dsh-standards 1.2.2 → 1.4.0

package/40-checker/src/author-report.mjs

@@ -0,0 +1,271 @@
+/**
+ * Author-facing renderers for a `dsh-conformance/1` report.
+ *
+ * Markdown is the default `dsh-standards check` output; HTML is a single
+ * self-contained file with inline CSS, no scripts, no external assets, and
+ * every dynamic value escaped. Both read the same report object the checker
+ * already produced, so the verdict and exit code never change here.
+ */
+
+const DISCLAIMER =
+  'Non-official report. This is not a certification, security audit, endorsement, or ranking. '
+  + 'Hygiene warnings are not a clean pass; items under "Not checked" were not inspected.'
+
+function text(value) {
+  return String(value ?? '').replace(/\s+/g, ' ').trim()
+}
+
+function mdCell(value) {
+  return text(value).replace(/\|/g, '\\|')
+}
+
+export function escapeHtml(value) {
+  return String(value ?? '').replace(/[&<>"']/g, character => ({
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#39;',
+  }[character]))
+}
+
+function headlineOf(report) {
+  return text(report?.conclusion?.headline) || text(report?.conclusion?.reason) || 'no conclusion'
+}
+
+export function priorityFixes(report, limit = 3) {
+  const advice = Array.isArray(report?.advice) ? report.advice : []
+  const seen = new Set()
+  const fixes = []
+  for (const item of advice) {
+    const key = item?.key ?? item?.title
+    if (key === undefined || seen.has(key)) continue
+    seen.add(key)
+    fixes.push(item)
+    if (fixes.length >= limit) break
+  }
+  if (fixes.length > 0) return fixes
+  // Advice may be disabled; fall back to the FAIL/WARN rows themselves.
+  const rows = [...(report?.buckets?.blocking ?? []), ...(report?.buckets?.hygiene ?? [])]
+  for (const row of rows) {
+    if (fixes.length >= limit) break
+    fixes.push({ key: row.id, gate: row.result, severity: row.result, source: row.id, fix: row.reason, why: null, docsUrl: null })
+  }
+  return fixes
+}
+
+function passedIds(report) {
+  return (report?.checks ?? []).filter(item => item.result === 'PASS').map(item => item.id)
+}
+
+function adviceRows(report) {
+  return Array.isArray(report?.advice) ? report.advice : []
+}
+
+const BUCKETS = [
+  { key: 'blocking', title: 'Blocking (FAIL)' },
+  { key: 'hygiene', title: 'Hygiene (WARN)' },
+  { key: 'partial', title: 'Partly checked (static subset)' },
+  { key: 'notChecked', title: 'Not checked (NA / not-run / ERROR)' },
+]
+
+function bucketRows(report, key) {
+  return Array.isArray(report?.buckets?.[key]) ? report.buckets[key] : []
+}
+
+export function renderMarkdown(report) {
+  const subject = report?.subject ?? {}
+  const conclusion = report?.conclusion ?? {}
+  const coverage = report?.coverage ?? {}
+  const metrics = report?.metrics ?? {}
+  const anchor = report?.anchor ?? {}
+  const lines = []
+  lines.push(`# DSH standards check — ${text(subject.name) || '<unknown>'}@${text(subject.version) || '?'}`)
+  lines.push('')
+  lines.push(`**Conclusion:** ${headlineOf(report)}`)
+  lines.push('')
+  lines.push(`- Status: **${text(conclusion.status) || 'unknown'}** (exit ${conclusion.exitCode ?? '?'})`)
+  if (conclusion.level) lines.push(`- Level: ${text(conclusion.level)}`)
+  lines.push(`- Anchor: dsh=${text(anchor.dsh) || '?'}${anchor.runtimeSource ? ` (source=${anchor.runtimeSource}${anchor.suspect ? ', suspect=true' : ''})` : ''}`)
+  lines.push(`- Coverage: ${metrics.checked ?? coverage.checked ?? 0}/${metrics.total ?? coverage.total ?? (report?.checks ?? []).length} checks evaluated · declared fields ${metrics.declaredFields ?? 0}/5`)
+  lines.push('')
+
+  lines.push('## Priority fixes (up to 3)')
+  lines.push('')
+  const fixes = priorityFixes(report)
+  if (fixes.length === 0) {
+    lines.push('_None: no FAIL or WARN finding produced advice._')
+  } else {
+    fixes.forEach((item, index) => {
+      lines.push(`${index + 1}. **${text(item.severity ?? item.gate ?? 'WARN')} ${text(item.key) || text(item.title)}** (${text(item.source)}) — ${text(item.fix ?? item.title ?? item.reason)}`)
+      if (item.why) lines.push(`   - Why: ${text(item.why)}`)
+      if (item.docsUrl) lines.push(`   - Docs: ${text(item.docsUrl)}`)
+    })
+  }
+  lines.push('')
+
+  for (const bucket of BUCKETS) {
+    const rows = bucketRows(report, bucket.key)
+    lines.push(`## ${bucket.title} — ${rows.length}`)
+    lines.push('')
+    if (rows.length === 0) {
+      lines.push('_None._')
+    } else {
+      lines.push('| id | clause | result | coverage | reason |')
+      lines.push('|---|---|---|---|---|')
+      for (const row of rows) {
+        const tags = [row.declaration ? 'declaration' : null, row.advisory ? 'advisory' : null].filter(Boolean)
+        const reason = tags.length > 0 ? `${text(row.reason)} [${tags.join(',')}]` : text(row.reason)
+        lines.push(`| ${mdCell(row.id)} | ${mdCell(row.clause ?? '-')} | ${mdCell(row.result)} | ${mdCell(row.coverage ?? '-')} | ${mdCell(reason)} |`)
+      }
+    }
+    lines.push('')
+  }
+
+  const passed = passedIds(report)
+  lines.push(`## Passed — ${passed.length}`)
+  lines.push('')
+  lines.push(passed.length > 0 ? passed.join(', ') : '_None._')
+  lines.push('')
+
+  const advice = adviceRows(report)
+  lines.push(`## Advice (non-blocking) — ${advice.length}`)
+  lines.push('')
+  if (advice.length === 0) {
+    lines.push('_None._')
+  } else {
+    for (const item of advice) {
+      const missing = item.ruleMissing ? ' [ruleMissing]' : ''
+      lines.push(`- ${text(item.severity)} ${text(item.key)} (${text(item.source)}${missing}): ${text(item.fix ?? item.title ?? '')}`)
+      if (item.docsUrl) lines.push(`  ${text(item.docsUrl)}`)
+    }
+  }
+  lines.push('')
+
+  const notChecked = bucketRows(report, 'notChecked')
+  const partial = bucketRows(report, 'partial')
+  lines.push('## What this report does not check')
+  lines.push('')
+  if (notChecked.length === 0 && partial.length === 0) {
+    lines.push('- No check was skipped in this run.')
+  } else {
+    for (const row of notChecked) {
+      lines.push(`- ${text(row.id)}${row.clause ? ` (${text(row.clause)})` : ''}: ${text(row.reason) || 'not checked'}`)
+      if (row.howToEnable) lines.push(`  - enable: ${text(row.howToEnable)}`)
+    }
+    for (const row of partial) {
+      lines.push(`- ${text(row.id)}${row.clause ? ` (${text(row.clause)})` : ''}: partial coverage${row.reason ? ` — ${text(row.reason)}` : ''}`)
+      if (row.howToEnable) lines.push(`  - still needs: ${text(row.howToEnable)}`)
+    }
+  }
+  lines.push(`- Runtime execution beyond the checks listed above is not observed by this report${anchor.suspect ? '; the anchor differs from the host and is flagged suspect' : ''}.`)
+  lines.push('- It does not certify, rank, audit security, or endorse the package.')
+  lines.push('')
+  lines.push('---')
+  lines.push('')
+  lines.push(DISCLAIMER)
+  lines.push('')
+  return `${lines.join('\n')}\n`
+}
+
+export function renderHtml(report) {
+  const subject = report?.subject ?? {}
+  const conclusion = report?.conclusion ?? {}
+  const metrics = report?.metrics ?? {}
+  const anchor = report?.anchor ?? {}
+  const title = `DSH standards check — ${text(subject.name) || '<unknown>'}@${text(subject.version) || '?'}`
+  const fixes = priorityFixes(report)
+  const advice = adviceRows(report)
+  const passed = passedIds(report)
+  const notChecked = bucketRows(report, 'notChecked')
+  const partial = bucketRows(report, 'partial')
+
+  const table = (key) => {
+    const rows = bucketRows(report, key)
+    if (rows.length === 0) return '<p class="none">None.</p>'
+    const body = rows.map(row => {
+      const tags = [row.declaration ? 'declaration' : null, row.advisory ? 'advisory' : null].filter(Boolean)
+      const reason = tags.length > 0 ? `${text(row.reason)} [${tags.join(',')}]` : text(row.reason)
+      return `<tr><td>${escapeHtml(row.id)}</td><td>${escapeHtml(row.clause ?? '-')}</td><td class="result ${escapeHtml(String(row.result).toLowerCase())}">${escapeHtml(row.result)}</td><td>${escapeHtml(row.coverage ?? '-')}</td><td>${escapeHtml(reason)}</td></tr>`
+    }).join('\n')
+    return `<table><thead><tr><th>id</th><th>clause</th><th>result</th><th>coverage</th><th>reason</th></tr></thead><tbody>\n${body}\n</tbody></table>`
+  }
+
+  const fixList = fixes.length === 0
+    ? '<p class="none">None: no FAIL or WARN finding produced advice.</p>'
+    : `<ol>${fixes.map(item => {
+      const why = item.why ? `<br><span class="muted">Why: ${escapeHtml(text(item.why))}</span>` : ''
+      const docs = item.docsUrl ? `<br><span class="muted">Docs: ${link(item.docsUrl)}</span>` : ''
+      return `<li><strong>${escapeHtml(text(item.severity ?? item.gate ?? 'WARN'))} ${escapeHtml(text(item.key) || text(item.title))}</strong> (${escapeHtml(text(item.source))}) — ${escapeHtml(text(item.fix ?? item.title ?? item.reason))}${why}${docs}</li>`
+    }).join('\n')}</ol>`
+
+  const adviceList = advice.length === 0
+    ? '<p class="none">None.</p>'
+    : `<ul>${advice.map(item => `<li><strong>${escapeHtml(text(item.severity))} ${escapeHtml(text(item.key))}</strong> (${escapeHtml(text(item.source))}${item.ruleMissing ? ' [ruleMissing]' : ''}): ${escapeHtml(text(item.fix ?? item.title ?? ''))}${item.docsUrl ? ` ${link(item.docsUrl)}` : ''}</li>`).join('\n')}</ul>`
+
+  const notCheckedList = notChecked.length === 0 && partial.length === 0
+    ? '<li>No check was skipped in this run.</li>'
+    : [
+        ...notChecked.map(row => `<li><strong>${escapeHtml(text(row.id))}</strong>${row.clause ? ` (${escapeHtml(text(row.clause))})` : ''}: ${escapeHtml(text(row.reason) || 'not checked')}${row.howToEnable ? ` <span class="muted">enable: ${escapeHtml(text(row.howToEnable))}</span>` : ''}</li>`),
+        ...partial.map(row => `<li><strong>${escapeHtml(text(row.id))}</strong>${row.clause ? ` (${escapeHtml(text(row.clause))})` : ''}: partial coverage${row.reason ? ` — ${escapeHtml(text(row.reason))}` : ''}${row.howToEnable ? ` <span class="muted">still needs: ${escapeHtml(text(row.howToEnable))}</span>` : ''}</li>`),
+      ].join('\n')
+
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(title)}</title>
+<style>
+:root{color-scheme:light dark}
+body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,"PingFang SC","Microsoft YaHei",sans-serif;max-width:980px;margin:2rem auto;padding:0 1rem;line-height:1.55;color:#1f2328;background:#fff}
+h1{font-size:1.45rem;margin:0 0 .35rem}
+h2{font-size:1.1rem;margin:1.8rem 0 .5rem;border-bottom:1px solid #d0d7de;padding-bottom:.25rem}
+.headline{font-size:1.05rem;font-weight:600;background:#f6f8fa;border:1px solid #d0d7de;border-radius:6px;padding:.65rem .8rem}
+.meta{margin:.6rem 0 0;padding-left:1.1rem;color:#57606a}
+.muted{color:#57606a;font-size:.9rem}
+table{border-collapse:collapse;width:100%;margin:.4rem 0 1rem;font-size:.9rem}
+th,td{border:1px solid #d0d7de;padding:.3rem .5rem;text-align:left;vertical-align:top}
+th{background:#f6f8fa}
+td.result{font-weight:600;white-space:nowrap}
+td.result.fail{color:#b42318}
+td.result.warn{color:#9a6700}
+td.result.na,td.result.error,td.result.not-run{color:#57606a}
+.none{color:#57606a}
+footer{margin-top:2rem;padding-top:.8rem;border-top:1px solid #d0d7de;color:#57606a;font-size:.9rem}
+code{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}
+@media (prefers-color-scheme:dark){body{background:#0d1117;color:#e6edf3}h2,.headline,th,td,footer{border-color:#30363d}.headline,th{background:#161b22}.meta,.muted,.none,footer{color:#8b949e}td.result.fail{color:#ff7b72}td.result.warn{color:#d29922}}
+</style>
+</head>
+<body>
+<h1>${escapeHtml(title)}</h1>
+<p class="headline">${escapeHtml(headlineOf(report))}</p>
+<ul class="meta">
+<li>Status: <strong>${escapeHtml(text(conclusion.status) || 'unknown')}</strong> (exit ${escapeHtml(conclusion.exitCode ?? '?')})${conclusion.level ? ` · Level: ${escapeHtml(text(conclusion.level))}` : ''}</li>
+<li>Anchor: dsh=${escapeHtml(text(anchor.dsh) || '?')}${anchor.runtimeSource ? ` (source=${escapeHtml(anchor.runtimeSource)}${anchor.suspect ? ', suspect=true' : ''})` : ''}</li>
+<li>Coverage: ${escapeHtml(metrics.checked ?? 0)}/${escapeHtml(metrics.total ?? (report?.checks ?? []).length)} checks evaluated · declared fields ${escapeHtml(metrics.declaredFields ?? 0)}/5</li>
+</ul>
+<h2>Priority fixes (up to 3)</h2>
+${fixList}
+${BUCKETS.map(bucket => `<h2>${escapeHtml(bucket.title)} — ${bucketRows(report, bucket.key).length}</h2>\n${table(bucket.key)}`).join('\n')}
+<h2>Passed — ${passed.length}</h2>
+<p>${passed.length > 0 ? passed.map(escapeHtml).join(', ') : '<span class="none">None.</span>'}</p>
+<h2>Advice (non-blocking) — ${advice.length}</h2>
+${adviceList}
+<h2>What this report does not check</h2>
+<ul>
+${notCheckedList}
+<li>Runtime execution beyond the checks listed above is not observed by this report${anchor.suspect ? '; the anchor differs from the host and is flagged suspect' : ''}.</li>
+<li>It does not certify, rank, audit security, or endorse the package.</li>
+</ul>
+<footer>${escapeHtml(DISCLAIMER)}</footer>
+</body>
+</html>
+`
+}
+
+function link(url) {
+  const value = text(url)
+  if (!/^https:\/\//i.test(value)) return escapeHtml(value)
+  return `<a href="${escapeHtml(value)}" rel="noreferrer noopener">${escapeHtml(value)}</a>`
+}

package/40-checker/src/bundle-static.mjs

@@ -0,0 +1,181 @@
+/**
+ * Static partial coverage for the L1-L3 checks (DSC-04..DSC-09) when a bundle
+ * or client package cannot be executed.
+ *
+ * These checks are NOT a runtime verdict. They cover the statically decidable
+ * part of each clause (manifest/patch/entry/exports declarations, static
+ * provide/effect/teardown clues and declaration consistency) and always report
+ * `coverage: "partial"`. The report keeps them in the partial bucket and lists
+ * what still needs `--host` / `--runtime`.
+ */
+import path from 'node:path'
+import { check, detail, worst } from './result.mjs'
+import { isFile, regexHits } from './util.mjs'
+
+const PRIVATE_SURFACE = /(?:ctx\.events\._hooks|ctx\.reflect\.store|ctx\.registry\._internal|fiber\._disposables)\s*(?:\.|\[)[^\n]{0,40}=/g
+const EFFECT_REGISTRATION = /\bctx\.(?:effect|on)\s*\(|\.effect\s*\(/g
+const TEARDOWN = /\b(?:onDispose|dispose|disposed)\b|\.dispose\s*\(/g
+const RESTART = /\brestart\b|_revision|\.restart\s*\(/g
+const PROVIDE_DECLARATION = /(?:^|\n)\s*(?:export\s+)?(?:const|let|var)\s+provide\s*=|export\s*\{[^}]*\bprovide\b[^}]*\}/g
+const CTX_PROVIDE = /\bctx\.provide\s*\(/g
+
+function packageNameOf(name) {
+  if (typeof name !== 'string') return ''
+  if (name.startsWith('@')) {
+    const parts = name.split('/')
+    return parts.length >= 2 ? `${parts[0]}/${parts[1]}` : name
+  }
+  return name.split('/')[0]
+}
+
+function runtimeNeed(kind) {
+  if (kind === 'bundle') {
+    return 'bundle G0-G3 needs --host <dir>; L1-L3 need --treat-as-plugin --runtime <path>'
+  }
+  return 'L1-L3 need --treat-as-plugin --runtime <path>'
+}
+
+function liveResult(details) {
+  const live = details.filter(item => item.result === 'FAIL' || item.result === 'WARN')
+  return live.length === 0 ? 'PASS' : worst(live.map(item => item.result))
+}
+
+function staticCheck({ id, clause, layer, details, kind, scan, extra = '' }) {
+  const result = liveResult(details)
+  const failures = details
+    .filter(item => item.result === 'FAIL' || item.result === 'WARN')
+    .map(item => `${item.item}: ${item.reason}`)
+  const truncation = scan?.truncated
+    ? `source scan truncated at ${scan.maxFiles} files / ${scan.maxBytes} bytes`
+    : ''
+  const reasonParts = []
+  if (failures.length > 0) reasonParts.push(failures.join(' | '))
+  else reasonParts.push(`static subset passed${extra ? `: ${extra}` : ''}`)
+  reasonParts.push(runtimeNeed(kind))
+  if (truncation) reasonParts.push(truncation)
+  return check({
+    id,
+    clause,
+    layer,
+    result,
+    coverage: 'partial',
+    reason: reasonParts.join('; '),
+    details,
+    evidence: details.flatMap(item => item.evidence ?? []).slice(0, 5),
+  })
+}
+
+/** @returns {object[]} the six DSC-04..DSC-09 checks with coverage "partial". */
+export function runStaticBundleChecks({ manifest, kind, entry, patch, sources = [], g4 = null, scan = null, dir = null }) {
+  const name = manifest?.name ?? null
+  const deps = new Set([
+    ...Object.keys(manifest?.dependencies ?? {}),
+    ...Object.keys(manifest?.peerDependencies ?? {}),
+    ...Object.keys(manifest?.optionalDependencies ?? {}),
+  ])
+  const self = packageNameOf(name)
+
+  // C-4: entry / patch / client export shape, all statically resolvable.
+  const c4 = []
+  if (entry?.escape) c4.push(detail('C-4', 'FAIL', `entry escapes the package: ${entry.target}`, ['package.json#exports']))
+  else if (entry?.declaredMissing) c4.push(detail('C-4', 'FAIL', `declared entry is missing: ${entry.target}`, ['package.json#exports']))
+  else if (entry?.exists) c4.push(detail('C-4', 'PASS', `declared entry resolves: ${entry.relative}`, [entry.relative]))
+  else if (kind === 'bundle' && patch?.present) c4.push(detail('C-4', 'PASS', 'patch-only bundle; dsh.bundle.patch is the carrier'))
+  else c4.push(detail('C-4', 'NA', 'no runtime entry declared'))
+  if (patch?.present) {
+    if (patch.problems?.length > 0) {
+      c4.push(detail('C-4', 'FAIL', `bundle patch problems: ${patch.problems.join('; ')}`, patch.files?.map(file => file.relative) ?? []))
+    } else {
+      c4.push(detail('C-4', 'PASS', `bundle patch parsed (${patch.files?.length ?? 0} file(s), ${patch.rows?.length ?? 0} row(s))`))
+    }
+  }
+  if (g4?.hasClient) {
+    if (g4.result === 'FAIL') c4.push(detail('C-4', 'FAIL', g4.reason ?? 'dsh.client shape failed'))
+    else if (g4.result === 'PASS') c4.push(detail('C-4', 'PASS', 'dsh.client + exports["./client"] resolvable'))
+  }
+  const c4Check = staticCheck({ id: 'DSC-04', clause: 'C-4', layer: 'L1', details: c4, kind, scan, extra: 'entry/export/patch shape' })
+
+  // C-5: can a static provide declaration be enumerated?
+  const c5 = []
+  const provideDecl = regexHits(sources, PROVIDE_DECLARATION)
+  const ctxProvide = regexHits(sources, CTX_PROVIDE)
+  if (provideDecl.length > 0) {
+    c5.push(detail('C-5.1', 'PASS', `static provide declaration found (${provideDecl.length} site(s))`, provideDecl.slice(0, 3).map(hit => `${hit.file}:${hit.line}`)))
+  } else if (ctxProvide.length > 0) {
+    c5.push(detail('C-5.1', 'PASS', `ctx.provide registration found (${ctxProvide.length} site(s))`, ctxProvide.slice(0, 3).map(hit => `${hit.file}:${hit.line}`)))
+  } else {
+    c5.push(detail('C-5.1', 'NA', 'no static provide declaration or ctx.provide call found; service ownership needs runtime'))
+  }
+  const c5Check = staticCheck({ id: 'DSC-05', clause: 'C-5', layer: 'L1', details: c5, kind, scan, extra: 'provide declarations enumerated' })
+
+  // C-6: static private-surface writes; effect registration is runtime-only.
+  const c6 = []
+  const privateHits = regexHits(sources, PRIVATE_SURFACE)
+  if (privateHits.length > 0) {
+    c6.push(detail('C-6.1', 'FAIL', 'static write to a Cordis private registration surface', privateHits.slice(0, 3).map(hit => `${hit.file}:${hit.line}`)))
+  } else if (sources.length > 0) {
+    c6.push(detail('C-6.1', 'PASS', 'no static write to a private registration surface'))
+  }
+  const effectHits = regexHits(sources, EFFECT_REGISTRATION)
+  if (effectHits.length > 0) {
+    c6.push(detail('C-6.2', 'PASS', `${effectHits.length} static effect registration site(s); effect lifetime needs runtime`, effectHits.slice(0, 3).map(hit => `${hit.file}:${hit.line}`)))
+  } else {
+    c6.push(detail('C-6.2', 'NA', 'effect registration/lifetime needs runtime'))
+  }
+  const c6Check = staticCheck({ id: 'DSC-06', clause: 'C-6', layer: 'L1+L2', details: c6, kind, scan, extra: 'no private-surface writes found' })
+
+  // C-7: static teardown clue; effect/store/registry baselines need runtime.
+  const c7 = []
+  const teardownHits = regexHits(sources, TEARDOWN)
+  if (teardownHits.length > 0) {
+    c7.push(detail('C-7.1', 'PASS', `${teardownHits.length} static teardown site(s); dispose baseline needs runtime`, teardownHits.slice(0, 3).map(hit => `${hit.file}:${hit.line}`)))
+  } else {
+    c7.push(detail('C-7.1', 'NA', 'dispose/effect baseline needs runtime'))
+  }
+  const c7Check = staticCheck({ id: 'DSC-07', clause: 'C-7', layer: 'L2', details: c7, kind, scan, extra: 'teardown references enumerated' })
+
+  // C-8: static restart/remount clue; repeatability needs runtime.
+  const c8 = []
+  const restartHits = regexHits(sources, RESTART)
+  if (restartHits.length > 0) {
+    c8.push(detail('C-8.1', 'PASS', `${restartHits.length} static restart/revision site(s); repeatability needs runtime`, restartHits.slice(0, 3).map(hit => `${hit.file}:${hit.line}`)))
+  } else {
+    c8.push(detail('C-8.1', 'NA', 'restart/remount repeatability needs runtime'))
+  }
+  const c8Check = staticCheck({ id: 'DSC-08', clause: 'C-8', layer: 'L3', details: c8, kind, scan, extra: 'restart references enumerated' })
+
+  // C-9: declaration consistency that is decidable from the manifest + patch.
+  const c9 = []
+  const mismatched = []
+  for (const row of patch?.rows ?? []) {
+    if (!row.name || row.disabled) continue
+    // A patch row may mount a local module (a bundle's own server entry) rather
+    // than a registry package. Verify the file; do not compare it to deps.
+    if (row.name.startsWith('.') || path.isAbsolute(row.name)) {
+      const absolute = dir ? path.resolve(dir, row.name) : null
+      if (!absolute || !isFile(absolute)) mismatched.push(`${row.name} (missing local module)`)
+      continue
+    }
+    const target = packageNameOf(row.name)
+    if (!target || target === self || deps.has(target) || target.startsWith('@deepseek-ai/')) continue
+    mismatched.push(row.name)
+  }
+  if (mismatched.length > 0) {
+    c9.push(detail('C-9.2', 'WARN', `patch mounts package(s) that are not declared in dependencies/peerDependencies: ${[...new Set(mismatched)].join(', ')}`, patch.files?.map(file => file.relative) ?? []))
+  } else if (patch?.present) {
+    c9.push(detail('C-9.1', 'PASS', 'patch mount targets match package.json declarations or host-provided @deepseek-ai packages'))
+  }
+  const inject = Array.isArray(manifest?.dsh?.client?.inject) ? manifest.dsh.client.inject : []
+  const unread = []
+  for (const service of inject) {
+    if (typeof service !== 'string' || !/^[A-Za-z_$][\w$]*$/.test(service)) continue
+    if (regexHits(sources, new RegExp(`\\bctx\\.${service.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`, 'g')).length === 0) unread.push(service)
+  }
+  if (unread.length > 0) {
+    c9.push(detail('C-9.3', 'WARN', `dsh.client.inject declares service(s) with no static ctx.<service> read: ${unread.join(', ')}`))
+  }
+  if (c9.length === 0) c9.push(detail('C-9.1', 'NA', 'no statically decidable declaration mismatch found'))
+  const c9Check = staticCheck({ id: 'DSC-09', clause: 'C-9', layer: 'L1', details: c9, kind, scan, extra: 'declaration cross-check' })
+
+  return [c4Check, c5Check, c6Check, c7Check, c8Check, c9Check]
+}