nsauditor-ai 0.2.55 → 0.2.56

package/utils/scan_delta.mjs

@@ -18,6 +18,10 @@
 // A finding may be called RESOLVED only when its host, plugin, scope and framework enumeration
 // were in scope in BOTH runs. Otherwise it goes to NOT-COMPARABLE **with its reason** — never
 // into `resolved`, and never silently dropped.
+// ⚠️ 1.2.0 limit, boarded for 1.2.1: "plugin" is a PLUGIN row's own producer. An analysis agent's or the
+// CVE mapper's row is derived from other plugins' output, and whether those were requested in both runs
+// is NOT checked — narrow `--plugins` in one run and such a row goes into `resolved` (or `new`).
+// AGENT_SCOPE_FROM_TIER discloses it; tests/build6_delta_scope_honesty.test.mjs pins it until the check exists.
 // Integrity is a fact about BYTES ON DISK, so the caller measures it with `utils/run_chain.mjs`
 // and passes the verdict in. Keeping it out of this module means the comparability rules can be
 // driven without a filesystem, and the chain can be driven without the delta.
@@ -74,10 +78,147 @@ export const PROBE_NOT_MEASURED_REASON = 'probe-not-measured';
 // those ports read RESOLVED in the client's delta; five minutes later both ports were open again. A port in the
 // other run's tcpClosed WAS measured, and RESOLVED there stays legitimate. Enterprise's MTTR imports this name.
 export const PORT_NOT_MEASURED_REASON = 'port-not-measured';
+// A UDP-TRANSPORT FINDING THAT VANISHED WAS NOT MEASURED AS FIXED EITHER (1.1.1 board — found by the 1.1.0 web
+// cascade's reviewer driving the shipped engine). The TCP rule above keys on the port NUMBER in the holding run's
+// tcpOpen, so an SNMP 161/udp row that disappeared read RESOLVED with no caveat anywhere, and a udp/53 DNS row was
+// judged by TCP/53's state. No shipped UDP producer records a positive negative — SNMP records `no response`, DNS a
+// timeout, and the port scanner's `udpClosed` is empty on every sealed raw measured — so UDP SILENCE IS
+// INDISTINGUISHABLE FROM FILTERED, and a UDP row in one run only is NOT COMPARABLE unless the other run's service set
+// shows the port MEASURED for that producer (`udpPortMeasurement`: closed, or answered — and, for the CVE mapper,
+// identified). Same token, its own detail. What decides "UDP" is the finding's `protocol`, which is an APPLICATION LABEL, not a transport (the
+// concluder takes it from `probe_protocol || result.protocol || 'tcp'`), so the decision is this table.
+//
+// ⚠️ THE TABLE IS DERIVED, NOT HAND-LISTED: its keys are held in equality with every protocol label the shipped
+// producers WRITE — CE's plugins and utils here (`tests/udp_transport_label_census.test.mjs`), and Enterprise's
+// plugins, agents and engine on its side — so a label outside it is unreachable through the shipped path, and the
+// runtime default for an unknown label (not UDP, today's verdict) is a default nothing exercises. `dns` is classed
+// UDP because that is the SAFE direction, and its cost is STATED: a TCP-53 row labelled `dns` — a zone transfer (AXFR)
+// finding, which is TCP — OVER-REFUSES (it reads not-comparable where a closed TCP/53 would have been a measured fix),
+// while a UDP DNS row labelled TCP would read RESOLVED on a closed TCP/53. 060 writes port-53 rows under both `udp`
+// and `dns`, so the choice is live, not theoretical. `other` is a label with no port-bearing transport (ICMP, ARP, the
+// concluder's meta labels, which it filters out of the service set before any producer reads them).
+export const TRANSPORT_OF_LABEL = Object.freeze({
+  udp: 'udp', mdns: 'udp', dnssd: 'udp', llmnr: 'udp', upnp: 'udp', dns: 'udp',
+  tcp: 'tcp', 'tcp-ack': 'tcp', http: 'tcp', https: 'tcp', tr069: 'tcp',
+  icmp: 'other', 'icmp-timestamp': 'other', arp: 'other', 'os-detector': 'other', assessment: 'other', api: 'other',
+});
+export const UDP_TRANSPORT_LABELS = Object.freeze(Object.keys(TRANSPORT_OF_LABEL).filter((l) => TRANSPORT_OF_LABEL[l] === 'udp'));
+/** Is this protocol label a UDP transport? Case-insensitive; anything not a string, or not in the table, is not. */
+export const isUdpTransport = (label) => typeof label === 'string' && TRANSPORT_OF_LABEL[label.toLowerCase()] === 'udp';
+
+// The queue producer whose rows are CVE matches over a service's IDENTITY (program + version). Community cannot import
+// Enterprise, so the name is declared here and Enterprise's test holds it equal to its `INTELLIGENCE_ENGINE_SOURCE`.
+export const CVE_MAPPER_PRODUCER = 'intelligence_engine';
+const identified = (program) => typeof program === 'string' && program.trim() !== '' && program.trim().toLowerCase() !== 'unknown';
+
+/**
+ * WAS THIS UDP PORT MEASURED IN A RUN, FOR THIS PRODUCER? (1.1.1) — ONE decision, called by the delta and by
+ * Enterprise's MTTR, so the two channels cannot disagree. `services` is that run's UDP service records on the host
+ * (the loader's `udpServicesOf`), or null when the run recorded no service set.
+ *
+ * - `closed` on the port → MEASURED: the concluder writes it only from ECONNREFUSED, a real negative ("a CLOSED port
+ *   was measured, and closure there stands", as for TCP).
+ * - `open` → MEASURED for an analysis agent: it reads the fields the probe filled, so it looked and found nothing.
+ * - `open` for the CVE MAPPER → MEASURED only when the service was IDENTIFIED (a program that is not `Unknown`, and a
+ *   version). The mapper returns nothing and records nothing for an unidentified service (intelligence_engine's
+ *   program guard), so an `open` port whose program is `Unknown` would otherwise "resolve" every CVE row on it —
+ *   twenty dnsmasq rows on the router corpus — through this exemption's own front door (the audit seat's condition).
+ * - anything else (`no response`, `unknown`, the port absent from the set, no set at all) → NOT measured.
+ *
+ * @returns {{measured: true, basis: string} | {measured: false, kind: 'no-oracle'|'not-answered'|'unidentified', why: string}}
+ */
+export function udpPortMeasurement(port, producer, services, runName = 'the other run') {
+  if (!Array.isArray(services)) {
+    return { measured: false, kind: 'no-oracle', why: `${runName} recorded no service set, so nothing says whether a UDP service answered there` };
+  }
+  const here = services.filter((s) => Number(s?.port) === Number(port));
+  const closed = here.find((s) => s?.status === 'closed');
+  if (closed) return { measured: true, basis: `${port}/udp closed in ${runName} (${closed.service ?? closed.protocol} closed)` };
+  const open = here.filter((s) => s?.status === 'open');
+  if (open.length === 0) {
+    return { measured: false, kind: 'not-answered', why: here.length
+      ? `in ${runName} no UDP service answered on that port (${here.map((s) => `${s.service ?? s.protocol} ${s.status ?? 'no status'}`).join(', ')})`
+      : `${runName}'s service set holds no UDP service on that port` };
+  }
+  if (producer === CVE_MAPPER_PRODUCER) {
+    // ⚠️ A VERSION, NOT A PLACEHOLDER: the producers write an absent version as the literal `Unknown`, and the mapper
+    // queries a CPE with it, matches nothing and records nothing — so `Unknown` is as absent as null here.
+    const id = open.find((s) => identified(s.program) && identified(s.version));
+    if (!id) {
+      const s = open[0];
+      return { measured: false, kind: 'unidentified', why: `in ${runName} the UDP service answered but was not identified (program `
+        + `${identified(s.program) ? s.program : (s.program ?? 'absent')}, version ${identified(s.version) ? s.version : (s.version ?? 'absent')}), so the CVE mapper could not have matched it` };
+    }
+    return { measured: true, basis: `${port}/udp answered in ${runName} (${id.service ?? id.protocol} open · ${id.program} ${id.version})` };
+  }
+  const s = open[0];
+  const who = identified(s.program) ? ` · ${s.program}${s.version ? ` ${s.version}` : ''}` : '';
+  return { measured: true, basis: `${port}/udp answered in ${runName} (${s.service ?? s.protocol} open${who})` };
+}
+// ⚠️ A CVE ROW THAT VANISHED WHILE THE SAME PROGRAM AND VERSION STILL ANSWER WAS NOT FIXED (1.2.0 build 2 — the audit
+// seat's ruling on the build-1 smoke). The CVE mapper attributes a CVE on (program, version) alone, so a row present in
+// one run only while the IDENTIFIED program AND version at that host:port:transport are the same in both runs cannot
+// be a remediation: the vulnerability DATA moved — NVD's answer, the age of a cached answer, an offline store. MEASURED:
+// five dnsmasq 2.78 CVEs NVD stopped matching (all "Awaiting Analysis", no configurations) read RESOLVED across the
+// published 1.1.0 run and 1.2.0 build 1, with `dns · dnsmasq · 2.78 · open` on 53/udp in both. APPEND-ONLY.
+export const VULNERABILITY_DATA_CHANGED_REASON = 'vulnerability-data-changed';
+
+const transportOf = (label) => (typeof label === 'string' ? TRANSPORT_OF_LABEL[label.toLowerCase()] ?? null : null);
+/** An identity the CVE mapper could have matched on: a program AND a version, neither absent nor the `Unknown` placeholder. */
+export function identityOf(program, version) {
+  return identified(program) && identified(version) ? { program: String(program).trim(), version: String(version).trim() } : null;
+}
+/**
+ * THE SERVICE IDENTITY AT host:port:transport IN ONE RUN — the ONE decision both the delta and Enterprise's MTTR call.
+ * `services` is that run's service set, every transport (the loader's `servicesOf`); the row's `protocol` is an
+ * application LABEL, mapped to its transport by `TRANSPORT_OF_LABEL` on both sides. Only an OPEN, IDENTIFIED service
+ * counts; two different identities on one port and transport are AMBIGUOUS and return null, so the rule stays silent
+ * rather than choose one. Null also when no set was recorded — no oracle, never "nothing answered".
+ */
+export function serviceIdentityAt(services, port, protocol) {
+  const t = transportOf(protocol);
+  if (!Array.isArray(services) || !(Number(port) > 0) || (t !== 'tcp' && t !== 'udp')) return null;
+  const ids = new Map();
+  for (const s of services) {
+    if (Number(s?.port) !== Number(port) || transportOf(s?.protocol) !== t || s?.status !== 'open') continue;
+    const id = identityOf(s.program, s.version);
+    if (id) ids.set(`${id.program.toLowerCase()}|${id.version}`, { ...id, port: Number(port), transport: t });
+  }
+  return ids.size === 1 ? [...ids.values()][0] : null;
+}
+/** The same identified program AND version — both present. Program is compared case-insensitively, version exactly. */
+export const sameServiceIdentity = (a, b) => a != null && b != null
+  && a.program.toLowerCase() === b.program.toLowerCase() && a.version === b.version;
+/**
+ * WHERE A RUN'S VULNERABILITY DATA CAME FROM, in words, from its run record's `nvdCache` — never a local path, which
+ * would carry the operator's directory layout into a client artifact. `state` is the offline store's (`absent` means
+ * none was imported, so the NVD API answered, through the response cache when it held the entry).
+ */
+export function vulnerabilityDataSource(nvdCache) {
+  if (!nvdCache || typeof nvdCache !== 'object') return 'not recorded';
+  if (['fresh', 'stale', 'undated'].includes(nvdCache.state)) return `an offline NVD store (${nvdCache.state})`;
+  const rc = nvdCache.responseCache;
+  const day = (t) => (typeof t === 'string' ? t.slice(0, 10) : null);
+  if (rc?.present === true && day(rc.oldestAt)) {
+    const a = day(rc.oldestAt); const b = day(rc.newestAt) ?? a;
+    return `NVD answers cached up to ${rc.ttlDays} days, fetched ${a === b ? a : `${a} to ${b}`}`;
+  }
+  return 'the NVD API, asked live';
+}
 // The gap class Enterprise's service-set input gap stamps (`evidence.raw.gapClass`). Spelled ONCE, here, on
 // the reading side: Enterprise imports it, so the producer and this reader cannot drift to two spellings.
 export const INPUT_GAP_CLASS = 'input_gap';
 
+// ⚠️ RUNS ARE NAMED ABSOLUTELY IN EVERY DETAIL (1.1.1 — the audit seat's T1-c fold 1). The executive page prefixes a
+// not-comparable row with its direction in absolute terms ("absent from this run" / "appeared in this run", this run =
+// the CURRENT run), and the details used to name runs RELATIVE to the side holding the row ("in the other run") — which
+// for a row that DISAPPEARED is also the current run, so the assembled line placed a current-run failure in the
+// baseline. The call site knows the frame and passes it; `udpPortMeasurement` keeps "the other run" only as its DEFAULT,
+// because Enterprise's MTTR rewords that phrase for its own frame.
+export const RUN_NAMES = Object.freeze({ current: 'this run', baseline: 'the baseline run' });
+const FRAME_DISAPPEARED = Object.freeze({ mine: RUN_NAMES.baseline, theirs: RUN_NAMES.current });
+const FRAME_APPEARED = Object.freeze({ mine: RUN_NAMES.current, theirs: RUN_NAMES.baseline });
+
 export const NOT_COMPARABLE_REASONS = Object.freeze([
   'host-not-scanned',              // the other run never wrote this host
   'producer-unknown',              // the finding carries no producer identity to adjudicate
@@ -89,6 +230,7 @@ export const NOT_COMPARABLE_REASONS = Object.freeze([
   SCOPE_NOT_SCANNED_REASON,        // the finding's coverage unit was outside the OTHER run's recorded scope
   PROBE_NOT_MEASURED_REASON,       // a probe ran on the finding's port, open per the port scanner, and did not complete there
   PORT_NOT_MEASURED_REASON,        // the finding's port was open in its run and neither open nor closed in the other (filtered / unprobed)
+  VULNERABILITY_DATA_CHANGED_REASON, // a CVE row in one run only, the same program AND version identified on its port in both
 ]);
 
 /**
@@ -262,11 +404,11 @@ export const VIEW_REFUSAL_REASONS = Object.freeze([
 // the input. `tests/delta_boundary_contract.test.mjs` asserts CONSUMED ⊆ EMITTED ∪ DECLARED_ABSENT
 // against the REAL loader, so the fourth instance fails by name instead of shipping.
 export const CONSUMED_FINDING_FIELDS = ['host', 'plugin', 'pluginName', 'producerKind', 'evidenceGap', 'gapClass', 'deferredScope',
-  'contentDigest', 'identityQualifier', 'resource', 'region', 'port', 'title', 'severity', 'control'];
+  'contentDigest', 'identityQualifier', 'resource', 'region', 'port', 'protocol', 'title', 'severity', 'control'];
 
 // Fields this module WRITES onto its output records; they are never read from a loaded finding,
 // so they must not be demanded of the loader. Declared so the derivation can subtract them.
-export const OUTPUT_ONLY_FINDING_FIELDS = ['reason', 'detail', 'direction', 'from', 'to'];
+export const OUTPUT_ONLY_FINDING_FIELDS = ['reason', 'detail', 'direction', 'from', 'to', 'basisNote'];
 
 // A consumed field the loader legitimately cannot produce. NOT a bare allowlist: each entry names
 // the limit that DISCLOSES its absence, and the guard verifies that limit is actually emitted —
@@ -470,18 +612,33 @@ export function portsNotMeasured(findings) {
 function portStateOf(byHost) {
   const out = new Map();
   for (const h of Array.isArray(byHost) ? byHost : []) {
+    const k = hostKey(h?.host);
     const ps = h?.portScan;
-    if (!ps || !Array.isArray(ps.tcpOpen) || !Array.isArray(ps.tcpClosed)) continue;
-    const k = hostKey(h.host);
-    const e = out.get(k) ?? { open: new Set(), closed: new Set() };
-    for (const p of ps.tcpOpen) if (Number(p) > 0) e.open.add(Number(p));
-    for (const p of ps.tcpClosed) if (Number(p) > 0) e.closed.add(Number(p));
-    out.set(k, e);
+    if (ps && Array.isArray(ps.tcpOpen) && Array.isArray(ps.tcpClosed)) {
+      const e = out.get(k) ?? {};
+      e.open ??= new Set(); e.closed ??= new Set();
+      for (const p of ps.tcpOpen) if (Number(p) > 0) e.open.add(Number(p));
+      for (const p of ps.tcpClosed) if (Number(p) > 0) e.closed.add(Number(p));
+      out.set(k, e);
+    }
+    // The UDP oracle (1.1.1): the loader's `udpServices` — present only where the run recorded a service set. Two
+    // directories of one host pool their records, as their TCP lists do above.
+    if (Array.isArray(h?.udpServices)) {
+      const e = out.get(k) ?? {};
+      e.udpServices = [...(e.udpServices ?? []), ...h.udpServices];
+      out.set(k, e);
+    }
+    // Every transport's service identities (1.2.0 build 2) — the loader's `servicesOf`, for `serviceIdentityAt`.
+    if (Array.isArray(h?.services)) {
+      const e = out.get(k) ?? {};
+      e.services = [...(e.services ?? []), ...h.services];
+      out.set(k, e);
+    }
   }
   return out;
 }
 
-function scopeNotScanned(f, mine, theirs) {
+function scopeNotScanned(f, mine, theirs, names) {
   const provider = hostKey(f?.host);
   const mineEntry = mine?.scopeScanned?.[provider] ?? null;
   const theirEntry = theirs?.scopeScanned?.[provider] ?? null;
@@ -510,15 +667,15 @@ function scopeNotScanned(f, mine, theirs) {
   } else if (!mineEntry) {
     // Guard (1) already returned when NEITHER side knows, so the other side does know — and this
     // finding's own run does not. Which unit it belongs to is unknowable, so it fails closed.
-    return `this run's record carries no ${unitName} scope, so which ${unitName} this finding `
-      + 'belongs to is not known — it cannot be called fixed or new against the other run';
+    return `${names.mine}'s record carries no ${unitName} scope, so which ${unitName} this finding `
+      + `belongs to is not known — it cannot be called fixed or new against ${names.theirs}`;
   } else {
     value = mineEntry.scanned?.[0] ?? null;
     if (value === null) return null;                          // (2) recorded an empty scope
   }
 
   if (!theirEntry) {
-    return `the other run's record carries no ${unitName} scope, so it is not known whether `
+    return `${names.theirs}'s record carries no ${unitName} scope, so it is not known whether `
       + `${unitName} ${value} was covered there — this finding cannot be called fixed or new `
       + 'against an unknown scope';
   }
@@ -544,14 +701,14 @@ function scopeNotScanned(f, mine, theirs) {
     // and refuse every archived comparison at once.
     const perProducer = theirEntry.byPlugin?.[String(f?.plugin)];
     if (Array.isArray(perProducer) && !perProducer.includes(value)) {
-      return `${unitName} ${value} is inside the other run's overall scope, but producer `
+      return `${unitName} ${value} is inside ${names.theirs}'s overall scope, but producer `
         + `${f.plugin} only covered ${perProducer.join(', ') || 'no ' + unitName + 's'} there — `
         + 'the run-level set is the union across producers, so this surface was not looked at by '
         + 'the producer that would have found it, which is not the same as the finding being fixed';
     }
     return null;                                              // genuinely comparable
   }
-  return `${unitName} ${value} was outside the other run's recorded scope `
+  return `${unitName} ${value} was outside ${names.theirs}'s recorded scope `
     + `(${[...covered].join(', ') || 'none recorded'}) — the surface was not looked at there, `
     + 'which is not the same as the finding being fixed';
 }
@@ -617,10 +774,17 @@ const scopeOf = (side) => {
     // What this side's PORT SCANNER recorded, per host (EE 1.1.0 build 12): present only where 003 RAN and wrote
     // both lists (the loader's `portScan`), so an absent entry means "no oracle", never "nothing open".
     portState: portStateOf(side?.pluginStatus),
+    engineLookupGaps: engineLookupGapsOf(side?.findings),
+    // Where Enterprise's STAGE did not run on a host (1.1.1): the loader's `eeStage` — a failed LOAD or a failed
+    // ENRICHMENT recorded on the host's conclusion — keyed by host.
+    eeStages: new Map((Array.isArray(side?.pluginStatus) ? side.pluginStatus : [])
+      .filter((h) => h?.eeStage && (h.eeStage.loadError || h.eeStage.enrichmentError)).map((h) => [hostKey(h.host), h.eeStage])),
     // The release that WROTE this side. Carried on the scope because the identity-basis
     // declaration is a property of the comparison — which releases the two runs straddle — and
     // `incomparabilityReason` sees only the two scopes.
     eeVersion: rec.eeVersion ?? null,
+    // Where this run's vulnerability data came from (1.2.0 build 2) — the run record's `nvdCache`, rendered in words.
+    nvdCache: rec.nvdCache ?? null,
     // ⚠️ WHAT THE RUN ACTUALLY COVERED, per provider — never the FLAG. `undefined` means the
     // record predates this field and the scope is UNKNOWN, which is not the same as "covered
     // nothing": the rule below fails closed on unknown and stays silent when BOTH sides are
@@ -665,10 +829,12 @@ export const SCOPE_NOT_EVALUATED =
 // the service key) and NEVER `description`, which carries the program name identity is moving
 // away from — a digest over volatile prose reintroduces the volatility through the digest.
 export const AGENT_SCOPE_FROM_TIER =
-  'Agent-produced findings: their scope is derived from the run TIER, not from a per-agent run '
-  + 'record — this edition persists no per-agent status, and the agent set is a function of the '
-  + 'licensed capabilities. The two runs carry the same tier, which is what makes them comparable; '
-  + 'a tier difference refuses the comparison outright rather than narrowing it. '
+  'Agent-produced findings: their scope is derived from the run TIER, plus the records a run writes when '
+  + 'Enterprise failed on a host, an agent did not run, or a requested plugin it reads did not complete — the '
+  + 'agent set is a function of the licensed capabilities, and a tier difference refuses the comparison outright '
+  + 'rather than narrowing it. What is NOT compared is whether the plugins an analysis agent or the CVE mapper '
+  + 'reads were REQUESTED in both runs: when the two runs requested different --plugins, such a row can read '
+  + 'resolved or new with nothing changed. Keep --plugins identical between compared runs. '
   + 'Their IDENTITY is also narrower than a plugin finding\'s: an agent finding is keyed on host, '
   + 'producer, port and title, and on nothing else — it carries no object (resource), no region, '
   + 'no rule qualifier and NO CONTENT DIGEST. So two agent findings that differ only in text the '
@@ -697,8 +863,8 @@ export const producerNoun = (f) => (f?.producerKind === 'agent' ? 'producer' : '
 
 // Why a finding present in ONE run cannot be compared against the other. Order matters only for
 // which reason is reported first; each is independently sufficient.
-function incomparabilityReason(f, mine, theirs) {
-  if (!theirs.hosts.has(hostKey(f.host))) return { reason: 'host-not-scanned', detail: `host ${f.host} was not scanned in the other run` };
+function incomparabilityReason(f, mine, theirs, names) {
+  if (!theirs.hosts.has(hostKey(f.host))) return { reason: 'host-not-scanned', detail: `host ${f.host} was not scanned in ${names.theirs}` };
   // ⚠️ A NULL IDENTITY MAY NEVER SATISFY A SCOPE CHECK, and it may never be DESCRIBED as one
   // either. Before this leg a finding with no producer fell into `plugin-not-run` and reported
   // "plugin null did not run in the other run" — a sentence that is false about the run, about a
@@ -706,24 +872,45 @@ function incomparabilityReason(f, mine, theirs) {
   // missing. It is checked FIRST because every leg below keys on the producer.
   if (f.plugin == null) {
     return { reason: 'producer-unknown',
-      detail: 'this finding carries no producer identity, so whether it was in scope in the other run cannot be established' };
+      detail: `this finding carries no producer identity, so whether it was in scope in ${names.theirs} cannot be established` };
   }
   // ⚠️ THE ORACLE DEPENDS ON THE PRODUCER KIND, and guessing it from the string's SHAPE is what
   // this leg refuses to do. A plugin id is answerable from `pluginsRequested`. An EE analysis
   // agent appears in no such list and never will, so checking it there would bucket every
   // agent-produced finding as `plugin-not-run` for ever — safe, and useless, which is the failure
   // mode this engine was built to avoid on the other axis. Its scope is the run TIER, and the two
-  // whole-comparison refusals above (`ee-presence-differs`, `tier-differs`) are what make that
-  // sound: by the time control reaches here both sides carry Enterprise and carry the SAME tier,
-  // so the agent set is identical on both. No per-finding agent check is written here, because a
-  // check that cannot fail through the shipped path is dead code that reads as coverage.
+  // whole-comparison refusals above (`ee-presence-differs`, `tier-differs`) guarantee that by the
+  // time control reaches here both sides carry Enterprise and the SAME tier, so the agent SET is
+  // identical on both. ⚠️ THAT DOES NOT MAKE AN AGENT ROW COMPARABLE (1.2.0 limit, boarded for
+  // 1.2.1): the agent — and the CVE mapper — derives its rows from other plugins' output, and those
+  // can differ at the same tier when `--plugins` was narrowed in one run. Nothing here checks them,
+  // so such a row reads resolved or new; AGENT_SCOPE_FROM_TIER says so. That per-finding INPUT check
+  // CAN fail through the shipped path — it is owed, not dead code.
   if (f.producerKind !== 'agent' && !theirs.plugins.has(f.plugin)) {
     // ⚠️ THE NOUN HERE IS A LITERAL `plugin` AND THAT IS CORRECT — but only because of the
     // `producerKind !== 'agent'` guard on this very line, which makes the branch unreachable for
     // an agent. Delete that guard and this sentence starts calling agents plugins, which is the
     // defect the identity branch below had to be repaired for. The coupling is written here
     // because a reader deleting the guard is reading THIS line, not the sentence's test.
-    return { reason: PLUGIN_NOT_RUN_REASON, detail: `plugin ${producerLabel(f)} did not run in the other run` };
+    return { reason: PLUGIN_NOT_RUN_REASON, detail: `plugin ${producerLabel(f)} did not run in ${names.theirs}` };
+  }
+  // ⚠️ ENTERPRISE'S STAGE DID NOT RUN ON THIS HOST IN ONE OF THE RUNS (1.1.1 — the audit seat's T1-c ruling). A failed
+  // LOAD (utils/ee_load.mjs) or a failed ENRICHMENT leaves the host with no analysis-agent and no CVE-mapper rows, while
+  // the run record still names Enterprise's version and the same tier — so the whole-comparison refusals above do not
+  // fire, and before this leg every such row the other run held read RESOLVED. A queue-path row (an Enterprise producer)
+  // on a host where EITHER run recorded the failure was not looked for there. `evidence-gap`, the reason an individual
+  // agent's not-run record already carries; Community's plugins are not affected (their own status governs them).
+  // Checked before the identity-basis leg: a stage that did not run is a statement about coverage, and it wins.
+  if (f.producerKind === 'agent') {
+    const k = hostKey(f.host);
+    const stage = theirs.eeStages?.get(k) ?? mine.eeStages?.get(k);
+    if (stage) {
+      const which = theirs.eeStages?.has(k) ? names.theirs : names.mine;
+      const what = stage.loadError ? 'failed to load' : 'failed during enrichment';
+      return { reason: 'evidence-gap',
+        detail: `Enterprise ${what} on ${f.host} in ${which} — none of its analysis agents or its CVE mapper ran there, so `
+          + `this ${producerNoun(f)}'s rows were not looked for (${String(stage.loadError ?? stage.enrichmentError).slice(0, 200)})` };
+    }
   }
   // ⚠️ THE PRODUCER CHANGED WHAT IT NAMES BETWEEN THESE TWO RELEASES, so its two keys for one
   // object cannot be matched and must not be DIFFERENCED either. Checked here, before the
@@ -757,7 +944,7 @@ function incomparabilityReason(f, mine, theirs) {
   // EIGHT unremediated `eu-west-1` findings as RESOLVED — GuardDuty NOT ENABLED, Inspector2
   // DISABLED, default EBS encryption DISABLED — because narrowing a follow-up scan is a normal
   // operator action and nothing in the record could tell it from remediation.
-  const scopeMiss = scopeNotScanned(f, mine, theirs);
+  const scopeMiss = scopeNotScanned(f, mine, theirs, names);
   if (scopeMiss) return { reason: SCOPE_NOT_SCANNED_REASON, detail: scopeMiss };
 
   // ⚠️ `theirs` ONLY, AND THE `?? mine.gaps` THAT USED TO SIT HERE WAS WRONG IN BOTH HALVES.
@@ -780,9 +967,9 @@ function incomparabilityReason(f, mine, theirs) {
   if (gap) {
     return gap.kind === 'recorded-gap'
       ? { reason: 'evidence-gap',
-        detail: `the other run recorded an evidence gap on ${f.host}/${producerLabel(f)}: ${gap.reason}` }
+        detail: `${names.theirs} recorded an evidence gap on ${f.host}/${producerLabel(f)}: ${gap.reason}` }
       : { reason: PLUGIN_NOT_MEASURED_REASON,
-        detail: `${f.host}/${producerLabel(f)} was not measured in the other run — ${gap.reason}` };
+        detail: `${f.host}/${producerLabel(f)} was not measured in ${names.theirs} — ${gap.reason}` };
   }
   // ⚠️ THE FINDING'S PORT WAS NOT MEASURED IN THE OTHER RUN (EE 1.1.0 build 9, F6). Any producer's row: a
   // probe that could not complete on an OPEN port starves every consumer of that port's service. Placed
@@ -790,24 +977,92 @@ function incomparabilityReason(f, mine, theirs) {
   const portGap = f.port != null && Number(f.port) > 0 ? theirs.portGaps?.get(portGapKey(f.host, f.port)) : null;
   if (portGap) {
     return { reason: PROBE_NOT_MEASURED_REASON,
-      detail: `port ${f.port} on ${f.host} was not measured in the other run — a probe ran there and did not `
+      detail: `port ${f.port} on ${f.host} was not measured in ${names.theirs} — a probe ran there and did not `
         + `complete its connection (${portGap}). It is NOT reported as fixed or as new — rescan to compare.` };
   }
+  // ⚠️ THE CVE MAPPER COULD NOT LOOK THIS SERVICE UP IN THE OTHER RUN (1.1.1, T1b). Its own lookup gap on the same
+  // (host, port, transport) says the CVE rows were not looked for, whatever the port's state — so it answers before
+  // the port rules, and before the UDP exemption, whose "answered and identified" cannot say the lookup worked.
+  // ⚠️ AND A LOOKUP-GAP ROW ON ONE SIDE ONLY IS ITSELF NEVER NEW OR RESOLVED (condition 4): it is a record that the
+  // mapper could not look a service up, so its appearing is not a new exposure and its vanishing is not a remediation
+  // (the lookup worked again, or the service changed). It stays visible, with its reason, rather than leaving the table.
+  if (isEngineLookupGap(f)) {
+    return { reason: 'evidence-gap',
+      detail: `this is the CVE mapper's own record that it could not look up the service on ${f.port}/`
+        + `${TRANSPORT_OF_LABEL[String(f.protocol ?? '').toLowerCase()] ?? f.protocol} (${f.gapClass}), present in only one of the `
+        + 'two runs — a coverage gap that opened or cleared, not an exposure that appeared or was fixed.' };
+  }
+  if (f.plugin === CVE_MAPPER_PRODUCER && Number(f.port) > 0) {
+    const lookupGap = theirs.engineLookupGaps?.get(engineLookupGapKey(f.host, f.port, f.protocol));
+    if (lookupGap) {
+      return { reason: 'evidence-gap',
+        detail: `the CVE mapper recorded in ${names.theirs} that it could not look up the service on ${f.port}/`
+          + `${TRANSPORT_OF_LABEL[String(f.protocol ?? '').toLowerCase()] ?? f.protocol} on ${f.host} (${lookupGap}), so its CVE `
+          + 'rows there were not looked for. It is NOT reported as fixed or as new — rescan once the lookup succeeds.' };
+    }
+  }
   // ⚠️ THE FINDING'S PORT STOPPED ANSWERING (EE 1.1.0 build 12). Open in the run that HOLDS the finding, and in the
   // other run the port scanner ran and put it in NEITHER list: no answer inside its timeout, or not probed. After
   // F6, so a probe-not-measured verdict does not move. Keyed on the HOLDING run's tcpOpen, so a UDP service or a
   // port no TCP list ever named is untouched; and only where the other run's scanner RAN on this host — with no
   // oracle there the rule is silent and the legs above govern (a stated limit, not an inference).
+  //
+  // ⚠️ GATED TO NON-UDP ROWS (1.1.1): the port scanner's lists are TCP, and a udp/53 row judged by TCP/53 read
+  // RESOLVED when TCP/53 closed and printed this TCP-only sentence when TCP/53 was filtered. A UDP-transport row goes
+  // to the leg below whatever TCP says about its port number.
   const port = Number(f.port);
-  if (port > 0) {
+  const udpRow = isUdpTransport(f.protocol);
+  if (port > 0 && !udpRow) {
     const held = mine.portState?.get(hostKey(f.host));
     const other = theirs.portState?.get(hostKey(f.host));
-    if (held?.open.has(port) && other && !other.open.has(port) && !other.closed.has(port)) {
+    // `other?.open` — the TCP ORACLE, present only where 003 ran; a host entry may carry the UDP oracle alone (1.1.1).
+    if (held?.open?.has(port) && other?.open && other?.closed && !other.open.has(port) && !other.closed.has(port)) {
       return { reason: PORT_NOT_MEASURED_REASON,
-        detail: `port ${port} on ${f.host} was open in the run that holds this finding, and the other run's port `
+        detail: `port ${port} on ${f.host} was open in ${names.mine}, and ${names.theirs}'s port `
           + 'scanner recorded it neither open nor closed — no answer inside its timeout (filtered), or not probed — so '
           + 'the port was not measured there. It is NOT reported as fixed or as new — rescan to compare. (This rule '
-          + 'reads TCP ports the port scanner saw open; UDP-only and host-wide findings are not judged by it.)' };
+          + 'reads TCP ports the port scanner saw open; a UDP-transport finding is judged by its own rule, and a '
+          + 'host-wide finding by neither.)' };
+    }
+  }
+  // ⚠️ A UDP-TRANSPORT ROW PRESENT IN ONE RUN ONLY (1.1.1). No UDP producer in this release records a port as
+  // CLOSED, so the other run's silence on this port is not a measurement: never RESOLVED, never NEW. Its precondition
+  // is the finding's PRODUCER having run in the other run, which the producer-wide legs above already own — a gap or
+  // a not-measured producer answers first. It never reads the port scanner, so it does not depend on 003 running.
+  // ⚠️ THE ORACLE IS THE OTHER RUN'S UDP SERVICE RECORD (`udpPortMeasurement`, shared with MTTR): where it says the
+  // port was measured for this producer the verdict stands — a changed SNMP community resolves, a dnsmasq version
+  // bump moves its CVE set; everywhere else the row is not comparable, and the detail names which absence it was.
+  // With no service set recorded the rule FIRES: a UDP row with no oracle has no measurement at all (deliberately
+  // unlike the TCP rule's silence without 003). A PORTLESS UDP row (mdns/0) stays outside, as a host-wide row does.
+  if (port > 0 && udpRow) {
+    const m = udpPortMeasurement(port, f.plugin, theirs.portState?.get(hostKey(f.host))?.udpServices ?? null, names.theirs);
+    if (!m.measured) {
+      // The explanation follows the BRANCH: a service that answered but was not identified was not silent (the verifier
+      // of the first draft found it told the reader both), and rescanning will not change it while its version is hidden.
+      const why = m.kind === 'unidentified'
+        ? 'An unidentified service gives the CVE mapper nothing to match, so the absence of a CVE row there is not a '
+          + 'measurement. It is NOT reported as fixed or as new — rescan once the service\'s version can be read.'
+        : 'UDP silence is not a measurement: no producer in this release records an unanswered UDP port as closed, so a '
+          + 'UDP service that stopped answering cannot be told apart from one that was fixed. It is NOT reported as fixed '
+          + 'or as new — rescan, and confirm the service directly.';
+      return { reason: PORT_NOT_MEASURED_REASON,
+        detail: `${port}/udp on ${f.host} (${f.protocol}) carries a finding in only one of the two runs, and ${m.why}. ${why}` };
+    }
+  }
+  // ⚠️ THE SAME PROGRAM AND VERSION ANSWERED IN BOTH RUNS, AND ONE OF THEM HOLDS A CVE ROW THE OTHER DOES NOT (1.2.0
+  // build 2). DISAPPEARED only: a newly attributed CVE is new knowledge about an exposure that is real now, so it stays
+  // NEW and carries a basis note instead (`withNewBasis`). After the port and UDP legs, so a port that was not measured
+  // keeps its own reason; the mapper's CVE rows only — its gap and note rows carry a `gapClass` and are not attributions.
+  if (f.plugin === CVE_MAPPER_PRODUCER && !f.gapClass && port > 0 && names.mine === RUN_NAMES.baseline) {
+    const was = serviceIdentityAt(mine.portState?.get(hostKey(f.host))?.services, port, f.protocol);
+    const now = serviceIdentityAt(theirs.portState?.get(hostKey(f.host))?.services, port, f.protocol);
+    if (sameServiceIdentity(was, now)) {
+      return { reason: VULNERABILITY_DATA_CHANGED_REASON,
+        detail: `the same ${now.program} ${now.version} answered on ${port}/${now.transport} on ${f.host} in both runs, and `
+          + 'the CVE mapper attributes a CVE on the program and version alone — so this row\'s absence is a change in the '
+          + 'vulnerability data it was matched against, not a remediation. Vulnerability data — '
+          + `${names.mine}: ${vulnerabilityDataSource(mine.nvdCache)}; ${names.theirs}: ${vulnerabilityDataSource(theirs.nvdCache)}. `
+          + 'It is NOT reported as fixed — confirm against the vendor\'s advisory.' };
     }
   }
   // ⚠️ NO SILENT SHORT-CIRCUIT. This used to read `mine.frameworks && theirs.frameworks &&
@@ -826,6 +1081,70 @@ function incomparabilityReason(f, mine, theirs) {
   return null;
 }
 
+// ── THE CVE MAPPER'S OWN LOOKUP GAPS, PORT-SCOPED (1.1.1, T1b) ────────────────────────────────────────────────────
+// Enterprise's intelligence engine records a service it could not look up — the NVD lookup failed, the response was
+// not an array, the offline store could not be read or held no entry for the CPE, the program has no CPE alias, the
+// banner carried no version — as `[COVERAGE GAP] <gapClass> — <protocol>/<service>` with a `gapClass` and NO
+// `evidenceGap` flag. So since 0.2.55 a failed lookup made the baseline's CVE rows on that service read RESOLVED (TCP
+// and UDP alike). Flagging the record `evidenceGap` would not do: the recorded-gap leg keys PRODUCER-wide, so one
+// cpe_map_miss — every run has some — would set aside every engine row on the host. So it is PORT-SCOPED, on
+// (host, port, transport) from the gap record's own target, and it applies to the CVE mapper's rows alone. The gap
+// rows stay paired like findings (unchanged across runs); one on a single side is refused, never NEW or RESOLVED.
+//
+// ⚠️ THE TABLE CLASSIFIES EVERY GAP CLASS THE ENGINE DECLARES, and Enterprise's test holds it in two-way equality with
+// the engine's GAP_CLASSES, so a class the engine adds and nobody classified fails the build — incompleteness costs
+// noise, never silence. `offline_store_no_match` is a lookup failure too: a CPE absent from the store is
+// indistinguishable from an incomplete store, and a baseline that HAD rows for that CPE means the store moved.
+export const ENGINE_GAP_CLASS_KIND = Object.freeze({
+  nvd_lookup_failure: 'lookup-failed',
+  nvd_response_not_array: 'lookup-failed',
+  offline_store_read_error: 'lookup-failed',
+  offline_store_no_match: 'lookup-failed',
+  cpe_map_miss: 'lookup-failed',
+  no_version_detected: 'lookup-failed',
+  truncated_low_severity_cves: 'note',      // a COVERAGE NOTE: the lookup worked and some LOW rows were folded
+  input_gap: 'input-gap',                   // the engine's input gap — an evidence gap, handled by the recorded-gap leg
+});
+/** A CVE-mapper lookup-gap row, port-scoped. Written as plain `f.` reads so the boundary contract sees them. */
+export const isEngineLookupGap = (f) => f != null && f.plugin === CVE_MAPPER_PRODUCER
+  && ENGINE_GAP_CLASS_KIND[f.gapClass] === 'lookup-failed' && Number(f.port) > 0;
+/** The key a lookup gap and the CVE rows it covers share: host (as `hostKey`), port, and the TRANSPORT of the label. */
+export const engineLookupGapKey = (host, port, protocol) =>
+  `${hostKey(host)}|${Number(port)}|${TRANSPORT_OF_LABEL[String(protocol ?? '').toLowerCase()] ?? `label:${String(protocol ?? '').toLowerCase()}`}`;
+function engineLookupGapsOf(findings) {
+  const out = new Map();
+  for (const f of Array.isArray(findings) ? findings : []) {
+    if (isEngineLookupGap(f)) out.set(engineLookupGapKey(f.host, f.port, f.protocol), f.gapClass);
+  }
+  return out;
+}
+
+// A UDP row that RESOLVED or APPEARED did so because the other run MEASURED its port (1.1.1) — so the row shows that
+// work, in the client's own report: the Pro page sells a resolved column that says why it was trusted. `basisNote` is
+// output-only; nothing here reads it back.
+function withUdpBasis(f, theirs, theirName) {
+  const port = Number(f.port);
+  if (!(port > 0) || !isUdpTransport(f.protocol)) return f;
+  const m = udpPortMeasurement(port, f.plugin, theirs.portState?.get(hostKey(f.host))?.udpServices ?? null, theirName);
+  return m.measured ? { ...f, basisNote: m.basis } : f;
+}
+
+// A CVE row that APPEARED on a service identified the same in both runs (1.2.0 build 2 — MANDATORY, the audit seat's
+// ruling): it stays NEW, and says the service did not change, because "new exposure on my estate" and "new knowledge
+// about an old service" route to different work. A changed or unidentified service keeps today's basis.
+function withNewBasis(f, mine, theirs) {
+  const port = Number(f.port);
+  if (f.plugin === CVE_MAPPER_PRODUCER && !f.gapClass && port > 0) {
+    const now = serviceIdentityAt(mine.portState?.get(hostKey(f.host))?.services, port, f.protocol);
+    const was = serviceIdentityAt(theirs.portState?.get(hostKey(f.host))?.services, port, f.protocol);
+    if (sameServiceIdentity(was, now)) {
+      return { ...f, basisNote: `newly attributed — the same ${was.program} ${was.version} answered on ${port}/${was.transport} `
+        + `in ${RUN_NAMES.baseline}; the service is unchanged, the vulnerability data is not` };
+    }
+  }
+  return withUdpBasis(f, theirs, RUN_NAMES.baseline);
+}
+
 // The oracle test, separated from the per-finding check so its ABSENCE has somewhere to be
 // declared. gate:cascade's LEG (ii) is the precedent this repo already set: when the oracle is
 // missing, print NOT EVALUATED and never pass silently.
@@ -1025,6 +1344,8 @@ export function buildScanDelta({ baseline, current }) {
   // A declared scope boundary is set aside the same way (read into `scopeOf` as a statement); a row
   // flagged as both is a gap, which the line above already removes.
   const isScopeStatement = (f) => f.deferredScope === true;
+  // (The CVE mapper's lookup-gap rows stay PAIRED — unchanged when both runs carry one, which the mapper-gap corpus
+  // leg pins — and one present on ONE side only is refused in `incomparabilityReason`, never NEW or RESOLVED.)
   const bFind = (baseline?.findings ?? []).filter((f) => !isGap(f) && !isScopeStatement(f));
   const cFind = (current?.findings ?? []).filter((f) => !isGap(f) && !isScopeStatement(f));
   if ((baseline?.findings ?? []).some(isGap) || (current?.findings ?? []).some(isGap)) {
@@ -1087,17 +1408,17 @@ export function buildScanDelta({ baseline, current }) {
       else unchanged.push(f);
       continue;
     }
-    const why = incomparabilityReason(f, bScope, cScope);
+    const why = incomparabilityReason(f, bScope, cScope, FRAME_DISAPPEARED);
     if (why) notComparable.push({ ...f, direction: 'disappeared', ...why });
-    else resolved.push(f);
+    else resolved.push(withUdpBasis(f, cScope, RUN_NAMES.current));
   }
   for (const [k, f] of cMap) {
     if (bMap.has(k)) continue;
     // The mirror, and it is not symmetric in danger: a finding "new" only because its host or
     // plugin was out of scope last time is NEW COVERAGE, not a new exposure.
-    const why = incomparabilityReason(f, cScope, bScope);
+    const why = incomparabilityReason(f, cScope, bScope, FRAME_APPEARED);
     if (why) notComparable.push({ ...f, direction: 'appeared', ...why });
-    else newFindings.push(f);
+    else newFindings.push(withNewBasis(f, cScope, bScope));
   }
 
   return {

package/utils/scan_delta_view.mjs

@@ -2,9 +2,11 @@
 //
 // ⚠️ THE BASELINE SELECTION IS ITSELF A CLAIM, which is why this module names it rather than
 // silently diffing against it. If the selected run was narrow — a `--plugins` subset, one host,
-// an interrupted run — the delta is technically correct and practically a wall of NOT-COMPARABLE,
-// and an operator who meets that twice stops reading the feature. So the baseline's id, timestamp
-// and scope are printed BEFORE any verdict.
+// an interrupted run — the delta is practically a wall of NOT-COMPARABLE, and an operator who
+// meets that twice stops reading the feature. So the baseline's id, timestamp and scope are
+// printed BEFORE any verdict. ⚠️ Not for an AGENT row (1.2.0 limit): an analysis agent's or the
+// CVE mapper's row whose input plugins a `--plugins` subset dropped reads resolved or new instead
+// of NOT-COMPARABLE — see AGENT_SCOPE_FROM_TIER.
 //
 // ⚠️ AND REFUSING IS NOT STONEWALLING. When the selected baseline cannot support a verdict, this
 // says which earlier records exist and which of them are chain-verified — but it NEVER