any-doctor 0.0.6 → 0.0.7

package/CONTEXT.md

@@ -39,9 +39,9 @@ call: the runner's bounded pool, the crash fold (a crash is data — id
 plus full error detail, never a throw), the process-wide analysis fold,
 the per-doctor paths, the file-count policy, and the timing. Progress
 events (settle order) are the only side channel — the live line renders
-them, it never joins the fold. Skips are a discovery fact, so the
-command layer, which owns discovery, patches `skippedUnsafe` onto the
-outcome.
+them, it never joins the fold. Skips are a discovery fact, so they ride
+in with the CohortSpec: the command layer, which owns discovery, hands
+them to the run and the outcome comes back complete.
 
 ## Summary
 
@@ -160,9 +160,14 @@ An identity question asked through `ctx.analysis`: which **Binding** a
 name resolves to, and every **Reference** to it. `ctx.analysis.bindings(file)`
 returns the file's whole identity model in one answer — every binding
 with its declaration span and its references (positions in ctx.search's
-convention, plus read/write). The engine is optional (oxc-parser +
+convention, plus read/write). `ctx.analysis.spans(file)` (D26) returns
+every function-like **Span** — functions, methods, arrows, classes with
+name, asyncness, and extent — as an AST fact, replacing the brace-counting
+scans doctors once carried privately (the audit truncation bugs lived in
+those approximations). The engine is optional (oxc-parser +
 eslint-scope behind the Engine seam's second adapter): checks declare
-the analysis they need on their CheckMeta (`needs`), narrow without it,
+the analysis they need on their CheckMeta (`needs` — vocabulary:
+"bindings", "spans"), narrow without it,
 and the report renders "narrowed" — a degraded run is visible, never
 silent. References answer by position, so analysis queries compose with
 rule queries: shapes from one engine, identities from the other.
@@ -242,7 +247,12 @@ workflow's second pass; a doctor ships only after surviving its attack.
 
 Running a doctor program against its fixtures and diffing the findings.
 The trust gate: a doctor program is not considered working until verify
-passes.
+passes. The policies that compose the gate — the claim contract, the
+per-fixture diff, the shared innocent corpus, the duplicate-location
+probe, the shared sensitivity corpus — live in one module, the
+Certification harness (`src/certify.ts`), behind one interface:
+`certify(mod, fixtures) -> result rows`. The doctor loader calls it once;
+prevention tiers land there, not in loader choreography.
 
 ## Runner
 

package/bin/analysis-host.d.ts

@@ -1,6 +1,7 @@
-import { AnalysisFile, Mode } from "./contract.js";
-import { analysisStatus, analyzeBindings } from "./analysis.js";
+import { AnalysisFile, AnalysisSpans, Mode } from "./contract.js";
+import { analysisStatus, analyzeBindings, analyzeSpans } from "./analysis.js";
 type Analyzer = typeof analyzeBindings;
+type SpansAnalyzer = typeof analyzeSpans;
 type Status = typeof analysisStatus;
 export declare function clearAnalysisCache(): void;
 export interface AnalysisRequestBody {
@@ -13,8 +14,10 @@ export type AnalysisResponse = {
     reason?: string;
 } | {
     file: AnalysisFile;
+} | {
+    file: AnalysisSpans;
 } | {
     error: string;
 };
-export declare function handleAnalysisRequest(req: AnalysisRequestBody, mode: Mode, analyzer?: Analyzer, status?: Status): AnalysisResponse;
+export declare function handleAnalysisRequest(req: AnalysisRequestBody, mode: Mode, analyzer?: Analyzer, status?: Status, spansAnalyzer?: SpansAnalyzer): AnalysisResponse;
 export {};

package/bin/analysis-host.js

@@ -1,18 +1,20 @@
 import * as fs from "fs";
 import * as path from "path";
-import { analysisStatus, analyzeBindings } from "./analysis.js";
+import { analysisStatus, analyzeBindings, analyzeSpans } from "./analysis.js";
 import { searchBase, withinBase } from "./search-host.js";
 // One cache per host process. The host lives in the runner process, so
 // the lifetime is the any-doctor invocation; across a cohort's doctors
 // the same unchanged file answers from memory.
 const modelCache = new Map();
+const spansCache = new Map();
 // Test seam: the model cache is keyed by mtime+size for the process
 // lifetime; tests bust it between cases. Invisible to slop-doctor's
 // default run (test-file consumers are the documented narrowing).
 export function clearAnalysisCache() {
     modelCache.clear();
+    spansCache.clear();
 }
-export function handleAnalysisRequest(req, mode, analyzer = analyzeBindings, status = analysisStatus) {
+export function handleAnalysisRequest(req, mode, analyzer = analyzeBindings, status = analysisStatus, spansAnalyzer = analyzeSpans) {
     const base = searchBase(mode);
     const root = typeof req.root === "string" ? path.resolve(req.root) : "";
     if (base === "" || !withinBase(root, base)) {
@@ -22,35 +24,44 @@ export function handleAnalysisRequest(req, mode, analyzer = analyzeBindings, sta
         const s = status();
         return s.available ? { available: true } : { available: false, reason: s.reason };
     }
-    if (req.kind === "bindings") {
+    if (req.kind === "bindings" || req.kind === "spans") {
         if (typeof req.file !== "string" || req.file === "") {
-            return { error: 'ctx.analysis.bindings needs a "file" path' };
+            return { error: `ctx.analysis.${req.kind} needs a "file" path` };
         }
         const abs = path.resolve(root, req.file);
         if (!withinBase(abs, root)) {
             return { error: `ctx.analysis failed: file is outside the search root: ${req.file}` };
         }
-        let source;
-        let mtimeMs;
-        let size;
-        try {
-            const stat = fs.statSync(abs);
-            mtimeMs = stat.mtimeMs;
-            size = stat.size;
-            const cached = modelCache.get(abs);
-            if (cached && cached.mtimeMs === mtimeMs && cached.size === size)
-                return { file: cached.file };
-            source = fs.readFileSync(abs, "utf8");
+        if (req.kind === "bindings") {
+            return cachedModel(abs, root, modelCache, analyzer, req.file);
         }
-        catch {
-            return { error: `ctx.analysis failed: cannot read ${req.file}` };
-        }
-        const rel = path.relative(root, abs);
-        const r = analyzer(rel, source);
-        if (!r.ok)
-            return { error: r.error };
-        modelCache.set(abs, { mtimeMs, size, file: r.file });
-        return { file: r.file };
+        return cachedModel(abs, root, spansCache, spansAnalyzer, req.file);
+    }
+    return { error: `unknown analysis kind ${JSON.stringify(req.kind)} — known kinds: available, bindings, spans` };
+}
+// The shared per-file model lifecycle: stat (cache hit on mtime+size),
+// read, compute, cache. Bindings and spans are the same policy over two
+// analyzers and two caches.
+function cachedModel(abs, root, cache, compute, relFile) {
+    let source;
+    let mtimeMs;
+    let size;
+    try {
+        const stat = fs.statSync(abs);
+        mtimeMs = stat.mtimeMs;
+        size = stat.size;
+        const cached = cache.get(abs);
+        if (cached && cached.mtimeMs === mtimeMs && cached.size === size)
+            return { file: cached.file };
+        source = fs.readFileSync(abs, "utf8");
+    }
+    catch {
+        return { error: `ctx.analysis failed: cannot read ${relFile}` };
     }
-    return { error: `unknown analysis kind ${JSON.stringify(req.kind)} — known kinds: available, bindings` };
+    const rel = path.relative(root, abs);
+    const r = compute(rel, source);
+    if (!r.ok)
+        return { error: r.error };
+    cache.set(abs, { mtimeMs, size, file: r.file });
+    return { file: r.file };
 }

package/bin/analysis.d.ts

@@ -1,5 +1,5 @@
-import { AnalysisFile, BindingInfo, BindingRef } from "./contract.js";
-export type { AnalysisFile, BindingInfo, BindingRef };
+import { AnalysisFile, AnalysisSpans, BindingInfo, BindingRef, SpanInfo } from "./contract.js";
+export type { AnalysisFile, AnalysisSpans, BindingInfo, BindingRef, SpanInfo };
 export interface AnalysisStatus {
     available: true;
 }
@@ -15,4 +15,12 @@ export type AnalysisResult = {
     ok: false;
     error: string;
 };
+export type SpansResult = {
+    ok: true;
+    file: AnalysisSpans;
+} | {
+    ok: false;
+    error: string;
+};
+export declare function analyzeSpans(file: string, source: string): SpansResult;
 export declare function analyzeBindings(file: string, source: string): AnalysisResult;

package/bin/analysis.js

@@ -20,6 +20,89 @@ export function analysisStatus() {
     const stack = loadStack();
     return stack.error !== undefined ? { available: false, reason: stack.error } : { available: true };
 }
+// One file in, every function-like span out (D26): an AST fact answering
+// what the doctors' private brace-counting copies could only approximate.
+// Semicolons inside multi-line callbacks, strings containing braces, JSX —
+// none of it can truncate a span that the parser already knows. Named
+// declarations carry their id; arrows and anonymous expressions carry null.
+export function analyzeSpans(file, source) {
+    const stack = loadStack();
+    if (stack.error !== undefined)
+        return { ok: false, error: stack.error };
+    let program;
+    try {
+        program = stack.parseSync(file, source, { sourceType: "module" }).program;
+    }
+    catch (e) {
+        return { ok: false, error: `analysis failed to parse ${file}: ${e instanceof Error ? e.message : String(e)}` };
+    }
+    const pos = positioner(source);
+    const spans = [];
+    const visit = (node) => {
+        if (!node || typeof node !== "object")
+            return;
+        const n = node;
+        let span = null;
+        if (n.type === "FunctionDeclaration" || n.type === "TSDeclareFunction") {
+            span = spanOf(n, "function", idName(n.id));
+        }
+        else if (n.type === "FunctionExpression") {
+            span = spanOf(n, "function-expression", idName(n.id));
+        }
+        else if (n.type === "ArrowFunctionExpression") {
+            span = spanOf(n, "arrow", null);
+        }
+        else if (n.type === "ClassDeclaration" || n.type === "ClassExpression") {
+            span = spanOf(n, "class", idName(n.id));
+        }
+        else if (n.type === "MethodDefinition" || n.type === "TSAbstractMethodDefinition") {
+            span = spanOf(n.value, "method", propertyName(n.key));
+        }
+        if (span !== null)
+            spans.push(span);
+        for (const key of Object.keys(n)) {
+            if (key === "range" || key === "start" || key === "end")
+                continue;
+            const v = n[key];
+            if (Array.isArray(v)) {
+                for (const child of v)
+                    if (isNode(child))
+                        visit(child);
+            }
+            else if (isNode(v))
+                visit(v);
+        }
+    };
+    visit(program);
+    return { ok: true, file: { file, spans } };
+    function spanOf(n, kind, name) {
+        if (typeof n.start !== "number" || typeof n.end !== "number")
+            return null;
+        return {
+            kind,
+            name,
+            async: n.async === true,
+            line: pos.line(n.start),
+            column: pos.column(n.start),
+            endLine: pos.line(n.end),
+            endColumn: pos.column(n.end),
+        };
+    }
+}
+function idName(id) {
+    return id && typeof id.name === "string" ? id.name : null;
+}
+function propertyName(key) {
+    const k = key;
+    if (k && typeof k.name === "string")
+        return k.name;
+    if (k && typeof k.value === "string")
+        return k.value; // computed / literal keys
+    return null;
+}
+function isNode(v) {
+    return Boolean(v) && typeof v === "object" && typeof v.type === "string";
+}
 // One file in, one identity model out: every binding (declarations,
 // parameters, imports) with the span of its declaring node and every
 // reference to it, read or write. Type-position identifiers never become

package/bin/certify.d.ts

@@ -0,0 +1,15 @@
+import { buildCtx } from "./sdk.js";
+import type { Fixture, FixtureResult, RunResult } from "./contract.js";
+export interface DoctorModule {
+    meta?: unknown;
+    doctor?: (ctx: ReturnType<typeof buildCtx>["ctx"]) => unknown;
+}
+export declare function runOnce(root: string, mod: DoctorModule, opts: {
+    includeTests: boolean;
+}): Promise<RunResult>;
+export declare class ClaimContractViolation extends Error {
+    readonly problems: string[];
+    constructor(problems: string[]);
+}
+export declare function validateClaimContract(mod: DoctorModule): void;
+export declare function certify(mod: DoctorModule, fixtures: Fixture[]): Promise<FixtureResult[]>;

package/bin/certify.js

@@ -0,0 +1,377 @@
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { buildCtx, setAnalysisDisabled, probeAnalysisAvailable } from "./sdk.js";
+import * as contract from "./contract.js";
+// One execution of a doctor program against a root, framed as a run result.
+// Owned here because both halves need it: the loader's run mode and every
+// certification sandbox. Typed, not Record<string, unknown> — consumers
+// (certify, the loader frame) read .findings and .meta off it directly.
+export async function runOnce(root, mod, opts) {
+    const started = Date.now();
+    const { ctx, getFindings } = buildCtx(root, opts);
+    const fileCount = ctx.files.list().length;
+    const result = mod.doctor(ctx);
+    if (!result || typeof result.then !== "function") {
+        throw new Error("doctor() must be async — declare it `export async function doctor(ctx)`");
+    }
+    return result.then(() => ({
+        protocolVersion: contract.PROTOCOL_VERSION,
+        kind: "run",
+        root,
+        fileCount,
+        durationMs: Date.now() - started,
+        meta: mod.meta,
+        findings: getFindings(),
+    }));
+}
+// The claim contract (D23): certification requires each declared check to
+// state the observable condition it establishes, its innocent lookalikes,
+// and - when it needs the identity engine - what happens on unknown. Prose
+// impact is not a testable claim. Thrown before any sandbox runs; the
+// loader renders the problems and exits 3.
+export class ClaimContractViolation extends Error {
+    constructor(problems) {
+        super("claim contract violations:\n  " + problems.join("\n  "));
+        this.problems = problems;
+        this.name = "ClaimContractViolation";
+    }
+}
+export function validateClaimContract(mod) {
+    var _a;
+    const checks = (_a = mod.meta) === null || _a === void 0 ? void 0 : _a.checks;
+    if (!Array.isArray(checks))
+        return;
+    const problems = [];
+    for (const c of checks) {
+        if (typeof c.claim !== "string" || c.claim.trim().length === 0) {
+            problems.push(`check "${String(c.id)}": claim is required — one sentence, the observable condition detected, not the consequence`);
+        }
+        if (!Array.isArray(c.lookalikes) || c.lookalikes.length === 0) {
+            problems.push(`check "${String(c.id)}": lookalikes is required — at least one innocent shape that must stay silent`);
+        }
+        if (Array.isArray(c.needs) && c.needs.length > 0
+            && (c.onUnknown !== "narrow" && c.onUnknown !== "skip")) {
+            problems.push(`check "${String(c.id)}": onUnknown is required when needs is declared — "narrow" or "skip"`);
+        }
+    }
+    if (problems.length > 0)
+        throw new ClaimContractViolation(problems);
+}
+const SKIP_ANALYSIS = "analysis engine unavailable — pins the analysis-on path";
+// The result-row constructors: every policy speaks in the same row shape,
+// so a verify frame's consumers never see policy-specific spellings.
+const okRow = (name) => ({ name, ok: true, missing: [], unexpected: [] });
+const skipRow = (name) => ({ ...okRow(name), skipped: SKIP_ANALYSIS });
+const errorRow = (name, e) => ({
+    name, ok: false, missing: [], unexpected: [],
+    error: e instanceof Error ? e.message : String(e),
+});
+function materializeSeed(tmp, rel, content) {
+    const abs = path.resolve(tmp, rel);
+    if (abs !== tmp && !abs.startsWith(tmp + path.sep)) {
+        throw new Error(`fixture seed path escapes the sandbox: ${rel}`);
+    }
+    fs.mkdirSync(path.dirname(abs), { recursive: true });
+    fs.writeFileSync(abs, content);
+}
+// The one sandbox lifecycle: materialize a seed into a fresh temp dir, run,
+// clean up. A crashing sandbox is a named failing result (or the caller's
+// error row) — siblings always run.
+async function inSandbox(seed, run) {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "any-doctor-verify-"));
+    try {
+        for (const [rel, content] of Object.entries(seed))
+            materializeSeed(tmp, rel, content);
+        return await run(tmp);
+    }
+    finally {
+        fs.rmSync(tmp, { recursive: true, force: true });
+    }
+}
+// The one corpus walker: a directory tree as a seed map. `skip` carves out
+// manifest files (the sensitivity corpus's expect.json).
+function collectSeed(dir, prefix, seed, skip) {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        const abs = path.join(dir, entry.name);
+        const rel = prefix ? prefix + "/" + entry.name : entry.name;
+        if (entry.isDirectory())
+            collectSeed(abs, rel, seed, skip);
+        else if (entry.name !== skip)
+            seed[rel] = fs.readFileSync(abs, "utf8");
+    }
+}
+// The duplicate-location sensitivity probe (D24, hardened in the review
+// loop): a doctor's own flag-shaped fixture — the one with the most
+// expected findings concentrated in a single seeded file — is re-planted
+// at three locations:
+//
+//   1. the original file, untouched (every fact the fixture proved);
+//   2. a byte-identical twin module (the cross-file location — checks
+//      whose violation is inherently cross-module must fire at both);
+//   3. a pair file: the violation twice INSIDE one file, wrapped in two
+//      functions (the billing.ts shape — identical chains in separate
+//      functions of one module, collapsed to one finding by a dedup keyed
+//      on normalized statement text).
+//
+// The pair file's bodies are transformed (exports stripped, imports
+// hoisted) so the two in-file copies stay byte-identical TO EACH OTHER —
+// which is exactly what a text-keyed dedup collapses. Assertions, counting
+// only the rules the fixture expected at that file (unrelated rules cannot
+// inflate a floor):
+//
+//   - original and twin must each independently reproduce the fixture's
+//     expected count;
+//   - when the witness fixture itself seeded TWO OR MORE expected findings
+//     in the one file (proof the check reports per-violation, not one
+//     verdict per file — openrouter's "no error check anywhere in the
+//     file" is a legitimate file-scoped claim), the pair file must yield
+//     at least 2x that count — UNLESS it yields zero, which is exempt by
+//     design: the pair wrap strips exports and nests bodies in functions,
+//     which can remove the very context a check needs (an export-keyed
+//     check cannot fire inside the pair file). Less-than-double but
+//     nonzero is the collapse signature — N identical violations in one
+//     file reduced to a single finding. Doctors whose every fixture
+//     seeds at most one violation per file get twin+original policing
+//     only and the probe row says so; the skill tells authors to seed a
+//     two-violation fixture so the probe can police same-file dedup.
+function buildDuplicateLocationProbe(fixtures) {
+    var _a;
+    // Witness selection: the flag-shaped fixture with the most expected
+    // findings in one seeded file — a 2-in-one-file witness catches per-file
+    // collapse directly; any 1-file witness still exercises the twin and
+    // pair locations.
+    let best = null;
+    for (const fixture of fixtures) {
+        const perFile = new Map();
+        for (const e of fixture.expected)
+            perFile.set(e.file, ((_a = perFile.get(e.file)) !== null && _a !== void 0 ? _a : 0) + 1);
+        for (const [file, count] of perFile) {
+            if (typeof fixture.seed[file] === "string" && (best === null || count > best.count)) {
+                best = { fixture, file, count };
+            }
+        }
+    }
+    if (best === null)
+        return null;
+    const { fixture, file: originalFile, count: expectedCount } = best;
+    // Rule-less expectations (no `rule` field) can only be matched by
+    // rule-less findings — key those as "" so the count filter keeps them.
+    const rules = new Set(fixture.expected
+        .filter((e) => e.file === originalFile)
+        .map((e) => { var _a; return (_a = e.rule) !== null && _a !== void 0 ? _a : ""; }));
+    const twinFile = "__probe_twin__/" + originalFile.split("/").pop();
+    const pairFile = "__probe_pair__/" + originalFile.split("/").pop();
+    if (typeof fixture.seed[twinFile] === "string" || typeof fixture.seed[pairFile] === "string")
+        return null;
+    const pairContent = pairFileContent(fixture.seed[originalFile]);
+    if (pairContent === null)
+        return null;
+    const seed = { ...fixture.seed, [twinFile]: fixture.seed[originalFile], [pairFile]: pairContent };
+    return {
+        seed,
+        fixtureName: fixture.name,
+        analysisOff: fixture.analysis === "off",
+        originalFile,
+        twinFile,
+        pairFile,
+        expectedCount,
+        rules,
+    };
+}
+// The in-file pair: the original content twice, each copy wrapped in a
+// function (module-level declarations cannot repeat, and both copies get
+// the identical transform so they stay byte-equal to each other).
+function pairFileContent(original) {
+    const lines = original.split("\n").filter((l) => !/^\s*import\b/.test(l) && !/^\s*export\s*\{/.test(l)
+        && !/^\s*export\s+type\s*\{/.test(l) && !/^\s*export\s+\*\s*from/.test(l));
+    const body = lines.map((l) => l
+        .replace(/^(\s*)export default (?=(?:async\s+)?(?:function|class)\b)/, "$1")
+        .replace(/^(\s*)export default /, "$1const __probeDefault = ")
+        .replace(/^(\s*)export (?=(?:async\s+)?(?:function|class|const|let|var|type|interface|enum|abstract|declare)\b)/, "$1")).join("\n");
+    if (body.trim().length === 0)
+        return null;
+    const imports = original.split("\n").filter((l) => /^\s*import\b/.test(l)).join("\n");
+    return [
+        imports,
+        imports ? "" : null,
+        "// any-doctor duplicate-location probe — copy 1",
+        "function __anyDoctorProbeA() {",
+        body,
+        "}",
+        "// copy 2 — same violation, different location, same file",
+        "function __anyDoctorProbeB() {",
+        body,
+        "}",
+        "",
+    ].filter((l) => l !== null).join("\n");
+}
+// The certification entry point: every policy, in gate order, as result
+// rows a verify frame can carry.
+export async function certify(mod, fixtures) {
+    var _a;
+    validateClaimContract(mod);
+    const results = [];
+    // Only a doctor whose checks declare analysis needs can have
+    // analysis-on sandboxes — probing anyone else would make a channel-less
+    // direct invocation fail fixtures that never touch analysis at all.
+    const declaresNeeds = contract.narrowedCheckIds(mod.meta).length > 0;
+    let analysisAvailable;
+    // The one skip policy (D25): an analysis-on sandbox whose engine is not
+    // installed here is an honest skip, not a failure — expectations belong
+    // to the full-power path. One decision for every policy that asks.
+    const skipFor = async (analysisOn) => {
+        if (!declaresNeeds || !analysisOn)
+            return false;
+        if (analysisAvailable === undefined) {
+            analysisAvailable = await inSandbox({}, async (tmp) => probeAnalysisAvailable(tmp));
+        }
+        return analysisAvailable === false;
+    };
+    for (const fixture of fixtures) {
+        try {
+            // The fixture's declared analysis mode: "off" forces the degraded
+            // path (pinning the narrowed behavior); the default "on" runs with
+            // the engine — and skips honestly when it is not installed here,
+            // rather than failing a fixture whose expectations belong to the
+            // full-power path.
+            setAnalysisDisabled(fixture.analysis === "off");
+            if (await skipFor(fixture.analysis !== "off")) {
+                results.push(skipRow(fixture.name));
+                continue;
+            }
+            // Verify always lists everything (includeTestsFor): the sandbox is
+            // the doctor's own world — a seed named *.test.ts is deliberate
+            // test data (effect-v4-doctor's sleep-in-test depends on it).
+            const result = await inSandbox(fixture.seed, (tmp) => runOnce(tmp, mod, { includeTests: true }));
+            const diff = contract.compareFindings(fixture.expected, result.findings);
+            results.push({ name: fixture.name, ok: diff.missing.length === 0 && diff.unexpected.length === 0, ...diff });
+        }
+        catch (e) {
+            results.push(errorRow(fixture.name, e));
+        }
+        finally {
+            setAnalysisDisabled(false);
+        }
+    }
+    // The shared innocent corpus (D23): files that look guilty but aren't —
+    // the audit counterexamples as commons. Every doctor runs against them
+    // with expected: []; a finding here is a false positive by definition,
+    // whoever wrote the check.
+    const innocentDir = corpusDir("innocent");
+    if (innocentDir !== null) {
+        const seed = {};
+        collectSeed(innocentDir, "", seed);
+        try {
+            const diff = await inSandbox(seed, (tmp) => runOnce(tmp, mod, { includeTests: true }))
+                .then((r) => contract.compareFindings([], r.findings));
+            results.push({
+                name: "shared innocent corpus (" + Object.keys(seed).length + " files)",
+                ok: diff.missing.length === 0 && diff.unexpected.length === 0,
+                ...diff,
+            });
+        }
+        catch (e) {
+            results.push(errorRow("shared innocent corpus", e));
+        }
+    }
+    // The duplicate-location sensitivity probe (D24).
+    const probe = buildDuplicateLocationProbe(fixtures);
+    if (probe !== null) {
+        const name = `duplicate-location sensitivity (from "${probe.fixtureName}")` + (probe.expectedCount < 2
+            ? " — no two-in-one-file witness: same-file collapse unpolicied"
+            : "");
+        if (await skipFor(!probe.analysisOff)) {
+            results.push(skipRow(name));
+        }
+        else {
+            try {
+                setAnalysisDisabled(probe.analysisOff);
+                const findings = await inSandbox(probe.seed, (tmp) => runOnce(tmp, mod, { includeTests: true }))
+                    .then((r) => r.findings);
+                const at = (file) => findings.filter((f) => { var _a; return f.file === file && probe.rules.has((_a = f.rule) !== null && _a !== void 0 ? _a : ""); }).length;
+                const problems = [];
+                if (at(probe.originalFile) < probe.expectedCount) {
+                    problems.push(`the untouched original no longer produces its ${probe.expectedCount} finding(s) — got ${at(probe.originalFile)}`);
+                }
+                if (at(probe.twinFile) < probe.expectedCount) {
+                    problems.push(`the byte-identical twin module produces ${at(probe.twinFile)} finding(s) where ${probe.expectedCount} expected — a dedup keyed on statement text collapses distinct violations sharing a body`);
+                }
+                if (probe.expectedCount >= 2 && at(probe.pairFile) > 0 && at(probe.pairFile) < probe.expectedCount * 2) {
+                    problems.push(`the same violation planted twice in ONE file yields ${at(probe.pairFile)} finding(s) — the collapse signature (N identical violations reduced to one; the billing.ts bug class)`);
+                }
+                results.push(problems.length === 0
+                    ? okRow(name)
+                    : { ...errorRow(name, problems.join("; ")), missing: [], unexpected: [] });
+            }
+            catch (e) {
+                results.push(errorRow(name, e));
+            }
+            finally {
+                setAnalysisDisabled(false);
+            }
+        }
+    }
+    // The sensitivity corpus (D24): the innocent corpus's complement —
+    // confirmed-real patterns from the audits, patterns that MUST produce
+    // findings. Each case directory carries its seed files plus an expect.json
+    // mapping doctor id -> expected findings; a doctor only runs the cases it
+    // has stakes in.
+    const sensDir = corpusDir("sensitivity");
+    if (sensDir !== null) {
+        for (const entry of fs.readdirSync(sensDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            if (!entry.isDirectory())
+                continue;
+            const caseDir = path.join(sensDir, entry.name);
+            const expectPath = path.join(caseDir, "expect.json");
+            if (!fs.existsSync(expectPath))
+                continue;
+            const name = `sensitivity: ${entry.name}`;
+            let manifest;
+            try {
+                manifest = JSON.parse(fs.readFileSync(expectPath, "utf8"));
+            }
+            catch (e) {
+                results.push({ ...okRow(name), ok: false, error: "unreadable expect.json: " + (e instanceof Error ? e.message : String(e)) });
+                continue;
+            }
+            const expected = (_a = manifest === null || manifest === void 0 ? void 0 : manifest.expect) === null || _a === void 0 ? void 0 : _a[String(mod.meta.id)];
+            if (!Array.isArray(expected))
+                continue;
+            try {
+                const seed = {};
+                collectSeed(caseDir, "", seed, "expect.json");
+                if (await skipFor(true)) {
+                    results.push(skipRow(name));
+                    continue;
+                }
+                const diff = await inSandbox(seed, (tmp) => runOnce(tmp, mod, { includeTests: true }))
+                    .then((r) => contract.compareFindings(expected, r.findings));
+                results.push({ name, ok: diff.missing.length === 0 && diff.unexpected.length === 0, ...diff });
+            }
+            catch (e) {
+                results.push(errorRow(name, e));
+            }
+        }
+    }
+    return results;
+}
+// A shipped corpus directory, resolved next to the compiled module (bin/'s
+// sibling fixtures/), or null when absent — an unbundled checkout still
+// certifies, just without the commons. ANY_DOCTOR_CORPUS_ROOT is the test
+// seam: tests point the harness at their own corpus trees instead of
+// planting synthetic stakes in the shipped commons.
+function corpusDir(name) {
+    const override = process.env.ANY_DOCTOR_CORPUS_ROOT;
+    if (override !== undefined && override !== "") {
+        const dir = path.join(path.resolve(override), name);
+        return fs.existsSync(dir) ? dir : null;
+    }
+    try {
+        const dir = fs.realpathSync(new URL("../fixtures/" + name, import.meta.url));
+        return fs.existsSync(dir) ? dir : null;
+    }
+    catch {
+        return null;
+    }
+}