test(checks): add negative cases and fix tautological assertions

Closes: #528
Closes: #529
Closes: #530
Closes: #531

- unchecked-token-amount: assert exactly one finding for an unguarded
  transfer and add a negative case (amount > 0 guard -> no finding).
- missing-input-length-bound: add a negative case for a Bytes param with
  a data.len() guard, and wire the input-length fixture pair into
  fixture_scans.rs.
- large-loop: add an ignored regression test documenting the #449 gap
  (bounded `for i in 0..n` is currently a false positive).
- analyzer: add a regression comment for #531 on the scanned-file-count
  tests; the referenced compile/collect_rust_paths bugs are already
  fixed on main and the assertions pass unchanged.

Author: Petah1

crates/analyzer/src/lib.rs

@@ -599,6 +599,10 @@ mod tests {
         );
     }
 
+    // Regression guard for #531: `collect_rust_paths` must actually push discovered
+    // `.rs` files onto `paths`, so `scan_directory` / `scan_files` report a non-zero
+    // `files_scanned` for a directory that contains source. The assertions below are
+    // deliberately left unchanged.
     #[test]
     fn reports_scanned_rust_file_count_after_filters() {
         let root = std::env::temp_dir().join(format!(

crates/checks/src/large_loop.rs

@@ -145,4 +145,28 @@ impl C {
         assert_eq!(findings.len(), 1);
         Ok(())
     }
+
+    /// Documents the gap tracked by #449: the check has no bounds analysis and flags
+    /// *every* loop in a `pub` contractimpl method, so a genuinely bounded
+    /// `for i in 0..n { .. }` is a false positive. Ignored until #449 adds bounds
+    /// analysis, at which point this should pass unchanged.
+    #[test]
+    #[ignore = "false positive until #449 adds loop-bounds analysis"]
+    fn does_not_flag_bounded_for() -> Result<(), syn::Error> {
+        let src = r#"
+#[contractimpl]
+impl C {
+    pub fn process(env: Env, n: u32) {
+        for i in 0..n {
+            let x = i;
+        }
+    }
+}
+        "#;
+        let file = parse_file(src)?;
+        let check = LargeLoopCheck;
+        let findings = check.run(&file, src);
+        assert_eq!(findings.len(), 0);
+        Ok(())
+    }
 }

crates/checks/src/missing_input_length_bound.rs

@@ -152,6 +152,26 @@ impl C {
         Ok(())
     }
 
+    #[test]
+    fn does_not_flag_when_length_checked() -> Result<(), syn::Error> {
+        let src = r#"
+#[contractimpl]
+impl C {
+    pub fn process(env: Env, data: Bytes) {
+        if data.len() > 1000 {
+            panic!("input too long");
+        }
+        let x = data;
+    }
+}
+        "#;
+        let file = parse_file(src)?;
+        let check = MissingInputLengthBoundCheck;
+        let findings = check.run(&file, src);
+        assert!(findings.is_empty());
+        Ok(())
+    }
+
     #[test]
     fn ignores_fixed_size_bytes_n() -> Result<(), syn::Error> {
         let src = r#"

crates/checks/src/unchecked_token_amount.rs

@@ -130,7 +130,27 @@ impl C {
         let file = parse_file(src)?;
         let check = UncheckedTokenAmountCheck;
         let findings = check.run(&file, src);
-        assert!(findings.len() > 0);
+        assert_eq!(findings.len(), 1);
+        Ok(())
+    }
+
+    #[test]
+    fn does_not_flag_guarded_transfer() -> Result<(), syn::Error> {
+        let src = r#"
+#[contractimpl]
+impl C {
+    pub fn send_tokens(token: Address, to: Address, amount: u128) {
+        if amount > 0 {
+            let client = token::Client::new(&env, &token);
+            client.transfer(&to, &amount);
+        }
+    }
+}
+        "#;
+        let file = parse_file(src)?;
+        let check = UncheckedTokenAmountCheck;
+        let findings = check.run(&file, src);
+        assert!(findings.is_empty());
         Ok(())
     }
 }

crates/cli/tests/fixture_scans.rs

@@ -139,6 +139,11 @@ fn ttl_fixtures() {
     assert_fixture_pair("ttl", "missing-ttl-extension");
 }
 
+#[test]
+fn input_length_fixtures() {
+    assert_fixture_pair("input-length", "missing-input-length-bound");
+}
+
 /// Regression test for issue #362: a function that writes two distinct persistent keys but
 /// only calls extend_ttl on one of them must still produce a finding for the unextended key.
 /// The old function-scoped `has_extend` flag would have suppressed both findings.