nsauditor-ai 0.2.53 → 0.2.55

package/utils/report_inputs.mjs

@@ -4,15 +4,27 @@
 // report that renders confidently over a partial or mismatched run is the false clean this
 // feature exists to prevent: a correct report about the wrong (or incomplete) run reads
 // identically to a correct one without that caveat.
+// ⚠️ `fs` IS IMPORTED BECAUSE IT WAS BEING USED WITHOUT BEING IMPORTED. The queue read below
+// called `fs.readFileSync` while this module bound only `fsp`, so it threw
+// `ReferenceError: fs is not defined` on EVERY call and the bare `catch` around it swallowed the
+// throw — the primary artifact path was dead code and 100% of finding-queue entries arrived
+// through the `eeEnrichment` fallback the comment there calls a legacy shim. It read clean under
+// every hand probe written with `node -e`, because `node -e` exposes built-in modules as globals
+// and a real module file does not: THE PROBE HABITAT, NOT THE CODE, IS WHAT WAS PASSING.
+// Behaviour-preserving on the whole corpus: all 12 real `scan_finding_queue.json` files under
+// audit-evidence-samples are byte-identical to their record's `eeEnrichment.queue`.
+import fs from 'node:fs';
 import fsp from 'node:fs/promises';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import { describeFinding } from './cloud_finding_summary.mjs';
+import { canonicaliseResource } from './finding_identity.mjs';
 import { censusFindingContainers } from './report_finding_census.mjs';
 import {
   RUN_RECORD_SCHEMA, UNPARSEABLE, runRecordPath, listRunRecords, readRunRecord,
 } from './run_record.mjs';
 import { CE_RETENTION_MS } from './scan_history.mjs';
+import { canonicalHost } from './cloud_providers.mjs';
 
 const refuse = (reason, message) => ({ ok: false, reason, message });
 
@@ -117,9 +129,17 @@ function issueText(i) {
   return String(i);
 }
 
-export function shapeFinding(host, f) {
+// The envelope's plugin id, in the vocabulary `cli.mjs` writes into `pluginsRequested`
+// (`String(p.id)`). MEASURED across 152 real run records: 7,962 members, not one a display name.
+const envId = (e) => (e?.id != null ? String(e.id) : null);
+
+export function shapeFinding(host, f, plugin = null, pluginName = null) {
   const severity = f?.severity != null ? String(f.severity).toUpperCase() : 'INFO';
   const port = f?.port ?? null;
+  // The finding's OWN region, from its own field — never a default and never inferred. Nothing
+  // can be decoration without it, and guessing one would strip a legitimately region-named
+  // object. `null` for every non-regional producer, which is most of them.
+  const region = typeof f?.region === 'string' && f.region.length > 0 ? f.region : null;
   // ⚠️ THE REPORT USED TO READ `f.title` ALONE, AND NO SHIPPED PLUGIN EMITS IT.
   // Measured at Gate 3-B on the installed 0.44.0 trio: 27 of 29 EE plugins carry no
   // `title:` field, no CE plugin carries one, and exactly three `findings.push` sites
@@ -147,8 +167,20 @@ export function shapeFinding(host, f) {
   // what every other caller titles. `description` in particular is NOT in REASON_KEYS, so
   // without this a zero-trust finding titles itself "MEDIUM finding (no description)".
   const contentIssues = issueTexts.length ? issueTexts : (explicitDetail ? [String(explicitDetail)] : []);
+  // ⚠️ THE CANONICAL RESOURCE IS COMPUTED HERE, ABOVE THE TITLE, BECAUSE THE TITLE EMBEDS IT —
+  // and canonicalising only the `resource` FIELD leaves the decoration alive in a second place
+  // that identity keys on. `describeFinding` renders the resource into the title it derives, so
+  // a pre-E1 baseline titled a finding `backup:account [eu-west-2] — …` while a post-E1 run
+  // titles the same finding `backup:account — …`. `title` is a component of the delta's identity
+  // key and of `id`, so the pair would read as resolved+new across the upgrade: the exact
+  // fabricated churn the canonicaliser exists to prevent, surviving in the field nobody looked
+  // at. Found by a leg that rendered the row and READ it, not by reasoning about the field.
+  const canonicalResource = canonicaliseResource(
+    f?.resource ?? f?.target ?? f?.details?.resource ?? null, region);
   const title = f?.title
-    ?? (contentIssues.length ? describeFinding({ ...f, issues: contentIssues }) : null);
+    ?? (contentIssues.length
+      ? describeFinding({ ...f, resource: canonicalResource, issues: contentIssues })
+      : null);
   const cves = Array.isArray(f?.cves) ? f.cves.map(String)
     : Array.isArray(f?.cve) ? f.cve.map(String) : [];
   // CE ships no KEV/EPSS store of its own (utils/scan_history.mjs comment at cli.mjs:2780):
@@ -160,6 +192,80 @@ export function shapeFinding(host, f) {
     .digest('hex').slice(0, 16);
   return {
     host, port, severity, title,
+    // ⚠️ CARRIED FOR IDENTITY, not for display. Cloud issue strings name the DEFECT and not the
+    // resource ("No public access block configured…"), so without this every bucket on one host
+    // normalises to the same {host, port, severity, title} and a cross-run delta collapses them —
+    // masking a NEW exposure behind a surviving one. Dropping it here would defeat the delta's
+    // identity key from outside the delta, with the delta's own tests still green.
+    // ⚠️ CANONICALISED, NOT RAW (board E1). EE's `utils/aws_region_scan.mjs::_stampRegion`
+    // rewrote this field on every finding routed through `forEachRegion`: a finding with no
+    // resource got the REGION as its object identity, and a finding with one got ` [<region>]`
+    // appended. E1 stops both at the producer, but the PUBLISHED CE 0.2.54 already wrote
+    // baselines full of the decorated values and `RUN_RECORD_SCHEMA` is 1 on both sides — so
+    // those baselines compare as commensurable. Canonicalising here is what makes that true:
+    // the same object computes the same key whichever side of the upgrade wrote it. Shared with
+    // EE's MTTR fingerprint so the two comparison channels cannot disagree about identity.
+    resource: canonicalResource,
+    // ⚠️ THE REGION AS ITS OWN FIELD, which it has never been on this shape. Before E1 the
+    // region reached both identity and the READER only through the decoration above — this file
+    // mentioned `region` zero times — so removing the suffix without adding the field would take
+    // the region out of an assessor's view and out of the delta's key at the same time. It is a
+    // FIELD and never a suffix: a suffix is a value change that fabricates churn across an
+    // upgrade, a field is recomputed identically on both sides of any comparison.
+    region,
+    // ⚠️ AN EVIDENCE GAP IS SCOPE, NOT A FINDING, and the delta cannot tell them apart without
+    // this. A gap record says "the scanner could not read this surface" — so a finding that
+    // vanished behind one was not fixed, nobody looked. It is carried on the finding rather than
+    // in a side-channel because that is where the producer already writes it (`details.evidenceGap`
+    // on 7 AWS and 3 Azure findings of the real 1.1.0 run), which means the READ side needs no
+    // writer change to see it.
+    evidenceGap: f?.details?.evidenceGap === true,
+    // WHICH gap, when the producer names one (EE 1.1.0 build 9). The delta scopes an `input_gap` that
+    // carries a PORT to that port alone (`probe-not-measured`); every other gap stays producer-wide.
+    gapClass: typeof f?.details?.gapClass === 'string' ? f.details.gapClass : null,
+    // ⚠️ A DECLARED SCOPE BOUNDARY IS NOT A FINDING EITHER (EE 1.1.0 build 5, CFN-3's consumer-first
+    // route). Seventeen plugins emit one INFO row stating what they do NOT examine, flagged
+    // `details.deferredScope`; it routes to no control and is not an exposure. Paired like a finding,
+    // a correction to its WORDING read as one finding resolved and another appearing. Carried on the
+    // finding for the same reason as `evidenceGap`: that is where the producer already writes it.
+    deferredScope: f?.details?.deferredScope === true,
+    // ⚠️ IDENTITY MUST NEVER BE COMPUTED OVER A TRUNCATED STRING, and these two exist because it
+    // was. Plugin 1170 emits no `title`, so one is synthesised from `issues` and CUT AT 160 CHARS
+    // — and on a live estate three ingress rules on ONE security group (PostgreSQL 5432, SSH 22,
+    // Redis 6379, every one open to 0.0.0.0/0) synthesised to the SAME 158-character string,
+    // because the port list is the only token that differs and it falls just past the cut.
+    // `resource` is the REGION for that plugin and `port` is null, so neither discriminated.
+    // Three real CRITICAL exposures held ONE identity: remediate the SSH rule, acquire a new
+    // 0.0.0.0/0 rule on the same group, and the delta reports UNCHANGED.
+    //
+    // `contentDigest` is taken over the UNTRUNCATED content this function already holds, so the
+    // fix covers EVERY producer whose text differs only past 160 chars, not just 1170.
+    contentDigest: crypto.createHash('sha256')
+      .update(JSON.stringify([f?.title ?? null, contentIssues])).digest('hex').slice(0, 16),
+    // And the PRODUCER-EMITTED discriminators, never ones invented here: a rule identity the
+    // plugin already carries in `details`. Absent on producers that emit none, which is why the
+    // key falls back rather than requiring it.
+    identityQualifier: [f?.details?.groupId, f?.details?.protocol, f?.details?.fromPort, f?.details?.toPort]
+      .filter((v) => v != null).join('/') || null,
+    // WHICH ORACLE adjudicates this producer's scope. A plugin id is answerable from the record's
+    // `pluginsRequested`; an EE analysis agent is NOT — it appears in no such list, because
+    // `agents/agent_runner.mjs` derives the agent set from CAPABILITIES and the envelope persists
+    // no per-agent run status. Deriving this in the delta would mean guessing from the shape of
+    // the string; the loader KNOWS, because it knows which container the finding came out of.
+    producerKind: (plugin ?? f?.plugin) != null ? 'plugin' : null,
+    // ⚠️ CARRIED FOR COMPARABILITY, and for the same reason as `resource`. A cross-run delta can
+    // only call a finding resolved if the plugin that produced it RAN in both scans; without the
+    // producing plugin on the finding, every comparison falls to "plugin-not-run" — never a false
+    // "resolved" (the safe direction) but a wall of NOT-COMPARABLE, which is a feature nobody reads.
+    plugin: plugin ?? f?.plugin ?? null,
+    // ⚠️ IDENTITY AND DISPLAY ARE TWO FIELDS, and splitting them is not tidiness. `plugin` is
+    // compared against `record.pluginsRequested`, which `cli.mjs` writes as plugin IDs, so it must
+    // BE an id or the comparison is false on every real record. But `scan_delta.mjs` interpolates
+    // the producing plugin into its `plugin-not-run` detail and `executive_report.mjs` renders
+    // that detail into the CLIENT HTML's basis cell — so stamping the id alone would put
+    // "plugin 003 did not run in the other run" into a branded deliverable. One field cannot be
+    // both the join key and the prose.
+    pluginName: pluginName ?? f?.pluginName ?? null,
     // ALL issues, not just the lead clause the title took: a report that shows one of a
     // finding's four issues silently drops three the scan actually recorded.
     detail: explicitDetail ?? (issueTexts.length ? issueTexts.join(' · ') : null),
@@ -198,6 +304,42 @@ function shapeQueueEntry(host, q) {
     epss: typeof q?.epssScore === 'number' && Number.isFinite(q.epssScore) ? q.epssScore
       : (typeof q?.epss === 'number' && Number.isFinite(q.epss) ? q.epss : null),
     exploitPriority: q?.exploitPriority ?? null,
+    // ⚠️ THE QUEUE IS A SIBLING ARTIFACT WITH ITS OWN PRODUCER VOCABULARY, and emitting NO
+    // producer at all was the fifth instance of the loader-boundary class: every queue finding
+    // reached the delta as `plugin: undefined` and bucketed `plugin-not-run` with the sentence
+    // "plugin undefined did not run in the other run". Its real producer is an EE ANALYSIS AGENT,
+    // not a CE plugin — measured across 350 real queue entries: intelligence_engine 302 ·
+    // crypto_agent 46 · exposure_agent 2, and ZERO entries carrying anything id-shaped. So this
+    // identity is NOT a member of `pluginsRequested` and never will be; deciding whether an agent
+    // was in scope on the other side needs its own oracle, which is why a null producer must
+    // still refuse rather than fall through. Absence here is a per-finding fact, not a class.
+    plugin: q?.evidence?.source ?? null,
+    pluginName: q?.evidence?.source ?? null,
+    producerKind: q?.evidence?.source ? 'agent' : null,
+    // ⚠️ THIS WAS THE CONSTANT `false`, UNDER A COMMENT THAT SAID "a queue entry is never a gap
+    // record: gaps are emitted by plugins into the host envelope". Enterprise's CPE mapper emits
+    // SIX classes of coverage-gap record straight into this queue, and one of them exists purely
+    // to say "my discovery upstreams did not run" — so the premise was false about the code, and
+    // the seam discarded the only fact that record carried. Measured consequence on two real
+    // scans: three `[COVERAGE GAP] cpe_map_miss` rows that vanished because ten discovery plugins
+    // TIMED OUT were reported to the reader as REMEDIATED.
+    //
+    // The queue's vocabulary is `evidence.raw`, not `details` — a queue entry has no `details`.
+    // Exactly `true`, never merely truthy: a producer writing something else has a bug, and
+    // reading it as a declaration would make that producer's whole output un-differenceable.
+    evidenceGap: q?.evidence?.raw?.evidenceGap === true,
+    // WHICH gap (EE 1.1.0 build 9). EE's service-set input gap names the port a probe could not
+    // measure: a probe that RAN on a port the port scanner saw open and did not complete its connection
+    // there. The delta reads `input_gap` + a port as "that port was not measured in this run", so a
+    // baseline row on it reads `probe-not-measured`, never RESOLVED. Carried verbatim; the queue's
+    // vocabulary is `evidence.raw`, as for `evidenceGap`.
+    gapClass: typeof q?.evidence?.raw?.gapClass === 'string' ? q.evidence.raw.gapClass : null,
+    // ⚠️ NO QUEUE PRODUCER EMITS ONE TODAY — measured on the build-4 corpus, the only queue (38
+    // entries, intelligence_engine 33 + crypto_agent 5) carries no `deferredScope` at either depth,
+    // and `evidence.raw` there is an intel record, not a finding. This read is SHAPE PARITY with the
+    // envelope path, so a queue producer that starts declaring a boundary is set aside on the day it
+    // does, rather than paired. Exactly `true`, as above; pinned in both directions by test.
+    deferredScope: q?.evidence?.raw?.deferredScope === true,
     id: q?.id ?? null,
   };
 }
@@ -214,6 +356,78 @@ function shapeQueueEntry(host, q) {
  * carrying severity-bearing objects that is neither read here nor allowlisted there fails
  * loudly. Incompleteness costs NOISE, never SILENCE.
  */
+// ⚠️ ONE DEFINITION OF A FINDING, SHARED BY BOTH COMPARISON CHANNELS (board C10).
+//
+// `scan_history.jsonl` used to carry a count `cli.mjs` computed for itself — service-level
+// attributes plus plugin `result.findings` — while `report --since` counted whatever THIS module
+// shapes. On the real estate the two disagreed completely: the 192.168.1.1 Gate-2 run recorded
+// `findingsCount: 0` while its queue held 37 entries, 21 carrying CVEs. The history is a
+// COMPARISON channel (`computeDiff` derives `newFindings` and `findingsDelta` from that number,
+// and `delta_reporter` gates a webhook on it), so the host reported "no change" on every scan.
+//
+// ⚠️ AND THE FIX IS NOT A THIRD SUM. The previous repair of this same channel added
+// `cloudFindingsCount` after cloud plugins recorded 0 over a 201-finding scan — a per-producer
+// patch, which closes only the producers it enumerates, which is how the channel came to be
+// wrong twice. Deriving the count from the shaping the delta already uses is what makes the two
+// channels incapable of drifting apart: a producer this module learns to read is counted by both,
+// on the same day, without anyone remembering to add it here.
+//
+// A GAP IS SCOPE, NOT A FINDING, and is excluded — exactly as the delta excludes gaps from its
+// buckets. Counting one would make an AccessDenied look like a vulnerability appearing and a
+// fixed permission look like a remediation.
+// ⚠️ AND SO IS A DECLARED SCOPE STATEMENT (`deferredScope`), since the delta began setting those
+// aside before pairing (CE 0.2.55, CFN-3). Leaving them in this count would make the sentence
+// above false the day that landed: the delta and the history would disagree about the 12 scope
+// rows of the test estate's aws run. A row carrying both flags is a gap and is excluded either way.
+export function countHostFindings(host, raw, queue = []) {
+  return shapeHostFindings(host, raw, queue)
+    .filter((f) => f?.evidenceGap !== true && f?.deferredScope !== true).length;
+}
+
+// ⚠️ THE VALUE CHANGED UNDER AN UNCHANGED KEY, which contract-v1 §5.3 records as the shape that
+// once reported a mass remediation that never happened. A history line written before this fix
+// counted the old way; one written after counts the new way, and subtracting across them would
+// report a fabricated "+N new" on the first scan after an upgrade. The basis rides the line so
+// `computeDiff` can REFUSE the comparison instead of computing it.
+// `loader-shaped-v2` (CE 0.2.55): scope statements left the count. A v1 line and a v2 line are
+// refused like any basis change — the number moved under the same key again, by the number of
+// scope statements the run carried.
+export const FINDINGS_COUNT_BASIS = 'loader-shaped-v2';
+
+// ⚠️ THE COUNT AND ITS BASIS COME FROM ONE CALL, DELIBERATELY. They were two statements, and a
+// mutant that reverted the COUNT to the old per-producer sum kept the BASIS stamp — so the
+// history line claimed to have been counted the new way while holding an old-way number, and the
+// end-to-end leg could not tell. A line's basis is a claim about HOW it was produced, so only the
+// thing that produces it may assert it. Returns null when the artifacts cannot be read, and the
+// caller then records an UN-BASED line rather than a mislabelled one.
+export async function deriveFindingsCount(outDir, host) {
+  try {
+    const raw = JSON.parse(await fsp.readFile(path.join(outDir, 'scan_conclusion_raw.json'), 'utf8'));
+    // ⚠️ THE QUEUE IS RESOLVED EXACTLY AS `loadRun` RESOLVES IT, and the first draft of this did
+    // not. `loadRun` normalises a non-array file (`{queue:[…]}` / `{findings:[…]}`) and falls back
+    // to the in-envelope `eeEnrichment.queue` for a run written before the file existed. Reading
+    // the same PATH is not the same as reading the same SOURCE: with a wrapped queue this counted
+    // zero while the report counted every entry — "one definition" nominally, two in fact, which
+    // is the whole defect C10 exists to close. Found by reading the consumer, not by a fixture.
+    return { count: countHostFindings(host, raw, resolveFindingQueue(outDir, raw)),
+      basis: FINDINGS_COUNT_BASIS };
+  } catch {
+    return null;
+  }
+}
+
+// The one resolver both channels use. Kept beside `countHostFindings` so a future change to the
+// queue's shape cannot reach one channel and miss the other.
+export function resolveFindingQueue(dir, raw) {
+  try {
+    const qRaw = JSON.parse(fs.readFileSync(path.join(dir, 'scan_finding_queue.json'), 'utf8'));
+    return Array.isArray(qRaw) ? qRaw : (qRaw?.queue ?? qRaw?.findings ?? []);
+  } catch {
+    const q = raw?.conclusion?.result?.eeEnrichment?.queue;
+    return Array.isArray(q) ? q : [];
+  }
+}
+
 export function shapeHostFindings(host, raw, queue = []) {
   const out = [];
   const seen = new Set();
@@ -247,17 +461,17 @@ export function shapeHostFindings(host, raw, queue = []) {
     // producers; the report sees BOTH paths.
     const rf = res.findings;
     if (Array.isArray(rf)) {
-      for (const f of rf) push(shapeFinding(host, f));
+      for (const f of rf) push(shapeFinding(host, f, envId(e), e?.name ?? null));
     } else if (rf && typeof rf === 'object') {
       // 060 DNS Security Auditor emits a DICT OF CATEGORIES ({spf:[…], dmarc:[…]}), which
       // an `Array.isArray` guard skips in complete silence.
       for (const arr of Object.values(rf)) {
-        if (Array.isArray(arr)) for (const f of arr) push(shapeFinding(host, f));
+        if (Array.isArray(arr)) for (const f of arr) push(shapeFinding(host, f, envId(e), e?.name ?? null));
       }
     }
     if (res.zeroTrust && typeof res.zeroTrust === 'object') {
       for (const dim of Object.values(res.zeroTrust)) {
-        if (Array.isArray(dim?.findings)) for (const f of dim.findings) push(shapeFinding(host, f));
+        if (Array.isArray(dim?.findings)) for (const f of dim.findings) push(shapeFinding(host, f, envId(e), e?.name ?? null));
       }
     }
     if (Array.isArray(res.portResults)) {
@@ -265,7 +479,7 @@ export function shapeHostFindings(host, raw, queue = []) {
         // The port result's own `severity` is a ROLL-UP of these issues, never a finding —
         // rendering both would double-count every TLS issue.
         if (Array.isArray(pr?.issues)) {
-          for (const i of pr.issues) push(shapeFinding(host, { ...i, port: i?.port ?? pr?.port ?? null }));
+          for (const i of pr.issues) push(shapeFinding(host, { ...i, port: i?.port ?? pr?.port ?? null }, envId(e), e?.name ?? null));
         }
       }
     }
@@ -277,6 +491,18 @@ export function shapeHostFindings(host, raw, queue = []) {
   return out;
 }
 
+// What the PORT SCANNER recorded on this host (EE 1.1.0 build 12) — the delta's port-state oracle. Present only when
+// 003's status on the host reads exactly `ran` AND its result carries both TCP lists; otherwise null, which the delta
+// reads as "no oracle", never as "nothing open". tcpFiltered is not carried: the delta's rule is "neither open nor
+// closed", which a filtered port and an unprobed port satisfy alike.
+export function portScanOf(raw) {
+  const st = (Array.isArray(raw?.pluginStatus) ? raw.pluginStatus : []).find((p) => String(p?.id) === '003');
+  const res = (Array.isArray(raw?.results) ? raw.results : []).find((e) => String(e?.id) === '003')?.result;
+  if (st?.status !== 'ran' || !Array.isArray(res?.tcpOpen) || !Array.isArray(res?.tcpClosed)) return null;
+  const ports = (l) => l.map(Number).filter((n) => Number.isInteger(n) && n > 0);
+  return { tcpOpen: ports(res.tcpOpen), tcpClosed: ports(res.tcpClosed) };
+}
+
 function shapeHost(host, dir, raw) {
   const envelopes = Array.isArray(raw.results) ? raw.results : [];
   const up = envelopes.some((e) => e?.result?.up === true);
@@ -284,6 +510,16 @@ function shapeHost(host, dir, raw) {
   return {
     host, dir, up, findings,
     pluginStatus: Array.isArray(raw.pluginStatus) ? raw.pluginStatus : [],
+    // ⚠️ THE DEFAULT ABOVE ERASES THE ONE DISTINCTION `scan_delta.mjs` INSISTS ON. Its `scopeOf`
+    // says in as many words that `[]` means "measured, no gaps" while MISSING means nothing was
+    // measured, and that the two must not render alike — and then reads `Array.isArray(...)` over
+    // a value this loader guarantees is an array, so the question is always true and the
+    // `scope-not-evaluated` disclosure could never fire. The default stays (every consumer
+    // iterates it), and the answer travels BESIDE it. Same loader-boundary class as the dropped
+    // `plugin` / `resource` / `control` fields: the distinction was preserved in the consumer and
+    // destroyed here, before the consumer ever saw it.
+    pluginStatusRecorded: Array.isArray(raw.pluginStatus),
+    portScan: portScanOf(raw),
   };
 }
 
@@ -300,7 +536,8 @@ function buildModel(rec, hosts, counts) {
     // (`--host 10.0.0.7,10.0.0.7`, a repeated --host-file line, an overlapping range — none of
     // which utils/host_iterator.mjs de-duplicates). A name-keyed Map is last-write-wins and
     // silently drops every same-named host's own plugin table but the final one's.
-    plugins.byHost.push({ host: h.host, dir: h.dir, status: h.pluginStatus });
+    plugins.byHost.push({ host: h.host, dir: h.dir, status: h.pluginStatus,
+      pluginStatusRecorded: h.pluginStatusRecorded, portScan: h.portScan });
     for (const ps of h.pluginStatus) {
       if (ps?.status === 'ran') plugins.ran += 1;
       else if (ps?.status === 'skipped') plugins.skipped += 1;
@@ -345,7 +582,10 @@ async function finishLoadingRecord(outRoot, rec, allowPartial) {
 
   const hosts = [];
   const unreadByHost = [];
-  for (const { host, dir } of rec.hostsWritten ?? []) {
+  // ⚠️ THE HOST IS READ CANONICAL (census G6, CE half): a record written before the parse-time fold
+  // carries `AWS` as typed, and a model that kept it would compare unequal to a later `aws` run.
+  for (const { host: recordedHost, dir } of rec.hostsWritten ?? []) {
+    const host = canonicalHost(recordedHost);
     const rawPath = path.join(outRoot, dir, 'scan_conclusion_raw.json');
     let raw;
     try { raw = JSON.parse(await fsp.readFile(rawPath, 'utf8')); }
@@ -369,14 +609,11 @@ async function finishLoadingRecord(outRoot, rec, allowPartial) {
     // fallback covers a record written before the file existed. A queue that cannot be read
     // yields [] and the host simply renders its plugin findings — never an exception, and
     // never a silent substitution of one source for another.
-    let findingQueue = [];
-    try {
-      const qRaw = JSON.parse(fs.readFileSync(path.join(outRoot, dir, 'scan_finding_queue.json'), 'utf8'));
-      findingQueue = Array.isArray(qRaw) ? qRaw : (qRaw?.queue ?? qRaw?.findings ?? []);
-    } catch {
-      const q = raw?.conclusion?.result?.eeEnrichment?.queue;
-      if (Array.isArray(q)) findingQueue = q;
-    }
+    // ⚠️ ONE RESOLVER, SHARED WITH `deriveFindingsCount` (board C10). This logic was duplicated
+    // there and the copy was already wrong — it handled only a bare array, so a wrapped queue
+    // counted zero in the history channel and every entry in the report. Two copies of "what the
+    // queue is" is the same defect one layer down from two copies of "what a finding is".
+    const findingQueue = resolveFindingQueue(path.join(outRoot, dir), raw);
     // ⚠️ THE CENSUS RUNS ON EVERY REAL RUN, NOT ONLY IN TESTS — this is what makes it a
     // guard rather than a fixture. Its reconcile leg's corpus is synthetic, and the two real
     // runs were reconciled BY HAND; a new plugin inventing a new container would be silent
@@ -397,10 +634,29 @@ async function finishLoadingRecord(outRoot, rec, allowPartial) {
 
   const requested = (rec.hostsRequested ?? []).length;
   const written = hosts.length;
-  const { missingNamed, missingUnparseable } = computeMissing(rec.hostsRequested ?? [], hosts.map((h) => h.host));
+  const { missingNamed, missingUnparseable } = computeMissing((rec.hostsRequested ?? []).map(canonicalHost), hosts.map((h) => h.host));
   const incomplete = !rec.finishedAt;
   const anyMissing = missingNamed.length > 0 || missingUnparseable > 0;
 
+  // ⚠️ AN ABORTED RUN IS REFUSED BY NAME, WITH ITS RECORDED REASON (board item 2). It is finalised and
+  // sealed now, so `finishedAt` is set and the incomplete check below would pass it — and the partial-
+  // hosts message would say what is missing without saying the scan was stopped. Checked before both.
+  // Refused, never skipped: `--since prior` still selects it ("disclose, never substitute").
+  if (rec.status === 'aborted' && !allowPartial) {
+    // Disclose, never substitute — and never leave the user without the fix: name the nearest FINISHED
+    // run before it, so it can be passed explicitly. A record with no `status` predates the field and
+    // is a finished run, never an aborted one.
+    const prior = (await listRunRecords(outRoot))
+      .filter((r) => r?.runId !== rec.runId && r?.finishedAt && r?.status !== 'aborted' && String(r?.startedAt) < String(rec.startedAt))
+      .sort((a, b) => String(b.startedAt).localeCompare(String(a.startedAt)))[0] ?? null;
+    return refuse('aborted-run',
+      `Refusing to report: this run was ABORTED before it completed (${rec.abortReason ?? 'no reason was recorded'}). `
+      + `${written} of ${requested} requested hosts were written. `
+      + (prior ? `The nearest finished run before it is \`${prior.runId}\` — pass it with \`--run\` or \`--since\` to use it explicitly. `
+        : 'No finished run precedes it. ')
+      + 'Re-run the scan, or pass `--allow-partial` to report on what was recorded.');
+  }
+
   // ORDER MATTERS (mutant-proven — see the task report): the incomplete case is checked FIRST.
   // A crash after the LAST host directory is written leaves hostsWritten === hostsRequested with
   // no finishedAt, so `anyMissing` is false and the partial-hosts message below would be FALSE —