExtension block has no gracefulDegradation flag (positive-control OK) -> declare gracefulDegradation: true (Extension Rule 2)"
+          };
+        }
       }
-      if (site.state === "absent") {
+      const total = manifests.length + sites.length;
+      if (total === 0) {
         return {
           id: this.id,
-          anchor: site.anchor,
-          state: "non-conforming",
-          verdict: "defineExtension block has no gracefulDegradation flag (positive-control OK) -> declare gracefulDegradation: true (Extension Rule 2)"
+          anchor: tree.root.split("/").pop() ?? tree.root,
+          state: "absent",
+          verdict: "no extension graceful-degradation flag found (no extension.json manifest, no defineExtension factory) -> declare graceful_degradation: true (Extension Rule 2)"
         };
       }
-    }
-    const total = manifests.length + sites.length;
-    if (total === 0) {
       return {
         id: this.id,
-        anchor: tree.root.split("/").pop() ?? tree.root,
-        state: "absent",
-        verdict: "no extension graceful-degradation flag found (no extension.json manifest, no defineExtension factory) -> declare graceful_degradation: true (Extension Rule 2)"
+        anchor: sites.length > 0 ? sites[0].anchor : manifests[0].split("/").slice(-2).join("/"),
+        state: "present",
+        verdict: `${total} graceful-degradation flag(s) true (manifest=${manifests.length}, ts=${sites.length}, positive-control OK)`
       };
-    }
-    return {
-      id: this.id,
-      anchor: sites.length > 0 ? sites[0].anchor : manifests[0].split("/").slice(-2).join("/"),
-      state: "present",
-      verdict: `${total} graceful-degradation flag(s) true (manifest=${manifests.length}, ts=${sites.length}, positive-control OK)`
-    };
+    })();
+    return settle(this.id, decided, unreadable);
   }
 };
 
 // src/detectors/dExt3.ts
-import { readFileSync as readFileSync12, readdirSync as readdirSync6, statSync as statSync7 } from "fs";
+import { readdirSync as readdirSync6, statSync as statSync7 } from "fs";
 import { join as join14 } from "path";
 var TYPE_MATCHERS = [
   { type: "middleware", re: /\bmiddleware\b/ },
@@ -4594,100 +4809,118 @@ var dExt3 = {
         `DExt3 single-type control FAILED: detectMix(\`${TYPE_MIXED}\`)=${controls.type.detectsMix} detectSingle(\`${TYPE_SINGLE}\`)=${controls.type.detectsSingle} \u2014 matcher broken, verdict untrustworthy`
       );
     }
-    const declared = /* @__PURE__ */ new Set();
-    let firstAnchor2 = null;
-    const manifests = findExtensionManifests3(tree.root);
-    for (const manifestPath2 of manifests) {
-      const shortPath = manifestPath2.split("/").slice(-2).join("/");
-      let parsed;
-      try {
-        parsed = JSON.parse(readFileSync12(manifestPath2, "utf8"));
-      } catch {
-        throw new Error(
-          `DExt3 could not parse ${shortPath} as JSON \u2014 a present manifest with an unreadable type cannot pass (Extension Rule 3). Fail-closed, not a silent present.`
-        );
-      }
-      if (!("type" in parsed)) {
-        throw new Error(
-          `DExt3 found a present manifest ${shortPath} with no "type" field \u2014 Extension Rule 3 requires exactly one declared type. Fail-closed, not a silent present.`
-        );
-      }
-      const rawValue = coerceTypeValue(parsed.type);
-      if (rawValue === null) {
-        throw new Error(
-          `DExt3 found a present manifest ${shortPath} whose "type" is neither string nor string[] (got ${typeof parsed.type}) \u2014 type undeterminable (Extension Rule 3). Fail-closed, not a silent present.`
-        );
-      }
-      const found = typesIn(rawValue);
-      if (found.length === 0) {
-        throw new Error(
-          `DExt3 found a present manifest ${shortPath} whose "type" value ${JSON.stringify(parsed.type)} names no known category (middleware|tool-extension|transport) \u2014 type undeterminable (Extension Rule 3). Fail-closed, not a silent present.`
-        );
+    const unreadable = [];
+    const decided = (() => {
+      const declared = /* @__PURE__ */ new Set();
+      let firstAnchor2 = null;
+      const manifests = findExtensionManifests3(tree.root);
+      for (const manifestPath2 of manifests) {
+        const shortPath = manifestPath2.split("/").slice(-2).join("/");
+        const parsed = readJsonObject(manifestPath2);
+        if (parsed === null) {
+          unreadable.push({
+            anchor: shortPath,
+            reason: `could not parse ${shortPath} as JSON \u2014 a present manifest with an unreadable type cannot pass (Extension Rule 3)`
+          });
+          continue;
+        }
+        if (!("type" in parsed)) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest ${shortPath} has no "type" field -> declare exactly one type (middleware|tool-extension|transport) (Extension Rule 3)`
+          };
+        }
+        const rawValue = coerceTypeValue(parsed.type);
+        if (rawValue === null) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest ${shortPath} "type" is neither string nor string[] (got ${typeof parsed.type}) -> declare exactly one type (middleware|tool-extension|transport) (Extension Rule 3)`
+          };
+        }
+        const found = typesIn(rawValue);
+        if (found.length === 0) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest ${shortPath} "type" value ${JSON.stringify(parsed.type)} names no known category (middleware|tool-extension|transport) -> declare exactly one known type (Extension Rule 3)`
+          };
+        }
+        if (found.length > 1) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest "type" ${JSON.stringify(parsed.type)} mixes ${found.join(" + ")} (positive-control OK) -> one extension = one type, split into ${found.length} extensions (Extension Rule 3)`
+          };
+        }
+        firstAnchor2 ??= shortPath;
+        declared.add(found[0]);
+      }
+      const sites = findTsTypeSites(tree);
+      for (const site of sites) {
+        if (site.unresolved) {
+          unreadable.push({
+            anchor: site.anchor,
+            reason: `cannot read the type at ${site.anchor}${site.value === void 0 ? " (no `type:` literal in the defineExtension block)" : ` (got \`${site.value}\`)`} \u2014 computed/imported/template or absent, single-type unverifiable (Extension Rule 3)`
+          });
+          continue;
+        }
+        const raw = site.value ?? "";
+        const found = typesIn(raw);
+        if (found.length === 0) {
+          return {
+            id: this.id,
+            anchor: site.anchor,
+            state: "non-conforming",
+            verdict: `defineExtension type: "${raw}" at ${site.anchor} names no known category (middleware|tool-extension|transport) -> declare exactly one known type (Extension Rule 3)`
+          };
+        }
+        if (found.length > 1) {
+          return {
+            id: this.id,
+            anchor: site.anchor,
+            state: "non-conforming",
+            verdict: `type: "${raw}" mixes ${found.join(" + ")} (positive-control OK) -> one extension = one type (Extension Rule 3)`
+          };
+        }
+        firstAnchor2 ??= site.anchor;
+        declared.add(found[0]);
       }
-      if (found.length > 1) {
+      const total = manifests.length + sites.length;
+      if (total === 0) {
         return {
           id: this.id,
-          anchor: shortPath,
-          state: "non-conforming",
-          verdict: `manifest "type" ${JSON.stringify(parsed.type)} mixes ${found.join(" + ")} (positive-control OK) -> one extension = one type, split into ${found.length} extensions (Extension Rule 3)`
+          anchor: tree.root.split("/").pop() ?? tree.root,
+          state: "absent",
+          verdict: "no extension type declared (no extension.json manifest, no defineExtension `type:` literal) -> declare exactly one type (Extension Rule 3)"
         };
       }
-      firstAnchor2 ??= shortPath;
-      declared.add(found[0]);
-    }
-    const sites = findTsTypeSites(tree);
-    for (const site of sites) {
-      if (site.unresolved) {
-        throw new Error(
-          `DExt3 cannot read the type at ${site.anchor}${site.value === void 0 ? " (no `type:` literal in the defineExtension block)" : ` (got \`${site.value}\`)`} \u2014 computed/imported/template or absent, single-type unverifiable (Extension Rule 3). Fail-closed, not a silent present.`
-        );
-      }
-      const raw = site.value ?? "";
-      const found = typesIn(raw);
-      if (found.length === 0) {
-        throw new Error(
-          `DExt3 found a defineExtension type: "${raw}" at ${site.anchor} naming no known category (middleware|tool-extension|transport) \u2014 type undeterminable (Extension Rule 3). Fail-closed, not a silent present.`
-        );
-      }
-      if (found.length > 1) {
+      if (declared.size > 1) {
         return {
           id: this.id,
-          anchor: site.anchor,
+          anchor: firstAnchor2 ?? tree.root.split("/").pop() ?? tree.root,
           state: "non-conforming",
-          verdict: `type: "${raw}" mixes ${found.join(" + ")} (positive-control OK) -> one extension = one type (Extension Rule 3)`
+          verdict: `extension declares ${declared.size} types across its forms: ${[...declared].join(" + ")} (positive-control OK) -> one extension = one type (Extension Rule 3)`
         };
       }
-      firstAnchor2 ??= site.anchor;
-      declared.add(found[0]);
-    }
-    const total = manifests.length + sites.length;
-    if (total === 0) {
-      return {
-        id: this.id,
-        anchor: tree.root.split("/").pop() ?? tree.root,
-        state: "absent",
-        verdict: "no extension type declared (no extension.json manifest, no defineExtension `type:` literal) -> declare exactly one type (Extension Rule 3)"
-      };
-    }
-    if (declared.size > 1) {
       return {
         id: this.id,
         anchor: firstAnchor2 ?? tree.root.split("/").pop() ?? tree.root,
-        state: "non-conforming",
-        verdict: `extension declares ${declared.size} types across its forms: ${[...declared].join(" + ")} (positive-control OK) -> one extension = one type (Extension Rule 3)`
+        state: "present",
+        verdict: `single type "${[...declared][0]}" declared across ${total} form(s) (manifest=${manifests.length}, ts=${sites.length}, positive-control OK)`
       };
-    }
-    return {
-      id: this.id,
-      anchor: firstAnchor2 ?? tree.root.split("/").pop() ?? tree.root,
-      state: "present",
-      verdict: `single type "${[...declared][0]}" declared across ${total} form(s) (manifest=${manifests.length}, ts=${sites.length}, positive-control OK)`
-    };
+    })();
+    return settle(this.id, decided, unreadable);
   }
 };
 
 // src/detectors/dExt4.ts
-import { readFileSync as readFileSync13, readdirSync as readdirSync7, statSync as statSync8 } from "fs";
+import { readdirSync as readdirSync7, statSync as statSync8 } from "fs";
 import { join as join15 } from "path";
 function canonical(name) {
   return name.replace(/[-_]/g, "").toLowerCase();
@@ -4831,7 +5064,7 @@ function findFactorySites(tree) {
 function manifestHookTokens(raw) {
   const set = /* @__PURE__ */ new Set();
   if (!Array.isArray(raw)) {
-    throw new Error("not-array");
+    return null;
   }
   for (const h of raw) {
     if (typeof h === "string") set.add(canonical(h));
@@ -4847,82 +5080,90 @@ var dExt4 = {
         `DExt4 lifecycle-hooks control FAILED: unify(${HOOK_SNAKE}/${HOOK_KEBAB}/${HOOK_CAMEL})=${controls.hooks.unifiesSpellings} distinct(${HOOK_SNAKE}!=${HOOK_OTHER})=${controls.hooks.keepsDistinct} \u2014 normaliser broken, verdict untrustworthy`
       );
     }
-    const hooksDirs = findHooksDirs(tree.root);
-    const { sites, unresolved } = findFactorySites(tree);
-    if (unresolved.length > 0) {
-      throw new Error(
-        `DExt4 cannot read the lifecycle implementation at ${unresolved.length} TS site(s): ${unresolved.join(", ")} \u2014 value is computed/imported/template, not an object literal, so the implemented hooks are unverifiable (Extension Rule 4). Fail-closed, not a silent present.`
-      );
-    }
-    const implemented = /* @__PURE__ */ new Set();
-    for (const d of hooksDirs) for (const t of d.tokens) implemented.add(t);
-    for (const s of sites) for (const t of s.tokens) implemented.add(t);
-    const implSurfacePresent = hooksDirs.length > 0 || sites.length > 0;
-    const manifests = findExtensionManifests4(tree.root);
-    let declaredAnyLifecycle = false;
-    for (const manifestPath2 of manifests) {
-      const shortPath = manifestPath2.split("/").slice(-2).join("/");
-      let parsed;
-      try {
-        parsed = JSON.parse(readFileSync13(manifestPath2, "utf8"));
-      } catch {
-        throw new Error(
-          `DExt4 could not parse ${shortPath} as JSON \u2014 a present manifest whose lifecycle cannot be read cannot pass (Extension Rule 4). Fail-closed, not a silent present.`
-        );
-      }
-      if (!("lifecycle" in parsed)) continue;
-      let declared;
-      try {
-        declared = manifestHookTokens(parsed.lifecycle);
-      } catch {
-        throw new Error(
-          `DExt4 found a present manifest ${shortPath} whose "lifecycle" is not an array (got ${typeof parsed.lifecycle}) \u2014 the declared hooks are undeterminable (Extension Rule 4). Fail-closed, not a silent present.`
-        );
-      }
-      if (declared.size === 0) continue;
-      declaredAnyLifecycle = true;
-      if (!implSurfacePresent) {
-        throw new Error(
-          `DExt4 found a present manifest ${shortPath} declaring lifecycle hooks while NO implementation surface exists (no hooks/ directory, no factory lifecycle object) \u2014 the parity is undeterminable (Extension Rule 4). Fail-closed, not a silent present.`
-        );
+    const unreadable = [];
+    const decided = (() => {
+      const hooksDirs = findHooksDirs(tree.root);
+      const { sites, unresolved } = findFactorySites(tree);
+      for (const anchor of unresolved) {
+        unreadable.push({
+          anchor,
+          reason: `cannot read the lifecycle implementation at ${anchor} \u2014 value is computed/imported/template, not an object literal, so the implemented hooks are unverifiable (Extension Rule 4)`
+        });
       }
-      const phantom = [...declared].filter((h) => !implemented.has(h));
-      if (phantom.length > 0) {
-        return {
-          id: this.id,
-          anchor: shortPath,
-          state: "non-conforming",
-          verdict: `manifest "lifecycle" declares hook(s) [${phantom.join(", ")}] with no implementation (implemented: [${[...implemented].join(", ") || "none"}], positive-control OK) -> a declared hook without implementation is a phantom hook (Extension Rule 4)`
-        };
+      const implemented = /* @__PURE__ */ new Set();
+      for (const d of hooksDirs) for (const t of d.tokens) implemented.add(t);
+      for (const s of sites) for (const t of s.tokens) implemented.add(t);
+      const implSurfacePresent = hooksDirs.length > 0 || sites.length > 0;
+      const manifests = findExtensionManifests4(tree.root);
+      let declaredAnyLifecycle = false;
+      for (const manifestPath2 of manifests) {
+        const shortPath = manifestPath2.split("/").slice(-2).join("/");
+        const parsed = readJsonObject(manifestPath2);
+        if (parsed === null) {
+          unreadable.push({
+            anchor: shortPath,
+            reason: `could not parse ${shortPath} as JSON \u2014 a present manifest whose lifecycle cannot be read cannot pass (Extension Rule 4)`
+          });
+          continue;
+        }
+        if (!("lifecycle" in parsed)) continue;
+        const declared = manifestHookTokens(parsed.lifecycle);
+        if (declared === null) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest ${shortPath} "lifecycle" is not an array (got ${typeof parsed.lifecycle}) -> declare the hooks as an array of hook names (Extension Rule 4)`
+          };
+        }
+        if (declared.size === 0) continue;
+        declaredAnyLifecycle = true;
+        if (!implSurfacePresent) {
+          unreadable.push({
+            anchor: shortPath,
+            reason: `present manifest ${shortPath} declares lifecycle hooks while NO implementation surface exists (no hooks/ directory, no factory lifecycle object) \u2014 the parity is undeterminable (Extension Rule 4)`
+          });
+          continue;
+        }
+        const phantom = [...declared].filter((h) => !implemented.has(h));
+        if (phantom.length > 0) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest "lifecycle" declares hook(s) [${phantom.join(", ")}] with no implementation (implemented: [${[...implemented].join(", ") || "none"}], positive-control OK) -> a declared hook without implementation is a phantom hook (Extension Rule 4)`
+          };
+        }
       }
-    }
-    if (!declaredAnyLifecycle) {
-      if (manifests.length === 0 && !implSurfacePresent) {
+      if (!declaredAnyLifecycle) {
+        if (manifests.length === 0 && !implSurfacePresent) {
+          return {
+            id: this.id,
+            anchor: tree.root.split("/").pop() ?? tree.root,
+            state: "absent",
+            verdict: "no lifecycle hooks declared (no extension.json manifest `lifecycle` array) -> declare the hooks the extension implements (Extension Rule 4)"
+          };
+        }
         return {
           id: this.id,
-          anchor: tree.root.split("/").pop() ?? tree.root,
-          state: "absent",
-          verdict: "no lifecycle hooks declared (no extension.json manifest `lifecycle` array) -> declare the hooks the extension implements (Extension Rule 4)"
+          anchor: manifests.length > 0 ? manifests[0].split("/").slice(-2).join("/") : tree.root.split("/").pop() ?? tree.root,
+          state: "present",
+          verdict: `no manifest lifecycle hooks declared, nothing to reconcile (implemented: [${[...implemented].join(", ") || "none"}], positive-control OK)`
         };
       }
       return {
         id: this.id,
-        anchor: manifests.length > 0 ? manifests[0].split("/").slice(-2).join("/") : tree.root.split("/").pop() ?? tree.root,
+        anchor: manifests[0].split("/").slice(-2).join("/"),
         state: "present",
-        verdict: `no manifest lifecycle hooks declared, nothing to reconcile (implemented: [${[...implemented].join(", ") || "none"}], positive-control OK)`
+        verdict: `every declared lifecycle hook is implemented (declared \u2286 implemented: [${[...implemented].join(", ")}], hooksDir=${hooksDirs.length}, factory=${sites.length}, positive-control OK)`
       };
-    }
-    return {
-      id: this.id,
-      anchor: manifests[0].split("/").slice(-2).join("/"),
-      state: "present",
-      verdict: `every declared lifecycle hook is implemented (declared \u2286 implemented: [${[...implemented].join(", ")}], hooksDir=${hooksDirs.length}, factory=${sites.length}, positive-control OK)`
-    };
+    })();
+    return settle(this.id, decided, unreadable);
   }
 };
 
 // src/detectors/dExt5.ts
-import { existsSync as existsSync12, readFileSync as readFileSync14, readdirSync as readdirSync8, statSync as statSync9 } from "fs";
+import { existsSync as existsSync12, readdirSync as readdirSync8, statSync as statSync9 } from "fs";
 import { dirname as dirname7, join as join16 } from "path";
 function nonEmptyString(v) {
   return typeof v === "string" && v.trim().length > 0;
@@ -5003,10 +5244,8 @@ var dExt5 = {
         reason,
         verdict: `could not judge: ${reason}`
       });
-      let parsed;
-      try {
-        parsed = JSON.parse(readFileSync14(manifestPath2, "utf8"));
-      } catch {
+      const parsed = readJsonObject(manifestPath2);
+      if (parsed === null) {
         return cannotRead(
           `${shortPath} does not parse as JSON \u2014 the FR surface of a present manifest cannot be read (Extension Rule 5)`
         );
@@ -5063,7 +5302,7 @@ var dExt5 = {
 };
 
 // src/detectors/dExt7.ts
-import { existsSync as existsSync13, readFileSync as readFileSync15, readdirSync as readdirSync9, statSync as statSync10 } from "fs";
+import { existsSync as existsSync13, readdirSync as readdirSync9, statSync as statSync10 } from "fs";
 import { dirname as dirname8, join as join17 } from "path";
 var ABSENCE_FLAG_FIELDS = [
   "extensionAbsent",
@@ -5160,65 +5399,78 @@ var dExt7 = {
         verdict: "no extension.json manifest found -> declare an extension with an eval suite (>=3 cases incl. 1 'extension absente') (Extension Rule 7)"
       };
     }
-    for (const manifestPath2 of manifests) {
-      const extDir = dirname8(manifestPath2);
-      const extLabel = extDir.split("/").pop() ?? extDir;
-      const evalsPath = join17(extDir, "evals", "evals.json");
-      const shortPath = `${extLabel}/evals/evals.json`;
-      if (!existsSync13(evalsPath)) {
-        return {
-          id: this.id,
-          anchor: `${extLabel}/extension.json`,
-          state: "non-conforming",
-          verdict: `no evals/evals.json for extension "${extLabel}" -> add an eval suite with >=3 cases incl. 1 'extension absente' (Extension Rule 7)`
-        };
-      }
-      let cases;
-      try {
-        const raw = readFileSync15(evalsPath, "utf8");
-        const parsed = JSON.parse(raw);
+    const unreadable = [];
+    const decided = (() => {
+      for (const manifestPath2 of manifests) {
+        const extDir = dirname8(manifestPath2);
+        const extLabel = extDir.split("/").pop() ?? extDir;
+        const evalsPath = join17(extDir, "evals", "evals.json");
+        const shortPath = `${extLabel}/evals/evals.json`;
+        if (!existsSync13(evalsPath)) {
+          return {
+            id: this.id,
+            anchor: `${extLabel}/extension.json`,
+            state: "non-conforming",
+            verdict: `no evals/evals.json for extension "${extLabel}" -> add an eval suite with >=3 cases incl. 1 'extension absente' (Extension Rule 7)`
+          };
+        }
+        const parsed = readJsonObject(evalsPath);
+        if (parsed === null) {
+          unreadable.push({
+            anchor: shortPath,
+            reason: `could not parse ${shortPath}: not readable as a JSON object \u2014 a present eval surface that cannot be read cannot pass (Extension Rule 7)`
+          });
+          continue;
+        }
         if (!Array.isArray(parsed.cases)) {
-          throw new Error("`cases` is not an array");
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `${shortPath} "cases" is not an array (got ${typeof parsed.cases}) -> declare cases as an array of eval cases (Extension Rule 7)`
+          };
         }
-        cases = parsed.cases;
-      } catch (err) {
-        throw new Error(
-          `DExt7 could not parse ${shortPath}: ${err instanceof Error ? err.message : String(err)} \u2014 a present eval surface that cannot be read cannot pass (Extension Rule 7). Fail-closed, not a silent present.`
+        const cases = parsed.cases;
+        const badCase = cases.findIndex(
+          (c) => c === null || typeof c !== "object" || Array.isArray(c)
         );
-      }
-      cases.forEach((c, i) => {
-        if (c === null || typeof c !== "object" || Array.isArray(c)) {
-          throw new Error(
-            `DExt7 found ${shortPath} cases[${i}] is not an object (got ${c === null ? "null" : Array.isArray(c) ? "array" : typeof c}) \u2014 case shape undeterminable, absence-case presence cannot be decided (Extension Rule 7). Fail-closed, not a silent present.`
-          );
+        if (badCase !== -1) {
+          const c = cases[badCase];
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `${shortPath} cases[${badCase}] is not an object (got ${c === null ? "null" : Array.isArray(c) ? "array" : typeof c}) -> every eval case must be an object (Extension Rule 7)`
+          };
+        }
+        const count = cases.length;
+        const hasAbsence = cases.some(isAbsenceCase);
+        const failures = [];
+        if (count < 3) failures.push(`only ${count} case(s) (need >=3)`);
+        if (!hasAbsence) failures.push("no 'extension absente'/degradation case");
+        if (failures.length > 0) {
+          return {
+            id: this.id,
+            anchor: `${shortPath}`,
+            state: "non-conforming",
+            verdict: `eval suite for "${extLabel}": ${failures.join("; ")} (positive-control OK) -> Extension Rule 7 needs >=3 cases incl. 1 'extension absente'`
+          };
         }
-      });
-      const count = cases.length;
-      const hasAbsence = cases.some(isAbsenceCase);
-      const failures = [];
-      if (count < 3) failures.push(`only ${count} case(s) (need >=3)`);
-      if (!hasAbsence) failures.push("no 'extension absente'/degradation case");
-      if (failures.length > 0) {
-        return {
-          id: this.id,
-          anchor: `${shortPath}`,
-          state: "non-conforming",
-          verdict: `eval suite for "${extLabel}": ${failures.join("; ")} (positive-control OK) -> Extension Rule 7 needs >=3 cases incl. 1 'extension absente'`
-        };
       }
-    }
-    const firstLabel = manifests[0].split("/").slice(-2, -1)[0] ?? "ext";
-    return {
-      id: this.id,
-      anchor: `${firstLabel}/evals/evals.json`,
-      state: "present",
-      verdict: `eval suite complete across ${manifests.length} extension(s): >=3 cases incl. an 'extension absente'/degradation case (positive-control OK)`
-    };
+      const firstLabel = manifests[0].split("/").slice(-2, -1)[0] ?? "ext";
+      return {
+        id: this.id,
+        anchor: `${firstLabel}/evals/evals.json`,
+        state: "present",
+        verdict: `eval suite complete across ${manifests.length} extension(s): >=3 cases incl. an 'extension absente'/degradation case (positive-control OK)`
+      };
+    })();
+    return settle(this.id, decided, unreadable);
   }
 };
 
 // src/detectors/dExt8.ts
-import { existsSync as existsSync14, readFileSync as readFileSync16, readdirSync as readdirSync10, statSync as statSync11 } from "fs";
+import { existsSync as existsSync14, readdirSync as readdirSync10, statSync as statSync11 } from "fs";
 import { dirname as dirname9, join as join18 } from "path";
 var SEMVER_RE2 = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/;
 var POSITIVE_CONTROL5 = "1.2.3-beta.1+build.7";
@@ -5282,73 +5534,88 @@ var dExt8 = {
         verdict: "no extension.json manifest found -> declare an extension with a valid SemVer version + CHANGELOG.md (Extension Rule 8)"
       };
     }
+    const unreadable = [];
+    let finding;
+    let judgedConforming = 0;
     for (const manifestPath2 of manifests) {
       const extDir = dirname9(manifestPath2);
       const extLabel = extDir.split("/").pop() ?? extDir;
       const pkgPath = join18(extDir, "package.json");
       const shortPkgPath = `${extLabel}/package.json`;
       if (!existsSync14(pkgPath)) {
-        throw new Error(
-          `DExt8 could not locate ${shortPkgPath} for extension "${extLabel}" \u2014 cannot verify SemVer/CHANGELOG (Extension Rule 8). Fail-closed, not a silent present.`
-        );
+        unreadable.push({
+          anchor: shortPkgPath,
+          reason: `could not locate ${shortPkgPath} for extension "${extLabel}" \u2014 cannot verify SemVer/CHANGELOG (Extension Rule 8)`
+        });
+        continue;
       }
-      let pkgJson;
-      try {
-        pkgJson = JSON.parse(readFileSync16(pkgPath, "utf8"));
-      } catch {
-        throw new Error(
-          `DExt8 could not parse ${shortPkgPath} as JSON for extension "${extLabel}" \u2014 cannot verify SemVer/CHANGELOG (Extension Rule 8). Fail-closed, not a silent present.`
-        );
+      const pkgJson = readJsonObject(pkgPath);
+      if (pkgJson === null) {
+        unreadable.push({
+          anchor: shortPkgPath,
+          reason: `could not parse ${shortPkgPath} as JSON for extension "${extLabel}" \u2014 cannot verify SemVer/CHANGELOG (Extension Rule 8)`
+        });
+        continue;
       }
       const version = pkgJson.version;
       if ("version" in pkgJson && typeof version !== "string") {
-        throw new Error(
-          `DExt8 found ${shortPkgPath} whose "version" is not a string (got ${typeof version}) for extension "${extLabel}" \u2014 cannot verify SemVer (Extension Rule 8). Fail-closed, not a silent present.`
-        );
+        finding ??= {
+          id: this.id,
+          anchor: shortPkgPath,
+          state: "non-conforming",
+          verdict: `"version" in ${shortPkgPath} is not a string (got ${typeof version}) for extension "${extLabel}" -> set a valid SemVer version string (Extension Rule 8)`
+        };
+        continue;
       }
       if (typeof version !== "string" || version.trim().length === 0) {
-        return {
+        finding ??= {
           id: this.id,
           anchor: shortPkgPath,
           state: "non-conforming",
           verdict: `no "version" field in ${shortPkgPath} for extension "${extLabel}" -> set a valid SemVer version (Extension Rule 8)`
         };
+        continue;
       }
       const validSemver = SEMVER_RE2.test(version);
       const changelogPath = join18(extDir, "CHANGELOG.md");
       const hasChangelog = existsSync14(changelogPath);
       if (!validSemver) {
-        return {
+        finding ??= {
           id: this.id,
           anchor: shortPkgPath,
           state: "non-conforming",
           verdict: `"version": "${version}" is not valid SemVer for extension "${extLabel}" (positive-control OK) -> use MAJOR.MINOR.PATCH (Extension Rule 8)`
         };
+        continue;
       }
       if (!hasChangelog) {
-        return {
+        finding ??= {
           id: this.id,
           anchor: shortPkgPath,
           state: "absent",
           verdict: `no CHANGELOG.md next to ${shortPkgPath} for extension "${extLabel}" (positive-control OK) -> add CHANGELOG.md, update it each release (Extension Rule 8)`
         };
+        continue;
       }
+      judgedConforming++;
     }
+    if (finding) return settle(this.id, finding, unreadable);
     const firstLabel = manifests[0].split("/").slice(-2, -1)[0] ?? "ext";
-    return {
+    const conforming = {
       id: this.id,
       anchor: `${firstLabel}/package.json`,
       state: "present",
-      verdict: `SemVer valid + CHANGELOG.md present across ${manifests.length} extension(s) (positive-control OK)`
+      verdict: `SemVer valid + CHANGELOG.md present across ${judgedConforming} of ${manifests.length} extension(s) (positive-control OK)`
     };
+    return settle(this.id, conforming, unreadable);
   }
 };
 
 // src/detectors/dExt9.ts
-import { readFileSync as readFileSync17, readdirSync as readdirSync11, statSync as statSync12 } from "fs";
+import { readFileSync as readFileSync10, readdirSync as readdirSync11, statSync as statSync12 } from "fs";
 import { join as join19 } from "path";
 var SKIP_DIRS9 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function collectHooksDirSources(root) {
+function collectHooksDirSources(root, unreadable) {
   const out = [];
   let base;
   try {
@@ -5387,11 +5654,14 @@ function collectHooksDirSources(root) {
           const filePath = join19(full, f);
           let body;
           try {
-            body = readFileSync17(filePath, "utf8");
+            body = readFileSync10(filePath, "utf8");
           } catch {
-            throw new Error(
-              `DExt9 could not read hook implementation ${filePath.split("/").slice(-2).join("/")} \u2014 timeout guard undeterminable for hook "${stem}" (Extension Rule 9). Fail-closed, not a silent absent.`
-            );
+            const shortPath = filePath.split("/").slice(-2).join("/");
+            unreadable.push({
+              anchor: shortPath,
+              reason: `could not read hook implementation ${shortPath} \u2014 timeout guard undeterminable for hook "${stem}" (Extension Rule 9)`
+            });
+            continue;
           }
           out.push({
             token: canonical(stem),
@@ -5461,13 +5731,11 @@ function dExt9PositiveControls() {
     negative: hasImplTimeoutGuard(CTRL_NEGATIVE_BODY)
   };
 }
-function manifestTimeoutTokens(raw, shortPath) {
+function manifestTimeoutTokens(raw) {
   const map = /* @__PURE__ */ new Map();
   if (raw === void 0) return map;
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-    throw new Error(
-      `DExt9 found ${shortPath} whose "timeouts" field is present but not an object (got ${Array.isArray(raw) ? "array" : typeof raw}) \u2014 declared timeout guards are undeterminable (Extension Rule 9). Fail-closed, not a silent absent.`
-    );
+    return null;
   }
   for (const [key, value] of Object.entries(raw)) {
     if (typeof value === "number" && value > 0) {
@@ -5485,67 +5753,83 @@ var dExt9 = {
         `DExt9 hook-timeout control FAILED: setTimeoutForm=${controls.setTimeoutForm} abortForm=${controls.abortForm} negative=${controls.negative} \u2014 impl-pattern matcher broken, verdict untrustworthy`
       );
     }
-    const hookSources = [...collectHooksDirSources(tree.root), ...collectFactorySources(tree)];
-    const implByToken = /* @__PURE__ */ new Map();
-    for (const s of hookSources) {
-      const list = implByToken.get(s.token) ?? [];
-      list.push(s);
-      implByToken.set(s.token, list);
-    }
-    const manifests = findExtensionManifests4(tree.root);
-    let declaredAnyLifecycle = false;
-    for (const manifestPath2 of manifests) {
-      const shortPath = manifestPath2.split("/").slice(-2).join("/");
-      let parsed;
-      try {
-        parsed = JSON.parse(readFileSync17(manifestPath2, "utf8"));
-      } catch {
-        throw new Error(
-          `DExt9 could not parse ${shortPath} as JSON \u2014 timeout guards undeterminable (Extension Rule 9). Fail-closed, not a silent absent.`
-        );
-      }
-      if (!("lifecycle" in parsed)) continue;
-      let declared;
-      try {
-        declared = manifestHookTokens(parsed.lifecycle);
-      } catch {
-        throw new Error(
-          `DExt9 found a present manifest ${shortPath} whose "lifecycle" is not an array (got ${typeof parsed.lifecycle}) \u2014 declared hooks are undeterminable (Extension Rule 9). Fail-closed, not a silent absent.`
-        );
+    const unreadable = [];
+    const decided = (() => {
+      const hookSources = [
+        ...collectHooksDirSources(tree.root, unreadable),
+        ...collectFactorySources(tree)
+      ];
+      const implByToken = /* @__PURE__ */ new Map();
+      for (const s of hookSources) {
+        const list = implByToken.get(s.token) ?? [];
+        list.push(s);
+        implByToken.set(s.token, list);
+      }
+      const manifests = findExtensionManifests4(tree.root);
+      let declaredAnyLifecycle = false;
+      for (const manifestPath2 of manifests) {
+        const shortPath = manifestPath2.split("/").slice(-2).join("/");
+        const parsed = readJsonObject(manifestPath2);
+        if (parsed === null) {
+          unreadable.push({
+            anchor: shortPath,
+            reason: `could not parse ${shortPath} as JSON \u2014 timeout guards undeterminable (Extension Rule 9)`
+          });
+          continue;
+        }
+        if (!("lifecycle" in parsed)) continue;
+        const declared = manifestHookTokens(parsed.lifecycle);
+        if (declared === null) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest ${shortPath} "lifecycle" is not an array (got ${typeof parsed.lifecycle}) -> declare the hooks as an array of hook names (Extension Rule 9)`
+          };
+        }
+        if (declared.size === 0) continue;
+        declaredAnyLifecycle = true;
+        const timeouts = manifestTimeoutTokens(parsed.timeouts);
+        if (timeouts === null) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `${shortPath} "timeouts" is present but not an object (got ${Array.isArray(parsed.timeouts) ? "array" : typeof parsed.timeouts}) -> declare timeouts as a { <hook>: <positive ms> } object (Extension Rule 9)`
+          };
+        }
+        const noTimeout = [];
+        for (const hook of declared) {
+          const hasManifestTimeout = timeouts.has(hook);
+          const implSources = implByToken.get(hook) ?? [];
+          const hasImplTimeout = implSources.some((s) => hasImplTimeoutGuard(s.body));
+          if (!hasManifestTimeout && !hasImplTimeout) noTimeout.push(hook);
+        }
+        if (noTimeout.length > 0) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `hook(s) [${noTimeout.join(", ")}] declare NO timeout guard in either form (manifest "timeouts.<hook>" positive number, or impl-side setTimeout/AbortController cutoff) -> a hook exceeding its timeout must be skipped, not a server blocker (Extension Rule 9)`
+          };
+        }
       }
-      if (declared.size === 0) continue;
-      declaredAnyLifecycle = true;
-      const timeouts = manifestTimeoutTokens(parsed.timeouts, shortPath);
-      const noTimeout = [];
-      for (const hook of declared) {
-        const hasManifestTimeout = timeouts.has(hook);
-        const implSources = implByToken.get(hook) ?? [];
-        const hasImplTimeout = implSources.some((s) => hasImplTimeoutGuard(s.body));
-        if (!hasManifestTimeout && !hasImplTimeout) noTimeout.push(hook);
-      }
-      if (noTimeout.length > 0) {
+      if (!declaredAnyLifecycle) {
         return {
           id: this.id,
-          anchor: shortPath,
-          state: "non-conforming",
-          verdict: `hook(s) [${noTimeout.join(", ")}] declare NO timeout guard in either form (manifest "timeouts.<hook>" positive number, or impl-side setTimeout/AbortController cutoff) -> a hook exceeding its timeout must be skipped, not a server blocker (Extension Rule 9)`
+          anchor: manifests.length > 0 ? manifests[0].split("/").slice(-2).join("/") : tree.root.split("/").pop() ?? tree.root,
+          state: "absent",
+          verdict: "no lifecycle hooks declared, nothing to guard with a timeout (Extension Rule 9)"
         };
       }
-    }
-    if (!declaredAnyLifecycle) {
       return {
         id: this.id,
-        anchor: manifests.length > 0 ? manifests[0].split("/").slice(-2).join("/") : tree.root.split("/").pop() ?? tree.root,
-        state: "absent",
-        verdict: "no lifecycle hooks declared, nothing to guard with a timeout (Extension Rule 9)"
+        anchor: manifests[0].split("/").slice(-2).join("/"),
+        state: "present",
+        verdict: "every declared lifecycle hook has a timeout guard (manifest timeouts.<hook>, or impl-side cutoff), positive-control OK (Extension Rule 9)"
       };
-    }
-    return {
-      id: this.id,
-      anchor: manifests[0].split("/").slice(-2).join("/"),
-      state: "present",
-      verdict: "every declared lifecycle hook has a timeout guard (manifest timeouts.<hook>, or impl-side cutoff), positive-control OK (Extension Rule 9)"
-    };
+    })();
+    return settle(this.id, decided, unreadable);
   }
 };
 
@@ -5574,7 +5858,7 @@ function unscopePackageName(name) {
   const m = name.match(/^@[^/]+\/(.+)$/);
   return m ? m[1] : name;
 }
-var dServer2 = {
+var dServer2Inner = {
   id: "DServer2 naming",
   rule: "C-2",
   pin: "a74a042b53c71a095ab88b3073bd47728eeda814",
@@ -5602,6 +5886,22 @@ var dServer2 = {
       };
     }
     const tools = findRegisteredTools(tree);
+    if (tools.length === 0) {
+      const surface = toolSurfaceAnchor(tree);
+      if (surface) {
+        const reason = noToolsLocatedReason(
+          tree,
+          "snake_case tool naming is unverifiable (Server Rule 2)"
+        );
+        return {
+          id: this.id,
+          anchor: surface,
+          state: "could-not-judge",
+          reason,
+          verdict: `could not judge: ${reason}`
+        };
+      }
+    }
     for (const t of tools) {
       if (!TOOL_SNAKE_RE.test(t.name)) {
         return {
@@ -5705,6 +6005,9 @@ var dServer2 = {
     };
   }
 };
+var dServer2 = guardUnreadablePackageJson(dServer2Inner, {
+  authoritative: false
+});
 
 // src/detectors/dServer6.ts
 var LOG_OPENER_RE = /\b(?:console|logger|log)\.(?:log|info|warn|error|debug|trace)\s*\(/;
@@ -5815,65 +6118,72 @@ var dServer6 = {
         `DServer6 stack control FAILED: /${controls.stack.pattern}/ accept(\`${STACK_POSITIVE}\`)=${controls.stack.positive} reject(\`${STACK_NEGATIVE}\`)=${!controls.stack.negative} \u2014 matcher broken, verdict untrustworthy`
       );
     }
-    for (const file of tree.files) {
-      const { calls, unbalanced } = collectLogCalls(file);
-      if (unbalanced.length > 0) {
-        throw new Error(
-          `DServer6 could not read the argument list of ${unbalanced.length} log call(s): ${unbalanced.join(", ")} \u2014 parentheses never balance, secret/PII content unverifiable (C-6). Fail-closed, not a silent present.`
-        );
-      }
-      for (const call of calls) {
-        if (SPREAD_RE.test(call.argText)) {
-          throw new Error(
-            `DServer6 cannot inspect the spread argument of the log call at ${call.anchor} \u2014 a spread hides arbitrary content, secret/PII presence unverifiable (C-6). Fail-closed, not a silent present.`
-          );
-        }
-        const refs = referencedIdentifiers(call.argText);
-        if (SECRET_RE.test(refs)) {
-          return {
-            id: this.id,
-            anchor: call.anchor,
-            state: "non-conforming",
-            verdict: "Form A \u2014 log call references a secret-like identifier (positive-control OK) -> never log secrets; redact before logging (C-6)"
-          };
-        }
-        if (PII_RE.test(refs)) {
-          return {
-            id: this.id,
-            anchor: call.anchor,
-            state: "non-conforming",
-            verdict: "Form C \u2014 log call references a PII-shaped identifier (positive-control OK) -> never log PII; redact before logging (C-6)"
-          };
+    const unreadable = [];
+    const decided = (() => {
+      for (const file of tree.files) {
+        const { calls, unbalanced } = collectLogCalls(file);
+        for (const anchor of unbalanced) {
+          unreadable.push({
+            anchor,
+            reason: `could not read the argument list of the log call at ${anchor} \u2014 parentheses never balance, secret/PII content unverifiable (C-6)`
+          });
         }
-        if (INTERNAL_RE.test(refs)) {
-          return {
-            id: this.id,
-            anchor: call.anchor,
-            state: "non-conforming",
-            verdict: "Form D \u2014 log call references an internal-infrastructure identifier (positive-control OK) -> never log internal system detail; redact before logging (C-6)"
-          };
+        for (const call of calls) {
+          if (SPREAD_RE.test(call.argText)) {
+            unreadable.push({
+              anchor: call.anchor,
+              reason: `cannot inspect the spread argument of the log call at ${call.anchor} \u2014 a spread hides arbitrary content, secret/PII presence unverifiable (C-6)`
+            });
+            continue;
+          }
+          const refs = referencedIdentifiers(call.argText);
+          if (SECRET_RE.test(refs)) {
+            return {
+              id: this.id,
+              anchor: call.anchor,
+              state: "non-conforming",
+              verdict: "Form A \u2014 log call references a secret-like identifier (positive-control OK) -> never log secrets; redact before logging (C-6)"
+            };
+          }
+          if (PII_RE.test(refs)) {
+            return {
+              id: this.id,
+              anchor: call.anchor,
+              state: "non-conforming",
+              verdict: "Form C \u2014 log call references a PII-shaped identifier (positive-control OK) -> never log PII; redact before logging (C-6)"
+            };
+          }
+          if (INTERNAL_RE.test(refs)) {
+            return {
+              id: this.id,
+              anchor: call.anchor,
+              state: "non-conforming",
+              verdict: "Form D \u2014 log call references an internal-infrastructure identifier (positive-control OK) -> never log internal system detail; redact before logging (C-6)"
+            };
+          }
         }
       }
-    }
-    for (const file of tree.files) {
-      for (const line of file.lines) {
-        if (line.comment) continue;
-        if (STACK_RE.test(line.raw) && CLIENT_SINK_RE.test(line.raw)) {
-          return {
-            id: this.id,
-            anchor: `${file.rel}:${line.n}`,
-            state: "non-conforming",
-            verdict: "Form B \u2014 raw error.stack serialized into a client-facing response (positive-control OK) -> return an McpError message, never the raw stack (C-6)"
-          };
+      for (const file of tree.files) {
+        for (const line of file.lines) {
+          if (line.comment) continue;
+          if (STACK_RE.test(line.raw) && CLIENT_SINK_RE.test(line.raw)) {
+            return {
+              id: this.id,
+              anchor: `${file.rel}:${line.n}`,
+              state: "non-conforming",
+              verdict: "Form B \u2014 raw error.stack serialized into a client-facing response (positive-control OK) -> return an McpError message, never the raw stack (C-6)"
+            };
+          }
         }
       }
-    }
-    return {
-      id: this.id,
-      anchor: tree.files.length > 0 ? `${tree.files[0].rel}:1` : tree.root,
-      state: "present",
-      verdict: "no secret/PII/internal-detail referenced in any log call; no raw error.stack exposed to the client (all positive-controls OK). Logging-sink configuration and explicit-activation-only diagnostic mode are the gate/runtime half, out of static scope (declared)."
-    };
+      return {
+        id: this.id,
+        anchor: tree.files.length > 0 ? `${tree.files[0].rel}:1` : tree.root,
+        state: "present",
+        verdict: "no secret/PII/internal-detail referenced in any log call; no raw error.stack exposed to the client (all positive-controls OK). Logging-sink configuration and explicit-activation-only diagnostic mode are the gate/runtime half, out of static scope (declared)."
+      };
+    })();
+    return settle(this.id, decided, unreadable);
   }
 };
 
@@ -5955,59 +6265,65 @@ var dServer8 = {
         `DServer8 text control FAILED: /${controls.text.pattern}/ accept(\`${TEXT_POSITIVE}\`)=${controls.text.positive} reject(\`${TEXT_NEGATIVE}\`)=${!controls.text.negative} \u2014 matcher broken, verdict untrustworthy`
       );
     }
-    const blocks = [];
-    for (const file of tree.files) {
-      const { blocks: fileBlocks, unbalanced } = collectContentArrays(file);
-      if (unbalanced.length > 0) {
-        throw new Error(
-          `DServer8 could not read the content[] array at ${unbalanced.join(", ")} \u2014 brackets never balance, a ui:// resource emission could hide inside it (Server Rule 8). Fail-closed, not a silent present.`
-        );
+    const unreadable = [];
+    const decided = (() => {
+      const blocks = [];
+      for (const file of tree.files) {
+        const { blocks: fileBlocks, unbalanced } = collectContentArrays(file);
+        for (const anchor of unbalanced) {
+          unreadable.push({
+            anchor,
+            reason: `could not read the content[] array at ${anchor} \u2014 brackets never balance, a ui:// resource emission could hide inside it (Server Rule 8)`
+          });
+        }
+        blocks.push(...fileBlocks);
+      }
+      for (const file of tree.files) {
+        const fileBlocks = blocks.filter((b) => b.file === file);
+        for (const line of file.lines) {
+          if (line.comment) continue;
+          if (!KIT_RE.test(line.raw)) continue;
+          const inside = fileBlocks.some((b) => line.n >= b.startLine && line.n <= b.endLine);
+          if (!inside) {
+            unreadable.push({
+              anchor: `${file.rel}:${line.n}`,
+              reason: `renderUiResource(\u2026) ui:// emission at ${file.rel}:${line.n} sits outside any content[] array \u2014 cannot associate it with a sibling text fallback (Server Rule 8)`
+            });
+          }
+        }
       }
-      blocks.push(...fileBlocks);
-    }
-    for (const file of tree.files) {
-      const fileBlocks = blocks.filter((b) => b.file === file);
-      for (const line of file.lines) {
-        if (line.comment) continue;
-        if (!KIT_RE.test(line.raw)) continue;
-        const inside = fileBlocks.some((b) => line.n >= b.startLine && line.n <= b.endLine);
-        if (!inside) {
-          throw new Error(
-            `DServer8 found a renderUiResource(\u2026) ui:// emission at ${file.rel}:${line.n} outside any content[] array \u2014 cannot associate it with a sibling text fallback (Server Rule 8). Fail-closed, not a silent present.`
-          );
+      let sawEmission = false;
+      for (const block of blocks) {
+        const inlineEmission = INLINE_RESOURCE_RE.test(block.text) && UI_URI_RE.test(block.text);
+        const kitEmission = KIT_RE.test(block.text);
+        if (!inlineEmission && !kitEmission) continue;
+        sawEmission = true;
+        const hasText = TEXT_RE.test(block.text) || MARKDOWN_RE.test(block.text);
+        if (!hasText) {
+          return {
+            id: this.id,
+            anchor: block.anchor,
+            state: "non-conforming",
+            verdict: `ui:// resource emitted in content[] with no text fallback beside ui:// in the same array (positive-control OK) -> add a sibling { type: "text" } / { type: "markdown" } entry (Server Rule 8)`
+          };
         }
       }
-    }
-    let sawEmission = false;
-    for (const block of blocks) {
-      const inlineEmission = INLINE_RESOURCE_RE.test(block.text) && UI_URI_RE.test(block.text);
-      const kitEmission = KIT_RE.test(block.text);
-      if (!inlineEmission && !kitEmission) continue;
-      sawEmission = true;
-      const hasText = TEXT_RE.test(block.text) || MARKDOWN_RE.test(block.text);
-      if (!hasText) {
+      if (!sawEmission) {
         return {
           id: this.id,
-          anchor: block.anchor,
-          state: "non-conforming",
-          verdict: `ui:// resource emitted in content[] with no text fallback beside ui:// in the same array (positive-control OK) -> add a sibling { type: "text" } / { type: "markdown" } entry (Server Rule 8)`
+          anchor: tree.files.length > 0 ? `${tree.files[0].rel}:1` : tree.root,
+          state: "absent",
+          verdict: "no ui:// resource emission in any content[] array (n/a for Server Rule 8)"
         };
       }
-    }
-    if (!sawEmission) {
       return {
         id: this.id,
-        anchor: tree.files.length > 0 ? `${tree.files[0].rel}:1` : tree.root,
-        state: "absent",
-        verdict: "no ui:// resource emission in any content[] array (n/a for Server Rule 8)"
+        anchor: blocks.length > 0 ? blocks[0].anchor : tree.root,
+        state: "present",
+        verdict: "every ui:// resource emission has a sibling text/markdown fallback in the same content[] (positive-control OK, Server Rule 8)"
       };
-    }
-    return {
-      id: this.id,
-      anchor: blocks.length > 0 ? blocks[0].anchor : tree.root,
-      state: "present",
-      verdict: "every ui:// resource emission has a sibling text/markdown fallback in the same content[] (positive-control OK, Server Rule 8)"
-    };
+    })();
+    return settle(this.id, decided, unreadable);
   }
 };
 
@@ -6236,7 +6552,7 @@ var detectors = [
 
 // src/runtime/launch.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync18, statSync as statSync13 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync11, statSync as statSync13 } from "fs";
 import { dirname as dirname10, isAbsolute, join as join20, resolve } from "path";
 function findPackageDir(target) {
   let dir;
@@ -6271,7 +6587,7 @@ function deriveLaunchPlan(target) {
   }
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync18(join20(pkgDir, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync11(join20(pkgDir, "package.json"), "utf8"));
   } catch (err) {
     return {
       error: `could not parse ${join20(pkgDir, "package.json")}: ${err instanceof Error ? err.message : String(err)}`
@@ -6355,7 +6671,7 @@ function readEvalCounts(target) {
     const candidate = join20(dir, "evals", "evals.json");
     if (existsSync15(candidate)) {
       try {
-        const parsed = JSON.parse(readFileSync18(candidate, "utf8"));
+        const parsed = JSON.parse(readFileSync11(candidate, "utf8"));
         for (const c of parsed.cases ?? []) {
           if (c && typeof c.tool === "string") counts.set(c.tool, (counts.get(c.tool) ?? 0) + 1);
         }
@@ -6615,7 +6931,7 @@ var USAGE = [
 function readVersion() {
   try {
     const here = dirname11(fileURLToPath(import.meta.url));
-    const manifest = JSON.parse(readFileSync19(join21(here, "..", "package.json"), "utf8"));
+    const manifest = JSON.parse(readFileSync12(join21(here, "..", "package.json"), "utf8"));
     return manifest.version ?? null;
   } catch {
     return null;