dsh-standards 0.0.2 → 1.0.0

package/40-checker/src/report.mjs

@@ -0,0 +1,204 @@
+import path from 'node:path'
+
+export const PACKAGE_MANDATORY = [
+  'DSC-01', 'DSC-02', 'DSC-04', 'DSC-05', 'DSC-06', 'DSC-07', 'DSC-08', 'DSC-09', 'DSC-11', 'DSC-12', 'DSC-13',
+]
+export const LISTING_MANDATORY = [...PACKAGE_MANDATORY, 'DSC-03']
+export const MVP_CHECKS = ['DSC-01', 'DSC-02', 'DSC-04', 'DSC-05', 'DSC-06', 'DSC-07', 'DSC-08', 'DSC-09']
+export const STATIC_MANDATORY = ['DSC-01', 'DSC-02', 'DSC-03', 'DSC-11', 'DSC-12', 'DSC-13']
+export const ENTRY_RUN = ['DSC-01', 'DSC-02', 'DSC-03', 'DSC-11', 'DSC-12', 'DSC-13', 'DSC-14']
+export const ENTRY_BLOCKING = ['C-1.1', 'C-1.2', 'C-1.4', 'C-3.1', 'C-3.2', 'C-3.5']
+export const ENTRY_RUNTIME_BLOCKING = [...ENTRY_BLOCKING, 'C-2.2', 'C-2.3']
+
+function mandatoryFor(scope, profile, staticOnly, entryClaim) {
+  if (scope === 'mvp') return MVP_CHECKS
+  if (scope === 'entry') return ENTRY_RUN.filter(id => (entryClaim !== 'static' || id !== 'DSC-14') && (id !== 'DSC-03' || profile === 'listing' || profile === 'both'))
+  if (staticOnly) return STATIC_MANDATORY
+  return profile === 'listing' || profile === 'both' ? LISTING_MANDATORY : PACKAGE_MANDATORY
+}
+
+function adjustEntryCheck(item, entryClaim) {
+  if (['DSC-11', 'DSC-12', 'DSC-13'].includes(item.id) && item.result === 'FAIL') {
+    return { ...item, result: 'WARN', reason: 'entry treats safety/brand fields as WARN; they do not block loadability' }
+  }
+  if (item.id !== 'DSC-02' || item.result !== 'FAIL') return item
+  const details = item.details ?? []
+  if (entryClaim === 'static') return { ...item, result: 'WARN', reason: 'entry static claim: version declaration is WARN, not blocking' }
+  const hard = details.some(detail => detail.result === 'FAIL' && ['C-2.2', 'C-2.3'].includes(detail.item))
+  if (hard) return item
+  return { ...item, result: 'WARN', reason: 'C-2.1 version declaration missing/invalid; entry treats it as WARN (C-2.2/C-2.3 remain blocking)' }
+}
+
+function allowedNa(check, scope, profile, kind) {
+  if (check.result !== 'NA') return false
+  if (check.id === 'DSC-03' && scope !== 'mvp' && profile === 'package') return true
+  if (check.id === 'DSC-14' && ['client', 'preset', 'skill', 'theme', 'mcp-config', 'unknown'].includes(kind)) return true
+  if (['DSC-04', 'DSC-05', 'DSC-06', 'DSC-07', 'DSC-08', 'DSC-09'].includes(check.id) && ['bundle', 'client', 'preset', 'skill', 'theme', 'mcp-config', 'unknown'].includes(kind)) return true
+  return false
+}
+
+export function buildReport({ subject, anchor, checks, g4 = null, scope, profile, kind, staticOnly = false, entryRuntime = 'require', entryClaim = 'runtime' }) {
+  const mandatory = mandatoryFor(scope, profile, staticOnly, entryClaim)
+  const adjustedChecks = scope === 'entry' ? checks.map(item => adjustEntryCheck(item, entryClaim)) : checks
+  const runtimeIds = new Set(['DSC-04', 'DSC-05', 'DSC-06', 'DSC-07', 'DSC-08', 'DSC-09'])
+  const effectiveChecks = staticOnly
+    ? adjustedChecks.map(item => runtimeIds.has(item.id) ? { ...item, result: 'NA', coverage: 'not-run', reason: 'out of scope for M1 static-only' } : item)
+    : adjustedChecks
+  const byId = new Map(effectiveChecks.map(item => [item.id, item]))
+  const selected = mandatory.map(id => byId.get(id)).filter(Boolean)
+  const missing = mandatory.filter(id => !byId.has(id))
+  const failed = selected.filter(item => item.result === 'FAIL')
+  const errored = selected.filter(item => item.result === 'ERROR')
+  const notRun = selected.filter(item => !allowedNa(item, scope, profile, kind) && (item.coverage === 'not-run' || item.coverage === 'partial'))
+  const notRunIds = [...new Set([...missing, ...errored.map(item => item.id), ...notRun.map(item => item.id)])]
+  const warnings = selected.filter(item => item.result === 'WARN')
+  const pass = selected.filter(item => item.result === 'PASS')
+
+  let status
+  let exitCode
+  if (failed.length > 0) { status = 'fail'; exitCode = 1 }
+  else if (notRunIds.length > 0) { status = 'incomplete'; exitCode = 2 }
+  else if (warnings.length > 0) { status = 'warn'; exitCode = 0 }
+  else { status = 'pass'; exitCode = 0 }
+
+  let level = null
+  if (scope === 'entry') {
+    const run = byId.get('DSC-14')
+    if (entryClaim === 'static') {
+      level = (status === 'pass' || status === 'warn') ? `DSH-ENTRY recognized${status === 'warn' ? ' (warnings)' : ''}` : null
+    } else if ((status === 'pass' || status === 'warn') && run?.result === 'PASS') {
+      level = `DSH-ENTRY runtime${entryRuntime === 'server-entry' ? ' (server-entry)' : ''}${status === 'warn' ? ' (warnings)' : ''}`
+    } else if (status === 'pass' || status === 'warn') {
+      level = `DSH-ENTRY static${status === 'warn' ? ' (warnings)' : ''}`
+    }
+  } else if (scope !== 'mvp' && (status === 'pass' || status === 'warn')) {
+    const suffix = status === 'warn' ? ', warnings' : ''
+    level = staticOnly ? `DS-C static${status === 'warn' ? ' (warnings)' : ''}` : profile === 'listing' || profile === 'both' ? `DS-C (listing${suffix})` : `DS-C (package${suffix})`
+  }
+
+  const reasonParts = []
+  if (failed.length > 0) reasonParts.push(`FAIL: ${failed.map(item => item.id).join(', ')}`)
+  if (notRunIds.length > 0) reasonParts.push(`not run: ${notRunIds.join(', ')}`)
+  if (warnings.length > 0) reasonParts.push(`WARN: ${warnings.map(item => item.id).join(', ')}`)
+
+  return {
+    schema: 'dsh-conformance/1',
+    standard: { id: 'DS-C', version: '1.0.0' },
+    subject,
+    anchor,
+    g4,
+    checks: effectiveChecks,
+    coverage: {
+      mandatory: mandatory.length,
+      pass: pass.length,
+      warn: warnings.length,
+      fail: failed.length,
+      na: selected.filter(item => item.result === 'NA').length,
+      notRun: notRunIds.length,
+      error: errored.length,
+      entryBlocking: scope === 'entry' ? (() => {
+        const blocking = entryClaim === 'static' ? ENTRY_BLOCKING : ENTRY_RUNTIME_BLOCKING
+        const failedItems = effectiveChecks.flatMap(item => (item.details ?? []).filter(detail => detail.result === 'FAIL' && blocking.includes(detail.item)).map(detail => detail.item))
+        return { required: blocking.length, failed: failedItems, pass: failedItems.length === 0 }
+      })() : null,
+    },
+    conclusion: {
+      level,
+      status,
+      exitCode,
+      profile,
+      scope,
+      subset: scope === 'mvp' ? 'MVP-13' : null,
+      staticOnly,
+      entryRuntime: scope === 'entry' ? entryRuntime : null,
+      entryClaim: scope === 'entry' ? entryClaim : null,
+      reason: reasonParts.join('; '),
+    },
+  }
+}
+
+const ICON = { PASS: 'PASS', WARN: 'WARN', FAIL: 'FAIL', NA: 'NA  ', ERROR: 'ERR ' }
+
+export function formatText(report) {
+  const lines = []
+  const { subject, anchor, conclusion, coverage } = report
+  lines.push(`DS-C check — ${subject.name ?? '<unknown>'}@${subject.version ?? '?'} (${subject.kind}${subject.kindInferred ? ', inferred' : ''})`)
+  lines.push(`anchor: repo=${anchor.repo} commit=${anchor.commit.slice(0, 12)} dsh=${anchor.dsh} cordis=${anchor.cordis}`)
+  lines.push(`scope=${conclusion.scope} profile=${conclusion.profile} status=${conclusion.status} exit=${conclusion.exitCode}${conclusion.subset ? ` subset=${conclusion.subset}` : ''}${conclusion.staticOnly ? ' static-only' : ''}`)
+  if (conclusion.level) lines.push(`level: ${conclusion.level}`)
+  lines.push('')
+  lines.push('id      result  clause  layer   reason')
+  for (const item of report.checks) {
+    const reason = (item.reason || '').replace(/\s+/g, ' ').slice(0, 120)
+    lines.push(`${item.id.padEnd(7)} ${ICON[item.result] ?? item.result}  ${item.clause.padEnd(6)} ${item.layer.padEnd(6)} ${reason}`)
+    for (const detail of item.details ?? []) {
+      if (detail.result === 'PASS') continue
+      lines.push(`        - ${detail.item}: ${detail.result} ${String(detail.reason).slice(0, 140)}`)
+    }
+  }
+  lines.push('')
+  lines.push(`coverage: mandatory=${coverage.mandatory} pass=${coverage.pass} warn=${coverage.warn} fail=${coverage.fail} na=${coverage.na} notRun=${coverage.notRun}`)
+  if (conclusion.reason) lines.push(`reason: ${conclusion.reason}`)
+  if (conclusion.status === 'incomplete') lines.push('NOT A DS-C PASS: at least one mandatory check did not run (see notRun).')
+  lines.push('')
+  return `${lines.join('\n')}\n`
+}
+
+function sarifLevel(item) {
+  if (item.result === 'FAIL' || item.result === 'ERROR') return 'error'
+  if (item.result === 'WARN') return 'warning'
+  return 'note'
+}
+
+function locationOf(item) {
+  const evidence = item.evidence?.find(value => /^[^:]+:\d+$/.test(value))
+  if (!evidence) return undefined
+  const index = evidence.lastIndexOf(':')
+  const file = evidence.slice(0, index)
+  const line = Number(evidence.slice(index + 1))
+  return {
+    physicalLocation: {
+      artifactLocation: { uri: file.replace(/\\/g, '/') },
+      region: { startLine: Number.isFinite(line) && line > 0 ? line : 1 },
+    },
+  }
+}
+
+export function formatSarif(report) {
+  const rules = report.checks.map(item => ({
+    id: item.id,
+    name: item.id,
+    shortDescription: { text: `${item.clause} ${item.layer}` },
+    fullDescription: { text: `${item.clause} conformance check; coverage=${item.coverage}${item.advisory ? '; advisory' : ''}` },
+    properties: { clause: item.clause, layer: item.layer, coverage: item.coverage, advisory: item.advisory === true },
+  }))
+  const results = report.checks
+    .filter(item => item.result !== 'PASS' && item.result !== 'NA')
+    .map(item => ({
+      ruleId: item.id,
+      level: sarifLevel(item),
+      message: { text: item.reason || `${item.result} ${item.clause}` },
+      locations: locationOf(item) ? [locationOf(item)] : [],
+      properties: { clause: item.clause, result: item.result, coverage: item.coverage, advisory: item.advisory === true },
+    }))
+  return {
+    $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+    version: '2.1.0',
+    runs: [{
+      tool: { driver: { name: 'dsh-plugin-verify', version: '0.1.0', informationUri: 'https://github.com/dsh-community/dsh-plugin-verify', rules } },
+      properties: { standard: report.standard, anchor: report.anchor, conclusion: report.conclusion, subject: report.subject },
+      results,
+    }],
+  }
+}
+
+export function writeReport(report, format) {
+  if (format === 'json') return JSON.stringify(report, null, 2)
+  if (format === 'sarif') return JSON.stringify(formatSarif(report), null, 2)
+  return formatText(report)
+}
+
+export function defaultOutPath(dir, format) {
+  const extension = format === 'json' ? 'json' : format === 'sarif' ? 'sarif' : 'txt'
+  return path.join(dir, `dsh-ds-c.${extension}`)
+}

package/40-checker/src/result.mjs

@@ -0,0 +1,60 @@
+/** Shared result shape for every check. */
+
+/**
+ * @param {object} input
+ * @param {string} input.id
+ * @param {string} input.clause
+ * @param {string} input.layer
+ * @param {'PASS'|'WARN'|'FAIL'|'NA'|'ERROR'} input.result
+ * @param {string} [input.reason]
+ * @param {string[]} [input.evidence]
+ * @param {object[]} [input.details]
+ * @param {'full'|'partial'|'not-run'} [input.coverage]
+ * @param {'M'|'M+H'|'H'} [input.method]
+ * @param {boolean} [input.advisory]
+ */
+export function check(input) {
+  return {
+    id: input.id,
+    clause: input.clause,
+    layer: input.layer,
+    result: input.result,
+    coverage: input.coverage ?? (input.result === 'NA' ? 'not-run' : 'full'),
+    reason: input.reason ?? '',
+    evidence: input.evidence ?? [],
+    details: input.details ?? [],
+    method: input.method ?? 'M',
+    advisory: input.advisory === true,
+  }
+}
+
+/**
+ * @param {string} item e.g. "C-1.1"
+ * @param {'PASS'|'WARN'|'FAIL'|'NA'|'ERROR'} result
+ * @param {string} reason
+ * @param {string[]} [evidence]
+ */
+export function detail(item, result, reason, evidence = []) {
+  return { item, result, reason, evidence }
+}
+
+const RANK = { ERROR: 5, FAIL: 4, WARN: 3, PASS: 2, NA: 1 }
+
+export function worst(results) {
+  let current = 'NA'
+  for (const result of results) {
+    if (!result) continue
+    if (RANK[result] > RANK[current]) current = result
+  }
+  return current
+}
+
+export function countByResult(checks) {
+  const counts = { PASS: 0, WARN: 0, FAIL: 0, NA: 0, ERROR: 0 }
+  for (const item of checks) counts[item.result] = (counts[item.result] ?? 0) + 1
+  return counts
+}
+
+export function notRun(check, reason) {
+  return { ...check, result: 'ERROR', coverage: 'not-run', reason }
+}

package/40-checker/src/runtime.mjs

@@ -0,0 +1,299 @@
+import path from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { check, detail, worst } from './result.mjs'
+import { regexHits } from './util.mjs'
+
+const ACTIVE = 2
+
+function classifyImportError(message) {
+  const missing = /Cannot find (?:module|package) ['"]([^'"]+)['"]/.exec(message)
+  if (missing) {
+    const specifier = missing[1]
+    // A missing relative file is a packaging bug; a missing bare package is
+    // an environment/host-farm gap (the checker cannot tell whether the
+    // package manager would have installed it).
+    return specifier.startsWith('.') || specifier.startsWith('/') ? 'fail' : 'blocked'
+  }
+  if (/timed out/.test(message)) return 'blocked'
+  return 'fail'
+}
+
+function makeStub() {
+  const fn = function stub() {}
+  return new Proxy(fn, {
+    get(_target, property) {
+      if (property === 'then') return undefined
+      if (property === 'toJSON') return () => ({})
+      if (property === Symbol.toPrimitive) return () => ''
+      if (property === Symbol.iterator) return function* empty() {}
+      return makeStub()
+    },
+    apply() { return makeStub() },
+    construct() { return makeStub() },
+  })
+}
+
+function withTimeout(promise, timeoutMs, label) {
+  let timer
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error(`${label} timed out after ${timeoutMs}ms`)), timeoutMs)
+    if (typeof timer.unref === 'function') timer.unref()
+  })
+  return Promise.race([promise, timeout]).finally(() => clearTimeout(timer))
+}
+
+function declaredInject(module) {
+  const value = module?.inject ?? module?.default?.inject
+  if (Array.isArray(value)) return value.filter(item => typeof item === 'string')
+  if (value && typeof value === 'object') return Object.keys(value)
+  return []
+}
+
+function declaredProvide(module) {
+  const value = module?.provide ?? module?.default?.provide
+  if (typeof value === 'string') return [value]
+  if (Array.isArray(value)) return value.filter(item => typeof item === 'string')
+  return []
+}
+
+function pluginOf(module) {
+  if (typeof module?.default === 'function') return module.default
+  if (typeof module?.apply === 'function') return module
+  if (typeof module === 'function') return module
+  return null
+}
+
+function implFiber(impl) {
+  return impl?.ctx?.fiber ?? impl?.fiber ?? null
+}
+
+function storeEntries(ctx) {
+  const store = ctx.reflect.store ?? {}
+  return Reflect.ownKeys(store).map(key => store[key]).filter(Boolean)
+}
+
+function ownedService(ctx, fiber, name) {
+  return storeEntries(ctx).find(impl => impl?.name === name && implFiber(impl) === fiber) ?? null
+}
+
+function serviceNames(ctx, fiber) {
+  return new Set(storeEntries(ctx).filter(impl => implFiber(impl) === fiber).map(impl => impl.name))
+}
+
+function makeNa(reason) {
+  return [
+    check({ id: 'DSC-04', clause: 'C-4', layer: 'L1', result: 'NA', reason }),
+    check({ id: 'DSC-05', clause: 'C-5', layer: 'L1', result: 'NA', reason }),
+    check({ id: 'DSC-06', clause: 'C-6', layer: 'L1+L2', result: 'NA', reason }),
+    check({ id: 'DSC-07', clause: 'C-7', layer: 'L2', result: 'NA', reason }),
+    check({ id: 'DSC-08', clause: 'C-8', layer: 'L3', result: 'NA', reason }),
+    check({ id: 'DSC-09', clause: 'C-9', layer: 'L1', result: 'NA', reason }),
+  ]
+}
+
+function makeNotRun(reason, skip = []) {
+  return ['DSC-04', 'DSC-05', 'DSC-06', 'DSC-07', 'DSC-08', 'DSC-09'].filter(id => !skip.includes(id)).map(id => {
+    const clause = { 'DSC-04': 'C-4', 'DSC-05': 'C-5', 'DSC-06': 'C-6', 'DSC-07': 'C-7', 'DSC-08': 'C-8', 'DSC-09': 'C-9' }[id]
+    const layer = { 'DSC-04': 'L1', 'DSC-05': 'L1', 'DSC-06': 'L1+L2', 'DSC-07': 'L2', 'DSC-08': 'L3', 'DSC-09': 'L1' }[id]
+    return check({ id, clause, layer, result: 'ERROR', coverage: 'not-run', reason })
+  })
+}
+
+/**
+ * Run L1-L3 in a child-free context. This is a best-effort harness: any
+ * failure that cannot be attributed to the plugin (missing host packages,
+ * incomplete stubs) is reported as ERROR/blocked, never FAIL.
+ *
+ * @param {object} input
+ * @param {string} input.dir
+ * @param {object} input.manifest
+ * @param {string} input.kind
+ * @param {object|null} input.entry
+ * @param {string} input.runtimePath
+ * @param {number} [input.timeoutMs]
+ * @param {object[]} [input.sources]
+ */
+export async function runRuntimeChecks(input) {
+  const { dir, manifest, kind, entry, runtimePath, timeoutMs = 10_000, sources = [] } = input
+  if (kind !== 'plugin') return makeNa(`kind=${kind}; L1-L3 apply to plugin entries only`)
+  if (!runtimePath) return makeNotRun('no --runtime supplied; L1-L3 not run')
+  if (!entry?.exists) return makeNotRun('no resolvable runtime entry; L1-L3 not run')
+
+  let Context
+  try {
+    const runtime = await import(pathToFileURL(path.resolve(runtimePath)).href)
+    Context = runtime.Context ?? runtime.default?.Context
+    if (typeof Context !== 'function') throw new Error('runtime module does not export Context')
+  } catch (error) {
+    return makeNotRun(`runtime import failed: ${error.message}`)
+  }
+
+  let module
+  try {
+    module = await import(pathToFileURL(entry.absolute).href)
+  } catch (error) {
+    const message = error?.message ?? String(error)
+    if (classifyImportError(message) === 'blocked') {
+      return makeNotRun(`plugin import blocked by missing host dependency: ${message.split('\n')[0]}`)
+    }
+    return [
+      check({ id: 'DSC-04', clause: 'C-4', layer: 'L1', result: 'FAIL', reason: `entry import failed: ${message}`, evidence: [entry.relative] }),
+      ...makeNotRun('C-4 failed; L1-L3 short-circuited', ['DSC-04']),
+    ]
+  }
+
+  const plugin = pluginOf(module)
+  if (!plugin) return makeNa('entry does not export a function, { apply }, or default class')
+
+  let ctx
+  let fiber
+  let beforeStore = null
+  let beforeRegistry = 0
+  try {
+    ctx = new Context()
+    for (const name of declaredInject(module)) {
+      if (ctx.get(name, false) === undefined) {
+        try { ctx.provide(name, makeStub()) } catch { /* already provided by the root */ }
+      }
+    }
+    beforeStore = new Set(Reflect.ownKeys(ctx.reflect.store ?? {}))
+    beforeRegistry = ctx.registry.size
+    fiber = ctx.plugin(plugin)
+    await withTimeout(Promise.resolve(fiber), timeoutMs, 'plugin load')
+  } catch (error) {
+    const message = error?.message ?? String(error)
+    const stubGap = /is not a function|Cannot read propert(?:y|ies) of (?:undefined|null)/.test(message)
+    const blocked = classifyImportError(message) === 'blocked' || stubGap
+    return [
+      check({ id: 'DSC-04', clause: 'C-4', layer: 'L1', result: blocked ? 'ERROR' : 'FAIL', coverage: blocked ? 'not-run' : 'full', reason: `load failed: ${message}`, evidence: [entry.relative] }),
+      ...makeNotRun('C-4 did not reach ACTIVE', ['DSC-04']),
+    ]
+  }
+
+  const active = fiber.state === ACTIVE
+  const loadCheck = check({
+    id: 'DSC-04', clause: 'C-4', layer: 'L1',
+    result: active ? 'PASS' : 'FAIL',
+    reason: active ? '' : `fiber state ${fiber.state} is not ACTIVE (2)`,
+    evidence: [entry.relative],
+  })
+  if (!active) return [loadCheck, ...makeNotRun('C-4 did not reach ACTIVE', ['DSC-04'])]
+
+  const realFiber = fiber.ctx?.fiber ?? Object.getPrototypeOf(fiber) ?? fiber
+  const declared = declaredProvide(module)
+  const measured = serviceNames(ctx, realFiber)
+  const provideDetails = []
+  for (const name of declared) {
+    const impl = ownedService(ctx, realFiber, name)
+    if (impl) provideDetails.push(detail('C-5.2', 'PASS', `service ${name} is owned by the plugin fiber`))
+    else if (storeEntries(ctx).some(entry => entry?.name === name)) provideDetails.push(detail('C-5.2', 'FAIL', `service ${name} is owned by another fiber`))
+    else provideDetails.push(detail('C-5.2', 'FAIL', `declared provide ${name} was not registered`))
+  }
+  if (declared.length === 0) provideDetails.push(detail('C-5.1', 'NA', 'no provide declaration'))
+  const provideResult = declared.length === 0 ? 'NA' : worst(provideDetails.map(item => item.result))
+  const provideCheck = check({
+    id: 'DSC-05', clause: 'C-5', layer: 'L1', result: provideResult,
+    reason: provideDetails.filter(item => item.result !== 'PASS' && item.result !== 'NA').map(item => `${item.item}: ${item.reason}`).join(' | '),
+    details: provideDetails,
+  })
+
+  const effects = fiber.getEffects()
+  const labels = effects.map(effect => effect?.label ?? 'anonymous')
+  const privateHits = regexHits(sources, /(?:ctx\.events\._hooks|ctx\.reflect\.store|ctx\.registry\._internal|fiber\._disposables)\s*(?:\.|\[)[^\n]{0,40}=/g)
+  const effectDetails = []
+  if (effects.length === 0 && (declared.length > 0 || labels.length === 0)) effectDetails.push(detail('C-6.2', 'WARN', 'no registered effects observed'))
+  else effectDetails.push(detail('C-6.2', 'PASS', `${effects.length} registered effect(s)`))
+  if (labels.length > 0 && labels.every(label => label === 'anonymous')) effectDetails.push(detail('C-6.2', 'WARN', 'all effects are anonymous'))
+  if (privateHits.length > 0) effectDetails.push(detail('C-6.1', 'FAIL', 'direct write to a Cordis private registration surface', privateHits.slice(0, 3).map(hit => `${hit.file}:${hit.line}`)))
+  const effectResult = worst(effectDetails.map(item => item.result))
+  const effectCheck = check({
+    id: 'DSC-06', clause: 'C-6', layer: 'L1+L2', result: effectResult,
+    reason: effectDetails.filter(item => item.result !== 'PASS').map(item => `${item.item}: ${item.reason}`).join(' | '),
+    details: effectDetails,
+  })
+
+  let unloadDetails = []
+  let unloadResult = 'PASS'
+  try {
+    await withTimeout(Promise.resolve(fiber.dispose()), timeoutMs, 'fiber dispose')
+    const afterEffects = fiber.getEffects().length
+    const afterStore = new Set(Reflect.ownKeys(ctx.reflect.store ?? {}))
+    const afterRegistry = ctx.registry.size
+    unloadDetails = [
+      detail('C-7.1', afterEffects === 0 ? 'PASS' : 'FAIL', `getEffects().length=${afterEffects}`),
+      detail('C-7.2', [...beforeStore].every(key => afterStore.has(key)) ? 'PASS' : 'FAIL', 'service store returned to baseline'),
+      detail('C-7.3', beforeRegistry === afterRegistry ? 'PASS' : 'FAIL', `registry.size ${beforeRegistry} -> ${afterRegistry}`),
+    ]
+    unloadResult = worst(unloadDetails.map(item => item.result))
+  } catch (error) {
+    unloadDetails = [detail('C-7.5', 'FAIL', `dispose failed: ${error.message}`)]
+    unloadResult = 'FAIL'
+  }
+  const unloadCheck = check({
+    id: 'DSC-07', clause: 'C-7', layer: 'L2', result: unloadResult,
+    reason: unloadDetails.filter(item => item.result !== 'PASS').map(item => `${item.item}: ${item.reason}`).join(' | '),
+    details: unloadDetails,
+  })
+
+  let restartResult = 'PASS'
+  let restartDetails = []
+  try {
+    const ctxR = new Context()
+    for (const name of declaredInject(module)) {
+      if (ctxR.get(name, false) === undefined) {
+        try { ctxR.provide(name, makeStub()) } catch { /* ignore */ }
+      }
+    }
+    const fiberR = ctxR.plugin(plugin)
+    await withTimeout(Promise.resolve(fiberR), timeoutMs, 'restart fixture load')
+    const beforeRestart = fiberR.getEffects().length
+    const revisionBefore = typeof fiberR._revision === 'number' ? fiberR._revision : null
+    const epochBefore = fiberR._runner?.epoch
+    await withTimeout(Promise.resolve(fiberR.restart()), timeoutMs, 'fiber restart')
+    const revisionAfter = typeof fiberR._revision === 'number' ? fiberR._revision : null
+    const epochAfter = fiberR._runner?.epoch
+    const afterRestart = fiberR.getEffects()
+    restartDetails.push(detail('C-8.1', fiberR.state === ACTIVE ? 'PASS' : 'FAIL', `state after restart=${fiberR.state}`))
+    restartDetails.push(detail('C-8.1', afterRestart.length === beforeRestart ? 'PASS' : 'WARN', `effect count ${beforeRestart} -> ${afterRestart.length}`))
+    const advanced = (revisionBefore !== null && revisionAfter !== null && revisionAfter > revisionBefore) || (epochBefore !== undefined && epochAfter !== undefined && epochAfter !== epochBefore)
+    restartDetails.push(detail('C-8.2', advanced ? 'PASS' : 'WARN', `revision ${revisionBefore} -> ${revisionAfter}; epoch ${String(epochBefore)} -> ${String(epochAfter)}`))
+    const ctx2 = new Context()
+    for (const name of declaredInject(module)) {
+      if (ctx2.get(name, false) === undefined) {
+        try { ctx2.provide(name, makeStub()) } catch { /* ignore */ }
+      }
+    }
+    const fiber2 = ctx2.plugin(plugin)
+    await withTimeout(Promise.resolve(fiber2), timeoutMs, 'cold remount')
+    restartDetails.push(detail('C-8.3', fiber2.state === ACTIVE ? 'PASS' : 'FAIL', `cold remount state=${fiber2.state}`))
+  } catch (error) {
+    restartDetails.push(detail('C-8.1', 'FAIL', `restart/remount failed: ${error.message}`))
+  }
+  restartResult = worst(restartDetails.map(item => item.result))
+  const restartCheck = check({
+    id: 'DSC-08', clause: 'C-8', layer: 'L3', result: restartResult,
+    reason: restartDetails.filter(item => item.result !== 'PASS').map(item => `${item.item}: ${item.reason}`).join(' | '),
+    details: restartDetails,
+  })
+
+  const crossDetails = []
+  for (const name of declared) {
+    if (!measured.has(name)) crossDetails.push(detail('C-9.1', 'FAIL', `declared provide ${name} is missing from measured services`))
+  }
+  for (const name of measured) {
+    if (!declared.includes(name)) crossDetails.push(detail('C-9.2', 'WARN', `measured service ${name} is not declared`))
+  }
+  const inject = declaredInject(module)
+  for (const name of inject) {
+    const hits = regexHits(sources, new RegExp(`ctx\\.${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`, 'g'))
+    if (hits.length === 0) crossDetails.push(detail('C-9.3', 'WARN', `inject declares ${name} but no static ctx.${name} read was found`))
+  }
+  const crossResult = crossDetails.length === 0 ? 'PASS' : worst(crossDetails.map(item => item.result))
+  const crossCheck = check({
+    id: 'DSC-09', clause: 'C-9', layer: 'L1', result: crossResult,
+    reason: crossDetails.filter(item => item.result !== 'PASS').map(item => `${item.item}: ${item.reason}`).join(' | '),
+    details: crossDetails,
+  })
+
+  return [loadCheck, provideCheck, effectCheck, unloadCheck, restartCheck, crossCheck]
+}