fix(evidence): reject runtime locations for managed static facts

src/domain/javascript/javascriptApplicationGraph.fixture.ts

@@ -50,6 +50,7 @@ export const artifactEvidence = (
   authority:
     | "artifact-bytes"
     | "ast-static-analysis"
+    | "managed-static-analysis"
     | "native-analysis-provider" = "artifact-bytes",
 ): ApplicationGraphEvidence => ({
   authority,

src/domain/javascript/javascriptApplicationGraph.test.ts

@@ -886,17 +886,20 @@ describe("JavaScript Application Graph: identity strategy requirements", () => {
     );
   });
 
-  it("prevents static authorities from claiming runtime locations", () => {
-    const evidence = artifactEvidence(
-      APPLICATION_GRAPH_DIGESTS.asar,
-      "dist/module.js",
-      "ast-static-analysis",
-    );
-    evidence.location = runtimeEvidence("script-module").location;
-    expect(() => graphForNode(contentNode(evidence))).toThrow(
-      /cannot claim a runtime location/u,
-    );
-  });
+  it.each(["ast-static-analysis", "managed-static-analysis"] as const)(
+    "prevents %s from claiming runtime locations",
+    (authority) => {
+      const evidence = artifactEvidence(
+        APPLICATION_GRAPH_DIGESTS.asar,
+        "dist/module.js",
+        authority,
+      );
+      evidence.location = runtimeEvidence("script-module").location;
+      expect(() => graphForNode(contentNode(evidence))).toThrow(
+        /cannot claim a runtime location/u,
+      );
+    },
+  );
 
   it("enforces epistemic truthfulness and content-addressed artifacts", () => {
     const inferredAsObserved = inferredArtifactEvidence(

src/domain/javascript/javascriptApplicationGraph.ts

@@ -155,6 +155,7 @@ const checkEvidenceNormalization = (
     "ast-static-analysis",
     "static-relationship-inference",
     "native-analysis-provider",
+    "managed-static-analysis",
   ].includes(evidence.authority);
   if (runtimeLocation && staticAuthority)
     context.addIssue({