create-principles-disciple 1.93.0 → 1.95.0

package/core/dist/runtime-v2/__tests__/architecture-regression.test.js

@@ -195,6 +195,16 @@ const REQUIRED_SOURCE_FILES = [
     'activation/approval-completion-service.ts',
     // PRI-431: L2 principle reader (pure logic, extracted from pd-cli + plugin duplicates)
     'build-l2-principle-reader.ts',
+    // PRI-446: pure logic migrated from openclaw-plugin into core
+    'evidence-triage/observation-resolver.ts',
+    'pain-gate/pain-diagnostic-gate-policy.ts',
+    'pain-gate/index.ts',
+    'detection/detection-funnel-policy.ts',
+    'detection/index.ts',
+    // PRI-470: IntentDecisionRecord durable store + types (SPEC §21.7)
+    'intent/intent-decision-record.ts',
+    'store/intent/sqlite-intent-decision-store.ts',
+    'store/intent/index.ts',
 ];
 // ── PRI-212: Plugin core anti-growth guard ────────────────────────────────────
 //
@@ -247,6 +257,9 @@ const KNOWN_PLUGIN_CORE_FILES = new Set([
     'schema/migration-runner.ts',
     'rule-host.ts',
     'principle-training-state.ts',
+    // PRI-446: now a thin adapter delegating pure decision logic to
+    // runtime-v2/pain-gate/pain-diagnostic-gate-policy.ts. Kept here because it
+    // owns the cooldown Map + SystemLogger + Date.now side effects.
     'pain-diagnostic-gate.ts',
     'hygiene/tracker.ts',
     'schema/migrations/002-init-central.ts',
@@ -289,6 +302,9 @@ const KNOWN_PLUGIN_CORE_FILES = new Set([
     'dictionary.ts',
     'thinking-os-parser.ts',
     'system-logger.ts',
+    // PRI-446: now a thin shell wiring DetectionFunnelCore (core runtime-v2/detection)
+    // with crypto.createHash + PainDictionary. Kept here because it owns the
+    // crypto + dictionary I/O boundary.
     'detection-funnel.ts',
     'risk-calculator.ts',
     'migration.ts',
@@ -298,6 +314,10 @@ const KNOWN_PLUGIN_CORE_FILES = new Set([
     'empathy-keyword-matcher.ts',
     'pain-lifecycle.ts',
     'session-tracker.ts',
+    // PRI-459: now a thin re-export adapter over @principles/core/principle-tree-ledger.
+    // Kept in the plugin baseline so existing relative imports (./principle-tree-ledger.js)
+    // still resolve. No parsing/serialization/mutation logic may live here — enforced by
+    // tests/ledger-schema-diff.test.ts.
     'principle-tree-ledger.ts',
     'evolution-logger.ts',
     'evolution-engine.ts',
@@ -309,6 +329,13 @@ const KNOWN_PLUGIN_CORE_FILES = new Set([
     'pd-config-loader.ts',
     // PRI-346: Pure function for checking conversation access config (extracted for circular import avoidance)
     'config-health.ts',
+    // PRI-467: Plugin I/O boundary — reads .principles/INTENT.md with TTL+mtime cache,
+    // delegates parsing/validation/hashing to @principles/core. Never throws.
+    'intent-doc-reader.ts',
+    // PRI-468: Plugin adapter implementing core IntentDocReader port — pure type
+    // mapping from safeReadIntentDoc result to the core-owned IntentDocReadResult.
+    // No new I/O; delegates to intent-doc-reader.ts above.
+    'intent-doc-reader-adapter.ts',
     // ── Test Files ──────────────────────────────────────────────────────────
     '__tests__/focus-history.test.ts',
     'principle-compiler/__tests__/compiler-replay-gate.test.ts',
@@ -350,7 +377,7 @@ describe('PRI-212 plugin core anti-growth guard', () => {
             expect.fail(msg);
         }
     });
-    it('known baseline count is self-consistent (97 files)', async () => {
+    it('known baseline count is self-consistent (93 files)', async () => {
         // Sanity check: if the baseline grows, update this number.
         // Prevents accidental baseline bloat from going unnoticed.
         // See docs/reviews/plugin-core-inventory-2026-05.md §7
@@ -361,7 +388,14 @@ describe('PRI-212 plugin core anti-growth guard', () => {
         // model-training-registry.ts, model-deployment-registry.ts,
         // shadow-observation-registry.ts (98 → 93)
         // PRI-449: Removed external-training-contract.ts (93 → 92)
-        expect(KNOWN_PLUGIN_CORE_FILES.size).toBe(92);
+        // PRI-446: pain-diagnostic-gate.ts and detection-funnel.ts remain at 92 —
+        // they are now thin adapters delegating pure logic to core, but still live
+        // in plugin src/core/ and own I/O side effects, so they stay classified.
+        // PRI-467: Added intent-doc-reader.ts (92 → 93) — plugin I/O boundary for
+        // reading .principles/INTENT.md with TTL+mtime cache for prompt injection.
+        // PRI-468: Added intent-doc-reader-adapter.ts (93 → 94) — plugin adapter
+        // implementing core IntentDocReader port (pure type mapping, no new I/O).
+        expect(KNOWN_PLUGIN_CORE_FILES.size).toBe(94);
     });
 });
 const REQUIRED_TEST_FILES = [
@@ -441,6 +475,11 @@ const REQUIRED_TEST_FILES = [
     '../internalization/__tests__/diag-chain-e2e.test.ts',
     // PRI-431
     'build-l2-principle-reader.test.ts',
+    // PRI-469
+    'evidence-chain-intent-tension.test.ts',
+    // PRI-470: IntentDecisionRecord types + SQLite store
+    '../intent/__tests__/intent-decision-record.test.ts',
+    '../store/intent/__tests__/sqlite-intent-decision-store.test.ts',
 ];
 const REQUIRED_DOC_FILES = [];
 for (const file of REQUIRED_SOURCE_FILES) {
@@ -506,6 +545,8 @@ describe('runtime-v2 public API (index.ts barrel)', () => {
         'buildL2PrincipleReaderFromLedger',
         // LLM output hardening — shared utility
         'stripFabricatedCorePrincipleIds',
+        // PRI-470: IntentDecisionRecord durable SQLite store
+        'SqliteIntentDecisionStore',
     ];
     for (const name of REQUIRED_EXPORTS) {
         it(`exports ${name}`, async () => {
@@ -597,6 +638,30 @@ describe('PRI-42 internalization boundary', () => {
             expect(src).not.toContain('../../../openclaw-plugin');
         }
     });
+    it('PRI-446: pain-gate has zero openclaw-plugin imports', async () => {
+        const { existsSync, readdirSync, readFileSync } = await import('node:fs');
+        const { resolve, join } = await import('node:path');
+        const dir = resolve(__dirname, '..', 'pain-gate');
+        expect(existsSync(dir)).toBe(true);
+        const files = readdirSync(dir).filter((f) => f.endsWith('.ts') && !f.endsWith('.test.ts'));
+        for (const file of files) {
+            const src = readFileSync(join(dir, file), 'utf-8');
+            expect(src).not.toContain('openclaw-plugin');
+            expect(src).not.toContain('../../../openclaw-plugin');
+        }
+    });
+    it('PRI-446: detection has zero openclaw-plugin imports', async () => {
+        const { existsSync, readdirSync, readFileSync } = await import('node:fs');
+        const { resolve, join } = await import('node:path');
+        const dir = resolve(__dirname, '..', 'detection');
+        expect(existsSync(dir)).toBe(true);
+        const files = readdirSync(dir).filter((f) => f.endsWith('.ts') && !f.endsWith('.test.ts'));
+        for (const file of files) {
+            const src = readFileSync(join(dir, file), 'utf-8');
+            expect(src).not.toContain('openclaw-plugin');
+            expect(src).not.toContain('../../../openclaw-plugin');
+        }
+    });
     it('plugin does not re-define RuleHost contract types locally', async () => {
         const { existsSync, readFileSync } = await import('node:fs');
         const { resolve } = await import('node:path');
@@ -1598,6 +1663,16 @@ describe('PRI-75/PRI-74/PRI-81 prompt-builder core boundary', () => {
         // Must NOT have the old multi-line fallback block with attitudeDirective interpolation
         expect(src).not.toMatch(/## 【CONTEXT SECTIONS】\n\n\[WARNING: Context sections stripped/);
     });
+    it('plugin prompt-helpers.ts imports escapeXml from core, not reimplemented', async () => {
+        const { readFileSync } = await import('node:fs');
+        const { resolve } = await import('node:path');
+        const src = readFileSync(resolve(__dirname, '../../../../openclaw-plugin/src/hooks/prompt-helpers.ts'), 'utf-8');
+        // Must import escapeXml from core
+        expect(src).toContain('@principles/core/prompt-builder');
+        expect(src).toMatch(/import\s*\{[^}]*escapeXml[^}]*\}\s*from\s*['"]@principles\/core\/prompt-builder['"]/);
+        // Must NOT reimplement escapeXml inline
+        expect(src).not.toMatch(/\b(function\s+escapeXml\s*\(|const\s+escapeXml\s*=\s*(?:async\s*)?(?:\([^)]*\)|[a-zA-Z_$][\w$]*)\s*=>)/);
+    });
     it('plugin empathy-keyword-matcher.ts is a thin adapter (re-exports from core)', async () => {
         const { readFileSync } = await import('node:fs');
         const { resolve } = await import('node:path');
@@ -1755,6 +1830,19 @@ describe('PRI-111 ArtificerRunner boundary', () => {
         expect(src).toContain('ArtificerRuleOutputSchema');
     });
 });
+// ── PRI-458: PhilosopherRunner barrel boundary (MVP-Quiet) ─────────────────────
+describe('PRI-458 PhilosopherRunner barrel boundary', () => {
+    it('BARREL_EXPORTS: internalization/index.ts does NOT export PhilosopherRunner (PRI-458 MVP-Quiet)', async () => {
+        // PRI-458: PhilosopherRunner is de-surfaced from the internal barrel (MVP-Quiet).
+        // It remains in runtime-v2/index.ts (public barrel) because rulehost-pipeline-runner.ts
+        // imports it from there (EP-02 exception).
+        const { readFileSync } = await import('node:fs');
+        const { resolve } = await import('node:path');
+        const src = readFileSync(resolve(__dirname, '..', 'internalization', 'index.ts'), 'utf-8');
+        expect(src).not.toContain("from './philosopher-runner.js'");
+        expect(src).not.toContain("from './philosopher-output.js'");
+    });
+});
 // ── PRI-EVAL: EvaluatorRunner boundary guards ──────────────────────────────────
 describe('PRI-EVAL EvaluatorRunner boundary', () => {
     it('evaluator source files exist in internalization directory', async () => {
@@ -1795,13 +1883,17 @@ describe('PRI-EVAL EvaluatorRunner boundary', () => {
         expect(src).not.toContain('node:fs');
         expect(src).not.toContain('node:cron');
     });
-    it('BARREL_EXPORTS: internalization/index.ts exports EvaluatorRunner and EvaluatorOutput', async () => {
+    it('BARREL_EXPORTS: internalization/index.ts does NOT export EvaluatorRunner (PRI-458 MVP-Quiet)', async () => {
+        // PRI-458: EvaluatorRunner is de-surfaced from the internal barrel (MVP-Quiet).
+        // It remains in runtime-v2/index.ts (public barrel) because rulehost-pipeline-runner.ts
+        // imports it from there (EP-02 exception). These negative assertions lock the boundary:
+        // if someone re-aggregates the evaluator exports into this barrel, the test will fail.
         const { readFileSync } = await import('node:fs');
         const { resolve } = await import('node:path');
         const src = readFileSync(resolve(__dirname, '..', 'internalization', 'index.ts'), 'utf-8');
-        expect(src).toContain('EvaluatorRunner');
-        expect(src).toContain('EvaluatorOutput');
-        expect(src).toContain('DefaultEvaluatorValidator');
+        expect(src).not.toContain("from './evaluator-runner.js'");
+        expect(src).not.toContain("from './evaluator-output.js'");
+        expect(src).not.toContain("from './evaluator-prompt-builder.js'");
     });
     it('SCHEMA_REGISTRY: pi-ai-runtime-adapter.ts registers evaluator-output-v1 schema', async () => {
         const { readFileSync } = await import('node:fs');
@@ -1851,13 +1943,16 @@ describe('PRI-RR RolloutReviewerRunner boundary', () => {
         expect(src).not.toContain('node:fs');
         expect(src).not.toContain('node:cron');
     });
-    it('BARREL_EXPORTS: internalization/index.ts exports RolloutReviewerRunner and RolloutReviewerOutput', async () => {
+    it('BARREL_EXPORTS: internalization/index.ts does NOT export RolloutReviewerRunner (PRI-458 MVP-Quiet)', async () => {
+        // PRI-458: RolloutReviewerRunner is de-surfaced from the internal barrel (MVP-Quiet).
+        // It remains in runtime-v2/index.ts (public barrel) because runtime-internalization-run-once.ts
+        // imports it from there and package.json has no deep import path available (EP-02 exception).
         const { readFileSync } = await import('node:fs');
         const { resolve } = await import('node:path');
         const src = readFileSync(resolve(__dirname, '..', 'internalization', 'index.ts'), 'utf-8');
-        expect(src).toContain('RolloutReviewerRunner');
-        expect(src).toContain('RolloutReviewerOutput');
-        expect(src).toContain('DefaultRolloutReviewerValidator');
+        expect(src).not.toContain("from './rollout-reviewer-runner.js'");
+        expect(src).not.toContain("from './rollout-reviewer-output.js'");
+        expect(src).not.toContain("from './rollout-reviewer-prompt-builder.js'");
     });
     it('SCHEMA_REGISTRY: pi-ai-runtime-adapter.ts registers rollout-reviewer-output-v1 schema', async () => {
         const { readFileSync } = await import('node:fs');
@@ -2127,12 +2222,14 @@ describe('PRI-117 Nocturnal god-class freeze', () => {
             expect(src).not.toContain('invokeStubScribe');
         }
     });
-    it('RUNTIME_V2_USES_PEER_RUNNERS: DreamerRunner/PhilosopherRunner/ScribeRunner are the canonical entry points', async () => {
+    it('RUNTIME_V2_USES_PEER_RUNNERS: DreamerRunner/ScribeRunner/ArtificerRunner are the canonical MVP-Core entry points', async () => {
+        // PRI-458: narrowed to MVP-Core runners only. PhilosopherRunner (MVP-Quiet)
+        // remains in runtime-v2/index.ts for rulehost-pipeline-runner.ts compatibility
+        // but is no longer asserted as a canonical entry point.
         const { readFileSync } = await import('node:fs');
         const { resolve } = await import('node:path');
         const src = readFileSync(resolve(__dirname, '..', 'index.ts'), 'utf-8');
         expect(src).toContain('DreamerRunner');
-        expect(src).toContain('PhilosopherRunner');
         expect(src).toContain('ScribeRunner');
         expect(src).toContain('ArtificerRunner');
     });
@@ -2878,7 +2975,7 @@ describe('PRI-225: No unsafe type assertions on untrusted metadata arrays', () =
 // ── PRI-239: Feature flag registry architecture boundary ──────────────────
 //
 // Core: packages/principles-core/src/runtime-v2/feature-flags/feature-flag-contract.ts
-// I/O Loader: packages/pd-cli/src/services/feature-flag-loader.ts
+// I/O Loader: packages/pd-cli/src/services/pd-config-loader.ts (PRI-460: replaced feature-flag-loader.ts)
 // CLI Command: packages/pd-cli/src/commands/runtime-features.ts
 // Consumption: packages/pd-cli/src/commands/runtime-canary.ts (GFI check)
 describe('PRI-239: Feature flag registry architecture boundary', () => {
@@ -2900,10 +2997,10 @@ describe('PRI-239: Feature flag registry architecture boundary', () => {
         expect(src).not.toContain('InternalizationOrchestrator');
         expect(src).not.toContain('SqliteConnection');
     });
-    it('IO_LOADER_OUTSIDE_CORE: I/O loader exists at pd-cli/src/services/feature-flag-loader.ts', async () => {
+    it('IO_LOADER_OUTSIDE_CORE: I/O loader exists at pd-cli/src/services/pd-config-loader.ts', async () => {
         const { existsSync } = await import('node:fs');
         const { resolve } = await import('node:path');
-        expect(existsSync(resolve(__dirname, '../../../../pd-cli/src/services/feature-flag-loader.ts'))).toBe(true);
+        expect(existsSync(resolve(__dirname, '../../../../pd-cli/src/services/pd-config-loader.ts'))).toBe(true);
     });
     it('CLI_COMMAND_OUTSIDE_CORE: CLI command exists at pd-cli/src/commands/runtime-features.ts', async () => {
         const { existsSync } = await import('node:fs');
@@ -2918,12 +3015,12 @@ describe('PRI-239: Feature flag registry architecture boundary', () => {
         expect(src).not.toContain('nocturnal-arbiter');
         expect(src).not.toContain('nocturnal-service');
     });
-    it('CONSUMPTION_WIRED: runtime-canary.ts imports feature flag loader', async () => {
+    it('CONSUMPTION_WIRED: runtime-canary.ts imports canonical PD config loader', async () => {
         const { readFileSync } = await import('node:fs');
         const { resolve } = await import('node:path');
         const src = readFileSync(resolve(__dirname, '../../../../pd-cli/src/commands/runtime-canary.ts'), 'utf-8');
-        expect(src).toContain('feature-flag-loader');
-        expect(src).toContain('loadEffectiveFeatureFlags');
+        expect(src).toContain('pd-config-loader');
+        expect(src).toContain('loadPdConfig');
     });
 });
 describe('PRI-304: PD-Owned Config Contract barrel exports and purity', () => {
@@ -3121,33 +3218,31 @@ describe('PRI-443: pure module boundary guards', () => {
         expect(src).not.toMatch(/export\s+type\s+\{\s*LedgerTreeStore\s*\}\s*from\s*['"]\.\.\/principle-tree-ledger\.js['"]/);
     });
 });
-// ── PRI-450: Core I/O whitelist guard ──────────────────────────────────────────
-//
-// Scans all production (.ts, non-test) files under packages/principles-core/src/
-// for fs/path imports and verifies they match an explicit whitelist. Any new file
-// that needs I/O must be added to ALLOWED_IO_FILES here — otherwise CI fails.
-// This forces developers to explain "why does this file need I/O?" in their PR.
-describe('PRI-450: core I/O whitelist guard', () => {
-    // Whitelist of production files allowed to import fs/path.
-    // Paths are relative to packages/principles-core/src/.
-    const ALLOWED_IO_FILES = new Set([
-        'principle-tree-ledger.ts',
-        'evolution-store.ts',
-        'trajectory-store.ts',
-        'workflow-funnel-loader.ts',
-        'runtime-v2/store/sqlite-connection.ts',
-        'runtime-v2/store/runtime-state-manager.ts',
-        'runtime-v2/adapter/openclaw-cli-runtime-adapter.ts',
-        'runtime-v2/candidate-audit.ts',
-        'runtime-v2/pain-signal-observability.ts',
-        'runtime-v2/internalization-chain-integrity-read-model.ts',
-        'runtime-v2/internalization-integrity-remediation.ts',
-        'runtime-v2/operator-health-read-model.ts',
-        'runtime-v2/pain-chain-read-model.ts',
-        'runtime-v2/pruning-read-model.ts',
-        'runtime-v2/pruning-review-log.ts',
-        'runtime-v2/schema-conformance-read-model.ts',
-    ]);
+describe('PRI-450 / PRI-462: core I/O seam registry guard', () => {
+    // Registry lives at packages/principles-core/io-seam-registry.json
+    // (3 levels up from __tests__: __tests__ → runtime-v2 → src → principles-core)
+    const registryPath = pathSync.resolve(__dirname, '..', '..', '..', 'io-seam-registry.json');
+    const registryRaw = fsSync.readFileSync(registryPath, 'utf-8');
+    const registry = JSON.parse(registryRaw);
+    // Runtime-validate the registry shape (Runtime Contract Rule 1+2: treat
+    // parsed JSON as unknown, validate with typeof/Array.isArray before access).
+    // `as` is used only for type narrowing AFTER runtime checks, not to bypass them.
+    function isValidRegistry(v) {
+        if (typeof v !== 'object' || v === null || !Object.hasOwn(v, 'seams'))
+            return false;
+        const { seams } = v;
+        if (!Array.isArray(seams))
+            return false;
+        return seams.every((s) => typeof s === 'object' && s !== null &&
+            typeof s.name === 'string' &&
+            typeof s.description === 'string' &&
+            Array.isArray(s.files) &&
+            s.files.every((f) => typeof f === 'string'));
+    }
+    // Flatten all registry files into a Set (relative to packages/principles-core/src/).
+    const ALLOWED_IO_FILES = new Set(isValidRegistry(registry)
+        ? registry.seams.flatMap((s) => s.files)
+        : []);
     // Extract all import module paths from source code.
     // Handles: import ... from 'mod', import 'mod' (side-effect), and multiline imports.
     // Reuses the same pattern proven in the PRI-215 extractImportModulePaths helper.
@@ -3186,7 +3281,52 @@ describe('PRI-450: core I/O whitelist guard', () => {
             }
         }
     }
-    it('core/src/ production files: only whitelisted files import fs/path', () => {
+    // ── Registry validity (PRI-462) ───────────────────────────────────────────
+    it('io-seam-registry.json is valid: seams array with name/description/files', () => {
+        expect(isValidRegistry(registry)).toBe(true);
+        if (!isValidRegistry(registry))
+            return; // type narrowing
+        expect(registry.seams.length).toBeGreaterThan(0);
+        for (const seam of registry.seams) {
+            expect(seam.name.length).toBeGreaterThan(0);
+            expect(seam.description.length).toBeGreaterThan(0);
+            expect(seam.files.length).toBeGreaterThan(0);
+        }
+    });
+    it('registry has no duplicate files across seams', () => {
+        if (!isValidRegistry(registry)) {
+            // isValidRegistry test above will fail with details; skip here.
+            expect(isValidRegistry(registry)).toBe(true);
+            return;
+        }
+        const seen = new Set();
+        const dupes = [];
+        for (const seam of registry.seams) {
+            for (const f of seam.files) {
+                if (seen.has(f))
+                    dupes.push(f);
+                seen.add(f);
+            }
+        }
+        expect(dupes).toEqual([]);
+    });
+    it('every seam description explains why the I/O is allowed (non-trivial)', () => {
+        if (!isValidRegistry(registry)) {
+            expect(isValidRegistry(registry)).toBe(true);
+            return;
+        }
+        const weak = [];
+        for (const seam of registry.seams) {
+            // Description must be at least 20 chars — a single word like "legacy" is
+            // not an explanation. This forces maintainers to write a real rationale.
+            if (seam.description.trim().length < 20) {
+                weak.push(`${seam.name}: "${seam.description}"`);
+            }
+        }
+        expect(weak).toEqual([]);
+    });
+    // ── Registry ↔ production files (PRI-450, EP-02) ──────────────────────────
+    it('core/src/ production files: only registry-listed files import fs/path', () => {
         const coreSrcDir = pathSync.resolve(__dirname, '..', '..');
         const allFiles = [];
         collectTsFiles(coreSrcDir, allFiles);
@@ -3200,9 +3340,13 @@ describe('PRI-450: core I/O whitelist guard', () => {
                 }
             }
         }
-        expect(violations).toEqual([]);
+        if (violations.length > 0) {
+            throw new Error(`Found ${violations.length} file(s) importing fs/path that are NOT in io-seam-registry.json.\n` +
+                `Add them to the appropriate seam in packages/principles-core/io-seam-registry.json.\n` +
+                `Violations:\n  ` + violations.join('\n  '));
+        }
     });
-    it('ALLOWED_IO_FILES whitelist entries all exist on disk', () => {
+    it('registry-listed files all exist on disk', () => {
         const coreSrcDir = pathSync.resolve(__dirname, '..', '..');
         const missing = [];
         for (const relPath of ALLOWED_IO_FILES) {
@@ -3213,6 +3357,19 @@ describe('PRI-450: core I/O whitelist guard', () => {
         }
         expect(missing).toEqual([]);
     });
+    // ── Registry ↔ ESLint exemption (PRI-462, EP-06 single source of truth) ───
+    //
+    // ESLint's no-restricted-imports exemption list must be DERIVED from the
+    // registry, not hand-maintained. This test verifies eslint.config.js
+    // references the registry file, proving the two stay in sync.
+    it('eslint.config.js derives fs/path exemption from the registry (no shadow list)', () => {
+        const eslintPath = pathSync.resolve(__dirname, '..', '..', '..', '..', '..', 'eslint.config.js');
+        const eslintSrc = fsSync.readFileSync(eslintPath, 'utf-8');
+        // The eslint config must read the registry JSON — if this reference is
+        // removed, someone has reintroduced a hand-maintained shadow list.
+        expect(eslintSrc).toContain('io-seam-registry.json');
+    });
+    // ── Helper unit tests ─────────────────────────────────────────────────────
     it('importsFsOrPath detects sub-path imports (fs/promises) and side-effect imports', () => {
         // Sub-path import
         expect(importsFsOrPath(`import { mkdir } from 'node:fs/promises';`)).toBe(true);