@vantageos/mcp-doctor 0.3.1 → 0.4.0

package/dist/doctor.js

@@ -1,13 +1,998 @@
 #!/usr/bin/env node
 
 // src/doctor.ts
-import { readFileSync as readFileSync19, realpathSync } from "fs";
-import { dirname as dirname11, join as join21, resolve as resolve2 } from "path";
+import { readFileSync as readFileSync12, realpathSync } from "fs";
+import { dirname as dirname11, join as join19, resolve as resolve2 } from "path";
 import { fileURLToPath } from "url";
 
+// src/scan.ts
+import { existsSync, readFileSync, readdirSync, statSync } from "fs";
+import { basename, dirname, join, relative, sep } from "path";
+var SKIP_DIR_INFO = {
+  node_modules: { reason: "vendored dependencies", authored: false },
+  dist: { reason: "build output", authored: false },
+  build: { reason: "build output", authored: false },
+  ".git": { reason: "version-control metadata", authored: false },
+  coverage: { reason: "generated coverage output", authored: false },
+  // `authored: true` marks content the target's own authors wrote, as opposed
+  // to vendored or generated content. A walk that looks for a site (C-26) may
+  // probe an authored directory it skips: a deployable there would otherwise
+  // be reported as if it did not exist.
+  tests: { reason: "test material", authored: true },
+  __tests__: { reason: "test material", authored: true },
+  // Test material, not a target's served surface: deliberately-malformed
+  // servers and foreign copies live here. Scanning them makes the instrument
+  // trip its own fail-closed detectors when pointed at its own tree, and lints
+  // inputs that are meant to be broken. A real target's fixtures are equally
+  // test inputs, not its product surface.
+  fixtures: { reason: "test material (fixtures)", authored: true }
+};
+var SKIP_DIRS = new Set(Object.keys(SKIP_DIR_INFO));
+function recordSkip(tree, dir, root, reason) {
+  const path = relative(root, dir).split(sep).join("/");
+  const existing = tree.skippedDirs.find((d) => d.path === path);
+  if (existing) return existing;
+  const entry = {
+    path,
+    reason: reason ?? SKIP_DIR_INFO[basename(dir)]?.reason ?? "skipped"
+  };
+  tree.skippedDirs.push(entry);
+  return entry;
+}
+function isCommentLine(raw) {
+  const t = raw.trim();
+  if (t === "") return false;
+  return t.startsWith("*") || t.startsWith("//") || t.startsWith("/*") || t.startsWith("*/");
+}
+function walk(dir, out, onSkip) {
+  let entries;
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return;
+  }
+  for (const name of entries) {
+    const full = join(dir, name);
+    let st;
+    try {
+      st = statSync(full);
+    } catch {
+      continue;
+    }
+    if (st.isDirectory()) {
+      if (SKIP_DIRS.has(name)) {
+        onSkip(full);
+        continue;
+      }
+      walk(full, out, onSkip);
+    } else if (name.endsWith(".ts") || name.endsWith(".tsx")) {
+      if (name.endsWith(".d.ts") || name.endsWith(".test.ts")) continue;
+      out.push(full);
+    }
+  }
+}
+function loadFile(path, root) {
+  const raw = readFileSync(path, "utf8");
+  const lines = raw.split("\n").map((r, i) => ({ n: i + 1, raw: r, comment: isCommentLine(r) }));
+  const file = { path, rel: relative(root, path) || path, lines };
+  const mask = maskOf(file);
+  for (const line of lines) {
+    if (line.comment) continue;
+    const row = mask[line.n - 1];
+    let any = false;
+    let allComment = true;
+    for (let c = 0; c < line.raw.length; c++) {
+      if (line.raw[c] === " " || line.raw[c] === "	" || line.raw[c] === "\r") continue;
+      any = true;
+      if (row[c] !== COM) {
+        allComment = false;
+        break;
+      }
+    }
+    if (any && allComment) line.comment = true;
+  }
+  return file;
+}
+function findPackageJson(startDir) {
+  let dir = startDir;
+  for (let depth = 0; depth < 8; depth++) {
+    const candidate = join(dir, "package.json");
+    if (existsSync(candidate)) {
+      try {
+        const parsed = JSON.parse(readFileSync(candidate, "utf8"));
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+          return { path: candidate, json: {}, unreadable: "not a JSON object" };
+        }
+        return { path: candidate, json: parsed };
+      } catch (err) {
+        return { path: candidate, json: {}, unreadable: err.message };
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function loadTree(root) {
+  const st = statSync(root);
+  const baseDir = st.isDirectory() ? root : dirname(root);
+  const filePaths = [];
+  const tree = { root, files: [], packageJson: null, skippedDirs: [] };
+  if (st.isDirectory()) walk(root, filePaths, (d) => recordSkip(tree, d, root));
+  else if (root.endsWith(".ts") || root.endsWith(".tsx")) filePaths.push(root);
+  tree.files = filePaths.map((p) => loadFile(p, baseDir));
+  tree.packageJson = findPackageJson(baseDir);
+  return tree;
+}
+var COM = 1;
+var CODE = 2;
+var maskCache = /* @__PURE__ */ new WeakMap();
+function buildCodeMask(file) {
+  const mask = [];
+  let mode = "code";
+  const tplStack = [];
+  let braceDepth = 0;
+  let prevSig = "";
+  let prevWord = "";
+  const regexAfterKeyword = /* @__PURE__ */ new Set([
+    "case",
+    "default",
+    "delete",
+    "do",
+    "else",
+    "extends",
+    "in",
+    "instanceof",
+    "new",
+    "of",
+    "return",
+    "throw",
+    "typeof",
+    "void",
+    "yield",
+    "await"
+  ]);
+  const regexAfter = /* @__PURE__ */ new Set([
+    "",
+    "(",
+    ",",
+    "=",
+    ":",
+    "[",
+    "!",
+    "&",
+    "|",
+    "?",
+    "{",
+    "}",
+    ";",
+    "+",
+    "-",
+    "*",
+    "%",
+    "<",
+    ">",
+    "~",
+    "^"
+  ]);
+  for (const line of file.lines) {
+    const s = line.raw;
+    const row = new Uint8Array(s.length);
+    let i = 0;
+    while (i < s.length) {
+      const c = s[i];
+      const n = s[i + 1];
+      if (mode === "block") {
+        row[i] = COM;
+        if (c === "*" && n === "/") {
+          row[i + 1] = COM;
+          i += 2;
+          mode = "code";
+        } else i++;
+        continue;
+      }
+      if (mode === "sq" || mode === "dq") {
+        if (c === "\\") i += 2;
+        else if (mode === "sq" && c === "'" || mode === "dq" && c === '"') {
+          row[i] = CODE;
+          i++;
+          mode = "code";
+          prevSig = c;
+        } else i++;
+        continue;
+      }
+      if (mode === "tpl") {
+        if (c === "\\") i += 2;
+        else if (c === "`") {
+          row[i] = CODE;
+          i++;
+          mode = "code";
+          prevSig = c;
+        } else if (c === "$" && n === "{") {
+          row[i] = CODE;
+          row[i + 1] = CODE;
+          tplStack.push(braceDepth);
+          braceDepth++;
+          i += 2;
+          mode = "code";
+          prevSig = "{";
+        } else i++;
+        continue;
+      }
+      if (mode === "re" || mode === "recls") {
+        if (c === "\\") i += 2;
+        else if (mode === "re" && c === "[") {
+          mode = "recls";
+          i++;
+        } else if (mode === "recls" && c === "]") {
+          mode = "re";
+          i++;
+        } else if (mode === "re" && c === "/") {
+          row[i] = CODE;
+          i++;
+          mode = "code";
+          prevSig = "/";
+        } else i++;
+        continue;
+      }
+      if (c === "/" && n === "/") {
+        row.fill(COM, i);
+        break;
+      }
+      if (c === "/" && n === "*") {
+        mode = "block";
+        row[i] = COM;
+        row[i + 1] = COM;
+        i += 2;
+        continue;
+      }
+      row[i] = CODE;
+      const wordBefore = prevWord;
+      if (c !== " " && c !== "	") prevWord = "";
+      if (/[A-Za-z_$]/.test(c)) {
+        let j = i + 1;
+        while (j < s.length && /[\w$]/.test(s[j])) j++;
+        for (let k = i; k < j; k++) row[k] = CODE;
+        prevWord = prevSig === "." ? "" : s.slice(i, j);
+        prevSig = s[j - 1];
+        i = j;
+        continue;
+      }
+      if (c === '"' || c === "'" || c === "`") {
+        mode = c === '"' ? "dq" : c === "'" ? "sq" : "tpl";
+        i++;
+        continue;
+      }
+      if (c === "/" && (regexAfter.has(prevSig) || regexAfterKeyword.has(wordBefore))) {
+        mode = "re";
+        i++;
+        continue;
+      }
+      if (c === "{") braceDepth++;
+      else if (c === "}") {
+        braceDepth--;
+        if (tplStack.length > 0 && tplStack[tplStack.length - 1] === braceDepth) {
+          tplStack.pop();
+          mode = "tpl";
+          i++;
+          continue;
+        }
+      }
+      if (c !== " " && c !== "	") prevSig = c;
+      i++;
+    }
+    if (mode === "sq" || mode === "dq" || mode === "re" || mode === "recls") mode = "code";
+    mask.push(row);
+  }
+  return mask;
+}
+function maskOf(file) {
+  let mask = maskCache.get(file);
+  if (!mask) {
+    mask = buildCodeMask(file);
+    maskCache.set(file, mask);
+  }
+  return mask;
+}
+function isCodeAt(file, n, col) {
+  const mask = maskOf(file);
+  return mask[n - 1]?.[col] === CODE;
+}
+function matchInCode(file, line, re) {
+  const g = new RegExp(re.source, re.flags.includes("g") ? re.flags : `${re.flags}g`);
+  for (const m of line.raw.matchAll(g)) {
+    if (isCodeAt(file, line.n, m.index ?? 0)) return m;
+  }
+  return null;
+}
+function testInCode(file, line, re) {
+  return matchInCode(file, line, re) !== null;
+}
+function countInCode(file, line, ch) {
+  let n = 0;
+  for (let c = 0; c < line.raw.length; c++) {
+    if (line.raw[c] === ch && isCodeAt(file, line.n, c)) n++;
+  }
+  return n;
+}
+
+// src/detectors/couldNotJudge.ts
+import { readFileSync as readFileSync2 } from "fs";
+function couldNotJudge(id, anchor, reason) {
+  return {
+    id,
+    anchor,
+    state: "could-not-judge",
+    reason,
+    verdict: `could not judge: ${reason}`
+  };
+}
+function settle(id, decided, unreadable) {
+  if (unreadable.length === 0) return decided;
+  const named = unreadable.map((u) => `${u.anchor}: ${u.reason}`).join("; ");
+  if (decided.state === "non-conforming") {
+    return { ...decided, verdict: `${decided.verdict} [also could not read: ${named}]` };
+  }
+  const judgedRest = decided.state === "could-not-judge" ? ` ${decided.reason ?? decided.verdict}` : ` The readable remainder judged ${decided.state}: ${decided.verdict}`;
+  return couldNotJudge(
+    id,
+    unreadable[0].anchor,
+    `${unreadable.length} input(s) present but unreadable \u2014 ${named}.${judgedRest}`
+  );
+}
+function readJsonObject(path) {
+  let value;
+  try {
+    value = JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return null;
+  }
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+  return value;
+}
+function guardUnreadablePackageJson(inner, opts) {
+  return {
+    ...inner,
+    run(tree) {
+      const decided = inner.run(tree);
+      const pkg = tree.packageJson;
+      if (!pkg?.unreadable) return decided;
+      const u = {
+        anchor: pkg.path,
+        reason: `package.json is present but could not be parsed (${pkg.unreadable})`
+      };
+      if (opts.authoritative && decided.state !== "could-not-judge") {
+        return couldNotJudge(inner.id, u.anchor, `${u.anchor}: ${u.reason}`);
+      }
+      return settle(inner.id, decided, [u]);
+    }
+  };
+}
+
+// src/detectors/dLocalIdentity.ts
+var CLOUD_IDENTITY_PACKAGE = "@vantageos/cloud-identity";
+var EXEMPT_MARKER = "allow-local-identity:";
+var MIN_JUSTIFICATION = 8;
+var TENANT_NAMES = "orgId|org_id|orgSlug|org_slug|tenantId|tenant_id";
+var TENANT_PROP = new RegExp(`\\.(${TENANT_NAMES})$`, "i");
+var unbracket = (x) => x.replace(/\??\.?\[\s*["'`]([\w$]+)["'`]\s*\]/g, ".$1").replace(/\?/g, "");
+var FOLD_NAMES = "toLowerCase|toUpperCase|toLocaleLowerCase|toLocaleUpperCase|trim|normalize";
+var FOLD_CALL = String.raw`(?:\s*\.\s*(?:${FOLD_NAMES})\s*\([^()]*\))*`;
+var PATH = String.raw`[\w$.?]+(?![\w$])(?<!\.(?:${FOLD_NAMES}))`;
+var OPERAND = String.raw`${PATH}(?:\[\s*["\`][\w$]+["\`]\s*\]\??[\w$.?]*)*${FOLD_CALL}`;
+var NON_OPERAND = /* @__PURE__ */ new Set(["undefined", "null", "true", "false", "NaN"]);
+var isLiteral = (x) => NON_OPERAND.has(x) || /^-?\d/.test(x);
+var unfold = (x) => unbracket(x.replace(new RegExp(`${FOLD_CALL}$`), ""));
+var lastSegment = (x) => x.split(".").pop() ?? "";
+var ACTING_FIELD = /^(createdBy|assignedTo|assignee|from|fromOrchestrator|toOrchestrator|recipient|sender|callerOrchestrator|orchestrator|orchestratorName|actor|actorName|actingAs|claimedBy|callerName|agentName|fromName)$/;
+var ACTING_BARE = /^(createdBy|assignedTo|assignee|fromOrchestrator|toOrchestrator|callerOrchestrator|actingAs|claimedBy)$/;
+var CALLERISH = /^(caller\w*|actor\w*|acting\w*|claimed\w*|\w*Orchestrator|\w*AgentName)$/i;
+var NAME_FIELD = /^(name|agentName|orchestratorName|displayName)$/;
+var isActing = (x) => ACTING_FIELD.test(lastSegment(x)) && (x.includes(".") || ACTING_BARE.test(x)) || x.includes(".") && CALLERISH.test(lastSegment(x));
+var isNameField = (x) => x.includes(".") && NAME_FIELD.test(lastSegment(x));
+var isBareCallerish = (x) => !x.includes(".") && CALLERISH.test(x);
+var comparesTenants = (a, b) => TENANT_PROP.test(a) || TENANT_PROP.test(b);
+var comparesNames = (a, b) => isActing(a) && (isActing(b) || CALLERISH.test(lastSegment(b)) || isNameField(b)) || isActing(b) && (CALLERISH.test(lastSegment(a)) || isNameField(a)) || isBareCallerish(a) && isNameField(b) || isBareCallerish(b) && isNameField(a);
+var comparesIdentity = (a, b) => comparesTenants(a, b) || comparesNames(a, b);
+function operands(x, y) {
+  const [a, b] = [unfold(x), unfold(y)];
+  return isLiteral(a) || isLiteral(b) ? null : [a, b];
+}
+var CMP = String.raw`(${OPERAND})\s*[!=]==?\s*(${OPERAND})`;
+var OBJECT_IS = String.raw`\bObject\s*\.\s*is\s*\(\s*(${OPERAND})\s*,\s*(${OPERAND})\s*\)`;
+var acceptWith = (pred) => (m) => {
+  const ops = operands(m[1], m[2]);
+  return ops !== null && pred(ops[0], ops[1]);
+};
+var STRING_LITERAL = String.raw`(?:"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|\`[^\`$\\]*\`)`;
+var LITERAL_CONCAT = new RegExp(String.raw`^${STRING_LITERAL}(?:\s*\+\s*${STRING_LITERAL})*$`);
+function staticConstants(file) {
+  const out = /* @__PURE__ */ new Set();
+  const decl = /^(?:export\s+)?const\s+([\w$]+)\s*(?::[^=]+)?=\s*(.*)$/;
+  for (let i = 0; i < file.lines.length; i++) {
+    const m = file.lines[i].raw.match(decl);
+    if (!m) continue;
+    let init = m[2];
+    for (let j = i + 1; !/;\s*$/.test(init) && j < Math.min(file.lines.length, i + 40); j++) {
+      init += `
+${file.lines[j].raw}`;
+    }
+    const body = init.replace(/;\s*$/, "").trim();
+    if (LITERAL_CONCAT.test(body)) out.add(m[1]);
+  }
+  return out;
+}
+function callArgs(text, from) {
+  const args = [];
+  let depth = 0;
+  let start = from;
+  for (let i = from; i < text.length; i++) {
+    const c = text[i];
+    if (c === '"' || c === "'" || c === "`") {
+      for (i++; i < text.length && text[i] !== c; i++) if (text[i] === "\\") i++;
+      continue;
+    }
+    if (c === "(" || c === "[" || c === "{") depth++;
+    else if (c === ")" || c === "]" || c === "}") {
+      if (depth === 0) {
+        args.push(text.slice(start, i).trim());
+        return { args, end: i + 1 };
+      }
+      depth--;
+    } else if (c === "," && depth === 0) {
+      args.push(text.slice(start, i).trim());
+      start = i + 1;
+    }
+  }
+  return null;
+}
+function isStaticInput(expr, statics) {
+  const e = expr.trim();
+  if (LITERAL_CONCAT.test(e) || statics.has(e)) return true;
+  const wrapped = e.match(/^(?:new\s+TextEncoder\s*\(\s*\)\s*\.\s*encode|Buffer\s*\.\s*from)\s*\(/);
+  if (!wrapped) return false;
+  const inner = callArgs(e, wrapped[0].length);
+  return inner !== null && inner.end === e.length && isStaticInput(inner.args[0], statics);
+}
+function textFrom(ctx, extra = 12) {
+  const { file, line, idx } = ctx;
+  const tail = file.lines.slice(line.n, line.n + extra).map((l) => l.raw);
+  return [line.raw.slice(idx), ...tail].join("\n");
+}
+function blockFrom(text, from) {
+  const open = text.indexOf("{", from);
+  if (open < 0) return null;
+  let depth = 0;
+  for (let i = open; i < text.length; i++) {
+    const c = text[i];
+    if (c === '"' || c === "'" || c === "`") {
+      for (i++; i < text.length && text[i] !== c; i++) if (text[i] === "\\") i++;
+      continue;
+    }
+    if (c === "{") depth++;
+    else if (c === "}" && --depth === 0) return text.slice(open, i + 1);
+  }
+  return null;
+}
+function switchComparesIdentity(m, ctx) {
+  if (!ctx) return false;
+  const subject = unfold(m[1]);
+  const body = blockFrom(textFrom(ctx, 60), m[0].length);
+  if (body === null) return false;
+  const label = new RegExp(String.raw`\bcase\s+(${OPERAND})\s*:`, "g");
+  for (const c of body.matchAll(label)) {
+    const ops = operands(subject, c[1]);
+    if (ops !== null && comparesIdentity(ops[0], ops[1])) return true;
+  }
+  return false;
+}
+function literalHoldsIdentity(m) {
+  const arg = unfold(m[2]);
+  return m[1].split(",").map((e) => unfold(e.trim())).some((e) => e !== "" && !isLiteral(e) && !isLiteral(arg) && comparesIdentity(e, arg));
+}
+function digestsStaticInput(m, ctx) {
+  if (!ctx) return false;
+  const text = textFrom(ctx);
+  const open = text.indexOf("(");
+  if (open < 0) return false;
+  const call = callArgs(text, open + 1);
+  if (!call) return false;
+  if (/^subtle/.test(m[0])) {
+    return m[1] === "digest" && call.args.length >= 2 && isStaticInput(call.args[1], ctx.statics);
+  }
+  if (!/^createHash/.test(m[0])) return false;
+  const update = text.slice(call.end).match(/^\s*\.\s*update\s*\(/);
+  if (!update) return false;
+  const data = callArgs(text, call.end + update[0].length);
+  return data !== null && isStaticInput(data.args[0], ctx.statics);
+}
+var RENAMEABLE = [
+  "createHash",
+  "createHmac",
+  "timingSafeEqual",
+  "jwtVerify",
+  "jwtDecrypt",
+  "createRemoteJWKSet",
+  "createLocalJWKSet",
+  "decodeJwt",
+  "compactVerify",
+  "verifyToken"
+];
+function renamedPrimitives(file) {
+  const text = file.lines.map((l) => l.raw).join("\n");
+  const out = [];
+  const named = /import\s+(type\s+)?\{([^}]*)\}\s*from\s*["']([^"']+)["']/g;
+  for (const m of text.matchAll(named)) {
+    if (m[1] || m[3].startsWith(CLOUD_IDENTITY_PACKAGE)) continue;
+    for (const part of m[2].split(",")) {
+      const as = part.trim().match(/^([\w$]+)\s+as\s+([\w$]+)$/);
+      if (as && RENAMEABLE.includes(as[1])) out.push([as[1], as[2]]);
+    }
+  }
+  const destructured = /(?:const|let|var)\s*\{([^}]*)\}\s*=\s*(?:await\s+)?(?:require|import)\s*\(\s*["']([^"']+)["']/g;
+  for (const m of text.matchAll(destructured)) {
+    if (m[2].startsWith(CLOUD_IDENTITY_PACKAGE)) continue;
+    for (const part of m[1].split(",")) {
+      const as = part.trim().match(/^([\w$]+)\s*:\s*([\w$]+)$/);
+      if (as && RENAMEABLE.includes(as[1])) out.push([as[1], as[2]]);
+    }
+  }
+  return out;
+}
+var escapeRe = (x) => x.replace(/[$]/g, "\\$&");
+function aliasMatchers(file) {
+  const out = [];
+  for (const [orig, alias] of renamedPrimitives(file)) {
+    for (const mt of MATCHERS) {
+      if (!mt.re.source.includes(orig)) continue;
+      const re = new RegExp(mt.re.source.split(orig).join(escapeRe(alias)), mt.re.flags);
+      const { accept } = mt;
+      out.push({
+        ...mt,
+        re,
+        // The predicate reads the matched text; give it the original callee name.
+        accept: accept ? (m, ctx) => {
+          const fake = Object.assign(
+            [...m].map((x) => x?.replace(alias, orig)),
+            {
+              index: m.index,
+              input: m.input
+            }
+          );
+          return accept(fake, ctx);
+        } : void 0
+      });
+    }
+  }
+  return out;
+}
+var MATCHERS = [
+  {
+    id: "local-jwt-verify",
+    category: "resolves-caller",
+    re: /\b(jwtVerify|jwtDecrypt|createRemoteJWKSet|createLocalJWKSet|decodeJwt|compactVerify|verifyToken)\s*\(/,
+    callee: 1,
+    sample: "const { payload } = await jwtVerify(token, jwks);"
+  },
+  {
+    id: "local-jwt-verify",
+    category: "resolves-caller",
+    re: /\b(jwt|jsonwebtoken)\.(verify|decode)\s*\(/,
+    sample: "const claims = jwt.verify(token, key);"
+  },
+  {
+    id: "raw-claim-read",
+    category: "resolves-caller",
+    re: /\b(payload|claims|decoded)\??\.(org_id|org_slug|org_role|orgId|orgSlug|orgRole)\b/,
+    sample: "const orgId = payload.org_id as string;"
+  },
+  {
+    // A populated grant attached locally: a non-empty literal, or a value read
+    // off another object (a mapping row). A pass-through copy of the same
+    // field (`fromAllowList: ctx.fromAllowList`) grants nothing new.
+    id: "local-grant",
+    category: "resolves-caller",
+    re: /\bfromAllowList\s*:\s*(\[\s*[^\]\s][^\]]*\]|[\w$]+(?:\??\.[\w$]+)+)/,
+    accept: (m) => !/\.fromAllowList$/.test(m[1]),
+    sample: 'fromAllowList: ["*"],'
+  },
+  {
+    // A role compared to a value. A presence test (`orgRole !== undefined`,
+    // forwarding the claim on) asserts nothing and is not a site.
+    id: "org-role-assert",
+    category: "asserts-membership",
+    re: /\b(orgRole|org_role)\s*[!=]==\s*([^\s);&|?:]+)/,
+    accept: (m) => !NON_OPERAND.has(m[2]),
+    sample: 'if (orgRole === "org:admin") return true;'
+  },
+  {
+    id: "org-role-assert",
+    category: "asserts-membership",
+    re: /[!=]==\s*["'`]org:|\.has\(\s*\{\s*(role|permission)\s*:/,
+    sample: 'if (auth.has({ role: "org:admin" })) return true;'
+  },
+  {
+    // Identifying an agent by NAME: a typed name compared to a roster or an
+    // allow-list, by method or by iteration.
+    id: "name-allowlist",
+    category: "filters-by-scope",
+    re: /\b[\w$]*(roster|allow_?list|allowed_?orchestrators)\s*\??\.\s*(includes|indexOf|some|find|findIndex|every|has)\s*\(/i,
+    sample: "if (ctx.fromAllowList.includes(from)) return null;"
+  },
+  {
+    id: "name-allowlist",
+    category: "filters-by-scope",
+    re: /\b(isIn\w*Allow_?list)\s*\(/i,
+    callee: 1,
+    sample: "if (!isInAllowList(list, name)) return false;"
+  },
+  {
+    id: "name-allowlist",
+    category: "filters-by-scope",
+    re: /\bof\s+[\w$.?]*(roster|allow_?list|allowed_?orchestrators)\s*\)/i,
+    sample: "for (const entry of ctx.fromAllowList) {"
+  },
+  {
+    // A row kept or dropped by comparing its tenant to the caller's: ===, !==, == or !=.
+    id: "tenant-row-filter",
+    category: "filters-by-scope",
+    re: new RegExp(CMP),
+    accept: acceptWith(comparesTenants),
+    sample: "return row.orgId == ctx.actor.orgSlug;"
+  },
+  {
+    id: "tenant-row-filter",
+    category: "filters-by-scope",
+    re: new RegExp(OBJECT_IS),
+    accept: acceptWith(comparesTenants),
+    sample: "return Object.is(row.orgId, ctx.actor.orgSlug);"
+  },
+  {
+    // A tenant passed to a membership test: `callerOrgs.includes(row.orgId)`.
+    id: "tenant-row-filter",
+    category: "filters-by-scope",
+    re: new RegExp(
+      String.raw`\.(includes|has|indexOf|some|find|findIndex)\s*\(\s*(${OPERAND})\s*[,)]`
+    ),
+    accept: (m) => TENANT_PROP.test(unfold(m[2])),
+    sample: "return callerOrgs.includes(row.orgId);"
+  },
+  {
+    // Identifying an agent by NAME through a normaliser: either side of a strict
+    // comparison is a call to `normalize...Id/Name/Orchestrator/Agent/...`.
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: /\bnormali[sz]e\w*(id|name|orchestrator|agent|label|slug|handle)\w*\s*\([^()]*(?:\([^()]*\)[^()]*)*\)\s*[!=]==|[!=]==\s*normali[sz]e\w*(id|name|orchestrator|agent|label|slug|handle)\w*\s*\(/i,
+    sample: "return normalizeOrchestratorId(claimedName) === only;"
+  },
+  {
+    // A typed or argument name compared straight to an allow-list / roster entry.
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: /(?:\b[\w$.?]*(?:roster|allow_?list|allowed_?orchestrators)\s*\??\.?\[[^\]]*\]\s*[!=]==|[!=]==\s*[\w$.?]*(?:roster|allow_?list|allowed_?orchestrators)\s*\??\.?\[)/i,
+    sample: "return claimedName === ctx.fromAllowList[0];"
+  },
+  {
+    // Identifying an agent by NAME through its acting-name fields: who made a row
+    // against who is asking. ===, !==, == and !=, case-folded or not.
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: new RegExp(CMP),
+    accept: acceptWith(comparesNames),
+    sample: "return row.assignedTo.toLowerCase() !== a.callerOrchestrator.toLowerCase();"
+  },
+  {
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: new RegExp(OBJECT_IS),
+    accept: acceptWith(comparesNames),
+    sample: "return Object.is(row.createdBy, m.from);"
+  },
+  {
+    // `switch (row.createdBy) { case caller: }` is the same compare, spelled as a jump table.
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: new RegExp(String.raw`\bswitch\s*\(\s*(${OPERAND})\s*\)`),
+    accept: (m, ctx) => switchComparesIdentity(m, ctx),
+    sample: "switch (row.createdBy) { case caller: return true; }"
+  },
+  {
+    // `[caller].includes(row.createdBy)`: a membership test against a literal that holds the caller.
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: new RegExp(
+      String.raw`(?<![\w$\])])\[([^\[\]]*)\]\s*\.\s*(?:includes|indexOf)\s*\(\s*(${OPERAND})\s*[,)]`
+    ),
+    accept: (m) => literalHoldsIdentity(m),
+    sample: "return [caller].includes(row.createdBy);"
+  },
+  {
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: new RegExp(
+      String.raw`\bnew\s+Set\s*\(\s*\[([^\[\]]*)\]\s*\)\s*\.\s*has\s*\(\s*(${OPERAND})\s*[,)]`
+    ),
+    accept: (m) => literalHoldsIdentity(m),
+    sample: "return new Set([caller]).has(row.assignedTo);"
+  },
+  {
+    // `a.localeCompare(b) === 0` is an equality test, whichever way round it is written.
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: new RegExp(
+      String.raw`(${OPERAND})\s*\.\s*localeCompare\s*\(\s*(${OPERAND})\s*(?:,[^()]*(?:\([^()]*\)[^()]*)*)?\)\s*[!=]==?\s*0(?![\w$.])`
+    ),
+    accept: acceptWith(comparesIdentity),
+    sample: "return row.assignedTo.localeCompare(a.callerOrchestrator) === 0;"
+  },
+  {
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: new RegExp(
+      String.raw`(?<![\w$.])0\s*[!=]==?\s*(${OPERAND})\s*\.\s*localeCompare\s*\(\s*(${OPERAND})\s*[,)]`
+    ),
+    accept: acceptWith(comparesIdentity),
+    sample: "return 0 === row.assignedTo.localeCompare(a.callerOrchestrator);"
+  },
+  {
+    id: "local-secret-compare",
+    category: "validates-credential",
+    re: /\b(timingSafeEqual)\s*\(/,
+    callee: 1,
+    sample: "return timingSafeEqual(a, b);"
+  },
+  {
+    // Any digest of a presented credential, whatever the algorithm.
+    id: "local-digest",
+    category: "validates-credential",
+    // A digest over static content (a literal, or a constant made of literals) is
+    // not a digest of a credential. HMAC and sign/verify always take a key: a site.
+    re: /\bcreateHash\s*\(|\bcreateHmac\s*\(|\bsubtle\s*\.\s*(digest|sign|verify)\s*\(/,
+    accept: (m, ctx) => !digestsStaticInput(m, ctx),
+    sample: 'const h = await crypto.subtle.digest("SHA-256", data);'
+  }
+];
+function biteSample(mt, text) {
+  const m = text.match(mt.re);
+  if (m === null) return false;
+  if (!mt.accept) return true;
+  const line = { n: 1, raw: text, comment: false };
+  const file = { path: "sample", rel: "sample", lines: [line] };
+  return mt.accept(m, { file, line, idx: m.index ?? 0, statics: /* @__PURE__ */ new Set() });
+}
+function localIdentityPositiveControls() {
+  const out = {};
+  MATCHERS.forEach((mt, i) => {
+    out[`${mt.id}#${i}`] = biteSample(mt, mt.sample);
+  });
+  const bites = (line) => MATCHERS.some((mt) => biteSample(mt, line));
+  out["negative:pass-through-grant"] = !bites("fromAllowList: ctx.fromAllowList,");
+  out["negative:delegated-bearer"] = !MATCHERS.some(
+    (mt) => mt.re.test("const r = await validateMasterBearer(authHeader, secret);")
+  );
+  out["negative:role-presence-test"] = !bites(
+    "...(ctx.orgRole !== undefined ? { role: ctx.orgRole } : {}),"
+  );
+  out["negative:undefined-compare"] = !bites("if (row.orgId === undefined) return;");
+  out["negative:acting-field-vs-nullish"] = !bites("if (row.assignedTo !== undefined) return;");
+  out["negative:acting-field-vs-literal"] = !bites('return t.createdBy === "system";');
+  out["negative:unrelated-field-compare"] = !bites("return page.from === page.to;");
+  out["negative:switch-on-unrelated-field"] = !bites('switch (row.kind) { case "a": return 1; }');
+  out["negative:literal-array-unrelated"] = !bites("return [kind].includes(row.status);");
+  out["negative:localecompare-unrelated"] = !bites("return a.name.localeCompare(b.name) === 0;");
+  out["negative:object-is-nullish"] = !bites("return Object.is(row.orgId, undefined);");
+  return out;
+}
+function cloudIdentityBindings(file) {
+  const text = file.lines.map((l) => l.raw).join("\n");
+  const names = /* @__PURE__ */ new Set();
+  const namespaces = /* @__PURE__ */ new Set();
+  const pkg = `@vantageos\\/cloud-identity(?:\\/[^"']*)?`;
+  const named = new RegExp(`import\\s+(type\\s+)?\\{([^}]*)\\}\\s*from\\s*["']${pkg}["']`, "g");
+  for (const m of text.matchAll(named)) {
+    if (m[1]) continue;
+    for (const part of m[2].split(",")) {
+      const p = part.trim();
+      if (!p || p.startsWith("type ")) continue;
+      const as = p.match(/^[\w$]+\s+as\s+([\w$]+)$/);
+      names.add(as ? as[1] : p);
+    }
+  }
+  const ns = new RegExp(`import\\s+\\*\\s+as\\s+([\\w$]+)\\s+from\\s*["']${pkg}["']`, "g");
+  for (const m of text.matchAll(ns)) namespaces.add(m[1]);
+  return { names, namespaces };
+}
+function isDelegated(raw, start, callee, b) {
+  const before = raw.slice(0, start);
+  const qualified = before.match(/([\w$]+)\s*\.\s*$/);
+  if (qualified) return b.namespaces.has(qualified[1]);
+  return b.names.has(callee);
+}
+function countDelegatedCalls(file, b) {
+  if (b.names.size === 0 && b.namespaces.size === 0) return 0;
+  let n = 0;
+  for (const line of file.lines) {
+    if (line.comment) continue;
+    for (const m of line.raw.matchAll(/([\w$]+)\s*\(/g)) {
+      const idx = m.index ?? 0;
+      if (isCodeAt(file, line.n, idx) && isDelegated(line.raw, idx, m[1], b)) n++;
+    }
+  }
+  return n;
+}
+var DECL = /^(?:export\s+)?(?:default\s+)?(?:async\s+)?(?:function\s*\*?\s*([\w$]+)|(?:const|let|var|class)\s+([\w$]+))/;
+function enclosingDecl(file, n) {
+  for (let i = n - 1; i >= 0; i--) {
+    const l = file.lines[i];
+    if (l.comment) continue;
+    const m = l.raw.match(DECL);
+    if (m) return { name: m[1] ?? m[2], line: l.n };
+  }
+  return null;
+}
+function justificationIn(line, file) {
+  const at = line.raw.indexOf(EXEMPT_MARKER);
+  if (at < 0) return null;
+  if (!line.comment && isCodeAt(file, line.n, at)) return null;
+  if (!line.comment && !/\/\/|\/\*/.test(line.raw.slice(0, at))) return null;
+  return line.raw.slice(at + EXEMPT_MARKER.length).replace(/\*\/\s*$/, "").trim();
+}
+function commentBlockAbove(file, n) {
+  const out = [];
+  for (let i = n - 2; i >= 0; i--) {
+    const l = file.lines[i];
+    if (!l.comment) break;
+    out.push(l);
+  }
+  return out;
+}
+function findJustification(file, line, decl) {
+  const candidates = [line, ...commentBlockAbove(file, line.n)];
+  if (decl) candidates.push(...commentBlockAbove(file, decl.line));
+  for (const c of candidates) {
+    const j = justificationIn(c, file);
+    if (j !== null) return { text: j, valid: j.length >= MIN_JUSTIFICATION };
+  }
+  return null;
+}
+function unreadableReason(file) {
+  if (file.lines.some((l) => l.raw.includes("\0") || l.raw.includes("\uFFFD"))) {
+    return "file is not valid UTF-8 text";
+  }
+  const pairs = [
+    ["{", "}"],
+    ["(", ")"],
+    ["[", "]"]
+  ];
+  const off = [];
+  for (const [open, close] of pairs) {
+    let net = 0;
+    for (const l of file.lines) net += countInCode(file, l, open) - countInCode(file, l, close);
+    if (net !== 0) off.push(`${open}${close} ${net > 0 ? "+" : ""}${net}`);
+  }
+  return off.length > 0 ? `brackets never balance (${off.join(", ")}) \u2014 the file cannot be read as code` : null;
+}
+function findLocalIdentitySites(tree) {
+  const pkg = tree.packageJson;
+  const selfExempt = !pkg?.unreadable && pkg?.json.name === CLOUD_IDENTITY_PACKAGE;
+  const scan = {
+    selfExempt,
+    violations: [],
+    exempt: [],
+    delegatedCalls: 0,
+    unreadable: []
+  };
+  for (const file of tree.files) {
+    const bad = unreadableReason(file);
+    if (bad) scan.unreadable.push({ anchor: file.rel, reason: bad });
+    const bindings = cloudIdentityBindings(file);
+    const statics = staticConstants(file);
+    const catalog = [...MATCHERS, ...aliasMatchers(file)];
+    scan.delegatedCalls += countDelegatedCalls(file, bindings);
+    for (const line of file.lines) {
+      if (line.comment) continue;
+      let hit = null;
+      for (const mt of catalog) {
+        const g = new RegExp(mt.re.source, `${mt.re.flags.replace("g", "")}g`);
+        for (const m of line.raw.matchAll(g)) {
+          const idx = m.index ?? 0;
+          if (!isCodeAt(file, line.n, idx)) continue;
+          if (mt.accept && !mt.accept(m, { file, line, idx, statics })) continue;
+          const callee = mt.callee !== void 0 ? m[mt.callee] : void 0;
+          if (callee && isDelegated(line.raw, idx, callee, bindings)) continue;
+          hit = mt;
+          break;
+        }
+        if (hit) break;
+      }
+      if (!hit) continue;
+      const decl = enclosingDecl(file, line.n);
+      const site = {
+        file: file.rel,
+        line: line.n,
+        primitive: hit.id,
+        category: hit.category,
+        enclosing: decl
+      };
+      const j = findJustification(file, line, decl);
+      if (j?.valid) scan.exempt.push({ ...site, justification: j.text });
+      else scan.violations.push(site);
+    }
+  }
+  return scan;
+}
+function describeSite(s) {
+  const where = s.enclosing ? ` in ${s.enclosing.name} (declared :${s.enclosing.line})` : "";
+  return `${s.file}:${s.line} [${s.category}/${s.primitive}]${where}`;
+}
+function exemptSuffix(exempt) {
+  if (exempt.length === 0) return "";
+  const rows = exempt.map((e) => `${describeSite(e)} \u2014 "${e.justification}"`);
+  return `; EXEMPT (${exempt.length}): ${rows.join("; ")}`;
+}
+function makeLocalIdentity(opts = {}) {
+  const ceiling = opts.ceiling ?? 0;
+  if (!Number.isInteger(ceiling) || ceiling < 0) {
+    throw new Error(`local-identity ceiling must be a non-negative integer, got ${ceiling}`);
+  }
+  return {
+    id: "DLocalIdentity no-local-identity",
+    run(tree) {
+      const controls = localIdentityPositiveControls();
+      const failed = Object.entries(controls).filter(([, ok]) => !ok);
+      if (failed.length > 0) {
+        throw new Error(
+          `DLocalIdentity positive control FAILED: ${failed.map(([k]) => k).join(", ")} \u2014 matcher broken, verdict untrustworthy`
+        );
+      }
+      const id = this.id;
+      const s = findLocalIdentitySites(tree);
+      if (s.selfExempt) {
+        const n = s.violations.length + s.exempt.length;
+        return {
+          id,
+          anchor: tree.packageJson?.path ?? "-",
+          state: "present",
+          verdict: `EXEMPT: the target is ${CLOUD_IDENTITY_PACKAGE} itself, the one place identity primitives live (${n} primitive site(s) not counted)`
+        };
+      }
+      const listed = s.violations.map(describeSite).join("; ");
+      const delegated = `${s.delegatedCalls} call(s) to ${CLOUD_IDENTITY_PACKAGE}`;
+      let decided;
+      if (s.violations.length > ceiling) {
+        const v = s.violations[0];
+        decided = {
+          id,
+          anchor: `${v.file}:${v.line}`,
+          state: "non-conforming",
+          verdict: `${s.violations.length} local identity primitive(s), ceiling ${ceiling} (positive-control OK): ${listed}${exemptSuffix(s.exempt)} -> delegate to ${CLOUD_IDENTITY_PACKAGE} (validateMasterBearer, verifyClerkSessionToken, isMasterScope, ...) or justify the site with "// ${EXEMPT_MARKER} <reason>"`
+        };
+      } else if (s.violations.length > 0) {
+        const v = s.violations[0];
+        decided = {
+          id,
+          anchor: `${v.file}:${v.line}`,
+          state: "present",
+          verdict: `${s.violations.length} local identity primitive(s) at or under the ceiling ${ceiling} \u2014 a ratchet, not a clean bill: ${listed}${exemptSuffix(s.exempt)}`
+        };
+      } else {
+        decided = {
+          id,
+          anchor: s.exempt[0] ? `${s.exempt[0].file}:${s.exempt[0].line}` : "-",
+          state: "present",
+          verdict: `0 local identity primitives; ${delegated} (positive-control OK)${exemptSuffix(s.exempt)}`
+        };
+      }
+      return settle(id, decided, s.unreadable);
+    }
+  };
+}
+var localIdentity = makeLocalIdentity();
+
 // src/detectors/c7-artifact-verifiable.ts
-import { existsSync, readFileSync } from "fs";
-import { join } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { join as join2 } from "path";
 var PIN = "a74a042b53c71a095ab88b3073bd47728eeda814";
 var DOC_FILES = ["README.md", "README.fr.md"];
 var INSTALL_RE = /\b(?:npm\s+(?:install|i)|npx|pnpm\s+add|yarn\s+add)\s+(@?[\w./-]+)/i;
@@ -46,10 +1031,10 @@ function c7PositiveControls() {
 }
 function readDocText(root) {
   for (const name of DOC_FILES) {
-    const path = join(root, name);
-    if (!existsSync(path)) continue;
+    const path = join2(root, name);
+    if (!existsSync2(path)) continue;
     try {
-      return { text: readFileSync(path, "utf8"), file: name };
+      return { text: readFileSync3(path, "utf8"), file: name };
     } catch {
     }
   }
@@ -230,8 +1215,46 @@ function findRegisteredTools(tree) {
       }
     }
   }
+  for (const file of tree.files) {
+    for (let i = 0; i < file.lines.length; i++) {
+      const line = file.lines[i];
+      if (line.comment) continue;
+      const m = line.raw.match(DESCRIPTOR_KEY_RE);
+      if (!m) continue;
+      const indent = m[1];
+      const hasSchema = objectHasKey(file.lines, i, indent);
+      if (hasSchema) push(m[2], `${file.rel}:${line.n}`);
+    }
+  }
   return out;
 }
+var DESCRIPTOR_KEY_RE = new RegExp(`^(\\s*)name:\\s*["'\`](${NAME_LITERAL})["'\`]\\s*,?\\s*$`);
+var INPUT_SCHEMA_KEY_RE = /^(\s*)inputSchema\s*:/;
+function objectHasKey(lines, at, indent) {
+  for (const step of [1, -1]) {
+    for (let j = at + step; j >= 0 && j < lines.length; j += step) {
+      const l = lines[j];
+      if (l.comment || l.raw.trim() === "") continue;
+      const lead = l.raw.match(/^(\s*)/)[1];
+      if (lead.length < indent.length) break;
+      if (lead === indent && INPUT_SCHEMA_KEY_RE.test(l.raw)) return true;
+    }
+  }
+  return false;
+}
+var TOOL_SURFACE_RE = /\bListToolsRequestSchema\b|["'`]tools\/list["'`]|\binputSchema\s*:|\bToolDefinition\b/;
+function toolSurfaceAnchor(tree) {
+  for (const file of tree.files) {
+    for (const line of file.lines) {
+      if (line.comment) continue;
+      if (TOOL_SURFACE_RE.test(line.raw)) return `${file.rel}:${line.n}`;
+    }
+  }
+  return null;
+}
+function noToolsLocatedReason(tree, what) {
+  return `the tree serves MCP tools (tool-surface marker found) but no registered tool could be located: searched ${tree.files.length} .ts/.tsx file(s) under ${tree.root} (all directories except node_modules/dist/build/tests/fixtures) for registerTool/.tool( calls and declarative { name, inputSchema } descriptors \u2014 ${what}`;
+}
 var REGISTRATION_CALL_RE = /\b(?:s\.tool|\.tool|registerTool)\s*\(/;
 function findUnresolvedToolSites(tree) {
   const bindings = resolveNameBindings(tree);
@@ -1180,7 +2203,7 @@ function c14PositiveControls() {
     rejectsPartial: missing(partial) !== void 0
   };
 }
-var c14CatalogRegistration = {
+var c14CatalogRegistrationInner = {
   id: "C14 catalog-registration",
   rule: "C-14",
   pin: PIN3,
@@ -1235,6 +2258,10 @@ var c14CatalogRegistration = {
     };
   }
 };
+var c14CatalogRegistration = guardUnreadablePackageJson(
+  c14CatalogRegistrationInner,
+  { authoritative: true }
+);
 
 // src/detectors/c15-annotations-untrusted.ts
 var AUTO_APPROVE_ACTION_RE = /\b(?:autoApprove|skipConfirm|autoRun|autoExecute)\w*\s*\(/;
@@ -1419,11 +2446,11 @@ var c16UntrustedOutput = {
 };
 
 // src/detectors/c17-supply-chain.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync } from "fs";
-import { join as join2 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync4, readdirSync as readdirSync2 } from "fs";
+import { join as join3 } from "path";
 var PIN4 = "a74a042b53c71a095ab88b3073bd47728eeda814";
 var LOCKFILES = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb"];
-var WORKFLOW_DIR = join2(".github", "workflows");
+var WORKFLOW_DIR = join3(".github", "workflows");
 var PROVENANCE_RE2 = /--provenance\b|\bprovenance\s*:\s*true\b|id-token:\s*write/i;
 function c17PositiveControls() {
   const sample = "npm publish --provenance --access public";
@@ -1439,7 +2466,7 @@ function c17PositiveControls() {
 }
 function findLockfile(root) {
   for (const name of LOCKFILES) {
-    if (existsSync2(join2(root, name))) return name;
+    if (existsSync3(join3(root, name))) return name;
   }
   return null;
 }
@@ -1451,20 +2478,20 @@ function findProvenanceClaim(tree, root) {
       return { site: `${pkg.path}:publishConfig.provenance`, text: "provenance: true" };
     }
   }
-  const workflowsDir = join2(root, WORKFLOW_DIR);
-  if (!existsSync2(workflowsDir)) return null;
+  const workflowsDir = join3(root, WORKFLOW_DIR);
+  if (!existsSync3(workflowsDir)) return null;
   let entries = [];
   try {
-    entries = readdirSync(workflowsDir);
+    entries = readdirSync2(workflowsDir);
   } catch {
     return null;
   }
   for (const name of entries) {
     if (!/\.ya?ml$/.test(name)) continue;
-    const path = join2(workflowsDir, name);
+    const path = join3(workflowsDir, name);
     let text;
     try {
-      text = readFileSync2(path, "utf8");
+      text = readFileSync4(path, "utf8");
     } catch {
       continue;
     }
@@ -1475,7 +2502,7 @@ function findProvenanceClaim(tree, root) {
   }
   return null;
 }
-var c17SupplyChain = {
+var c17SupplyChainInner = {
   id: "C17 supply-chain",
   rule: "C-17",
   pin: PIN4,
@@ -1512,19 +2539,22 @@ var c17SupplyChain = {
     };
   }
 };
+var c17SupplyChain = guardUnreadablePackageJson(c17SupplyChainInner, {
+  authoritative: true
+});
 
 // src/detectors/c18-structure-manifest.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { join as join3 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
+import { join as join4 } from "path";
 var PIN5 = "a74a042b53c71a095ab88b3073bd47728eeda814";
 function manifestPath(root) {
-  const extPath = join3(root, "extension.json");
-  if (existsSync3(extPath)) return { kind: "extension", path: extPath };
-  return { kind: "server", path: join3(root, "mcp.json") };
+  const extPath = join4(root, "extension.json");
+  if (existsSync4(extPath)) return { kind: "extension", path: extPath };
+  return { kind: "server", path: join4(root, "mcp.json") };
 }
 function readJson(path) {
   try {
-    return JSON.parse(readFileSync3(path, "utf8"));
+    return JSON.parse(readFileSync5(path, "utf8"));
   } catch {
     return null;
   }
@@ -1538,7 +2568,7 @@ function c18PositiveControls() {
     }
   };
 }
-var c18StructureManifest = {
+var c18StructureManifestInner = {
   id: "C18 structure-manifest",
   rule: "C-18",
   pin: PIN5,
@@ -1572,7 +2602,7 @@ var c18StructureManifest = {
     }
     const { kind, path } = manifestPath(tree.root);
     const manifestName = kind === "extension" ? "extension.json" : "mcp.json";
-    if (!existsSync3(path)) {
+    if (!existsSync4(path)) {
       return {
         id: this.id,
         anchor: tree.root,
@@ -1650,85 +2680,10 @@ var c18StructureManifest = {
     };
   }
 };
-
-// src/scan.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4, readdirSync as readdirSync2, statSync } from "fs";
-import { dirname, join as join4, relative } from "path";
-var SKIP_DIRS = /* @__PURE__ */ new Set([
-  "node_modules",
-  "dist",
-  "build",
-  ".git",
-  "tests",
-  "__tests__",
-  "coverage",
-  // Test material, not a target's served surface: deliberately-malformed
-  // servers and foreign copies live here. Scanning them makes the instrument
-  // trip its own fail-closed detectors when pointed at its own tree, and lints
-  // inputs that are meant to be broken. A real target's fixtures are equally
-  // test inputs, not its product surface.
-  "fixtures"
-]);
-function isCommentLine(raw) {
-  const t = raw.trim();
-  if (t === "") return false;
-  return t.startsWith("*") || t.startsWith("//") || t.startsWith("/*") || t.startsWith("*/");
-}
-function walk(dir, out) {
-  let entries;
-  try {
-    entries = readdirSync2(dir);
-  } catch {
-    return;
-  }
-  for (const name of entries) {
-    const full = join4(dir, name);
-    let st;
-    try {
-      st = statSync(full);
-    } catch {
-      continue;
-    }
-    if (st.isDirectory()) {
-      if (SKIP_DIRS.has(name)) continue;
-      walk(full, out);
-    } else if (name.endsWith(".ts") || name.endsWith(".tsx")) {
-      if (name.endsWith(".d.ts") || name.endsWith(".test.ts")) continue;
-      out.push(full);
-    }
-  }
-}
-function loadFile(path, root) {
-  const raw = readFileSync4(path, "utf8");
-  const lines = raw.split("\n").map((r, i) => ({ n: i + 1, raw: r, comment: isCommentLine(r) }));
-  return { path, rel: relative(root, path) || path, lines };
-}
-function findPackageJson(startDir) {
-  let dir = startDir;
-  for (let depth = 0; depth < 8; depth++) {
-    const candidate = join4(dir, "package.json");
-    if (existsSync4(candidate)) {
-      try {
-        return { path: candidate, json: JSON.parse(readFileSync4(candidate, "utf8")) };
-      } catch {
-        return { path: candidate, json: {} };
-      }
-    }
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return null;
-}
-function loadTree(root) {
-  const st = statSync(root);
-  const baseDir = st.isDirectory() ? root : dirname(root);
-  const filePaths = [];
-  if (st.isDirectory()) walk(root, filePaths);
-  else if (root.endsWith(".ts") || root.endsWith(".tsx")) filePaths.push(root);
-  const files = filePaths.map((p) => loadFile(p, baseDir));
-  return { root, files, packageJson: findPackageJson(baseDir) };
-}
+var c18StructureManifest = guardUnreadablePackageJson(
+  c18StructureManifestInner,
+  { authoritative: false }
+);
 
 // src/detectors/c19-served-descriptions.ts
 var PIN6 = "a74a042b53c71a095ab88b3073bd47728eeda814";
@@ -1787,6 +2742,20 @@ var c19ServedDescriptions = {
     }
     const sites = findRegisteredTools(tree);
     if (sites.length === 0) {
+      const surface = toolSurfaceAnchor(tree);
+      if (surface) {
+        const reason = noToolsLocatedReason(
+          tree,
+          "served descriptions cannot be judged without the tool list (C-19)"
+        );
+        return {
+          id: this.id,
+          anchor: surface,
+          state: "could-not-judge",
+          reason,
+          verdict: `could not judge: ${reason}`
+        };
+      }
       return {
         id: this.id,
         anchor: "-",
@@ -2044,7 +3013,7 @@ var c21ProgressiveDisclosure = {
 };
 
 // src/detectors/c22-test-ratio-gate.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
 import { join as join5 } from "path";
 var DOC_FILES2 = ["README.md", "README.fr.md", "CHANGELOG.md"];
 var RATIO_RE = /\b(?:coverage|ratio de tests?|test ratio|couverture)\b[^\n%]{0,40}?(\d{1,3}(?:\.\d+)?\s?%)/i;
@@ -2074,7 +3043,7 @@ function findRatioCitations(root) {
     if (!existsSync5(path)) continue;
     let text;
     try {
-      text = readFileSync5(path, "utf8");
+      text = readFileSync6(path, "utf8");
     } catch {
       continue;
     }
@@ -2382,14 +3351,14 @@ import { spawnSync } from "child_process";
 import {
   existsSync as existsSync6,
   mkdtempSync,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   readdirSync as readdirSync3,
   rmSync,
   statSync as statSync2,
   writeFileSync
 } from "fs";
 import { tmpdir } from "os";
-import { join as join6, relative as relative2 } from "path";
+import { basename as basename2, join as join6, relative as relative2, sep as sep2 } from "path";
 var PIN9 = "20136b50";
 var DEPLOY_CONFIG_FILES = [
   "railway.json",
@@ -2406,8 +3375,7 @@ var LOCKFILES2 = [
   { name: "pnpm-lock.yaml", command: "pnpm", args: ["install", "--frozen-lockfile"] },
   { name: "yarn.lock", command: "yarn", args: ["install", "--frozen-lockfile"] }
 ];
-var SKIP_WALK_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", "coverage"]);
-function walkForConfigs(dir, depth, seen) {
+function walkForConfigs(dir, depth, seen, onSkip) {
   if (depth > 8) return;
   let entries;
   try {
@@ -2424,8 +3392,11 @@ function walkForConfigs(dir, depth, seen) {
       continue;
     }
     if (st.isDirectory()) {
-      if (SKIP_WALK_DIRS.has(name)) continue;
-      walkForConfigs(full, depth + 1, seen);
+      if (SKIP_DIRS.has(name)) {
+        onSkip(full, depth + 1);
+        continue;
+      }
+      walkForConfigs(full, depth + 1, seen, onSkip);
     } else if (DEPLOY_CONFIG_FILES.includes(name)) {
       if (!seen.has(dir)) {
         seen.set(dir, { dir, configFile: name, configPath: full });
@@ -2433,10 +3404,41 @@ function walkForConfigs(dir, depth, seen) {
     }
   }
 }
+function probeForCandidate(dir, depth) {
+  if (depth > 8) return null;
+  let entries;
+  try {
+    entries = readdirSync3(dir).sort();
+  } catch {
+    return null;
+  }
+  const subdirs = [];
+  for (const name of entries) {
+    const full = join6(dir, name);
+    let st;
+    try {
+      st = statSync2(full);
+    } catch {
+      continue;
+    }
+    if (st.isDirectory()) {
+      const info = SKIP_DIR_INFO[name];
+      if (info && !info.authored) continue;
+      subdirs.push(full);
+    } else if (DEPLOY_CONFIG_FILES.includes(name)) {
+      return full;
+    }
+  }
+  for (const sub of subdirs) {
+    const hit = probeForCandidate(sub, depth + 1);
+    if (hit) return hit;
+  }
+  return null;
+}
 function resolveRailwayRootDirectory(configPath) {
   let text;
   try {
-    text = readFileSync6(configPath, "utf8");
+    text = readFileSync7(configPath, "utf8");
   } catch (err) {
     return {
       error: `could not read ${configPath}: ${err instanceof Error ? err.message : String(err)}`
@@ -2454,15 +3456,31 @@ function resolveRailwayRootDirectory(configPath) {
   const rootDirectory = typeof parsed.rootDirectory === "string" && parsed.rootDirectory || build && typeof build.rootDirectory === "string" && build.rootDirectory || null;
   return rootDirectory;
 }
-function c26DeriveScope(root) {
+function c26DeriveScope(root, tree) {
   const seen = /* @__PURE__ */ new Map();
-  walkForConfigs(root, 0, seen);
+  const skipped = [];
+  const onSkip = (skippedDir, depth) => {
+    const entry = tree ? recordSkip(tree, skippedDir, root) : {
+      path: relative2(root, skippedDir).split(sep2).join("/"),
+      reason: SKIP_DIR_INFO[basename2(skippedDir)]?.reason ?? "skipped"
+    };
+    if (SKIP_DIR_INFO[basename2(skippedDir)]?.authored) {
+      const hit = probeForCandidate(skippedDir, depth);
+      if (hit) entry.candidate = relative2(root, hit).split(sep2).join("/");
+    }
+    if (!skipped.some((d) => d.path === entry.path)) skipped.push(entry);
+  };
+  walkForConfigs(root, 0, seen, onSkip);
   const sites = [];
   for (const site of seen.values()) {
     if (site.configFile === "railway.json") {
       const resolved = resolveRailwayRootDirectory(site.configPath);
       if (resolved && typeof resolved === "object" && "error" in resolved) {
-        return { sites: [], unparsable: { path: site.configPath, reason: resolved.error } };
+        return {
+          sites: [],
+          skipped,
+          unparsable: { path: site.configPath, reason: resolved.error }
+        };
       }
       if (typeof resolved === "string" && resolved.trim()) {
         sites.push({ ...site, dir: join6(site.dir, resolved) });
@@ -2471,10 +3489,11 @@ function c26DeriveScope(root) {
     }
     if (site.configFile === "vercel.json") {
       try {
-        JSON.parse(readFileSync6(site.configPath, "utf8"));
+        JSON.parse(readFileSync7(site.configPath, "utf8"));
       } catch (err) {
         return {
           sites: [],
+          skipped,
           unparsable: {
             path: site.configPath,
             reason: `could not parse ${site.configPath} as JSON: ${err instanceof Error ? err.message : String(err)}`
@@ -2484,7 +3503,7 @@ function c26DeriveScope(root) {
     }
     sites.push(site);
   }
-  return { sites };
+  return { sites, skipped };
 }
 function findLockfile2(dir) {
   for (const l of LOCKFILES2) {
@@ -2539,8 +3558,8 @@ function nameDrift(lockfileName, siteDir, isolatedDir, stderr) {
   }
   if (lockfileName === "bun.lock" || lockfileName === "bun.lockb") {
     try {
-      const manifestText = readFileSync6(join6(isolatedDir, "package.json"), "utf8");
-      const lockText = readFileSync6(join6(isolatedDir, lockfileName), "utf8");
+      const manifestText = readFileSync7(join6(isolatedDir, "package.json"), "utf8");
+      const lockText = readFileSync7(join6(isolatedDir, lockfileName), "utf8");
       const drifted = nameBunDrift(manifestText, lockText);
       if (drifted.length > 0) return drifted.join(", ");
     } catch {
@@ -2571,8 +3590,8 @@ function gateSite(site) {
   }
   const isolated = mkdtempSync(join6(tmpdir(), "mcp-doctor-c26-"));
   try {
-    const manifestText = readFileSync6(pkgPath, "utf8");
-    const lockText = readFileSync6(join6(site.dir, lock.name), "utf8");
+    const manifestText = readFileSync7(pkgPath, "utf8");
+    const lockText = readFileSync7(join6(site.dir, lock.name), "utf8");
     writeFileSync(join6(isolated, "package.json"), manifestText);
     writeFileSync(join6(isolated, lock.name), lockText);
     let proc;
@@ -2641,7 +3660,18 @@ var c26SubpackageLockfile = {
   rule: "C-26",
   pin: PIN9,
   run(tree) {
-    const scope = c26DeriveScope(tree.root);
+    const scope = c26DeriveScope(tree.root, tree);
+    const hidden = scope.skipped.filter((d) => d.candidate !== void 0);
+    const unjudgedHidden = (prefix) => {
+      const reason = `${prefix}deployment configuration found only under skipped director${hidden.length === 1 ? "y" : "ies"}: ${hidden.map((d) => `${d.path} (${d.reason}) -> ${d.candidate}`).join("; ")} \u2014 C-26 does not descend into skipped directories, so these site(s) were not judged`;
+      return {
+        id: this.id,
+        anchor: join6(tree.root, hidden[0].candidate),
+        state: "could-not-judge",
+        reason,
+        verdict: `could not judge: ${reason}`
+      };
+    };
     if (scope.unparsable) {
       const reason = `deployment configuration ${scope.unparsable.path} could not be parsed: ${scope.unparsable.reason} \u2014 scope unestablished, C-26 cannot derive its targets`;
       return {
@@ -2653,6 +3683,7 @@ var c26SubpackageLockfile = {
       };
     }
     if (scope.sites.length === 0) {
+      if (hidden.length > 0) return unjudgedHidden("");
       return {
         id: this.id,
         anchor: tree.root,
@@ -2664,6 +3695,7 @@ var c26SubpackageLockfile = {
     const inventory = renderCoverage(scope.sites, verdicts);
     const analysed = verdicts.filter((v) => v.status === "analysed");
     if (analysed.length === 0) {
+      if (hidden.length > 0) return unjudgedHidden("no analysable site; ");
       return {
         id: this.id,
         anchor: tree.root,
@@ -2680,6 +3712,11 @@ var c26SubpackageLockfile = {
         verdict: reds.some((r) => r.detail?.includes("no lockfile")) ? `${reds[0].detail} (C-26). Coverage: ${inventory}` : `${reds.map((r) => r.detail).join(" ; ")} (C-26). Coverage: ${inventory}`
       };
     }
+    if (hidden.length > 0) {
+      return unjudgedHidden(
+        `${analysed.length} analysed site(s) are consistent, but coverage is partial; `
+      );
+    }
     return {
       id: this.id,
       anchor: analysed[0].site.dir,
@@ -2749,6 +3786,21 @@ var d3 = {
           verdict: `could not judge: ${reason}`
         };
       }
+      const surface = toolSurfaceAnchor(tree);
+      if (surface) {
+        const located = findRegisteredTools(tree);
+        const reason = located.length > 0 ? `${located.length} tool(s) located but no hand-rolled list/read result builder found \u2014 result shaping and any resultType are delegated to wrappers/the transport and not statically readable in this tree` : noToolsLocatedReason(
+          tree,
+          "result shaping and resultType are not statically readable without the located tools"
+        );
+        return {
+          id: this.id,
+          anchor: surface,
+          state: "could-not-judge",
+          reason,
+          verdict: `could not judge: ${reason}`
+        };
+      }
       return {
         id: this.id,
         anchor: "-",
@@ -2793,6 +3845,21 @@ var d4 = {
           verdict: `could not judge: ${reason}`
         };
       }
+      const surface = toolSurfaceAnchor(tree);
+      if (surface) {
+        const located = findRegisteredTools(tree);
+        const reason = located.length > 0 ? `${located.length} tool(s) located but no hand-rolled list/read result builder found \u2014 result shaping and any ttlMs/cacheScope are delegated to wrappers/the transport and not statically readable in this tree` : noToolsLocatedReason(
+          tree,
+          "result shaping and any ttlMs/cacheScope are not statically readable without the located tools"
+        );
+        return {
+          id: this.id,
+          anchor: surface,
+          state: "could-not-judge",
+          reason,
+          verdict: `could not judge: ${reason}`
+        };
+      }
       return {
         id: this.id,
         anchor: "-",
@@ -2922,7 +3989,7 @@ function depListed(pkgJson) {
   }
   return false;
 }
-var d7 = {
+var d7Inner = {
   id: "D7 protocol-kit",
   run(tree) {
     const listed = depListed(tree.packageJson?.json);
@@ -2961,9 +4028,10 @@ var d7 = {
     };
   }
 };
+var d7 = guardUnreadablePackageJson(d7Inner, { authoritative: true });
 
 // src/detectors/d8.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7, statSync as statSync3 } from "fs";
+import { existsSync as existsSync7, statSync as statSync3 } from "fs";
 import { dirname as dirname2, join as join7, relative as relative3 } from "path";
 var POSITIVE_CONTROL2 = 'server.registerTool("list_items", { ... }, handler);';
 function d8PositiveControl() {
@@ -3016,6 +4084,20 @@ var d8 = {
           verdict: `could not judge: ${reason}`
         };
       }
+      const surface = toolSurfaceAnchor(tree);
+      if (surface) {
+        const reason = noToolsLocatedReason(
+          tree,
+          "eval coverage cannot be judged without the tool list"
+        );
+        return {
+          id: this.id,
+          anchor: surface,
+          state: "could-not-judge",
+          reason,
+          verdict: `could not judge: ${reason}`
+        };
+      }
       return {
         id: this.id,
         anchor: "-",
@@ -3034,19 +4116,15 @@ var d8 = {
     }
     const baseDir = resolveBaseDir(tree);
     const displayPath = relative3(baseDir, evalsPath) || evalsPath;
-    let cases;
-    try {
-      const raw = readFileSync7(evalsPath, "utf8");
-      const parsed = JSON.parse(raw);
-      if (!Array.isArray(parsed.cases)) {
-        throw new Error("`cases` is not an array");
-      }
-      cases = parsed.cases;
-    } catch (err) {
-      throw new Error(
-        `D8 could not parse ${displayPath}: ${err instanceof Error ? err.message : String(err)} \u2014 coverage verdict untrustworthy, fix the eval file`
+    const parsed = readJsonObject(evalsPath);
+    if (parsed === null || !Array.isArray(parsed.cases)) {
+      return couldNotJudge(
+        this.id,
+        displayPath,
+        `could not parse ${displayPath}: ${parsed === null ? "not readable as a JSON object" : "`cases` is not an array"} \u2014 coverage verdict untrustworthy, fix the eval file`
       );
     }
+    const cases = parsed.cases;
     const counts = /* @__PURE__ */ new Map();
     for (const t of tools) counts.set(t.name, 0);
     for (const c of cases) {
@@ -3131,7 +4209,7 @@ function d9PositiveControl() {
     matched: SEMVER_RE.test(POSITIVE_CONTROL3)
   };
 }
-var d9 = {
+var d9Inner = {
   id: "D9 semver+changelog",
   rule: "C-3",
   pin: "a74a042b53c71a095ab88b3073bd47728eeda814",
@@ -3154,7 +4232,11 @@ var d9 = {
     }
     const { path: pkgPath, json: pkgJson } = tree.packageJson;
     if (!pkgJson || Object.keys(pkgJson).length === 0) {
-      throw new Error(`D9 could not parse ${pkgPath} as JSON \u2014 cannot verify SemVer/CHANGELOG`);
+      return couldNotJudge(
+        this.id,
+        pkgPath.split("/").slice(-2).join("/"),
+        `could not parse ${pkgPath} as JSON \u2014 cannot verify SemVer/CHANGELOG`
+      );
     }
     const version = pkgJson.version;
     if (typeof version !== "string") {
@@ -3193,6 +4275,7 @@ var d9 = {
     };
   }
 };
+var d9 = guardUnreadablePackageJson(d9Inner, { authoritative: false });
 
 // src/detectors/d10.ts
 import { existsSync as existsSync9 } from "fs";
@@ -3244,7 +4327,7 @@ function scanSourceDescriptionFr(tree) {
   }
   return { present: false, anchor: null };
 }
-var d10 = {
+var d10Inner = {
   id: "D10 bilingual",
   rule: "C-1",
   pin: "a74a042b53c71a095ab88b3073bd47728eeda814",
@@ -3315,6 +4398,7 @@ var d10 = {
     };
   }
 };
+var d10 = guardUnreadablePackageJson(d10Inner, { authoritative: true });
 
 // src/detectors/d11.ts
 var ZOD_ANY_RE = /\bz\s*\.\s*any\s*\(\s*\)/;
@@ -3386,6 +4470,27 @@ var d11 = {
       }
     }
     if (toolCount === 0) {
+      const located = findRegisteredTools(tree);
+      if (located.length > 0) {
+        toolCount = located.length;
+        firstToolAnchor = located[0].anchor;
+      }
+    }
+    if (toolCount === 0) {
+      const surface = toolSurfaceAnchor(tree);
+      if (surface) {
+        const reason = noToolsLocatedReason(
+          tree,
+          "the outputSchema check cannot be judged without the tool list"
+        );
+        return {
+          id: this.id,
+          anchor: surface,
+          state: "could-not-judge",
+          reason,
+          verdict: `could not judge: ${reason}`
+        };
+      }
       return {
         id: this.id,
         anchor: "-",
@@ -3465,7 +4570,7 @@ function findHttpSite(tree) {
   }
   return null;
 }
-var d12 = {
+var d12Inner = {
   id: "D12 stdio-transport",
   run(tree) {
     const stdioControl = d12StdioPositiveControl();
@@ -3516,6 +4621,7 @@ var d12 = {
     };
   }
 };
+var d12 = guardUnreadablePackageJson(d12Inner, { authoritative: false });
 
 // src/detectors/d15.ts
 var HANDLE_ASSIGN_RE = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*[^;]*\.(?:registerTool|tool)\s*\(/;
@@ -4129,71 +5235,63 @@ var dDebugOptIn = {
         );
       }
     }
-    const computed = findAll(tree, COMPUTED_LEVEL_RE);
-    if (computed.length > 0) {
-      const sites = computed.map((h) => `${h.file.rel}:${h.line}`).join(", ");
-      throw new Error(
-        `DDebugOptIn cannot read the level of ${computed.length} computed-level log call(s): ${sites} \u2014 a bracket-indexed level hides whether it is debug (Server Rule 6). Fail-closed, not a silent present.`
-      );
-    }
-    const debugCalls = findAll(tree, DEBUG_CALL_RE);
-    if (debugCalls.length === 0) {
-      return {
-        id: this.id,
-        anchor: tree.files.length > 0 ? `${tree.files[0].rel}:1` : tree.root,
-        state: "absent",
-        verdict: "no debug output emitted (n/a for Server Rule 6 debug-half)"
-      };
-    }
-    const callAnchor = `${debugCalls[0].file.rel}:${debugCalls.map((h) => h.line).join(",")}`;
-    const debugFileRels = new Set(debugCalls.map((h) => h.file.rel));
-    const localGate = firstMatchInFiles2(tree, GATE_RE, debugFileRels);
-    if (localGate) {
-      return {
-        id: this.id,
-        anchor: callAnchor,
-        state: "present",
-        verdict: `debug output at ${callAnchor} gated by an env/config switch in the same file at ${localGate.file.rel}:${localGate.line} (Server Rule 6 debug-half)`
-      };
+    const unreadable = [];
+    for (const h of findAll(tree, COMPUTED_LEVEL_RE)) {
+      const anchor = `${h.file.rel}:${h.line}`;
+      unreadable.push({
+        anchor,
+        reason: `cannot read the level of the computed-level log call at ${anchor} \u2014 a bracket-indexed level hides whether it is debug (Server Rule 6)`
+      });
     }
-    const remoteGate = firstMatchInFiles2(tree, GATE_RE, new Set(tree.files.map((f) => f.rel)));
-    if (remoteGate) {
-      const reason = `debug output at ${callAnchor}; an env/config gate exists at ${remoteGate.file.rel}:${remoteGate.line} but in a DIFFERENT file from every debug call \u2014 whether the debug path is opt-in is unreadable statically (Server Rule 6 debug-half)`;
+    const decided = (() => {
+      const debugCalls = findAll(tree, DEBUG_CALL_RE);
+      if (debugCalls.length === 0) {
+        return {
+          id: this.id,
+          anchor: tree.files.length > 0 ? `${tree.files[0].rel}:1` : tree.root,
+          state: "absent",
+          verdict: "no debug output emitted (n/a for Server Rule 6 debug-half)"
+        };
+      }
+      const callAnchor = `${debugCalls[0].file.rel}:${debugCalls.map((h) => h.line).join(",")}`;
+      const debugFileRels = new Set(debugCalls.map((h) => h.file.rel));
+      const localGate = firstMatchInFiles2(tree, GATE_RE, debugFileRels);
+      if (localGate) {
+        return {
+          id: this.id,
+          anchor: callAnchor,
+          state: "present",
+          verdict: `debug output at ${callAnchor} gated by an env/config switch in the same file at ${localGate.file.rel}:${localGate.line} (Server Rule 6 debug-half)`
+        };
+      }
+      const remoteGate = firstMatchInFiles2(tree, GATE_RE, new Set(tree.files.map((f) => f.rel)));
+      if (remoteGate) {
+        const reason = `debug output at ${callAnchor}; an env/config gate exists at ${remoteGate.file.rel}:${remoteGate.line} but in a DIFFERENT file from every debug call \u2014 whether the debug path is opt-in is unreadable statically (Server Rule 6 debug-half)`;
+        return {
+          id: this.id,
+          anchor: callAnchor,
+          state: "could-not-judge",
+          reason,
+          verdict: `could not judge: ${reason}`
+        };
+      }
       return {
         id: this.id,
         anchor: callAnchor,
-        state: "could-not-judge",
-        reason,
-        verdict: `could not judge: ${reason}`
+        state: "non-conforming",
+        verdict: `debug output at ${callAnchor} with NO env/config gate -> debug is on by default; gate it behind process.env.*DEBUG* or a config switch (Server Rule 6 debug-half)`
       };
-    }
-    return {
-      id: this.id,
-      anchor: callAnchor,
-      state: "non-conforming",
-      verdict: `debug output at ${callAnchor} with NO env/config gate -> debug is on by default; gate it behind process.env.*DEBUG* or a config switch (Server Rule 6 debug-half)`
-    };
+    })();
+    return settle(this.id, decided, unreadable);
   }
 };
 
-// src/detectors/dExt1.ts
-import { readFileSync as readFileSync10, readdirSync as readdirSync4, statSync as statSync5 } from "fs";
+// src/detectors/extManifests.ts
+import { readdirSync as readdirSync4, statSync as statSync5 } from "fs";
 import { join as join12 } from "path";
-var IDENTIFIER_RE2 = /^[a-z0-9]+(\.[a-z0-9-]+)+\/[a-z0-9-]+$/;
-var IDENTIFIER_POSITIVE = "com.elpi/middleware-redact-pii";
-var IDENTIFIER_NEGATIVE = "Com.Elpi/Bad_Id";
-function dExt1PositiveControls() {
-  return {
-    identifier: {
-      pattern: IDENTIFIER_RE2.source,
-      positive: IDENTIFIER_RE2.test(IDENTIFIER_POSITIVE),
-      negative: IDENTIFIER_RE2.test(IDENTIFIER_NEGATIVE)
-    }
-  };
-}
-var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function findExtensionManifests(root) {
+function findExtensionManifests(tree) {
   const out = [];
+  const root = tree.root;
   let base;
   try {
     base = statSync5(root).isDirectory() ? root : join12(root, "..");
@@ -4216,7 +5314,10 @@ function findExtensionManifests(root) {
         continue;
       }
       if (st.isDirectory()) {
-        if (SKIP_DIRS2.has(name)) continue;
+        if (SKIP_DIRS.has(name)) {
+          recordSkip(tree, full, base);
+          continue;
+        }
         walk2(full);
       } else if (name === "extension.json") {
         out.push(full);
@@ -4226,20 +5327,34 @@ function findExtensionManifests(root) {
   walk2(base);
   return out;
 }
+
+// src/detectors/dExt1.ts
+var IDENTIFIER_RE2 = /^[a-z0-9]+(\.[a-z0-9-]+)+\/[a-z0-9-]+$/;
+var IDENTIFIER_POSITIVE = "com.elpi/middleware-redact-pii";
+var IDENTIFIER_NEGATIVE = "Com.Elpi/Bad_Id";
+function dExt1PositiveControls() {
+  return {
+    identifier: {
+      pattern: IDENTIFIER_RE2.source,
+      positive: IDENTIFIER_RE2.test(IDENTIFIER_POSITIVE),
+      negative: IDENTIFIER_RE2.test(IDENTIFIER_NEGATIVE)
+    }
+  };
+}
 var TS_IDENT_LITERAL_RE = /\bidentifier:\s*["'`]([^"'`]*)["'`]/;
-var TS_IDENT_KEY_RE = /\bidentifier:\s*[^\s"'`]/;
+var TS_IDENT_KEY_RE = /\bidentifier:\s*[^\s"'`{]/;
 function findTsIdentifiers(tree) {
   const sites = [];
   const unresolved = [];
   for (const file of tree.files) {
     for (const line of file.lines) {
       if (line.comment) continue;
-      const lit = line.raw.match(TS_IDENT_LITERAL_RE);
+      const lit = matchInCode(file, line, TS_IDENT_LITERAL_RE);
       if (lit) {
         sites.push({ value: lit[1], anchor: `${file.rel}:${line.n}` });
         continue;
       }
-      if (TS_IDENT_KEY_RE.test(line.raw)) {
+      if (testInCode(file, line, TS_IDENT_KEY_RE)) {
         unresolved.push(`${file.rel}:${line.n}`);
       }
     }
@@ -4255,69 +5370,75 @@ var dExt1 = {
         `DExt1 identifier control FAILED: /${controls.identifier.pattern}/ accept(\`${IDENTIFIER_POSITIVE}\`)=${controls.identifier.positive} reject(\`${IDENTIFIER_NEGATIVE}\`)=${!controls.identifier.negative} \u2014 matcher broken, verdict untrustworthy`
       );
     }
-    const manifests = findExtensionManifests(tree.root);
-    for (const manifestPath2 of manifests) {
-      const shortPath = manifestPath2.split("/").slice(-2).join("/");
-      let parsed;
-      try {
-        parsed = JSON.parse(readFileSync10(manifestPath2, "utf8"));
-      } catch {
-        throw new Error(
-          `DExt1 could not parse ${shortPath} as JSON \u2014 a present manifest with an unreadable identifier cannot pass (Extension Rule 1). Fail-closed, not a silent present.`
-        );
+    const unreadable = [];
+    const decided = (() => {
+      const manifests = findExtensionManifests(tree);
+      for (const manifestPath2 of manifests) {
+        const shortPath = manifestPath2.split("/").slice(-2).join("/");
+        const parsed = readJsonObject(manifestPath2);
+        if (parsed === null) {
+          unreadable.push({
+            anchor: shortPath,
+            reason: `could not parse ${shortPath} as JSON \u2014 a present manifest with an unreadable identifier cannot pass (Extension Rule 1)`
+          });
+          continue;
+        }
+        const idValue = parsed.identifier;
+        if (typeof idValue !== "string") {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest ${shortPath} has no string "identifier" field (got ${typeof idValue}) -> declare a reverse-DNS identifier <reverse.dns>/<slug> e.g. com.elpi/redact-pii (Extension Rule 1)`
+          };
+        }
+        if (!IDENTIFIER_RE2.test(idValue)) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest identifier "${idValue}" is not reverse-DNS (positive-control OK) -> use <reverse.dns>/<slug> e.g. com.elpi/redact-pii (Extension Rule 1)`
+          };
+        }
       }
-      const idValue = parsed.identifier;
-      if (typeof idValue !== "string") {
-        throw new Error(
-          `DExt1 found a present manifest ${shortPath} with no string "identifier" field (got ${typeof idValue}) \u2014 Extension Rule 1 requires a reverse-DNS identifier. Fail-closed, not a silent present.`
-        );
+      const { sites, unresolved } = findTsIdentifiers(tree);
+      for (const anchor of unresolved) {
+        unreadable.push({
+          anchor,
+          reason: `cannot read the identifier at ${anchor} \u2014 value is computed/imported/template, reverse-DNS unverifiable (Extension Rule 1)`
+        });
       }
-      if (!IDENTIFIER_RE2.test(idValue)) {
-        return {
-          id: this.id,
-          anchor: shortPath,
-          state: "non-conforming",
-          verdict: `manifest identifier "${idValue}" is not reverse-DNS (positive-control OK) -> use <reverse.dns>/<slug> e.g. com.elpi/redact-pii (Extension Rule 1)`
-        };
+      for (const site of sites) {
+        if (!IDENTIFIER_RE2.test(site.value)) {
+          return {
+            id: this.id,
+            anchor: site.anchor,
+            state: "non-conforming",
+            verdict: `identifier "${site.value}" is not reverse-DNS (positive-control OK) -> use <reverse.dns>/<slug> e.g. com.elpi/redact-pii (Extension Rule 1)`
+          };
+        }
       }
-    }
-    const { sites, unresolved } = findTsIdentifiers(tree);
-    if (unresolved.length > 0) {
-      throw new Error(
-        `DExt1 cannot read the identifier at ${unresolved.length} TS site(s): ${unresolved.join(", ")} \u2014 value is computed/imported/template, reverse-DNS unverifiable (Extension Rule 1). Fail-closed, not a silent present.`
-      );
-    }
-    for (const site of sites) {
-      if (!IDENTIFIER_RE2.test(site.value)) {
+      const total = manifests.length + sites.length;
+      if (total === 0) {
         return {
           id: this.id,
-          anchor: site.anchor,
-          state: "non-conforming",
-          verdict: `identifier "${site.value}" is not reverse-DNS (positive-control OK) -> use <reverse.dns>/<slug> e.g. com.elpi/redact-pii (Extension Rule 1)`
+          anchor: tree.root.split("/").pop() ?? tree.root,
+          state: "absent",
+          verdict: "no extension identifier found (no extension.json manifest, no TS `identifier:` literal) -> declare a reverse-DNS identifier (Extension Rule 1)"
         };
       }
-    }
-    const total = manifests.length + sites.length;
-    if (total === 0) {
       return {
         id: this.id,
-        anchor: tree.root.split("/").pop() ?? tree.root,
-        state: "absent",
-        verdict: "no extension identifier found (no extension.json manifest, no TS `identifier:` literal) -> declare a reverse-DNS identifier (Extension Rule 1)"
+        anchor: sites.length > 0 ? sites[0].anchor : manifests[0].split("/").slice(-2).join("/"),
+        state: "present",
+        verdict: `${total} identifier(s) reverse-DNS conforming (manifest=${manifests.length}, ts=${sites.length}, positive-control OK)`
       };
-    }
-    return {
-      id: this.id,
-      anchor: sites.length > 0 ? sites[0].anchor : manifests[0].split("/").slice(-2).join("/"),
-      state: "present",
-      verdict: `${total} identifier(s) reverse-DNS conforming (manifest=${manifests.length}, ts=${sites.length}, positive-control OK)`
-    };
+    })();
+    return settle(this.id, decided, unreadable);
   }
 };
 
 // src/detectors/dExt2.ts
-import { readFileSync as readFileSync11, readdirSync as readdirSync5, statSync as statSync6 } from "fs";
-import { join as join13 } from "path";
 var TS_GD_TRUE_RE = /\bgracefulDegradation:\s*true\b/;
 var TS_GD_FALSE_RE = /\bgracefulDegradation:\s*false\b/;
 var TS_GD_KEY_RE = /\bgracefulDegradation:\s*([^\s,}]+)/;
@@ -4332,41 +5453,6 @@ function dExt2PositiveControls() {
     }
   };
 }
-var SKIP_DIRS3 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function findExtensionManifests2(root) {
-  const out = [];
-  let base;
-  try {
-    base = statSync6(root).isDirectory() ? root : join13(root, "..");
-  } catch {
-    return out;
-  }
-  const walk2 = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync5(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      const full = join13(dir, name);
-      let st;
-      try {
-        st = statSync6(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        if (SKIP_DIRS3.has(name)) continue;
-        walk2(full);
-      } else if (name === "extension.json") {
-        out.push(full);
-      }
-    }
-  };
-  walk2(base);
-  return out;
-}
 function findTsFactorySites(tree) {
   const sites = [];
   for (const file of tree.files) {
@@ -4374,7 +5460,7 @@ function findTsFactorySites(tree) {
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
       if (line.comment) continue;
-      if (!DEFINE_EXTENSION_OPEN_RE.test(line.raw)) continue;
+      if (!testInCode(file, line, DEFINE_EXTENSION_OPEN_RE)) continue;
       const anchor = `${file.rel}:${line.n}`;
       let depth = 0;
       let started = false;
@@ -4384,20 +5470,20 @@ function findTsFactorySites(tree) {
         const bl = lines[j];
         if (!bl.comment) {
           if (state === "absent") {
-            if (TS_GD_TRUE_RE.test(bl.raw)) {
+            if (testInCode(file, bl, TS_GD_TRUE_RE)) {
               state = "true";
-            } else if (TS_GD_FALSE_RE.test(bl.raw)) {
+            } else if (testInCode(file, bl, TS_GD_FALSE_RE)) {
               state = "false";
             } else {
-              const key = bl.raw.match(TS_GD_KEY_RE);
+              const key = matchInCode(file, bl, TS_GD_KEY_RE);
               if (key) {
                 state = "unresolved";
                 value = key[1];
               }
             }
           }
-          depth += (bl.raw.match(/\{/g) ?? []).length;
-          depth -= (bl.raw.match(/\}/g) ?? []).length;
+          depth += countInCode(file, bl, "{");
+          depth -= countInCode(file, bl, "}");
           if (depth > 0) started = true;
         }
         if (started && depth <= 0) break;
@@ -4416,133 +5502,105 @@ var dExt2 = {
         `DExt2 graceful-degradation control FAILED: accept(\`${GD_POSITIVE}\`)=${controls.gracefulDegradation.acceptsTrue} reject(\`${GD_NEGATIVE}\`)=${controls.gracefulDegradation.rejectsFalse} \u2014 matcher broken, verdict untrustworthy`
       );
     }
-    const manifests = findExtensionManifests2(tree.root);
-    for (const manifestPath2 of manifests) {
-      const shortPath = manifestPath2.split("/").slice(-2).join("/");
-      let parsed;
-      try {
-        parsed = JSON.parse(readFileSync11(manifestPath2, "utf8"));
-      } catch {
-        throw new Error(
-          `DExt2 could not parse ${shortPath} as JSON \u2014 a present manifest silent on graceful degradation cannot pass (Extension Rule 2). Fail-closed, not a silent present.`
-        );
-      }
-      if (!("graceful_degradation" in parsed)) {
-        throw new Error(
-          `DExt2 found a present manifest ${shortPath} with no "graceful_degradation" field \u2014 Extension Rule 2 requires it to be true. Fail-closed, not a silent present.`
-        );
-      }
-      const gdValue = parsed.graceful_degradation;
-      if (gdValue !== true) {
-        return {
-          id: this.id,
-          anchor: shortPath,
-          state: "non-conforming",
-          verdict: `manifest "graceful_degradation" is ${JSON.stringify(gdValue)}, not true (positive-control OK) -> set "graceful_degradation": true, an extension never breaks the host server (Extension Rule 2)`
-        };
-      }
-    }
-    const sites = findTsFactorySites(tree);
-    for (const site of sites) {
-      if (site.state === "unresolved") {
-        throw new Error(
-          `DExt2 cannot read the gracefulDegradation value at ${site.anchor} (got \`${site.value}\`) \u2014 computed/imported/template, graceful degradation unverifiable (Extension Rule 2). Fail-closed, not a silent present.`
-        );
+    const unreadable = [];
+    const decided = (() => {
+      const manifests = findExtensionManifests(tree);
+      for (const manifestPath2 of manifests) {
+        const shortPath = manifestPath2.split("/").slice(-2).join("/");
+        const parsed = readJsonObject(manifestPath2);
+        if (parsed === null) {
+          unreadable.push({
+            anchor: shortPath,
+            reason: `could not parse ${shortPath} as JSON \u2014 a present manifest silent on graceful degradation cannot pass (Extension Rule 2)`
+          });
+          continue;
+        }
+        if (!("graceful_degradation" in parsed)) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest ${shortPath} has no "graceful_degradation" field -> set "graceful_degradation": true, an extension never breaks the host server (Extension Rule 2)`
+          };
+        }
+        const gdValue = parsed.graceful_degradation;
+        if (gdValue !== true) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest "graceful_degradation" is ${JSON.stringify(gdValue)}, not true (positive-control OK) -> set "graceful_degradation": true, an extension never breaks the host server (Extension Rule 2)`
+          };
+        }
       }
-      if (site.state === "false") {
-        return {
-          id: this.id,
-          anchor: site.anchor,
-          state: "non-conforming",
-          verdict: "gracefulDegradation is false, not true (positive-control OK) -> an extension never breaks the host server (Extension Rule 2)"
-        };
+      const sites = findTsFactorySites(tree);
+      for (const site of sites) {
+        if (site.state === "unresolved") {
+          unreadable.push({
+            anchor: site.anchor,
+            reason: `cannot read the gracefulDegradation value at ${site.anchor} (got \`${site.value}\`) \u2014 computed/imported/template, graceful degradation unverifiable (Extension Rule 2)`
+          });
+          continue;
+        }
+        if (site.state === "false") {
+          return {
+            id: this.id,
+            anchor: site.anchor,
+            state: "non-conforming",
+            verdict: "gracefulDegradation is false, not true (positive-control OK) -> an extension never breaks the host server (Extension Rule 2)"
+          };
+        }
+        if (site.state === "absent") {
+          return {
+            id: this.id,
+            anchor: site.anchor,
+            state: "non-conforming",
+            verdict: "defineExtension block has no gracefulDegradation flag (positive-control OK) -> declare gracefulDegradation: true (Extension Rule 2)"
+          };
+        }
       }
-      if (site.state === "absent") {
+      const total = manifests.length + sites.length;
+      if (total === 0) {
         return {
           id: this.id,
-          anchor: site.anchor,
-          state: "non-conforming",
-          verdict: "defineExtension block has no gracefulDegradation flag (positive-control OK) -> declare gracefulDegradation: true (Extension Rule 2)"
+          anchor: tree.root.split("/").pop() ?? tree.root,
+          state: "absent",
+          verdict: "no extension graceful-degradation flag found (no extension.json manifest, no defineExtension factory) -> declare graceful_degradation: true (Extension Rule 2)"
         };
       }
-    }
-    const total = manifests.length + sites.length;
-    if (total === 0) {
       return {
         id: this.id,
-        anchor: tree.root.split("/").pop() ?? tree.root,
-        state: "absent",
-        verdict: "no extension graceful-degradation flag found (no extension.json manifest, no defineExtension factory) -> declare graceful_degradation: true (Extension Rule 2)"
-      };
-    }
-    return {
-      id: this.id,
-      anchor: sites.length > 0 ? sites[0].anchor : manifests[0].split("/").slice(-2).join("/"),
-      state: "present",
-      verdict: `${total} graceful-degradation flag(s) true (manifest=${manifests.length}, ts=${sites.length}, positive-control OK)`
-    };
-  }
-};
-
-// src/detectors/dExt3.ts
-import { readFileSync as readFileSync12, readdirSync as readdirSync6, statSync as statSync7 } from "fs";
-import { join as join14 } from "path";
-var TYPE_MATCHERS = [
-  { type: "middleware", re: /\bmiddleware\b/ },
-  { type: "tool-extension", re: /\btool-ext(?:ension)?\b/ },
-  { type: "transport", re: /\btransport\b/ }
-];
-function typesIn(value) {
-  const found = [];
-  for (const { type, re } of TYPE_MATCHERS) {
-    if (re.test(value)) found.push(type);
-  }
-  return found;
-}
-var TYPE_MIXED = "middleware|transport";
-var TYPE_SINGLE = "middleware";
-function dExt3PositiveControls() {
-  return {
-    type: {
-      detectsMix: typesIn(TYPE_MIXED).length === 2,
-      detectsSingle: typesIn(TYPE_SINGLE).length === 1
-    }
-  };
-}
-var SKIP_DIRS4 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function findExtensionManifests3(root) {
-  const out = [];
-  let base;
-  try {
-    base = statSync7(root).isDirectory() ? root : join14(root, "..");
-  } catch {
-    return out;
-  }
-  const walk2 = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync6(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      const full = join14(dir, name);
-      let st;
-      try {
-        st = statSync7(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        if (SKIP_DIRS4.has(name)) continue;
-        walk2(full);
-      } else if (name === "extension.json") {
-        out.push(full);
-      }
+        anchor: sites.length > 0 ? sites[0].anchor : manifests[0].split("/").slice(-2).join("/"),
+        state: "present",
+        verdict: `${total} graceful-degradation flag(s) true (manifest=${manifests.length}, ts=${sites.length}, positive-control OK)`
+      };
+    })();
+    return settle(this.id, decided, unreadable);
+  }
+};
+
+// src/detectors/dExt3.ts
+var TYPE_MATCHERS = [
+  { type: "middleware", re: /\bmiddleware\b/ },
+  { type: "tool-extension", re: /\btool-ext(?:ension)?\b/ },
+  { type: "transport", re: /\btransport\b/ }
+];
+function typesIn(value) {
+  const found = [];
+  for (const { type, re } of TYPE_MATCHERS) {
+    if (re.test(value)) found.push(type);
+  }
+  return found;
+}
+var TYPE_MIXED = "middleware|transport";
+var TYPE_SINGLE = "middleware";
+function dExt3PositiveControls() {
+  return {
+    type: {
+      detectsMix: typesIn(TYPE_MIXED).length === 2,
+      detectsSingle: typesIn(TYPE_SINGLE).length === 1
     }
   };
-  walk2(base);
-  return out;
 }
 var DEFINE_EXTENSION_OPEN_RE2 = /\bdefineExtension\s*\(\s*\{/;
 var TS_TYPE_LITERAL_RE = /\btype:\s*["'`]([^"'`]*)["'`]/;
@@ -4554,7 +5612,7 @@ function findTsTypeSites(tree) {
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
       if (line.comment) continue;
-      if (!DEFINE_EXTENSION_OPEN_RE2.test(line.raw)) continue;
+      if (!testInCode(file, line, DEFINE_EXTENSION_OPEN_RE2)) continue;
       const anchor = `${file.rel}:${line.n}`;
       let depth = 0;
       let started = false;
@@ -4565,17 +5623,17 @@ function findTsTypeSites(tree) {
         const bl = lines[j];
         if (!bl.comment) {
           if (!found) {
-            const lit = bl.raw.match(TS_TYPE_LITERAL_RE);
+            const lit = matchInCode(file, bl, TS_TYPE_LITERAL_RE);
             if (lit) {
               value = lit[1];
               found = true;
-            } else if (TS_TYPE_KEY_RE.test(bl.raw)) {
+            } else if (testInCode(file, bl, TS_TYPE_KEY_RE)) {
               unresolved = true;
               found = true;
             }
           }
-          depth += (bl.raw.match(/\{/g) ?? []).length;
-          depth -= (bl.raw.match(/\}/g) ?? []).length;
+          depth += countInCode(file, bl, "{");
+          depth -= countInCode(file, bl, "}");
           if (depth > 0) started = true;
         }
         if (started && depth <= 0) break;
@@ -4599,101 +5657,119 @@ var dExt3 = {
         `DExt3 single-type control FAILED: detectMix(\`${TYPE_MIXED}\`)=${controls.type.detectsMix} detectSingle(\`${TYPE_SINGLE}\`)=${controls.type.detectsSingle} \u2014 matcher broken, verdict untrustworthy`
       );
     }
-    const declared = /* @__PURE__ */ new Set();
-    let firstAnchor2 = null;
-    const manifests = findExtensionManifests3(tree.root);
-    for (const manifestPath2 of manifests) {
-      const shortPath = manifestPath2.split("/").slice(-2).join("/");
-      let parsed;
-      try {
-        parsed = JSON.parse(readFileSync12(manifestPath2, "utf8"));
-      } catch {
-        throw new Error(
-          `DExt3 could not parse ${shortPath} as JSON \u2014 a present manifest with an unreadable type cannot pass (Extension Rule 3). Fail-closed, not a silent present.`
-        );
-      }
-      if (!("type" in parsed)) {
-        throw new Error(
-          `DExt3 found a present manifest ${shortPath} with no "type" field \u2014 Extension Rule 3 requires exactly one declared type. Fail-closed, not a silent present.`
-        );
-      }
-      const rawValue = coerceTypeValue(parsed.type);
-      if (rawValue === null) {
-        throw new Error(
-          `DExt3 found a present manifest ${shortPath} whose "type" is neither string nor string[] (got ${typeof parsed.type}) \u2014 type undeterminable (Extension Rule 3). Fail-closed, not a silent present.`
-        );
-      }
-      const found = typesIn(rawValue);
-      if (found.length === 0) {
-        throw new Error(
-          `DExt3 found a present manifest ${shortPath} whose "type" value ${JSON.stringify(parsed.type)} names no known category (middleware|tool-extension|transport) \u2014 type undeterminable (Extension Rule 3). Fail-closed, not a silent present.`
-        );
+    const unreadable = [];
+    const decided = (() => {
+      const declared = /* @__PURE__ */ new Set();
+      let firstAnchor2 = null;
+      const manifests = findExtensionManifests(tree);
+      for (const manifestPath2 of manifests) {
+        const shortPath = manifestPath2.split("/").slice(-2).join("/");
+        const parsed = readJsonObject(manifestPath2);
+        if (parsed === null) {
+          unreadable.push({
+            anchor: shortPath,
+            reason: `could not parse ${shortPath} as JSON \u2014 a present manifest with an unreadable type cannot pass (Extension Rule 3)`
+          });
+          continue;
+        }
+        if (!("type" in parsed)) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest ${shortPath} has no "type" field -> declare exactly one type (middleware|tool-extension|transport) (Extension Rule 3)`
+          };
+        }
+        const rawValue = coerceTypeValue(parsed.type);
+        if (rawValue === null) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest ${shortPath} "type" is neither string nor string[] (got ${typeof parsed.type}) -> declare exactly one type (middleware|tool-extension|transport) (Extension Rule 3)`
+          };
+        }
+        const found = typesIn(rawValue);
+        if (found.length === 0) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest ${shortPath} "type" value ${JSON.stringify(parsed.type)} names no known category (middleware|tool-extension|transport) -> declare exactly one known type (Extension Rule 3)`
+          };
+        }
+        if (found.length > 1) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest "type" ${JSON.stringify(parsed.type)} mixes ${found.join(" + ")} (positive-control OK) -> one extension = one type, split into ${found.length} extensions (Extension Rule 3)`
+          };
+        }
+        firstAnchor2 ??= shortPath;
+        declared.add(found[0]);
+      }
+      const sites = findTsTypeSites(tree);
+      for (const site of sites) {
+        if (site.unresolved) {
+          unreadable.push({
+            anchor: site.anchor,
+            reason: `cannot read the type at ${site.anchor}${site.value === void 0 ? " (no `type:` literal in the defineExtension block)" : ` (got \`${site.value}\`)`} \u2014 computed/imported/template or absent, single-type unverifiable (Extension Rule 3)`
+          });
+          continue;
+        }
+        const raw = site.value ?? "";
+        const found = typesIn(raw);
+        if (found.length === 0) {
+          return {
+            id: this.id,
+            anchor: site.anchor,
+            state: "non-conforming",
+            verdict: `defineExtension type: "${raw}" at ${site.anchor} names no known category (middleware|tool-extension|transport) -> declare exactly one known type (Extension Rule 3)`
+          };
+        }
+        if (found.length > 1) {
+          return {
+            id: this.id,
+            anchor: site.anchor,
+            state: "non-conforming",
+            verdict: `type: "${raw}" mixes ${found.join(" + ")} (positive-control OK) -> one extension = one type (Extension Rule 3)`
+          };
+        }
+        firstAnchor2 ??= site.anchor;
+        declared.add(found[0]);
       }
-      if (found.length > 1) {
+      const total = manifests.length + sites.length;
+      if (total === 0) {
         return {
           id: this.id,
-          anchor: shortPath,
-          state: "non-conforming",
-          verdict: `manifest "type" ${JSON.stringify(parsed.type)} mixes ${found.join(" + ")} (positive-control OK) -> one extension = one type, split into ${found.length} extensions (Extension Rule 3)`
+          anchor: tree.root.split("/").pop() ?? tree.root,
+          state: "absent",
+          verdict: "no extension type declared (no extension.json manifest, no defineExtension `type:` literal) -> declare exactly one type (Extension Rule 3)"
         };
       }
-      firstAnchor2 ??= shortPath;
-      declared.add(found[0]);
-    }
-    const sites = findTsTypeSites(tree);
-    for (const site of sites) {
-      if (site.unresolved) {
-        throw new Error(
-          `DExt3 cannot read the type at ${site.anchor}${site.value === void 0 ? " (no `type:` literal in the defineExtension block)" : ` (got \`${site.value}\`)`} \u2014 computed/imported/template or absent, single-type unverifiable (Extension Rule 3). Fail-closed, not a silent present.`
-        );
-      }
-      const raw = site.value ?? "";
-      const found = typesIn(raw);
-      if (found.length === 0) {
-        throw new Error(
-          `DExt3 found a defineExtension type: "${raw}" at ${site.anchor} naming no known category (middleware|tool-extension|transport) \u2014 type undeterminable (Extension Rule 3). Fail-closed, not a silent present.`
-        );
-      }
-      if (found.length > 1) {
+      if (declared.size > 1) {
         return {
           id: this.id,
-          anchor: site.anchor,
+          anchor: firstAnchor2 ?? tree.root.split("/").pop() ?? tree.root,
           state: "non-conforming",
-          verdict: `type: "${raw}" mixes ${found.join(" + ")} (positive-control OK) -> one extension = one type (Extension Rule 3)`
+          verdict: `extension declares ${declared.size} types across its forms: ${[...declared].join(" + ")} (positive-control OK) -> one extension = one type (Extension Rule 3)`
         };
       }
-      firstAnchor2 ??= site.anchor;
-      declared.add(found[0]);
-    }
-    const total = manifests.length + sites.length;
-    if (total === 0) {
-      return {
-        id: this.id,
-        anchor: tree.root.split("/").pop() ?? tree.root,
-        state: "absent",
-        verdict: "no extension type declared (no extension.json manifest, no defineExtension `type:` literal) -> declare exactly one type (Extension Rule 3)"
-      };
-    }
-    if (declared.size > 1) {
       return {
         id: this.id,
         anchor: firstAnchor2 ?? tree.root.split("/").pop() ?? tree.root,
-        state: "non-conforming",
-        verdict: `extension declares ${declared.size} types across its forms: ${[...declared].join(" + ")} (positive-control OK) -> one extension = one type (Extension Rule 3)`
+        state: "present",
+        verdict: `single type "${[...declared][0]}" declared across ${total} form(s) (manifest=${manifests.length}, ts=${sites.length}, positive-control OK)`
       };
-    }
-    return {
-      id: this.id,
-      anchor: firstAnchor2 ?? tree.root.split("/").pop() ?? tree.root,
-      state: "present",
-      verdict: `single type "${[...declared][0]}" declared across ${total} form(s) (manifest=${manifests.length}, ts=${sites.length}, positive-control OK)`
-    };
+    })();
+    return settle(this.id, decided, unreadable);
   }
 };
 
 // src/detectors/dExt4.ts
-import { readFileSync as readFileSync13, readdirSync as readdirSync7, statSync as statSync8 } from "fs";
-import { join as join15 } from "path";
+import { readdirSync as readdirSync5, statSync as statSync6 } from "fs";
+import { join as join13 } from "path";
 function canonical(name) {
   return name.replace(/[-_]/g, "").toLowerCase();
 }
@@ -4712,71 +5788,40 @@ function dExt4PositiveControls() {
     }
   };
 }
-var SKIP_DIRS5 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function findExtensionManifests4(root) {
+function findHooksDirs(tree) {
+  const root = tree.root;
   const out = [];
   let base;
   try {
-    base = statSync8(root).isDirectory() ? root : join15(root, "..");
+    base = statSync6(root).isDirectory() ? root : join13(root, "..");
   } catch {
     return out;
   }
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync7(dir);
+      entries = readdirSync5(dir);
     } catch {
       return;
     }
     for (const name of entries) {
-      const full = join15(dir, name);
+      const full = join13(dir, name);
       let st;
       try {
-        st = statSync8(full);
+        st = statSync6(full);
       } catch {
         continue;
       }
-      if (st.isDirectory()) {
-        if (SKIP_DIRS5.has(name)) continue;
-        walk2(full);
-      } else if (name === "extension.json") {
-        out.push(full);
-      }
-    }
-  };
-  walk2(base);
-  return out;
-}
-function findHooksDirs(root) {
-  const out = [];
-  let base;
-  try {
-    base = statSync8(root).isDirectory() ? root : join15(root, "..");
-  } catch {
-    return out;
-  }
-  const walk2 = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync7(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      const full = join15(dir, name);
-      let st;
-      try {
-        st = statSync8(full);
-      } catch {
+      if (!st.isDirectory()) continue;
+      if (SKIP_DIRS.has(name)) {
+        recordSkip(tree, full, base);
         continue;
       }
-      if (!st.isDirectory()) continue;
-      if (SKIP_DIRS5.has(name)) continue;
       if (name === "hooks") {
         const tokens = /* @__PURE__ */ new Set();
         let files;
         try {
-          files = readdirSync7(full);
+          files = readdirSync5(full);
         } catch {
           files = [];
         }
@@ -4805,7 +5850,7 @@ function findFactorySites(tree) {
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
       if (line.comment) continue;
-      if (LIFECYCLE_OBJ_RE.test(line.raw)) {
+      if (testInCode(file, line, LIFECYCLE_OBJ_RE)) {
         const anchor = `${file.rel}:${line.n}`;
         const tokens = /* @__PURE__ */ new Set();
         let depth = 0;
@@ -4813,20 +5858,19 @@ function findFactorySites(tree) {
         for (let j = i; j < lines.length; j++) {
           const bl = lines[j];
           if (bl.comment) continue;
-          const raw = bl.raw;
           if (started && depth === 1) {
-            const k = raw.match(OBJECT_KEY_RE);
+            const k = matchInCode(file, bl, OBJECT_KEY_RE);
             if (k) tokens.add(canonical(k[1]));
           }
-          depth += (raw.match(/\{/g) ?? []).length;
-          depth -= (raw.match(/\}/g) ?? []).length;
+          depth += countInCode(file, bl, "{");
+          depth -= countInCode(file, bl, "}");
           if (depth > 0) started = true;
           if (started && depth <= 0) break;
         }
         sites.push({ anchor, tokens });
         continue;
       }
-      if (LIFECYCLE_KEY_RE.test(line.raw)) {
+      if (testInCode(file, line, LIFECYCLE_KEY_RE)) {
         unresolved.push(`${file.rel}:${line.n}`);
       }
     }
@@ -4836,7 +5880,7 @@ function findFactorySites(tree) {
 function manifestHookTokens(raw) {
   const set = /* @__PURE__ */ new Set();
   if (!Array.isArray(raw)) {
-    throw new Error("not-array");
+    return null;
   }
   for (const h of raw) {
     if (typeof h === "string") set.add(canonical(h));
@@ -4852,83 +5896,91 @@ var dExt4 = {
         `DExt4 lifecycle-hooks control FAILED: unify(${HOOK_SNAKE}/${HOOK_KEBAB}/${HOOK_CAMEL})=${controls.hooks.unifiesSpellings} distinct(${HOOK_SNAKE}!=${HOOK_OTHER})=${controls.hooks.keepsDistinct} \u2014 normaliser broken, verdict untrustworthy`
       );
     }
-    const hooksDirs = findHooksDirs(tree.root);
-    const { sites, unresolved } = findFactorySites(tree);
-    if (unresolved.length > 0) {
-      throw new Error(
-        `DExt4 cannot read the lifecycle implementation at ${unresolved.length} TS site(s): ${unresolved.join(", ")} \u2014 value is computed/imported/template, not an object literal, so the implemented hooks are unverifiable (Extension Rule 4). Fail-closed, not a silent present.`
-      );
-    }
-    const implemented = /* @__PURE__ */ new Set();
-    for (const d of hooksDirs) for (const t of d.tokens) implemented.add(t);
-    for (const s of sites) for (const t of s.tokens) implemented.add(t);
-    const implSurfacePresent = hooksDirs.length > 0 || sites.length > 0;
-    const manifests = findExtensionManifests4(tree.root);
-    let declaredAnyLifecycle = false;
-    for (const manifestPath2 of manifests) {
-      const shortPath = manifestPath2.split("/").slice(-2).join("/");
-      let parsed;
-      try {
-        parsed = JSON.parse(readFileSync13(manifestPath2, "utf8"));
-      } catch {
-        throw new Error(
-          `DExt4 could not parse ${shortPath} as JSON \u2014 a present manifest whose lifecycle cannot be read cannot pass (Extension Rule 4). Fail-closed, not a silent present.`
-        );
-      }
-      if (!("lifecycle" in parsed)) continue;
-      let declared;
-      try {
-        declared = manifestHookTokens(parsed.lifecycle);
-      } catch {
-        throw new Error(
-          `DExt4 found a present manifest ${shortPath} whose "lifecycle" is not an array (got ${typeof parsed.lifecycle}) \u2014 the declared hooks are undeterminable (Extension Rule 4). Fail-closed, not a silent present.`
-        );
-      }
-      if (declared.size === 0) continue;
-      declaredAnyLifecycle = true;
-      if (!implSurfacePresent) {
-        throw new Error(
-          `DExt4 found a present manifest ${shortPath} declaring lifecycle hooks while NO implementation surface exists (no hooks/ directory, no factory lifecycle object) \u2014 the parity is undeterminable (Extension Rule 4). Fail-closed, not a silent present.`
-        );
+    const unreadable = [];
+    const decided = (() => {
+      const hooksDirs = findHooksDirs(tree);
+      const { sites, unresolved } = findFactorySites(tree);
+      for (const anchor of unresolved) {
+        unreadable.push({
+          anchor,
+          reason: `cannot read the lifecycle implementation at ${anchor} \u2014 value is computed/imported/template, not an object literal, so the implemented hooks are unverifiable (Extension Rule 4)`
+        });
       }
-      const phantom = [...declared].filter((h) => !implemented.has(h));
-      if (phantom.length > 0) {
-        return {
-          id: this.id,
-          anchor: shortPath,
-          state: "non-conforming",
-          verdict: `manifest "lifecycle" declares hook(s) [${phantom.join(", ")}] with no implementation (implemented: [${[...implemented].join(", ") || "none"}], positive-control OK) -> a declared hook without implementation is a phantom hook (Extension Rule 4)`
-        };
+      const implemented = /* @__PURE__ */ new Set();
+      for (const d of hooksDirs) for (const t of d.tokens) implemented.add(t);
+      for (const s of sites) for (const t of s.tokens) implemented.add(t);
+      const implSurfacePresent = hooksDirs.length > 0 || sites.length > 0;
+      const manifests = findExtensionManifests(tree);
+      let declaredAnyLifecycle = false;
+      for (const manifestPath2 of manifests) {
+        const shortPath = manifestPath2.split("/").slice(-2).join("/");
+        const parsed = readJsonObject(manifestPath2);
+        if (parsed === null) {
+          unreadable.push({
+            anchor: shortPath,
+            reason: `could not parse ${shortPath} as JSON \u2014 a present manifest whose lifecycle cannot be read cannot pass (Extension Rule 4)`
+          });
+          continue;
+        }
+        if (!("lifecycle" in parsed)) continue;
+        const declared = manifestHookTokens(parsed.lifecycle);
+        if (declared === null) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest ${shortPath} "lifecycle" is not an array (got ${typeof parsed.lifecycle}) -> declare the hooks as an array of hook names (Extension Rule 4)`
+          };
+        }
+        if (declared.size === 0) continue;
+        declaredAnyLifecycle = true;
+        if (!implSurfacePresent) {
+          unreadable.push({
+            anchor: shortPath,
+            reason: `present manifest ${shortPath} declares lifecycle hooks while NO implementation surface exists (no hooks/ directory, no factory lifecycle object) \u2014 the parity is undeterminable (Extension Rule 4)`
+          });
+          continue;
+        }
+        const phantom = [...declared].filter((h) => !implemented.has(h));
+        if (phantom.length > 0) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest "lifecycle" declares hook(s) [${phantom.join(", ")}] with no implementation (implemented: [${[...implemented].join(", ") || "none"}], positive-control OK) -> a declared hook without implementation is a phantom hook (Extension Rule 4)`
+          };
+        }
       }
-    }
-    if (!declaredAnyLifecycle) {
-      if (manifests.length === 0 && !implSurfacePresent) {
+      if (!declaredAnyLifecycle) {
+        if (manifests.length === 0 && !implSurfacePresent) {
+          return {
+            id: this.id,
+            anchor: tree.root.split("/").pop() ?? tree.root,
+            state: "absent",
+            verdict: "no lifecycle hooks declared (no extension.json manifest `lifecycle` array) -> declare the hooks the extension implements (Extension Rule 4)"
+          };
+        }
         return {
           id: this.id,
-          anchor: tree.root.split("/").pop() ?? tree.root,
-          state: "absent",
-          verdict: "no lifecycle hooks declared (no extension.json manifest `lifecycle` array) -> declare the hooks the extension implements (Extension Rule 4)"
+          anchor: manifests.length > 0 ? manifests[0].split("/").slice(-2).join("/") : tree.root.split("/").pop() ?? tree.root,
+          state: "present",
+          verdict: `no manifest lifecycle hooks declared, nothing to reconcile (implemented: [${[...implemented].join(", ") || "none"}], positive-control OK)`
         };
       }
       return {
         id: this.id,
-        anchor: manifests.length > 0 ? manifests[0].split("/").slice(-2).join("/") : tree.root.split("/").pop() ?? tree.root,
+        anchor: manifests[0].split("/").slice(-2).join("/"),
         state: "present",
-        verdict: `no manifest lifecycle hooks declared, nothing to reconcile (implemented: [${[...implemented].join(", ") || "none"}], positive-control OK)`
+        verdict: `every declared lifecycle hook is implemented (declared \u2286 implemented: [${[...implemented].join(", ")}], hooksDir=${hooksDirs.length}, factory=${sites.length}, positive-control OK)`
       };
-    }
-    return {
-      id: this.id,
-      anchor: manifests[0].split("/").slice(-2).join("/"),
-      state: "present",
-      verdict: `every declared lifecycle hook is implemented (declared \u2286 implemented: [${[...implemented].join(", ")}], hooksDir=${hooksDirs.length}, factory=${sites.length}, positive-control OK)`
-    };
+    })();
+    return settle(this.id, decided, unreadable);
   }
 };
 
 // src/detectors/dExt5.ts
-import { existsSync as existsSync12, readFileSync as readFileSync14, readdirSync as readdirSync8, statSync as statSync9 } from "fs";
-import { dirname as dirname7, join as join16 } from "path";
+import { existsSync as existsSync12 } from "fs";
+import { dirname as dirname7, join as join14 } from "path";
 function nonEmptyString(v) {
   return typeof v === "string" && v.trim().length > 0;
 }
@@ -4942,41 +5994,6 @@ function dExt5PositiveControls() {
     }
   };
 }
-var SKIP_DIRS6 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function findExtensionManifests5(root) {
-  const out = [];
-  let base;
-  try {
-    base = statSync9(root).isDirectory() ? root : join16(root, "..");
-  } catch {
-    return out;
-  }
-  const walk2 = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync8(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      const full = join16(dir, name);
-      let st;
-      try {
-        st = statSync9(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        if (SKIP_DIRS6.has(name)) continue;
-        walk2(full);
-      } else if (name === "extension.json") {
-        out.push(full);
-      }
-    }
-  };
-  walk2(base);
-  return out;
-}
 function isToolExtension(type) {
   return typeof type === "string" && type.includes("tool-extension");
 }
@@ -4989,7 +6006,7 @@ var dExt5 = {
         `DExt5 bilingual control FAILED: accept(\`${FR_POSITIVE}\`)=${controls.descriptionFr.positive} reject(empty)=${!controls.descriptionFr.negative} \u2014 FR-string matcher broken, absence verdict untrustworthy`
       );
     }
-    const manifests = findExtensionManifests5(tree.root);
+    const manifests = findExtensionManifests(tree);
     if (manifests.length === 0) {
       return {
         id: this.id,
@@ -5008,10 +6025,8 @@ var dExt5 = {
         reason,
         verdict: `could not judge: ${reason}`
       });
-      let parsed;
-      try {
-        parsed = JSON.parse(readFileSync14(manifestPath2, "utf8"));
-      } catch {
+      const parsed = readJsonObject(manifestPath2);
+      if (parsed === null) {
         return cannotRead(
           `${shortPath} does not parse as JSON \u2014 the FR surface of a present manifest cannot be read (Extension Rule 5)`
         );
@@ -5025,7 +6040,7 @@ var dExt5 = {
       if (!nonEmptyString(parsed.description_fr)) {
         missing.push("description_fr (extension.json)");
       }
-      if (!existsSync12(join16(root, "README.fr.md"))) {
+      if (!existsSync12(join14(root, "README.fr.md"))) {
         missing.push("README.fr.md");
       }
       if (isToolExtension(parsed.type) && "tools" in parsed) {
@@ -5068,8 +6083,8 @@ var dExt5 = {
 };
 
 // src/detectors/dExt7.ts
-import { existsSync as existsSync13, readFileSync as readFileSync15, readdirSync as readdirSync9, statSync as statSync10 } from "fs";
-import { dirname as dirname8, join as join17 } from "path";
+import { existsSync as existsSync13 } from "fs";
+import { dirname as dirname8, join as join15 } from "path";
 var ABSENCE_FLAG_FIELDS = [
   "extensionAbsent",
   "extension_absent",
@@ -5104,48 +6119,13 @@ var ABSENCE_POSITIVE_LABEL = {
   op: "callTool"
 };
 var ABSENCE_NEGATIVE = { id: "ping-1", op: "callTool", tool: "ping" };
-function dExt7PositiveControls() {
-  return {
-    flag: isAbsenceCase(ABSENCE_POSITIVE_FLAG),
-    token: isAbsenceCase(ABSENCE_POSITIVE_TOKEN),
-    label: isAbsenceCase(ABSENCE_POSITIVE_LABEL),
-    negative: isAbsenceCase(ABSENCE_NEGATIVE)
-  };
-}
-var SKIP_DIRS7 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function findExtensionManifests6(root) {
-  const out = [];
-  let base;
-  try {
-    base = statSync10(root).isDirectory() ? root : join17(root, "..");
-  } catch {
-    return out;
-  }
-  const walk2 = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync9(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      const full = join17(dir, name);
-      let st;
-      try {
-        st = statSync10(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        if (SKIP_DIRS7.has(name)) continue;
-        walk2(full);
-      } else if (name === "extension.json") {
-        out.push(full);
-      }
-    }
+function dExt7PositiveControls() {
+  return {
+    flag: isAbsenceCase(ABSENCE_POSITIVE_FLAG),
+    token: isAbsenceCase(ABSENCE_POSITIVE_TOKEN),
+    label: isAbsenceCase(ABSENCE_POSITIVE_LABEL),
+    negative: isAbsenceCase(ABSENCE_NEGATIVE)
   };
-  walk2(base);
-  return out;
 }
 var dExt7 = {
   id: "DExt7 eval-coverage",
@@ -5156,7 +6136,7 @@ var dExt7 = {
         `DExt7 absence-matcher control FAILED: flag=${controls.flag} token=${controls.token} label=${controls.label} reject(normal)=${!controls.negative} \u2014 absence matcher broken, eval-coverage verdict untrustworthy`
       );
     }
-    const manifests = findExtensionManifests6(tree.root);
+    const manifests = findExtensionManifests(tree);
     if (manifests.length === 0) {
       return {
         id: this.id,
@@ -5165,66 +6145,79 @@ var dExt7 = {
         verdict: "no extension.json manifest found -> declare an extension with an eval suite (>=3 cases incl. 1 'extension absente') (Extension Rule 7)"
       };
     }
-    for (const manifestPath2 of manifests) {
-      const extDir = dirname8(manifestPath2);
-      const extLabel = extDir.split("/").pop() ?? extDir;
-      const evalsPath = join17(extDir, "evals", "evals.json");
-      const shortPath = `${extLabel}/evals/evals.json`;
-      if (!existsSync13(evalsPath)) {
-        return {
-          id: this.id,
-          anchor: `${extLabel}/extension.json`,
-          state: "non-conforming",
-          verdict: `no evals/evals.json for extension "${extLabel}" -> add an eval suite with >=3 cases incl. 1 'extension absente' (Extension Rule 7)`
-        };
-      }
-      let cases;
-      try {
-        const raw = readFileSync15(evalsPath, "utf8");
-        const parsed = JSON.parse(raw);
+    const unreadable = [];
+    const decided = (() => {
+      for (const manifestPath2 of manifests) {
+        const extDir = dirname8(manifestPath2);
+        const extLabel = extDir.split("/").pop() ?? extDir;
+        const evalsPath = join15(extDir, "evals", "evals.json");
+        const shortPath = `${extLabel}/evals/evals.json`;
+        if (!existsSync13(evalsPath)) {
+          return {
+            id: this.id,
+            anchor: `${extLabel}/extension.json`,
+            state: "non-conforming",
+            verdict: `no evals/evals.json for extension "${extLabel}" -> add an eval suite with >=3 cases incl. 1 'extension absente' (Extension Rule 7)`
+          };
+        }
+        const parsed = readJsonObject(evalsPath);
+        if (parsed === null) {
+          unreadable.push({
+            anchor: shortPath,
+            reason: `could not parse ${shortPath}: not readable as a JSON object \u2014 a present eval surface that cannot be read cannot pass (Extension Rule 7)`
+          });
+          continue;
+        }
         if (!Array.isArray(parsed.cases)) {
-          throw new Error("`cases` is not an array");
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `${shortPath} "cases" is not an array (got ${typeof parsed.cases}) -> declare cases as an array of eval cases (Extension Rule 7)`
+          };
         }
-        cases = parsed.cases;
-      } catch (err) {
-        throw new Error(
-          `DExt7 could not parse ${shortPath}: ${err instanceof Error ? err.message : String(err)} \u2014 a present eval surface that cannot be read cannot pass (Extension Rule 7). Fail-closed, not a silent present.`
+        const cases = parsed.cases;
+        const badCase = cases.findIndex(
+          (c) => c === null || typeof c !== "object" || Array.isArray(c)
         );
-      }
-      cases.forEach((c, i) => {
-        if (c === null || typeof c !== "object" || Array.isArray(c)) {
-          throw new Error(
-            `DExt7 found ${shortPath} cases[${i}] is not an object (got ${c === null ? "null" : Array.isArray(c) ? "array" : typeof c}) \u2014 case shape undeterminable, absence-case presence cannot be decided (Extension Rule 7). Fail-closed, not a silent present.`
-          );
+        if (badCase !== -1) {
+          const c = cases[badCase];
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `${shortPath} cases[${badCase}] is not an object (got ${c === null ? "null" : Array.isArray(c) ? "array" : typeof c}) -> every eval case must be an object (Extension Rule 7)`
+          };
+        }
+        const count = cases.length;
+        const hasAbsence = cases.some(isAbsenceCase);
+        const failures = [];
+        if (count < 3) failures.push(`only ${count} case(s) (need >=3)`);
+        if (!hasAbsence) failures.push("no 'extension absente'/degradation case");
+        if (failures.length > 0) {
+          return {
+            id: this.id,
+            anchor: `${shortPath}`,
+            state: "non-conforming",
+            verdict: `eval suite for "${extLabel}": ${failures.join("; ")} (positive-control OK) -> Extension Rule 7 needs >=3 cases incl. 1 'extension absente'`
+          };
         }
-      });
-      const count = cases.length;
-      const hasAbsence = cases.some(isAbsenceCase);
-      const failures = [];
-      if (count < 3) failures.push(`only ${count} case(s) (need >=3)`);
-      if (!hasAbsence) failures.push("no 'extension absente'/degradation case");
-      if (failures.length > 0) {
-        return {
-          id: this.id,
-          anchor: `${shortPath}`,
-          state: "non-conforming",
-          verdict: `eval suite for "${extLabel}": ${failures.join("; ")} (positive-control OK) -> Extension Rule 7 needs >=3 cases incl. 1 'extension absente'`
-        };
       }
-    }
-    const firstLabel = manifests[0].split("/").slice(-2, -1)[0] ?? "ext";
-    return {
-      id: this.id,
-      anchor: `${firstLabel}/evals/evals.json`,
-      state: "present",
-      verdict: `eval suite complete across ${manifests.length} extension(s): >=3 cases incl. an 'extension absente'/degradation case (positive-control OK)`
-    };
+      const firstLabel = manifests[0].split("/").slice(-2, -1)[0] ?? "ext";
+      return {
+        id: this.id,
+        anchor: `${firstLabel}/evals/evals.json`,
+        state: "present",
+        verdict: `eval suite complete across ${manifests.length} extension(s): >=3 cases incl. an 'extension absente'/degradation case (positive-control OK)`
+      };
+    })();
+    return settle(this.id, decided, unreadable);
   }
 };
 
 // src/detectors/dExt8.ts
-import { existsSync as existsSync14, readFileSync as readFileSync16, readdirSync as readdirSync10, statSync as statSync11 } from "fs";
-import { dirname as dirname9, join as join18 } from "path";
+import { existsSync as existsSync14 } from "fs";
+import { dirname as dirname9, join as join16 } from "path";
 var SEMVER_RE2 = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/;
 var POSITIVE_CONTROL5 = "1.2.3-beta.1+build.7";
 function dExt8PositiveControl() {
@@ -5234,41 +6227,6 @@ function dExt8PositiveControl() {
     matched: SEMVER_RE2.test(POSITIVE_CONTROL5)
   };
 }
-var SKIP_DIRS8 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function findExtensionManifests7(root) {
-  const out = [];
-  let base;
-  try {
-    base = statSync11(root).isDirectory() ? root : join18(root, "..");
-  } catch {
-    return out;
-  }
-  const walk2 = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync10(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      const full = join18(dir, name);
-      let st;
-      try {
-        st = statSync11(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        if (SKIP_DIRS8.has(name)) continue;
-        walk2(full);
-      } else if (name === "extension.json") {
-        out.push(full);
-      }
-    }
-  };
-  walk2(base);
-  return out;
-}
 var dExt8 = {
   id: "DExt8 semver+changelog",
   run(tree) {
@@ -5278,7 +6236,7 @@ var dExt8 = {
         `DExt8 positive control FAILED: pattern /${control.pattern}/ did not match sample \`${control.sample}\` \u2014 matcher broken, verdict untrustworthy`
       );
     }
-    const manifests = findExtensionManifests7(tree.root);
+    const manifests = findExtensionManifests(tree);
     if (manifests.length === 0) {
       return {
         id: this.id,
@@ -5287,101 +6245,119 @@ var dExt8 = {
         verdict: "no extension.json manifest found -> declare an extension with a valid SemVer version + CHANGELOG.md (Extension Rule 8)"
       };
     }
+    const unreadable = [];
+    let finding;
+    let judgedConforming = 0;
     for (const manifestPath2 of manifests) {
       const extDir = dirname9(manifestPath2);
       const extLabel = extDir.split("/").pop() ?? extDir;
-      const pkgPath = join18(extDir, "package.json");
+      const pkgPath = join16(extDir, "package.json");
       const shortPkgPath = `${extLabel}/package.json`;
       if (!existsSync14(pkgPath)) {
-        throw new Error(
-          `DExt8 could not locate ${shortPkgPath} for extension "${extLabel}" \u2014 cannot verify SemVer/CHANGELOG (Extension Rule 8). Fail-closed, not a silent present.`
-        );
+        unreadable.push({
+          anchor: shortPkgPath,
+          reason: `could not locate ${shortPkgPath} for extension "${extLabel}" \u2014 cannot verify SemVer/CHANGELOG (Extension Rule 8)`
+        });
+        continue;
       }
-      let pkgJson;
-      try {
-        pkgJson = JSON.parse(readFileSync16(pkgPath, "utf8"));
-      } catch {
-        throw new Error(
-          `DExt8 could not parse ${shortPkgPath} as JSON for extension "${extLabel}" \u2014 cannot verify SemVer/CHANGELOG (Extension Rule 8). Fail-closed, not a silent present.`
-        );
+      const pkgJson = readJsonObject(pkgPath);
+      if (pkgJson === null) {
+        unreadable.push({
+          anchor: shortPkgPath,
+          reason: `could not parse ${shortPkgPath} as JSON for extension "${extLabel}" \u2014 cannot verify SemVer/CHANGELOG (Extension Rule 8)`
+        });
+        continue;
       }
       const version = pkgJson.version;
       if ("version" in pkgJson && typeof version !== "string") {
-        throw new Error(
-          `DExt8 found ${shortPkgPath} whose "version" is not a string (got ${typeof version}) for extension "${extLabel}" \u2014 cannot verify SemVer (Extension Rule 8). Fail-closed, not a silent present.`
-        );
+        finding ??= {
+          id: this.id,
+          anchor: shortPkgPath,
+          state: "non-conforming",
+          verdict: `"version" in ${shortPkgPath} is not a string (got ${typeof version}) for extension "${extLabel}" -> set a valid SemVer version string (Extension Rule 8)`
+        };
+        continue;
       }
       if (typeof version !== "string" || version.trim().length === 0) {
-        return {
+        finding ??= {
           id: this.id,
           anchor: shortPkgPath,
           state: "non-conforming",
           verdict: `no "version" field in ${shortPkgPath} for extension "${extLabel}" -> set a valid SemVer version (Extension Rule 8)`
         };
+        continue;
       }
       const validSemver = SEMVER_RE2.test(version);
-      const changelogPath = join18(extDir, "CHANGELOG.md");
+      const changelogPath = join16(extDir, "CHANGELOG.md");
       const hasChangelog = existsSync14(changelogPath);
       if (!validSemver) {
-        return {
+        finding ??= {
           id: this.id,
           anchor: shortPkgPath,
           state: "non-conforming",
           verdict: `"version": "${version}" is not valid SemVer for extension "${extLabel}" (positive-control OK) -> use MAJOR.MINOR.PATCH (Extension Rule 8)`
         };
+        continue;
       }
       if (!hasChangelog) {
-        return {
+        finding ??= {
           id: this.id,
           anchor: shortPkgPath,
           state: "absent",
           verdict: `no CHANGELOG.md next to ${shortPkgPath} for extension "${extLabel}" (positive-control OK) -> add CHANGELOG.md, update it each release (Extension Rule 8)`
         };
+        continue;
       }
+      judgedConforming++;
     }
+    if (finding) return settle(this.id, finding, unreadable);
     const firstLabel = manifests[0].split("/").slice(-2, -1)[0] ?? "ext";
-    return {
+    const conforming = {
       id: this.id,
       anchor: `${firstLabel}/package.json`,
       state: "present",
-      verdict: `SemVer valid + CHANGELOG.md present across ${manifests.length} extension(s) (positive-control OK)`
+      verdict: `SemVer valid + CHANGELOG.md present across ${judgedConforming} of ${manifests.length} extension(s) (positive-control OK)`
     };
+    return settle(this.id, conforming, unreadable);
   }
 };
 
 // src/detectors/dExt9.ts
-import { readFileSync as readFileSync17, readdirSync as readdirSync11, statSync as statSync12 } from "fs";
-import { join as join19 } from "path";
-var SKIP_DIRS9 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function collectHooksDirSources(root) {
+import { readFileSync as readFileSync10, readdirSync as readdirSync6, statSync as statSync7 } from "fs";
+import { join as join17 } from "path";
+function collectHooksDirSources(tree, unreadable) {
+  const root = tree.root;
   const out = [];
   let base;
   try {
-    base = statSync12(root).isDirectory() ? root : join19(root, "..");
+    base = statSync7(root).isDirectory() ? root : join17(root, "..");
   } catch {
     return out;
   }
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync11(dir);
+      entries = readdirSync6(dir);
     } catch {
       return;
     }
     for (const name of entries) {
-      const full = join19(dir, name);
+      const full = join17(dir, name);
       let st;
       try {
-        st = statSync12(full);
+        st = statSync7(full);
       } catch {
         continue;
       }
       if (!st.isDirectory()) continue;
-      if (SKIP_DIRS9.has(name)) continue;
+      if (SKIP_DIRS.has(name)) {
+        recordSkip(tree, full, base);
+        continue;
+      }
       if (name === "hooks") {
         let files;
         try {
-          files = readdirSync11(full);
+          files = readdirSync6(full);
         } catch {
           files = [];
         }
@@ -5389,14 +6365,17 @@ function collectHooksDirSources(root) {
           if (!f.endsWith(".ts") || f.endsWith(".d.ts")) continue;
           const stem = f.replace(/\.ts$/, "");
           if (stem === "index") continue;
-          const filePath = join19(full, f);
+          const filePath = join17(full, f);
           let body;
           try {
-            body = readFileSync17(filePath, "utf8");
+            body = readFileSync10(filePath, "utf8");
           } catch {
-            throw new Error(
-              `DExt9 could not read hook implementation ${filePath.split("/").slice(-2).join("/")} \u2014 timeout guard undeterminable for hook "${stem}" (Extension Rule 9). Fail-closed, not a silent absent.`
-            );
+            const shortPath = filePath.split("/").slice(-2).join("/");
+            unreadable.push({
+              anchor: shortPath,
+              reason: `could not read hook implementation ${shortPath} \u2014 timeout guard undeterminable for hook "${stem}" (Extension Rule 9)`
+            });
+            continue;
           }
           out.push({
             token: canonical(stem),
@@ -5420,7 +6399,7 @@ function collectFactorySources(tree) {
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
       if (line.comment) continue;
-      if (!LIFECYCLE_OBJ_RE2.test(line.raw)) continue;
+      if (!testInCode(file, line, LIFECYCLE_OBJ_RE2)) continue;
       let depth = 0;
       let started = false;
       let curKey = null;
@@ -5430,7 +6409,7 @@ function collectFactorySources(tree) {
         if (bl.comment) continue;
         const raw = bl.raw;
         if (started && depth === 1) {
-          const k = raw.match(OBJECT_KEY_RE2);
+          const k = matchInCode(file, bl, OBJECT_KEY_RE2);
           if (k) {
             curKey = canonical(k[1]);
             keyBodies.set(curKey, []);
@@ -5439,8 +6418,8 @@ function collectFactorySources(tree) {
         if (curKey && depth >= 1) {
           keyBodies.get(curKey)?.push(raw);
         }
-        depth += (raw.match(/\{/g) ?? []).length;
-        depth -= (raw.match(/\}/g) ?? []).length;
+        depth += countInCode(file, bl, "{");
+        depth -= countInCode(file, bl, "}");
         if (depth > 0) started = true;
         if (started && depth <= 0) break;
       }
@@ -5466,13 +6445,11 @@ function dExt9PositiveControls() {
     negative: hasImplTimeoutGuard(CTRL_NEGATIVE_BODY)
   };
 }
-function manifestTimeoutTokens(raw, shortPath) {
+function manifestTimeoutTokens(raw) {
   const map = /* @__PURE__ */ new Map();
   if (raw === void 0) return map;
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-    throw new Error(
-      `DExt9 found ${shortPath} whose "timeouts" field is present but not an object (got ${Array.isArray(raw) ? "array" : typeof raw}) \u2014 declared timeout guards are undeterminable (Extension Rule 9). Fail-closed, not a silent absent.`
-    );
+    return null;
   }
   for (const [key, value] of Object.entries(raw)) {
     if (typeof value === "number" && value > 0) {
@@ -5490,67 +6467,83 @@ var dExt9 = {
         `DExt9 hook-timeout control FAILED: setTimeoutForm=${controls.setTimeoutForm} abortForm=${controls.abortForm} negative=${controls.negative} \u2014 impl-pattern matcher broken, verdict untrustworthy`
       );
     }
-    const hookSources = [...collectHooksDirSources(tree.root), ...collectFactorySources(tree)];
-    const implByToken = /* @__PURE__ */ new Map();
-    for (const s of hookSources) {
-      const list = implByToken.get(s.token) ?? [];
-      list.push(s);
-      implByToken.set(s.token, list);
-    }
-    const manifests = findExtensionManifests4(tree.root);
-    let declaredAnyLifecycle = false;
-    for (const manifestPath2 of manifests) {
-      const shortPath = manifestPath2.split("/").slice(-2).join("/");
-      let parsed;
-      try {
-        parsed = JSON.parse(readFileSync17(manifestPath2, "utf8"));
-      } catch {
-        throw new Error(
-          `DExt9 could not parse ${shortPath} as JSON \u2014 timeout guards undeterminable (Extension Rule 9). Fail-closed, not a silent absent.`
-        );
-      }
-      if (!("lifecycle" in parsed)) continue;
-      let declared;
-      try {
-        declared = manifestHookTokens(parsed.lifecycle);
-      } catch {
-        throw new Error(
-          `DExt9 found a present manifest ${shortPath} whose "lifecycle" is not an array (got ${typeof parsed.lifecycle}) \u2014 declared hooks are undeterminable (Extension Rule 9). Fail-closed, not a silent absent.`
-        );
+    const unreadable = [];
+    const decided = (() => {
+      const hookSources = [
+        ...collectHooksDirSources(tree, unreadable),
+        ...collectFactorySources(tree)
+      ];
+      const implByToken = /* @__PURE__ */ new Map();
+      for (const s of hookSources) {
+        const list = implByToken.get(s.token) ?? [];
+        list.push(s);
+        implByToken.set(s.token, list);
+      }
+      const manifests = findExtensionManifests(tree);
+      let declaredAnyLifecycle = false;
+      for (const manifestPath2 of manifests) {
+        const shortPath = manifestPath2.split("/").slice(-2).join("/");
+        const parsed = readJsonObject(manifestPath2);
+        if (parsed === null) {
+          unreadable.push({
+            anchor: shortPath,
+            reason: `could not parse ${shortPath} as JSON \u2014 timeout guards undeterminable (Extension Rule 9)`
+          });
+          continue;
+        }
+        if (!("lifecycle" in parsed)) continue;
+        const declared = manifestHookTokens(parsed.lifecycle);
+        if (declared === null) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `manifest ${shortPath} "lifecycle" is not an array (got ${typeof parsed.lifecycle}) -> declare the hooks as an array of hook names (Extension Rule 9)`
+          };
+        }
+        if (declared.size === 0) continue;
+        declaredAnyLifecycle = true;
+        const timeouts = manifestTimeoutTokens(parsed.timeouts);
+        if (timeouts === null) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `${shortPath} "timeouts" is present but not an object (got ${Array.isArray(parsed.timeouts) ? "array" : typeof parsed.timeouts}) -> declare timeouts as a { <hook>: <positive ms> } object (Extension Rule 9)`
+          };
+        }
+        const noTimeout = [];
+        for (const hook of declared) {
+          const hasManifestTimeout = timeouts.has(hook);
+          const implSources = implByToken.get(hook) ?? [];
+          const hasImplTimeout = implSources.some((s) => hasImplTimeoutGuard(s.body));
+          if (!hasManifestTimeout && !hasImplTimeout) noTimeout.push(hook);
+        }
+        if (noTimeout.length > 0) {
+          return {
+            id: this.id,
+            anchor: shortPath,
+            state: "non-conforming",
+            verdict: `hook(s) [${noTimeout.join(", ")}] declare NO timeout guard in either form (manifest "timeouts.<hook>" positive number, or impl-side setTimeout/AbortController cutoff) -> a hook exceeding its timeout must be skipped, not a server blocker (Extension Rule 9)`
+          };
+        }
       }
-      if (declared.size === 0) continue;
-      declaredAnyLifecycle = true;
-      const timeouts = manifestTimeoutTokens(parsed.timeouts, shortPath);
-      const noTimeout = [];
-      for (const hook of declared) {
-        const hasManifestTimeout = timeouts.has(hook);
-        const implSources = implByToken.get(hook) ?? [];
-        const hasImplTimeout = implSources.some((s) => hasImplTimeoutGuard(s.body));
-        if (!hasManifestTimeout && !hasImplTimeout) noTimeout.push(hook);
-      }
-      if (noTimeout.length > 0) {
+      if (!declaredAnyLifecycle) {
         return {
           id: this.id,
-          anchor: shortPath,
-          state: "non-conforming",
-          verdict: `hook(s) [${noTimeout.join(", ")}] declare NO timeout guard in either form (manifest "timeouts.<hook>" positive number, or impl-side setTimeout/AbortController cutoff) -> a hook exceeding its timeout must be skipped, not a server blocker (Extension Rule 9)`
+          anchor: manifests.length > 0 ? manifests[0].split("/").slice(-2).join("/") : tree.root.split("/").pop() ?? tree.root,
+          state: "absent",
+          verdict: "no lifecycle hooks declared, nothing to guard with a timeout (Extension Rule 9)"
         };
       }
-    }
-    if (!declaredAnyLifecycle) {
       return {
         id: this.id,
-        anchor: manifests.length > 0 ? manifests[0].split("/").slice(-2).join("/") : tree.root.split("/").pop() ?? tree.root,
-        state: "absent",
-        verdict: "no lifecycle hooks declared, nothing to guard with a timeout (Extension Rule 9)"
+        anchor: manifests[0].split("/").slice(-2).join("/"),
+        state: "present",
+        verdict: "every declared lifecycle hook has a timeout guard (manifest timeouts.<hook>, or impl-side cutoff), positive-control OK (Extension Rule 9)"
       };
-    }
-    return {
-      id: this.id,
-      anchor: manifests[0].split("/").slice(-2).join("/"),
-      state: "present",
-      verdict: "every declared lifecycle hook has a timeout guard (manifest timeouts.<hook>, or impl-side cutoff), positive-control OK (Extension Rule 9)"
-    };
+    })();
+    return settle(this.id, decided, unreadable);
   }
 };
 
@@ -5579,7 +6572,7 @@ function unscopePackageName(name) {
   const m = name.match(/^@[^/]+\/(.+)$/);
   return m ? m[1] : name;
 }
-var dServer2 = {
+var dServer2Inner = {
   id: "DServer2 naming",
   rule: "C-2",
   pin: "a74a042b53c71a095ab88b3073bd47728eeda814",
@@ -5607,6 +6600,22 @@ var dServer2 = {
       };
     }
     const tools = findRegisteredTools(tree);
+    if (tools.length === 0) {
+      const surface = toolSurfaceAnchor(tree);
+      if (surface) {
+        const reason = noToolsLocatedReason(
+          tree,
+          "snake_case tool naming is unverifiable (Server Rule 2)"
+        );
+        return {
+          id: this.id,
+          anchor: surface,
+          state: "could-not-judge",
+          reason,
+          verdict: `could not judge: ${reason}`
+        };
+      }
+    }
     for (const t of tools) {
       if (!TOOL_SNAKE_RE.test(t.name)) {
         return {
@@ -5710,6 +6719,9 @@ var dServer2 = {
     };
   }
 };
+var dServer2 = guardUnreadablePackageJson(dServer2Inner, {
+  authoritative: false
+});
 
 // src/detectors/dServer6.ts
 var LOG_OPENER_RE = /\b(?:console|logger|log)\.(?:log|info|warn|error|debug|trace)\s*\(/;
@@ -5820,65 +6832,72 @@ var dServer6 = {
         `DServer6 stack control FAILED: /${controls.stack.pattern}/ accept(\`${STACK_POSITIVE}\`)=${controls.stack.positive} reject(\`${STACK_NEGATIVE}\`)=${!controls.stack.negative} \u2014 matcher broken, verdict untrustworthy`
       );
     }
-    for (const file of tree.files) {
-      const { calls, unbalanced } = collectLogCalls(file);
-      if (unbalanced.length > 0) {
-        throw new Error(
-          `DServer6 could not read the argument list of ${unbalanced.length} log call(s): ${unbalanced.join(", ")} \u2014 parentheses never balance, secret/PII content unverifiable (C-6). Fail-closed, not a silent present.`
-        );
-      }
-      for (const call of calls) {
-        if (SPREAD_RE.test(call.argText)) {
-          throw new Error(
-            `DServer6 cannot inspect the spread argument of the log call at ${call.anchor} \u2014 a spread hides arbitrary content, secret/PII presence unverifiable (C-6). Fail-closed, not a silent present.`
-          );
-        }
-        const refs = referencedIdentifiers(call.argText);
-        if (SECRET_RE.test(refs)) {
-          return {
-            id: this.id,
-            anchor: call.anchor,
-            state: "non-conforming",
-            verdict: "Form A \u2014 log call references a secret-like identifier (positive-control OK) -> never log secrets; redact before logging (C-6)"
-          };
-        }
-        if (PII_RE.test(refs)) {
-          return {
-            id: this.id,
-            anchor: call.anchor,
-            state: "non-conforming",
-            verdict: "Form C \u2014 log call references a PII-shaped identifier (positive-control OK) -> never log PII; redact before logging (C-6)"
-          };
+    const unreadable = [];
+    const decided = (() => {
+      for (const file of tree.files) {
+        const { calls, unbalanced } = collectLogCalls(file);
+        for (const anchor of unbalanced) {
+          unreadable.push({
+            anchor,
+            reason: `could not read the argument list of the log call at ${anchor} \u2014 parentheses never balance, secret/PII content unverifiable (C-6)`
+          });
         }
-        if (INTERNAL_RE.test(refs)) {
-          return {
-            id: this.id,
-            anchor: call.anchor,
-            state: "non-conforming",
-            verdict: "Form D \u2014 log call references an internal-infrastructure identifier (positive-control OK) -> never log internal system detail; redact before logging (C-6)"
-          };
+        for (const call of calls) {
+          if (SPREAD_RE.test(call.argText)) {
+            unreadable.push({
+              anchor: call.anchor,
+              reason: `cannot inspect the spread argument of the log call at ${call.anchor} \u2014 a spread hides arbitrary content, secret/PII presence unverifiable (C-6)`
+            });
+            continue;
+          }
+          const refs = referencedIdentifiers(call.argText);
+          if (SECRET_RE.test(refs)) {
+            return {
+              id: this.id,
+              anchor: call.anchor,
+              state: "non-conforming",
+              verdict: "Form A \u2014 log call references a secret-like identifier (positive-control OK) -> never log secrets; redact before logging (C-6)"
+            };
+          }
+          if (PII_RE.test(refs)) {
+            return {
+              id: this.id,
+              anchor: call.anchor,
+              state: "non-conforming",
+              verdict: "Form C \u2014 log call references a PII-shaped identifier (positive-control OK) -> never log PII; redact before logging (C-6)"
+            };
+          }
+          if (INTERNAL_RE.test(refs)) {
+            return {
+              id: this.id,
+              anchor: call.anchor,
+              state: "non-conforming",
+              verdict: "Form D \u2014 log call references an internal-infrastructure identifier (positive-control OK) -> never log internal system detail; redact before logging (C-6)"
+            };
+          }
         }
       }
-    }
-    for (const file of tree.files) {
-      for (const line of file.lines) {
-        if (line.comment) continue;
-        if (STACK_RE.test(line.raw) && CLIENT_SINK_RE.test(line.raw)) {
-          return {
-            id: this.id,
-            anchor: `${file.rel}:${line.n}`,
-            state: "non-conforming",
-            verdict: "Form B \u2014 raw error.stack serialized into a client-facing response (positive-control OK) -> return an McpError message, never the raw stack (C-6)"
-          };
+      for (const file of tree.files) {
+        for (const line of file.lines) {
+          if (line.comment) continue;
+          if (STACK_RE.test(line.raw) && CLIENT_SINK_RE.test(line.raw)) {
+            return {
+              id: this.id,
+              anchor: `${file.rel}:${line.n}`,
+              state: "non-conforming",
+              verdict: "Form B \u2014 raw error.stack serialized into a client-facing response (positive-control OK) -> return an McpError message, never the raw stack (C-6)"
+            };
+          }
         }
       }
-    }
-    return {
-      id: this.id,
-      anchor: tree.files.length > 0 ? `${tree.files[0].rel}:1` : tree.root,
-      state: "present",
-      verdict: "no secret/PII/internal-detail referenced in any log call; no raw error.stack exposed to the client (all positive-controls OK). Logging-sink configuration and explicit-activation-only diagnostic mode are the gate/runtime half, out of static scope (declared)."
-    };
+      return {
+        id: this.id,
+        anchor: tree.files.length > 0 ? `${tree.files[0].rel}:1` : tree.root,
+        state: "present",
+        verdict: "no secret/PII/internal-detail referenced in any log call; no raw error.stack exposed to the client (all positive-controls OK). Logging-sink configuration and explicit-activation-only diagnostic mode are the gate/runtime half, out of static scope (declared)."
+      };
+    })();
+    return settle(this.id, decided, unreadable);
   }
 };
 
@@ -5960,59 +6979,65 @@ var dServer8 = {
         `DServer8 text control FAILED: /${controls.text.pattern}/ accept(\`${TEXT_POSITIVE}\`)=${controls.text.positive} reject(\`${TEXT_NEGATIVE}\`)=${!controls.text.negative} \u2014 matcher broken, verdict untrustworthy`
       );
     }
-    const blocks = [];
-    for (const file of tree.files) {
-      const { blocks: fileBlocks, unbalanced } = collectContentArrays(file);
-      if (unbalanced.length > 0) {
-        throw new Error(
-          `DServer8 could not read the content[] array at ${unbalanced.join(", ")} \u2014 brackets never balance, a ui:// resource emission could hide inside it (Server Rule 8). Fail-closed, not a silent present.`
-        );
+    const unreadable = [];
+    const decided = (() => {
+      const blocks = [];
+      for (const file of tree.files) {
+        const { blocks: fileBlocks, unbalanced } = collectContentArrays(file);
+        for (const anchor of unbalanced) {
+          unreadable.push({
+            anchor,
+            reason: `could not read the content[] array at ${anchor} \u2014 brackets never balance, a ui:// resource emission could hide inside it (Server Rule 8)`
+          });
+        }
+        blocks.push(...fileBlocks);
+      }
+      for (const file of tree.files) {
+        const fileBlocks = blocks.filter((b) => b.file === file);
+        for (const line of file.lines) {
+          if (line.comment) continue;
+          if (!KIT_RE.test(line.raw)) continue;
+          const inside = fileBlocks.some((b) => line.n >= b.startLine && line.n <= b.endLine);
+          if (!inside) {
+            unreadable.push({
+              anchor: `${file.rel}:${line.n}`,
+              reason: `renderUiResource(\u2026) ui:// emission at ${file.rel}:${line.n} sits outside any content[] array \u2014 cannot associate it with a sibling text fallback (Server Rule 8)`
+            });
+          }
+        }
       }
-      blocks.push(...fileBlocks);
-    }
-    for (const file of tree.files) {
-      const fileBlocks = blocks.filter((b) => b.file === file);
-      for (const line of file.lines) {
-        if (line.comment) continue;
-        if (!KIT_RE.test(line.raw)) continue;
-        const inside = fileBlocks.some((b) => line.n >= b.startLine && line.n <= b.endLine);
-        if (!inside) {
-          throw new Error(
-            `DServer8 found a renderUiResource(\u2026) ui:// emission at ${file.rel}:${line.n} outside any content[] array \u2014 cannot associate it with a sibling text fallback (Server Rule 8). Fail-closed, not a silent present.`
-          );
+      let sawEmission = false;
+      for (const block of blocks) {
+        const inlineEmission = INLINE_RESOURCE_RE.test(block.text) && UI_URI_RE.test(block.text);
+        const kitEmission = KIT_RE.test(block.text);
+        if (!inlineEmission && !kitEmission) continue;
+        sawEmission = true;
+        const hasText = TEXT_RE.test(block.text) || MARKDOWN_RE.test(block.text);
+        if (!hasText) {
+          return {
+            id: this.id,
+            anchor: block.anchor,
+            state: "non-conforming",
+            verdict: `ui:// resource emitted in content[] with no text fallback beside ui:// in the same array (positive-control OK) -> add a sibling { type: "text" } / { type: "markdown" } entry (Server Rule 8)`
+          };
         }
       }
-    }
-    let sawEmission = false;
-    for (const block of blocks) {
-      const inlineEmission = INLINE_RESOURCE_RE.test(block.text) && UI_URI_RE.test(block.text);
-      const kitEmission = KIT_RE.test(block.text);
-      if (!inlineEmission && !kitEmission) continue;
-      sawEmission = true;
-      const hasText = TEXT_RE.test(block.text) || MARKDOWN_RE.test(block.text);
-      if (!hasText) {
+      if (!sawEmission) {
         return {
           id: this.id,
-          anchor: block.anchor,
-          state: "non-conforming",
-          verdict: `ui:// resource emitted in content[] with no text fallback beside ui:// in the same array (positive-control OK) -> add a sibling { type: "text" } / { type: "markdown" } entry (Server Rule 8)`
+          anchor: tree.files.length > 0 ? `${tree.files[0].rel}:1` : tree.root,
+          state: "absent",
+          verdict: "no ui:// resource emission in any content[] array (n/a for Server Rule 8)"
         };
       }
-    }
-    if (!sawEmission) {
       return {
         id: this.id,
-        anchor: tree.files.length > 0 ? `${tree.files[0].rel}:1` : tree.root,
-        state: "absent",
-        verdict: "no ui:// resource emission in any content[] array (n/a for Server Rule 8)"
+        anchor: blocks.length > 0 ? blocks[0].anchor : tree.root,
+        state: "present",
+        verdict: "every ui:// resource emission has a sibling text/markdown fallback in the same content[] (positive-control OK, Server Rule 8)"
       };
-    }
-    return {
-      id: this.id,
-      anchor: blocks.length > 0 ? blocks[0].anchor : tree.root,
-      state: "present",
-      verdict: "every ui:// resource emission has a sibling text/markdown fallback in the same content[] (positive-control OK, Server Rule 8)"
-    };
+    })();
+    return settle(this.id, decided, unreadable);
   }
 };
 
@@ -6236,22 +7261,23 @@ var detectors = [
   dExt5,
   dExt7,
   dExt8,
-  dExt9
+  dExt9,
+  localIdentity
 ];
 
 // src/runtime/launch.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync18, statSync as statSync13 } from "fs";
-import { dirname as dirname10, isAbsolute, join as join20, resolve } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync11, statSync as statSync8 } from "fs";
+import { dirname as dirname10, isAbsolute, join as join18, resolve } from "path";
 function findPackageDir(target) {
   let dir;
   try {
-    dir = statSync13(target).isDirectory() ? target : dirname10(target);
+    dir = statSync8(target).isDirectory() ? target : dirname10(target);
   } catch {
     return null;
   }
   for (let depth = 0; depth < 8; depth++) {
-    if (existsSync15(join20(dir, "package.json"))) return dir;
+    if (existsSync15(join18(dir, "package.json"))) return dir;
     const parent = dirname10(dir);
     if (parent === dir) break;
     dir = parent;
@@ -6276,10 +7302,10 @@ function deriveLaunchPlan(target) {
   }
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync18(join20(pkgDir, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync11(join18(pkgDir, "package.json"), "utf8"));
   } catch (err) {
     return {
-      error: `could not parse ${join20(pkgDir, "package.json")}: ${err instanceof Error ? err.message : String(err)}`
+      error: `could not parse ${join18(pkgDir, "package.json")}: ${err instanceof Error ? err.message : String(err)}`
     };
   }
   const bin = firstBinEntry(pkg.bin);
@@ -6357,10 +7383,10 @@ function readEvalCounts(target) {
   if (!pkgDir) return counts;
   let dir = pkgDir;
   for (let depth = 0; depth < 8; depth++) {
-    const candidate = join20(dir, "evals", "evals.json");
+    const candidate = join18(dir, "evals", "evals.json");
     if (existsSync15(candidate)) {
       try {
-        const parsed = JSON.parse(readFileSync18(candidate, "utf8"));
+        const parsed = JSON.parse(readFileSync11(candidate, "utf8"));
         for (const c of parsed.cases ?? []) {
           if (c && typeof c.tool === "string") counts.set(c.tool, (counts.get(c.tool) ?? 0) + 1);
         }
@@ -6376,7 +7402,7 @@ function readEvalCounts(target) {
 }
 function statSyncSafe(p) {
   try {
-    return statSync13(p).isDirectory();
+    return statSync8(p).isDirectory();
   } catch {
     return false;
   }
@@ -6495,6 +7521,9 @@ function reconcile(id, staticR, dynamicR) {
   };
 }
 function runDoctor(target, detectorList = detectors, opts = {}) {
+  return runDoctorReport(target, detectorList, opts).results;
+}
+function runDoctorReport(target, detectorList = detectors, opts = {}) {
   const mode = opts.mode ?? "static";
   const tree = loadTree(target);
   const needsRuntime = mode !== "static" && detectorList.some((d) => typeof d.runDynamic === "function");
@@ -6529,7 +7558,7 @@ function runDoctor(target, detectorList = detectors, opts = {}) {
       results.push(reconcile(d.id, staticR, dynamicR));
     }
   }
-  return results;
+  return { results, skipped: tree.skippedDirs };
 }
 async function invokeLiveChecked(d, session) {
   if (!session) {
@@ -6584,14 +7613,32 @@ async function runDoctorAsync(target, opts = {}) {
   }
   return results;
 }
-function renderTable(surface, results) {
+function renderSkipped(skipped) {
+  if (skipped.length === 0) {
+    return "skipped directories (0) \u2014 none: no directory was skipped on this run.";
+  }
+  const sorted = [...skipped].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  const head = `skipped directories (${sorted.length}) \u2014 NOT read on this run; a verdict above says nothing about what lies inside:`;
+  const rows = sorted.map(
+    (d) => `${d.path} | ${d.reason}${d.candidate ? ` | holds a deployment configuration: ${d.candidate}` : ""}`
+  );
+  return [head, "-".repeat(head.length), ...rows].join("\n");
+}
+function renderTable(surface, results, skipped) {
+  const body = renderResults(surface, results);
+  const section = skipped === void 0 ? "skipped directories: NOT REPORTED \u2014 the caller did not pass this run's skipped list (use runDoctorReport), so the scope above may be narrower than it reads." : renderSkipped(skipped);
+  return `${body}
+
+${section}`;
+}
+function renderResults(surface, results) {
   const cols = { item: 24, anchor: 26, state: 15 };
   const header = `${pad("item", cols.item)} | ${pad("file:line", cols.anchor)} | ${pad("state", cols.state)} | verdict`;
-  const sep = "-".repeat(header.length);
+  const sep3 = "-".repeat(header.length);
   const rows = results.map(
     (r) => `${pad(r.id, cols.item)} | ${pad(r.anchor, cols.anchor)} | ${pad(r.state, cols.state)} | ${r.verdict}`
   );
-  const table = [`surface: ${surface}`, header, sep, ...rows].join("\n");
+  const table = [`surface: ${surface}`, header, sep3, ...rows].join("\n");
   const unjudged = results.filter((r) => r.state === "could-not-judge");
   if (unjudged.length === 0) return table;
   const cnjHeader = `could-not-judge (${unjudged.length}) \u2014 the doctor could NOT read these; this is NOT a clean bill:`;
@@ -6612,6 +7659,9 @@ var USAGE = [
   "  --mode=static   read the tree only (default)",
   "  --mode=dynamic  launch the server and judge what it serves",
   "  --mode=both     both, dynamic findings taking precedence",
+  "  --local-identity-ceiling=N",
+  "                  local identity primitives tolerated before DLocalIdentity",
+  "                  fails (default 0)",
   "  --version       print the version and exit",
   "  --help          print this and exit",
   "",
@@ -6620,7 +7670,7 @@ var USAGE = [
 function readVersion() {
   try {
     const here = dirname11(fileURLToPath(import.meta.url));
-    const manifest = JSON.parse(readFileSync19(join21(here, "..", "package.json"), "utf8"));
+    const manifest = JSON.parse(readFileSync12(join19(here, "..", "package.json"), "utf8"));
     return manifest.version ?? null;
   } catch {
     return null;
@@ -6652,8 +7702,20 @@ function main() {
     console.error(`unknown --mode "${mode}" \u2014 expected static|dynamic|both`);
     process.exit(1);
   }
-  const results = runDoctor(target, void 0, { mode });
-  console.log(renderTable(target, results));
+  const ceilingArg = args.find((a) => a.startsWith("--local-identity-ceiling="));
+  let detectorList = detectors;
+  if (ceilingArg) {
+    const raw = ceilingArg.slice("--local-identity-ceiling=".length);
+    const ceiling = /^\d+$/.test(raw) ? Number(raw) : Number.NaN;
+    if (!Number.isInteger(ceiling)) {
+      console.error(`invalid --local-identity-ceiling "${raw}" \u2014 expected a non-negative integer`);
+      process.exit(1);
+    }
+    const ratchet = makeLocalIdentity({ ceiling });
+    detectorList = detectors.map((d) => d === localIdentity ? ratchet : d);
+  }
+  const { results, skipped } = runDoctorReport(target, detectorList, { mode });
+  console.log(renderTable(target, results, skipped));
   process.exitCode = computeExitCode(results);
 }
 function isDirectInvocation() {
@@ -6675,7 +7737,9 @@ if (isDirectInvocation()) main();
 export {
   computeExitCode,
   isLiveDetector,
+  renderSkipped,
   renderTable,
   runDoctor,
-  runDoctorAsync
+  runDoctorAsync,
+  runDoctorReport
 };