@cejel/cejel 0.4.5 → 0.4.7

package/dist/{chunk-4IXESHG7.js → chunk-QTLLASOO.js}

@@ -5,19 +5,24 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-EPK7UTIK.js";
+} from "./chunk-OIGCYULH.js";
 import {
   external_exports
-} from "./chunk-KGFGX3TP.js";
+} from "./chunk-UYJBSQCV.js";
 import {
+  MAX_REPOSITORY_CONTENT_BYTES,
+  contentReadSignalKey,
   init_esm_shims,
   readRepoText,
   readRepoTextPrefix,
   recordContentSkip,
+  recordContentSkipForCriteria,
   recordFilesystemSkip,
   trackContentReads,
-  withContentReadCriterion
-} from "./chunk-R4DPQLS2.js";
+  withContentReadCriterion,
+  withContentReadSignal,
+  withContentReadSignals
+} from "./chunk-ZNVILRHK.js";
 
 // src/witan/schemas.ts
 init_esm_shims();
@@ -117,10 +122,26 @@ var WitanEvidencePointerSchema = external_exports.object({
 }).strict().refine((value) => Boolean(value.url ?? value.path ?? value.contentHash), {
   message: "Witan evidence must include a path, url, or content hash."
 });
+var WitanInventoryScanDerivationSchema = external_exports.object({
+  kind: external_exports.literal("inventory-scan"),
+  inventoryScope: external_exports.enum(["tracked-scan-eligible", "tracked-complete"]),
+  inventoryCount: external_exports.number().int().nonnegative(),
+  patternSetId: external_exports.string().min(1).max(180),
+  patternCount: external_exports.number().int().positive(),
+  matchCount: external_exports.number().int().nonnegative()
+}).strict();
+var WitanFindingDerivationSchema = external_exports.discriminatedUnion("kind", [
+  WitanInventoryScanDerivationSchema
+]);
 var WitanFindingSchema = external_exports.object({
   severity: WitanFindingSeveritySchema,
   summary: external_exports.string().min(1).max(500),
-  evidence: WitanEvidencePointerSchema
+  evidence: WitanEvidencePointerSchema,
+  // Absence findings emitted by the native repository detector must name the exact
+  // inventory and versioned pattern set whose zero result supports the proposition.
+  // This remains optional at the shared schema boundary because positive findings and
+  // semantic derivations are separate contracts; native absence emitters require it.
+  derivation: WitanFindingDerivationSchema.optional()
 }).strict();
 var WitanCriterionMetricSchema = external_exports.object({
   name: external_exports.string().min(1).max(80),
@@ -321,6 +342,7 @@ var WitanReportSchema = external_exports.preprocess((value) => {
 }, StrictWitanReportSchema);
 var WITAN_ATTESTATION_STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
 var WITAN_ATTESTATION_PREDICATE_TYPE = "https://cejel.dev/attestations/scan/v1";
+var WITAN_REPORT_FORMAT_VERSION = "1.0";
 var WitanAttestationOutcomeSchema = external_exports.discriminatedUnion("status", [
   external_exports.object({
     status: external_exports.literal("scored"),
@@ -350,7 +372,16 @@ var WitanAttestationStatementSchema = external_exports.object({
       version: external_exports.string().min(1).max(80)
     }).strict(),
     generatedAt: external_exports.string().datetime({ offset: true }),
+    // Optional on read for attestations emitted before Evidence Seam v1. New attestations
+    // always carry it, keeping report.json byte-stable while giving paired consumers an
+    // explicit report contract version.
+    reportFormatVersion: external_exports.string().regex(/^1\.\d+$/).optional(),
     rubricVersion: external_exports.string().min(1).max(120),
+    // Only present when the scan ran under the GitHub Action (GITHUB_RUN_ATTEMPT observed in
+    // the runner environment). Absent, never fabricated or defaulted to "1", for a local CLI
+    // or any other CI. Not part of report.json: it is per-invocation, not per-repository-
+    // state, and report.json's reproducibility guarantee excludes exactly that kind of field.
+    githubRunAttempt: external_exports.string().regex(/^[1-9][0-9]*$/).optional(),
     repository: external_exports.object({
       productSlug: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/),
       url: external_exports.string().url().optional(),
@@ -392,13 +423,15 @@ var WITAN_RUBRIC_VERSION_V19 = "witan-rubric-v19-prospective-2026-08-09";
 var WITAN_RUBRIC_VERSION_V20 = "witan-rubric-v20-prospective-2026-08-10";
 var WITAN_RUBRIC_VERSION_V21 = "witan-rubric-v21-prospective-2026-08-10";
 var WITAN_RUBRIC_VERSION_V22 = "witan-rubric-v22-prospective-2026-08-10";
+var WITAN_RUBRIC_VERSION_V23 = "witan-rubric-v23-prospective-2026-09-06";
 var WITAN_LAST_CALIBRATED_RUBRIC_VERSION = WITAN_RUBRIC_VERSION_V17;
 var WITAN_PROSPECTIVE_RUBRIC_VERSIONS = Object.freeze([
   WITAN_RUBRIC_VERSION_V18,
   WITAN_RUBRIC_VERSION_V19,
   WITAN_RUBRIC_VERSION_V20,
   WITAN_RUBRIC_VERSION_V21,
-  WITAN_RUBRIC_VERSION_V22
+  WITAN_RUBRIC_VERSION_V22,
+  WITAN_RUBRIC_VERSION_V23
 ]);
 var WITAN_SELECTABLE_RUBRIC_VERSIONS = Object.freeze([
   WITAN_LAST_CALIBRATED_RUBRIC_VERSION,
@@ -421,7 +454,9 @@ init_esm_shims();
 // src/witan/abstention.ts
 init_esm_shims();
 var WITAN_NO_MEASUREMENT_REASON = "No free-core rubric criterion produced a measurable signal. Cejel abstains rather than publish a numeric zero for an entirely unmeasured repository.";
-var WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY = "Reviewable source is present, but the complete tracked inventory contains no concrete test file, configured test runner, CI test command, or coverage configuration.";
+var WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY = "Reviewable source is present, but the tracked scan-eligible inventory matched no concrete test file, configured test runner, CI test command, or coverage configuration.";
+var WITAN_DIRECTORY_WALK_AUTHENTICATED_A1_ABSENCE_SUMMARY = "Reviewable source is present, but the bounded directory walk matched no concrete test file, configured test runner, CI test command, or coverage configuration.";
+var WITAN_LEGACY_AUTHENTICATED_A1_ABSENCE_SUMMARY = "Reviewable source is present, but the complete tracked inventory contains no concrete test file, configured test runner, CI test command, or coverage configuration.";
 function isWitanNoMeasurementAbstention(report) {
   return report.verdict === "insufficient_source" && report.insufficientSourceReason.startsWith(WITAN_NO_MEASUREMENT_REASON) && report.criteria.every(
     ({ status }) => status === "not_applicable" || status === "insufficient_data"
@@ -785,6 +820,32 @@ function glossaryEntryForMetric(metric2) {
 function formatCertificateMetricLabel(metric2) {
   return CERTIFICATE_METRIC_REGISTRY[metric2.name]?.displayLabel ?? metric2.label;
 }
+function formatCertificateMetricAppliedWeightPercent(criterion, metric2) {
+  const metrics = criterion.metrics;
+  const index = metrics.indexOf(metric2);
+  if (index === -1) {
+    throw new Error(
+      "formatCertificateMetricAppliedWeightPercent: metric does not belong to criterion.metrics"
+    );
+  }
+  const totalWeight = metrics.reduce((sum, m) => sum + m.weight, 0);
+  if (totalWeight <= 0) return 0;
+  const shares = metrics.map((m, i) => {
+    const raw = m.weight / totalWeight * 100;
+    const floor = Math.floor(raw);
+    return { i, floor, fraction: raw - floor };
+  });
+  const flooredTotal = shares.reduce((sum, s) => sum + s.floor, 0);
+  const byLargestRemainder = [...shares].sort((a, b) => b.fraction - a.fraction);
+  const result = new Map(shares.map((s) => [s.i, s.floor]));
+  let remainder = Math.round(100 - flooredTotal);
+  for (const s of byLargestRemainder) {
+    if (remainder <= 0) break;
+    result.set(s.i, (result.get(s.i) ?? s.floor) + 1);
+    remainder -= 1;
+  }
+  return result.get(index) ?? 0;
+}
 function glossaryEntriesForReport(report) {
   const entries = new Map(CERTIFICATE_GLOSSARY.map((entry) => [entry.key, entry]));
   for (const metric2 of report.criteria.flatMap((criterion) => criterion.metrics)) {
@@ -900,6 +961,74 @@ function formatCertificateMetricValue(criterion, metric2) {
     `${formatMetricNumber(metric2.value)}/${formatMetricNumber(metric2.max)}${unit}`
   );
 }
+var NEXT_STEP_FINDING_SEVERITIES = /* @__PURE__ */ new Set(["critical", "warning"]);
+var NEXT_STEP_FINDING_SEVERITY_RANK = {
+  critical: 0,
+  warning: 1,
+  info: 2
+};
+var MAX_NEXT_STEP_FINDINGS = 3;
+function buildNextSteps(report, unmeasured, notApplicable, a1, coverageMetric) {
+  const steps = [];
+  if (unmeasured.length > 0) {
+    const ids = unmeasured.map((criterion) => criterion.id).join(", ");
+    steps.push(
+      `Obtain measurable evidence for ${ids} \u2014 ${unmeasured.length === 1 ? "this scored dimension has" : "these scored dimensions have"} no recorded result, and could change the verdict.`
+    );
+  }
+  const criterionFindings = report.criteria.flatMap(
+    (criterion) => criterion.findings.filter((finding) => NEXT_STEP_FINDING_SEVERITIES.has(finding.severity)).map((finding) => ({ criterionId: criterion.id, finding }))
+  );
+  const sortedFindings = [...criterionFindings].sort(
+    (a, b) => NEXT_STEP_FINDING_SEVERITY_RANK[a.finding.severity] - NEXT_STEP_FINDING_SEVERITY_RANK[b.finding.severity]
+  );
+  for (const { criterionId, finding } of sortedFindings.slice(0, MAX_NEXT_STEP_FINDINGS)) {
+    steps.push(
+      `Evidence is currently absent for the ${finding.severity} finding on ${criterionId}: obtain independent verification before relying on this criterion.`
+    );
+  }
+  if (sortedFindings.length > MAX_NEXT_STEP_FINDINGS) {
+    steps.push(
+      `${sortedFindings.length - MAX_NEXT_STEP_FINDINGS} more critical/warning finding(s) need the same independent verification; see the findings listed above for the complete set.`
+    );
+  }
+  if (a1 && coverageMetric && isCoverageNotMeasured(a1, coverageMetric)) {
+    steps.push(
+      "Obtain a coverage report or configured threshold for A1's static coverage metric; none was found, so it was not measured."
+    );
+  }
+  if (!report.repo.headSha && report.criteria.some(
+    (criterion) => criterion.metrics.some((metric2) => metric2.name === "pr_merge_ratio")
+  )) {
+    steps.push(
+      "Restore Git history access so the recent-commit PR-reference proxy has commit subjects to inspect; its scoring zero here is a conservative default, not a detected outcome."
+    );
+  }
+  if (notApplicable.length > 0) {
+    const ids = notApplicable.map((criterion) => criterion.id).join(", ");
+    steps.push(
+      `Confirm ${ids} ${notApplicable.length === 1 ? "is" : "are"} correctly marked not applicable to this repository; ${notApplicable.length === 1 ? "it was" : "they were"} not examined.`
+    );
+  }
+  const scanLimitationCount = report.scanLimitations?.length ?? 0;
+  if (scanLimitationCount > 0) {
+    steps.push(
+      `Resolve the ${scanLimitationCount} scan limitation${scanLimitationCount === 1 ? "" : "s"} qualifying the readable evidence, then reproduce the scan.`
+    );
+  }
+  const skippedCount = report.contentReadSummary?.skipped ?? 0;
+  if (skippedCount > 0) {
+    steps.push(
+      `Make the ${skippedCount} skipped content entr${skippedCount === 1 ? "y" : "ies"} readable (see the itemized reasons in the certificate), then reproduce the scan.`
+    );
+  }
+  if (steps.length === 0) {
+    steps.push(
+      "No unresolved evidence gaps were identified across the categories Cejel tracks; reproduce the scan at the reported revision when one is available before relying on this certificate."
+    );
+  }
+  return steps;
+}
 function buildRelyingPartySummary(report) {
   const applicable = report.criteria.filter((criterion) => criterion.status !== "not_applicable");
   const measured = applicable.filter((criterion) => criterion.status !== "insufficient_data");
@@ -947,7 +1076,7 @@ function buildRelyingPartySummary(report) {
     examined: `Cejel examined the repository evidence recorded for ${report.productDisplayName}${revision} under ${report.rubricVersion}.`,
     established: `The report established measured results for ${measured.length} of ${applicable.length} applicable rubric dimensions and recorded ${findings} evidence-backed finding${findings === 1 ? "" : "s"}.`,
     notEstablished: gaps.join(" "),
-    next: "Review the cited evidence and open or unverified items, reproduce the scan at the reported revision when one is available, and obtain missing measurements or resolve limitations before deciding whether to accept the code."
+    next: buildNextSteps(report, unmeasured, notApplicable, a1, coverageMetric).join(" ")
   };
 }
 function formatMetricNumber(value) {
@@ -1027,6 +1156,7 @@ function formatMetricMember(criterion, metric2) {
 }
 
 // src/witan/html.ts
+var CEJEL_CERTIFICATE_FORMAT_VERSION = "1.0";
 function renderWitanHtmlReport(report, options = {}) {
   const codeCriteria = criteriaByCategory(report, "code_trust");
   const processCriteria = criteriaByCategory(report, "process_trust");
@@ -1045,6 +1175,7 @@ function renderWitanHtmlReport(report, options = {}) {
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="cejel-certificate-format" content="${CEJEL_CERTIFICATE_FORMAT_VERSION}">
   <title>Cejel Trust Certificate - ${escapeHtml(report.productDisplayName)}</title>
   <style>${CERTIFICATE_CSS}</style>
 </head>
@@ -1064,6 +1195,7 @@ function renderWitanHtmlReport(report, options = {}) {
             ${options.generatedAt ? `<div><dt>Date</dt><dd>${escapeHtml(formatDate(options.generatedAt))}</dd></div>` : ""}
             <div><dt>Run</dt><dd>${escapeHtml(renderRepo(report))}</dd></div>
             <div><dt>CLI</dt><dd>${escapeHtml(options.cliVersion ? `Cejel ${options.cliVersion}` : "Not recorded")}</dd></div>
+            ${options.runAttempt ? `<div><dt>Run attempt</dt><dd>${escapeHtml(options.runAttempt)}</dd></div>` : ""}
             <div><dt>Rubric</dt><dd>${escapeHtml(report.rubricVersion)}</dd></div>
             ${// Gated on the rubric actually being prospective — a calibrated (v17) certificate's
   // HTML stays byte-identical to before --rubric-pin existed.
@@ -1086,6 +1218,8 @@ function renderWitanHtmlReport(report, options = {}) {
       </div>
     </header>
 
+    ${renderFindingsFirstSummary(report)}
+
     ${renderRelyingPartySummary(relyingPartySummary)}
 
     ${(report.scanLimitations?.length ?? 0) > 0 ? `<section class="scan-limitations-section evidence-section" aria-label="Scan limitations">
@@ -1127,6 +1261,26 @@ function renderWitanHtmlReport(report, options = {}) {
 </html>
 `;
 }
+var FINDINGS_FIRST_SEVERITY_ORDER = {
+  critical: 0,
+  warning: 1,
+  info: 2
+};
+function collectFindingsFirstEntries(report) {
+  return report.criteria.flatMap(
+    (criterion) => criterion.findings.filter((finding) => finding.severity === "critical" || finding.severity === "warning").map((finding) => ({ criterion, finding }))
+  ).sort(
+    (a, b) => FINDINGS_FIRST_SEVERITY_ORDER[a.finding.severity] - FINDINGS_FIRST_SEVERITY_ORDER[b.finding.severity]
+  );
+}
+function renderFindingsFirstSummary(report) {
+  const entries = collectFindingsFirstEntries(report);
+  const body = entries.length > 0 ? `<ul>${entries.map(({ criterion, finding }) => `<li>${renderFindingEvidence(criterion, finding)}</li>`).join("")}</ul>` : '<p class="findings-first-empty">No critical or warning findings were identified across any criterion in this scan.</p>';
+  return `<section class="findings-first-summary" aria-labelledby="findings-first-heading">
+      <h2 id="findings-first-heading">Critical and warning findings</h2>
+      ${body}
+    </section>`;
+}
 function renderRelyingPartySummary(summary) {
   return `<section class="relying-party-summary" aria-labelledby="relying-party-heading">
       <h2 id="relying-party-heading">How to read this certificate</h2>
@@ -1140,10 +1294,12 @@ function renderRelyingPartySummary(summary) {
 }
 function renderGlossary(entries) {
   return `<section class="glossary" aria-labelledby="glossary-heading">
-      <h2 id="glossary-heading">Plain-language glossary</h2>
-      <dl>${entries.map(
+      <details>
+        <summary><h2 id="glossary-heading">Plain-language glossary</h2></summary>
+        <dl>${entries.map(
     (entry) => `<div><dt id="glossary-${escapeAttribute(entry.key)}">${escapeHtml(entry.term)}</dt><dd>${escapeHtml(entry.definition)}</dd></div>`
   ).join("")}</dl>
+      </details>
     </section>`;
 }
 function renderContentReadSummary(report) {
@@ -1218,12 +1374,12 @@ function renderCriterionColumn(title, criteria, gitHistoryUnavailable) {
       </section>`;
 }
 function renderNotApplicableGroup(criteria) {
-  return `<div class="na-group">
-          <h3 class="na-heading">Not applicable to this repository</h3>
+  return `<details class="na-group">
+          <summary><h3 class="na-heading">Not applicable to this repository</h3></summary>
           <ul class="na-list">
             ${criteria.map(renderNotApplicableItem).join("")}
           </ul>
-        </div>`;
+        </details>`;
 }
 function renderNotApplicableItem(criterion) {
   const reason = criterion.notes ?? "Not applicable to this repository.";
@@ -1283,15 +1439,21 @@ function scoreBandForPresentation(score) {
   if (score >= 1.5) return "warning";
   return "critical";
 }
+function renderMetricWeightBadge(criterion, metric2) {
+  const appliedSharePercent = formatCertificateMetricAppliedWeightPercent(criterion, metric2);
+  return `<span class="metric-weight">weight ${appliedSharePercent}% of ${escapeHtml(criterion.id)}</span>`;
+}
 function renderMetric(criterion, metric2) {
   const entry = glossaryEntryForMetric(metric2);
   const tooltipId = `tooltip-${criterion.id}-${entry.key}`;
   const formatted = formatCertificateMetricValue(criterion, metric2);
+  const weightBadge = renderMetricWeightBadge(criterion, metric2);
   const cappedEntry = formatted.includes("capped") ? CERTIFICATE_GLOSSARY.find((candidate) => candidate.key === "capped") : void 0;
   const label = `<span class="term-help" tabindex="0" aria-describedby="${escapeAttribute(tooltipId)}"><strong>${escapeHtml(formatCertificateMetricLabel(metric2))}</strong><span class="term-tooltip" id="${escapeAttribute(tooltipId)}" role="tooltip">${escapeHtml(entry.definition)}</span></span>`;
-  if (!cappedEntry) return `${label}<span class="metric-value">${escapeHtml(formatted)}</span>`;
+  if (!cappedEntry)
+    return `${label}<span class="metric-value">${escapeHtml(formatted)} ${weightBadge}</span>`;
   const cappedTooltipId = `${tooltipId}-capped`;
-  return `${label}<span class="term-help metric-value" tabindex="0" aria-describedby="${escapeAttribute(cappedTooltipId)}">${escapeHtml(formatted)}<span class="term-tooltip" id="${escapeAttribute(cappedTooltipId)}" role="tooltip">${escapeHtml(cappedEntry.definition)}</span></span>`;
+  return `${label}<span class="term-help metric-value" tabindex="0" aria-describedby="${escapeAttribute(cappedTooltipId)}">${escapeHtml(formatted)} ${weightBadge}<span class="term-tooltip" id="${escapeAttribute(cappedTooltipId)}" role="tooltip">${escapeHtml(cappedEntry.definition)}</span></span>`;
 }
 function renderCategoryScore(score, coverage, category) {
   const categoryCoverage = coverage.byCategory.find((entry) => entry.category === category);
@@ -1439,6 +1601,9 @@ dd { margin: 0; color: var(--muted); overflow-wrap: anywhere; }
 .subscores { display: flex; gap: 12px; flex-wrap: wrap; margin-top: 18px; color: var(--muted); font-family: var(--mono); font-size: 12px; }
 .coverage-note { margin-top: 8px; color: var(--faint); font-family: var(--mono); font-size: 11px; }
 .source-counts { margin: 8px 0 0; padding-left: 18px; font-family: var(--mono); font-size: 12px; color: var(--muted); }
+.findings-first-summary { margin-top: 20px; border: 1px solid var(--line-strong); border-radius: 8px; background: var(--surface); padding: 22px; }
+.findings-first-summary ul { margin: 0; padding-left: 18px; display: grid; gap: 10px; }
+.findings-first-empty { margin: 0; color: var(--muted); }
 .relying-party-summary, .glossary { margin-top: 28px; border: 1px solid var(--line-strong); border-radius: 8px; background: var(--surface); padding: 22px; }
 .relying-party-summary dl { display: grid; gap: 14px; margin: 0; }
 .relying-party-summary dl div { display: grid; grid-template-columns: 190px minmax(0, 1fr); gap: 18px; }
@@ -1446,6 +1611,14 @@ dd { margin: 0; color: var(--muted); overflow-wrap: anywhere; }
 .glossary dl { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 12px 22px; margin: 0; }
 .glossary dl div { border-top: 1px solid var(--line); padding-top: 10px; }
 .glossary dd { margin-top: 4px; font-size: 13px; }
+/* Track A3: native <details>/<summary> disclosure \u2014 the summary is the clickable control, a
+   heading nests inside it as its accessible label (still exposed as a heading), and the heading's
+   own vertical margin is neutralized by making it inline, so the marker sits flush against it. */
+summary { cursor: pointer; }
+summary h2, summary h3 { display: inline; }
+summary::marker { color: var(--periwinkle); }
+summary:focus-visible { outline: none; box-shadow: 0 0 0 2px var(--periwinkle); border-radius: 3px; }
+.glossary details[open] dl, .na-group[open] .na-list { margin-top: 16px; }
 .trust-grid, .evidence-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 18px; margin-top: 28px; }
 .scan-limitations-section { margin-top: 28px; border-color: rgba(231, 191, 114, .44); }
 .scan-limitations-section .scan-warning { list-style: none; margin-left: -18px; }
@@ -1477,6 +1650,7 @@ h3 { font-size: 15px; line-height: 1.35; font-weight: 600; margin-bottom: 0; }
 .criterion-metrics li { display: flex; justify-content: space-between; gap: 12px; border-bottom: 1px solid rgba(238, 244, 247, .08); padding-bottom: 6px; }
 .criterion-metrics strong { color: var(--text); font-weight: 650; }
 .criterion-metrics span { color: var(--muted); }
+.criterion-metrics .metric-weight { font-size: 10px; color: var(--faint); }
 .criterion-metrics > li > .metric-value {
   min-width: 0; white-space: normal; overflow-wrap: anywhere; text-align: right;
 }
@@ -1639,6 +1813,8 @@ function createWitanAttestation(report, options) {
     predicate: {
       tool: { name: "cejel", version: options.toolVersion },
       generatedAt: options.generatedAt,
+      reportFormatVersion: WITAN_REPORT_FORMAT_VERSION,
+      ...options.githubRunAttempt ? { githubRunAttempt: options.githubRunAttempt } : {},
       rubricVersion: report.rubricVersion,
       repository: {
         productSlug: report.productSlug,
@@ -1724,6 +1900,23 @@ init_esm_shims();
 // src/witan/markdown.ts
 init_esm_shims();
 
+// src/presentation-safety.ts
+init_esm_shims();
+var PRESENTATION_CONTROL_PATTERN = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
+function sanitizePresentationLine(value, options) {
+  const withoutControls = value.replace(PRESENTATION_CONTROL_PATTERN, "").trim();
+  const safeValue = withoutControls.length > 0 ? withoutControls : options.fallback;
+  if (safeValue.length <= options.maxLength) return safeValue;
+  const ellipsis = ".".repeat(Math.min(3, options.maxLength));
+  const contentLimit = Math.max(options.maxLength - ellipsis.length, 0);
+  let prefix = "";
+  for (const character of safeValue) {
+    if (prefix.length + character.length > contentLimit) break;
+    prefix += character;
+  }
+  return `${prefix}${ellipsis}`;
+}
+
 // src/witan/repo-signals.ts
 init_esm_shims();
 import { createHash as createHash2 } from "crypto";
@@ -1743,27 +1936,148 @@ function stripBom(text) {
 
 // src/witan/repo-signals.ts
 function usesV17DetectorClosure(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
+}
+var LEGACY_INVENTORY_ABSENCE_CONTEXT = {
+  rubricGeneration: "legacy",
+  inventoryProvenance: "directory-walk"
+};
+var INVENTORY_SCAN_PATTERN_SETS = {
+  a1AuthenticatedAbsence: {
+    id: "cejel.core-a1.test-integrity-surface.v1",
+    count: 4
+  },
+  a1ConcreteTests: {
+    id: "cejel.core-a1.concrete-test-files.v1",
+    count: 16
+  },
+  a1CoverageConfigurationV1: {
+    id: "cejel.core-a1.coverage-configuration.v1",
+    count: 10
+  },
+  a1CoverageConfigurationV2: {
+    id: "cejel.core-a1.coverage-configuration.v2",
+    count: 14
+  },
+  a2CurrentSecret: {
+    id: "cejel.core-a2.current-secret-shape.v1",
+    count: 3
+  },
+  a2RlsPolicy: {
+    id: "cejel.core-a2.rls-policy.v1",
+    count: 3
+  },
+  a3CiOrReleaseDeploy: {
+    id: "cejel.core-a3.ci-or-release-deploy.v1",
+    count: 12
+  },
+  a4Lockfile: {
+    id: "cejel.core-a4.lockfile.v1",
+    count: 11
+  },
+  a5ClaimRealityArtifact: {
+    id: "cejel.core-a5.claim-reality-artifact.v1",
+    count: 3
+  }
+};
+function inventoryScanDerivation(inventoryCount, patternSet, matchCount) {
+  return {
+    kind: "inventory-scan",
+    inventoryScope: "tracked-scan-eligible",
+    inventoryCount,
+    patternSetId: patternSet.id,
+    patternCount: patternSet.count,
+    matchCount
+  };
+}
+function inventoryAbsenceFinding(options) {
+  const { context, summaries } = options;
+  const summary = context.rubricGeneration === "legacy" ? summaries.legacy : context.inventoryProvenance === "tracked-scan-eligible" ? summaries.currentTracked : summaries.currentDirectoryWalk;
+  const emitsDerivation = context.rubricGeneration === "current" && context.inventoryProvenance === "tracked-scan-eligible";
+  return {
+    severity: options.severity,
+    summary,
+    evidence: options.evidence,
+    ...emitsDerivation ? {
+      derivation: inventoryScanDerivation(
+        options.inventoryCount,
+        options.patternSet,
+        options.matchCount
+      )
+    } : {}
+  };
+}
+function wholesaleCriterionAbstention(signal) {
+  return {
+    criterionId: signal.criterionId,
+    positiveEvidence: [],
+    findings: [],
+    metrics: [],
+    insufficientData: true,
+    notes: "Cejel abstained on this criterion because one or more relevant repository files could not be read. Resolve the content-read limitations and re-scan."
+  };
 }
 function buildWitanInputFromRepo(options) {
   const tracked = trackContentReads(options.repoPath, () => buildWitanInputFromRepoUntracked(options));
   const affectedCriteria = tracked.affectedCriteria;
+  const rubricVersion = options.rubricVersion ?? WITAN_RUBRIC_VERSION;
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V23) {
+    const signals2 = (tracked.value.signals ?? []).map(
+      (signal) => affectedCriteria.has(signal.criterionId) ? wholesaleCriterionAbstention(signal) : signal
+    );
+    const affectedCount = affectedCriteria.size;
+    const scanLimitations2 = [...tracked.value.scanLimitations ?? []];
+    if (affectedCount > 0 && scanLimitations2.length < 16) {
+      scanLimitations2.push(
+        `${affectedCount} ${affectedCount === 1 ? "criterion" : "criteria"} abstained because relevant repository content could not be read. Counts and errno classes are recorded in contentReadSummary; file paths are intentionally omitted.`
+      );
+    }
+    return {
+      ...tracked.value,
+      signals: signals2,
+      ...scanLimitations2.length > 0 ? { scanLimitations: scanLimitations2 } : {},
+      contentReadSummary: tracked.summary
+    };
+  }
+  const wholesaleAbstainedCriteria = [];
+  const partiallyAbstainedSignals = [];
   const signals = (tracked.value.signals ?? []).map((signal) => {
     if (!affectedCriteria.has(signal.criterionId)) return signal;
+    if (tracked.unattributedCriteria.has(signal.criterionId)) {
+      wholesaleAbstainedCriteria.push(signal.criterionId);
+      return wholesaleCriterionAbstention(signal);
+    }
+    const prefix = contentReadSignalKey(signal.criterionId, "");
+    const affectedNames = [...tracked.affectedSignals].filter((key) => key.startsWith(prefix)).map((key) => key.slice(prefix.length));
+    if (affectedNames.length === 0) {
+      wholesaleAbstainedCriteria.push(signal.criterionId);
+      return wholesaleCriterionAbstention(signal);
+    }
+    const affectedNameSet = new Set(affectedNames);
+    const metrics = (signal.metrics ?? []).filter((metric2) => !affectedNameSet.has(metric2.name));
+    const anythingSurvives = metrics.length > 0 || (signal.positiveEvidence?.length ?? 0) > 0 || (signal.findings?.length ?? 0) > 0;
+    if (!anythingSurvives) {
+      wholesaleAbstainedCriteria.push(signal.criterionId);
+      return wholesaleCriterionAbstention(signal);
+    }
+    for (const name of affectedNames) {
+      partiallyAbstainedSignals.push(`${signal.criterionId}.${name}`);
+    }
     return {
-      criterionId: signal.criterionId,
-      positiveEvidence: [],
-      findings: [],
-      metrics: [],
-      insufficientData: true,
-      notes: "Cejel abstained on this criterion because one or more relevant repository files could not be read. Resolve the content-read limitations and re-scan."
+      ...signal,
+      metrics,
+      notes: `Cejel abstained on ${[...affectedNames].sort().join(", ")} in this criterion because that content could not be read; other signals in this criterion were computed from readable files and are unaffected.`
     };
   });
-  const affectedCount = affectedCriteria.size;
   const scanLimitations = [...tracked.value.scanLimitations ?? []];
-  if (affectedCount > 0 && scanLimitations.length < 16) {
+  if (wholesaleAbstainedCriteria.length > 0 && scanLimitations.length < 16) {
     scanLimitations.push(
-      `${affectedCount} ${affectedCount === 1 ? "criterion" : "criteria"} abstained because relevant repository content could not be read. Counts and errno classes are recorded in contentReadSummary; file paths are intentionally omitted.`
+      `${wholesaleAbstainedCriteria.length} ${wholesaleAbstainedCriteria.length === 1 ? "criterion" : "criteria"} abstained because relevant repository content could not be read and the affected signal could not be isolated. Counts and errno classes are recorded in contentReadSummary; file paths are intentionally omitted.`
+    );
+  }
+  if (partiallyAbstainedSignals.length > 0 && scanLimitations.length < 16) {
+    scanLimitations.push(
+      `${partiallyAbstainedSignals.length} ${partiallyAbstainedSignals.length === 1 ? "signal" : "signals"} abstained because its own repository content could not be read, while other signals in the same criterion were unaffected: ${[...partiallyAbstainedSignals].sort().join(", ")}.`
     );
   }
   return {
@@ -1783,11 +2097,16 @@ function buildWitanInputFromRepoUntracked(options) {
   const inventoryFiles = fileInventory.inventoryFiles;
   const ignoredTargetReason = repoFiles.length === 0 ? explainIgnoredScanTarget(options.repoPath) : void 0;
   const usesV17Detectors = usesV17DetectorClosure(rubricVersion);
-  const usesV18NativeRls = rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
-  const usesV19CommitYear = rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
-  const usesV20A3ExplicitGaps = rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
-  const usesV21ExecutedEscalations = rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
-  const usesV22PackageStartEntrypoint = rubricVersion === WITAN_RUBRIC_VERSION_V22;
+  const inventoryAbsenceContext = {
+    rubricGeneration: usesV17Detectors ? "current" : "legacy",
+    inventoryProvenance: fileInventory.repoFileInventoryScope === "tracked-scan-eligible" ? "tracked-scan-eligible" : "directory-walk"
+  };
+  const usesV18NativeRls = rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  const usesV19CommitYear = rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  const usesV20A3ExplicitGaps = rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  const usesV21ExecutedEscalations = rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  const usesV22PackageStartEntrypoint = rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  const usesV23CommandCoverage = rubricVersion === WITAN_RUBRIC_VERSION_V23;
   const structuralArchetype = classifyRepoArchetype(inventoryFiles, rubricVersion);
   const readableArchetype = rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion) ? applyReadableSourceRepresentationGate(
     options.repoPath,
@@ -1823,7 +2142,9 @@ function buildWitanInputFromRepoUntracked(options) {
     usesV20A3ExplicitGaps,
     usesV21ExecutedEscalations,
     usesV22PackageStartEntrypoint,
+    usesV23CommandCoverage,
     reviewableSourceProof,
+    inventoryAbsenceContext,
     scanLimitations
   );
   const archetype = usesV17Detectors && reviewableSourceProof?.passes === true && isV17RescuableAbstention(gatedArchetype.abstentionKind) && coreSignals.some(isMeasuredCriterionSignal) ? {
@@ -1833,7 +2154,10 @@ function buildWitanInputFromRepoUntracked(options) {
   } : gatedArchetype;
   return {
     productSlug: options.productSlug,
-    productDisplayName: options.productDisplayName,
+    productDisplayName: sanitizePresentationLine(options.productDisplayName, {
+      fallback: "Repository",
+      maxLength: 120
+    }),
     repo: {
       ...headSha ? { headSha } : {}
     },
@@ -2430,7 +2754,7 @@ function buildNotApplicableSignal(criterionId, reason) {
     notApplicable: true
   };
 }
-function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, reviewableSourceProof, scanLimitations = /* @__PURE__ */ new Set()) {
+function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, useV23CommandCoverage, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, scanLimitations = /* @__PURE__ */ new Set()) {
   const signals = [];
   const mono = resolveMonorepoContext(repoPath, scanLimitations);
   const collectCriterion = (criterionId, collect) => withContentReadCriterion(criterionId, collect);
@@ -2442,7 +2766,9 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       useV27Detectors,
       useV33Detectors,
       useV36Detectors,
-      reviewableSourceProof
+      useV23CommandCoverage,
+      reviewableSourceProof,
+      inventoryAbsenceContext
     )
   );
   const a2Signal = collectCriterion(
@@ -2456,6 +2782,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       useV39Detectors,
       useV47Detectors,
       useV18NativeRls,
+      inventoryAbsenceContext,
       scanLimitations
     )
   );
@@ -2466,7 +2793,8 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       repoFiles,
       useV27Detectors,
       useV20A3ExplicitGaps,
-      useV22PackageStartEntrypoint
+      useV22PackageStartEntrypoint,
+      inventoryAbsenceContext
     )
   );
   const a4Signal = collectCriterion(
@@ -2476,12 +2804,18 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       repoFiles,
       mono,
       useV27Detectors,
-      useV47Detectors
+      useV47Detectors,
+      inventoryAbsenceContext
     )
   );
   const a5Signal = collectCriterion(
     "A5",
-    () => collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors)
+    () => collectA5ClaimRealityEvidence(
+      repoPath,
+      repoFiles,
+      useV27Detectors,
+      inventoryAbsenceContext
+    )
   );
   const b1Signal = buildNotApplicableSignal(
     "B1",
@@ -2532,7 +2866,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
   }
   return signals;
 }
-function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, reviewableSourceProof) {
+function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV23CommandCoverage, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
   const evidence = [];
   const findings = [];
   const allTestFiles = findConcreteTestFiles(
@@ -2543,17 +2877,33 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
   const testFiles = allTestFiles.slice(0, 8);
   const sourceFiles = repoFiles.filter(isSourceFile);
   const runnerFiles = repoFiles.filter(
-    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isTestRunnerConfig(repoPath, file)
+    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && (isTestRunnerConfig(repoPath, file) || useV23CommandCoverage && isRecipeTestEntry(repoPath, file))
   ).slice(0, 6);
-  const configuredRunnerFiles = useV33Detectors ? findConfiguredTestRunnerFiles(repoPath, repoFiles) : runnerFiles;
-  const allCoverageFiles = findCoverageConfigFiles(repoPath, repoFiles, useV27Detectors);
-  const coverageFiles = allCoverageFiles.slice(0, 4);
+  const baseConfiguredRunnerFiles = useV33Detectors ? findConfiguredTestRunnerFiles(repoPath, repoFiles) : runnerFiles;
+  const configuredRunnerFiles = useV23CommandCoverage ? [
+    .../* @__PURE__ */ new Set([
+      ...baseConfiguredRunnerFiles,
+      ...repoFiles.filter((file) => isRecipeTestEntry(repoPath, file))
+    ])
+  ].sort() : baseConfiguredRunnerFiles;
   const packageJson = findRootPackageJson(repoFiles);
   const packageScripts = packageJson ? readPackageScripts(join(repoPath, packageJson)) : /* @__PURE__ */ new Map();
+  const { coverageAnalysis, coveragePercent } = withContentReadSignal("A1", "coverage_percent", () => {
+    const analysis = useV23CommandCoverage ? analyzeCoverageConfiguration(repoPath, repoFiles, useV27Detectors) : {
+      coverageFiles: findCoverageConfigFiles(repoPath, repoFiles, useV27Detectors),
+      unresolvedFiles: [],
+      hasCoverageCommand: packageScripts.has("coverage")
+    };
+    return {
+      coverageAnalysis: analysis,
+      coveragePercent: readCoveragePercent(repoPath, analysis.coverageFiles.slice(0, 4))
+    };
+  });
+  const allCoverageFiles = coverageAnalysis.coverageFiles;
+  const coverageFiles = allCoverageFiles.slice(0, 4);
   const packageJsonFiles = useV27Detectors ? repoFiles.filter(
     (file) => /(^|\/)package\.json$/.test(file) && isAuthoredProductionPath(file)
   ) : packageJson ? [packageJson] : [];
-  const coveragePercent = readCoveragePercent(repoPath, coverageFiles);
   const ciWorkflows = repoFiles.filter(
     (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isCiWorkflow(file)
   );
@@ -2568,7 +2918,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
   );
   const verificationScriptCount = [
     packageScripts.has("test") || Boolean(ciTestWorkflow),
-    packageScripts.has("coverage"),
+    coverageAnalysis.hasCoverageCommand,
     packageScripts.has("lint") || ciHasLintCommand,
     packageScripts.has("typecheck") || ciHasTypecheckCommand
   ].filter(Boolean).length;
@@ -2588,9 +2938,11 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
   if (packageJson && [...packageScripts.values()].some((script) => TEST_RUNNER_PATTERN.test(script))) {
     evidence.push(evidenceForRelative(repoPath, packageJson, "test_run", "Configured test runner"));
   }
-  for (const file of coverageFiles) {
-    evidence.push(evidenceForRelative(repoPath, file, "coverage", "Coverage configuration"));
-  }
+  withContentReadSignal("A1", "coverage_percent", () => {
+    for (const file of coverageFiles) {
+      evidence.push(evidenceForRelative(repoPath, file, "coverage", "Coverage configuration"));
+    }
+  });
   if (ciTestWorkflow) {
     evidence.push(
       evidenceForRelative(repoPath, ciTestWorkflow, "test_run", "CI workflow runs the test suite")
@@ -2629,7 +2981,12 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
     }
   }
   if (evidence.length === 0 && findings.length === 0 && configuredRunnerFiles.length === 0) {
-    return reviewableSourceProof?.passes === true && reviewableSourceProof.firstReadablePath ? buildA1AuthenticatedAbsenceSignal(repoPath, reviewableSourceProof) : null;
+    return reviewableSourceProof?.passes === true && reviewableSourceProof.firstReadablePath ? buildA1AuthenticatedAbsenceSignal(
+      repoPath,
+      reviewableSourceProof,
+      repoFiles.length,
+      inventoryAbsenceContext
+    ) : null;
   }
   if (testFiles.length === 0) {
     const fallback = configuredRunnerFiles[0] ? evidenceForRelative(
@@ -2639,13 +2996,23 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
       "Configured test runner"
     ) : useV33Detectors ? void 0 : evidence[0] ?? findings[0]?.evidence;
     if (fallback) {
-      findings.push({
-        severity: "warning",
-        summary: "A test runner is configured, but no concrete test files were detected.",
-        evidence: fallback
-      });
+      findings.push(
+        inventoryAbsenceFinding({
+          severity: "warning",
+          summaries: {
+            legacy: "A test runner is configured, but no concrete test files were detected.",
+            currentTracked: "A test runner is configured, but the tracked scan-eligible inventory matched no concrete test file.",
+            currentDirectoryWalk: "A test runner is configured, but the bounded directory walk matched no concrete test file."
+          },
+          evidence: fallback,
+          context: inventoryAbsenceContext,
+          inventoryCount: repoFiles.length,
+          patternSet: INVENTORY_SCAN_PATTERN_SETS.a1ConcreteTests,
+          matchCount: 0
+        })
+      );
     }
-  } else if (coverageFiles.length === 0 && (!useV33Detectors || configuredRunnerFiles.length > 0)) {
+  } else if (coverageFiles.length === 0 && coverageAnalysis.unresolvedFiles.length === 0 && (!useV33Detectors || configuredRunnerFiles.length > 0)) {
     if (isLeanTestToolchain) {
       const leanEvidenceFile = packageJson ?? testFiles[0];
       if (leanEvidenceFile) {
@@ -2661,17 +3028,27 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
     } else {
       const firstEvidence = evidence[0];
       if (!firstEvidence) return null;
-      findings.push({
-        severity: "info",
-        summary: "Test suite files are present, but no coverage configuration was detected.",
-        evidence: firstEvidence
-      });
+      findings.push(
+        inventoryAbsenceFinding({
+          severity: "info",
+          summaries: {
+            legacy: "Test suite files are present, but no coverage configuration was detected.",
+            currentTracked: "Test suite files are present, but the tracked scan-eligible inventory matched no coverage configuration.",
+            currentDirectoryWalk: "Test suite files are present, but the bounded directory walk matched no coverage configuration."
+          },
+          evidence: firstEvidence,
+          context: inventoryAbsenceContext,
+          inventoryCount: repoFiles.length,
+          patternSet: useV23CommandCoverage ? INVENTORY_SCAN_PATTERN_SETS.a1CoverageConfigurationV2 : INVENTORY_SCAN_PATTERN_SETS.a1CoverageConfigurationV1,
+          matchCount: 0
+        })
+      );
     }
   }
-  const nonHollowShare = measureNonHollowTestShare(
-    repoPath,
-    allTestFiles,
-    reviewableSourceProof !== void 0
+  const nonHollowShare = withContentReadSignal(
+    "A1",
+    "non_hollow_test_share",
+    () => measureNonHollowTestShare(repoPath, allTestFiles, reviewableSourceProof !== void 0)
   );
   return {
     criterionId: "A1",
@@ -2712,7 +3089,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
               label: "test command",
               count: packageScripts.has("test") || Boolean(ciTestWorkflow) ? 1 : 0
             },
-            { label: "coverage command", count: packageScripts.has("coverage") ? 1 : 0 },
+            { label: "coverage command", count: coverageAnalysis.hasCoverageCommand ? 1 : 0 },
             {
               label: "lint command",
               count: packageScripts.has("lint") || ciHasLintCommand ? 1 : 0
@@ -2735,10 +3112,10 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
         "Penalizes skipped or placeholder-only test files; test-directory support scaffolding (helpers/fixtures with no test in them) is excluded from the denominator."
       )
     ],
-    notes: "A1 is detected from real test files, test runner configuration, and optional coverage configuration."
+    notes: coverageFiles.length === 0 && coverageAnalysis.unresolvedFiles.length > 0 ? `A1 is detected from real test files, test runner configuration, and optional coverage configuration. Coverage command reachability or flag ownership was unresolved in ${coverageAnalysis.unresolvedFiles.slice(0, 4).join(", ")}; the no-coverage absence claim was withheld.` : "A1 is detected from real test files, test runner configuration, and optional coverage configuration."
   };
 }
-function buildA1AuthenticatedAbsenceSignal(repoPath, proof) {
+function buildA1AuthenticatedAbsenceSignal(repoPath, proof, inventoryCount, inventoryAbsenceContext) {
   const sourcePath = proof.firstReadablePath;
   if (!sourcePath) {
     throw new Error("Cejel invariant: a passing reviewable-source proof must have a readable path");
@@ -2753,11 +3130,19 @@ function buildA1AuthenticatedAbsenceSignal(repoPath, proof) {
     criterionId: "A1",
     positiveEvidence: [anchor],
     findings: [
-      {
+      inventoryAbsenceFinding({
         severity: "critical",
-        summary: WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY,
-        evidence: anchor
-      }
+        summaries: {
+          legacy: WITAN_LEGACY_AUTHENTICATED_A1_ABSENCE_SUMMARY,
+          currentTracked: WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY,
+          currentDirectoryWalk: WITAN_DIRECTORY_WALK_AUTHENTICATED_A1_ABSENCE_SUMMARY
+        },
+        evidence: anchor,
+        context: inventoryAbsenceContext,
+        inventoryCount,
+        patternSet: INVENTORY_SCAN_PATTERN_SETS.a1AuthenticatedAbsence,
+        matchCount: 0
+      })
     ],
     metrics: [
       metric(
@@ -2811,7 +3196,7 @@ function buildA1AuthenticatedAbsenceSignal(repoPath, proof) {
     notes: `V17 authenticated absence: ${proof.eligibleSourceFileCount} criterion-ratable of ${proof.sourceShapedFileCount} source-shaped files; sampled ${proof.sampledFileCount}; ${proof.readableSampledFileCount} representative-text files.`
   };
 }
-function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, scanLimitations) {
+function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, inventoryAbsenceContext, scanLimitations) {
   const evidence = [];
   const findings = [];
   const gitignore = repoFiles.find((file) => basename(file) === ".gitignore");
@@ -2819,40 +3204,47 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
   const migrationFiles = repoFiles.filter(
     (file) => /(^|\/)(migrations?|drizzle|prisma)\//.test(file)
   );
-  let committedSecret;
-  for (const path of repoFiles) {
-    const authoredProductionPath = useV47Detectors ? isV47AuthoredProductionPath(path) : useV39Detectors ? isV39AuthoredProductionPath(path) : isAuthoredProductionPath(path);
-    if (isIgnoredScanFile(path, useV47Detectors) || useV33Detectors && !authoredProductionPath) {
-      continue;
-    }
-    const match = findCommittedSecretInFile(
-      repoPath,
-      path,
-      useV36Detectors,
-      useV39Detectors,
-      useV47Detectors
-    );
-    if (!match) continue;
-    committedSecret = { path, match };
-    break;
-  }
-  const currentSecretFingerprintsByPath = /* @__PURE__ */ new Map();
-  if (useV27Detectors) {
-    for (const path of repoFiles.filter((candidate) => isCredentialHistoryPath(candidate))) {
-      currentSecretFingerprintsByPath.set(
-        path,
-        new Set(
-          findSecretFingerprintsInFile(
-            repoPath,
+  const { committedSecret, currentSecretFingerprintsByPath } = withContentReadSignal(
+    "A2",
+    "secret_cleanliness",
+    () => {
+      let match_;
+      for (const path of repoFiles) {
+        const authoredProductionPath = useV47Detectors ? isV47AuthoredProductionPath(path) : useV39Detectors ? isV39AuthoredProductionPath(path) : isAuthoredProductionPath(path);
+        if (isIgnoredScanFile(path, useV47Detectors) || useV33Detectors && !authoredProductionPath) {
+          continue;
+        }
+        const found = findCommittedSecretInFile(
+          repoPath,
+          path,
+          useV36Detectors,
+          useV39Detectors,
+          useV47Detectors
+        );
+        if (!found) continue;
+        match_ = { path, match: found };
+        break;
+      }
+      const fingerprintsByPath = /* @__PURE__ */ new Map();
+      if (useV27Detectors) {
+        for (const path of repoFiles.filter((candidate) => isCredentialHistoryPath(candidate))) {
+          fingerprintsByPath.set(
             path,
-            useV36Detectors,
-            useV39Detectors,
-            useV47Detectors
-          )
-        )
-      );
+            new Set(
+              findSecretFingerprintsInFile(
+                repoPath,
+                path,
+                useV36Detectors,
+                useV39Detectors,
+                useV47Detectors
+              )
+            )
+          );
+        }
+      }
+      return { committedSecret: match_, currentSecretFingerprintsByPath: fingerprintsByPath };
     }
-  }
+  );
   const historySecretScan = committedSecret && !useV27Detectors ? null : collectHistorySecretEvidence(
     repoPath,
     useV27Detectors,
@@ -2864,10 +3256,14 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
     useV47Detectors
   );
   const hasConfirmedSecretFinding = committedSecret != null || historySecretScan?.evidence != null;
-  const cryptoHygiene = collectCryptoHygieneEvidence(
-    repoPath,
-    repoFiles.filter(isImplementationFile).slice(0, 60),
-    useV39Detectors
+  const cryptoHygiene = withContentReadSignal(
+    "A2",
+    "crypto_comparison_hygiene",
+    () => collectCryptoHygieneEvidence(
+      repoPath,
+      repoFiles.filter(isImplementationFile).slice(0, 60),
+      useV39Detectors
+    )
   );
   const implFiles = repoFiles.filter(isImplementationFile);
   const gitignoreHasEnvRule = gitignore != null && fileContains(repoPath, gitignore, /^\.env(\*|\b)|\.env\./m);
@@ -2907,42 +3303,77 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
   } else if (dbLayerImportFile != null) {
     evidence.push(evidenceForRelative(repoPath, dbLayerImportFile, "artifact", "DB client import"));
   }
-  const v47RlsPolicyFiles = useV47Detectors ? findRlsPolicyFiles(repoPath, repoFiles) : [];
-  const nativeRlsInventory = useV18NativeRls ? deriveRlsPolicyScopeInventory(repoPath, repoFiles) : null;
-  const tenantWithoutRlsPremiseFiles = useV18NativeRls ? findTenantStoragePremiseFiles(repoPath, repoFiles) : [];
-  const v47TenantStorageFiles = useV47Detectors && !useV18NativeRls ? findTenantStoragePremiseFiles(repoPath, repoFiles) : [];
-  const rlsMigration = useV47Detectors ? v47RlsPolicyFiles[0] : migrationFiles.find((file) => fileContains(repoPath, file, RLS_PATTERN));
   const tenantScopePattern = useV39Detectors ? TENANT_SCOPE_PATTERN_V11 : useV36Detectors ? TENANT_SCOPE_PATTERN_V10 : TENANT_SCOPE_PATTERN;
-  const tenantScopedFile = useV18NativeRls ? nativeRlsInventory?.storageFiles[0] : useV47Detectors ? v47TenantStorageFiles[0] : migrationFiles.find((file) => fileContains(repoPath, file, tenantScopePattern));
-  const rlsPolicyCount = useV18NativeRls ? nativeRlsInventory?.policyCount ?? 0 : useV47Detectors ? v47RlsPolicyFiles.length : countPatternMatches(
-    repoPath,
-    migrationFiles,
-    /create policy|enable row level security|force row level security/gi
+  const {
+    rlsMigration,
+    tenantScopedFile,
+    rlsPolicyCount,
+    tenantScopedMigrationFileCount,
+    nativeRlsInventory,
+    tenantWithoutRlsPremiseFiles
+  } = withContentReadSignals("A2", ["rls_policy_count", "tenant_scope_ratio"], () => {
+    const v47RlsPolicyFiles = useV47Detectors ? findRlsPolicyFiles(repoPath, repoFiles) : [];
+    const rlsInventory = useV18NativeRls ? deriveRlsPolicyScopeInventory(repoPath, repoFiles) : null;
+    const tenantWithoutRlsFiles = useV18NativeRls ? findTenantStoragePremiseFiles(repoPath, repoFiles) : [];
+    const v47TenantStorageFiles = useV47Detectors && !useV18NativeRls ? findTenantStoragePremiseFiles(repoPath, repoFiles) : [];
+    return {
+      rlsMigration: useV47Detectors ? v47RlsPolicyFiles[0] : migrationFiles.find((file) => fileContains(repoPath, file, RLS_PATTERN)),
+      tenantScopedFile: useV18NativeRls ? rlsInventory?.storageFiles[0] : useV47Detectors ? v47TenantStorageFiles[0] : migrationFiles.find((file) => fileContains(repoPath, file, tenantScopePattern)),
+      rlsPolicyCount: useV18NativeRls ? rlsInventory?.policyCount ?? 0 : useV47Detectors ? v47RlsPolicyFiles.length : countPatternMatches(
+        repoPath,
+        migrationFiles,
+        /create policy|enable row level security|force row level security/gi
+      ),
+      tenantScopedMigrationFileCount: useV18NativeRls ? rlsInventory?.storageFiles.length ?? 0 : useV47Detectors ? v47TenantStorageFiles.length : countFilesContaining(repoPath, migrationFiles, tenantScopePattern),
+      nativeRlsInventory: rlsInventory,
+      tenantWithoutRlsPremiseFiles: tenantWithoutRlsFiles
+    };
+  });
+  const { gitignoreEnvFile, hasEnvReadsInImplementation, envHandlingDepth } = withContentReadSignal(
+    "A2",
+    "env_handling_depth",
+    () => {
+      const envFile = gitignore && fileContains(repoPath, gitignore, /^\.env(\*|\b)|\.env\./m) ? gitignore : null;
+      const hasEnvReads = countFilesContaining(repoPath, repoFiles.filter(isImplementationFile), ENV_READ_PATTERN) > 0;
+      const depth = (envExamples.length > 0 ? 1 : 0) + (envFile ? 1 : 0) + (hasEnvReads ? 1 : 0);
+      return { gitignoreEnvFile: envFile, hasEnvReadsInImplementation: hasEnvReads, envHandlingDepth: depth };
+    }
   );
-  const tenantScopedMigrationFileCount = useV18NativeRls ? nativeRlsInventory?.storageFiles.length ?? 0 : useV47Detectors ? v47TenantStorageFiles.length : countFilesContaining(repoPath, migrationFiles, tenantScopePattern);
-  const gitignoreEnvFile = gitignore && fileContains(repoPath, gitignore, /^\.env(\*|\b)|\.env\./m) ? gitignore : null;
-  const envHandlingDepth = (envExamples.length > 0 ? 1 : 0) + (gitignoreEnvFile ? 1 : 0) + (countFilesContaining(repoPath, repoFiles.filter(isImplementationFile), ENV_READ_PATTERN) > 0 ? 1 : 0);
   const isMultiTenant = useV18NativeRls ? (nativeRlsInventory?.policyCount ?? 0) > 0 && (nativeRlsInventory?.scopeIdentifiers.length ?? 0) > 0 : tenantScopedMigrationFileCount > 0;
   if (gitignoreEnvFile) {
-    evidence.push(
-      evidenceForRelative(repoPath, gitignoreEnvFile, "secret_scan", ".env files are gitignored")
+    withContentReadSignal(
+      "A2",
+      "env_handling_depth",
+      () => evidence.push(
+        evidenceForRelative(repoPath, gitignoreEnvFile, "secret_scan", ".env files are gitignored")
+      )
     );
   }
-  for (const file of envExamples.slice(0, 3)) {
-    evidence.push(evidenceForRelative(repoPath, file, "secret_scan", "Environment template"));
-  }
+  withContentReadSignal("A2", "env_handling_depth", () => {
+    for (const file of envExamples.slice(0, 3)) {
+      evidence.push(evidenceForRelative(repoPath, file, "secret_scan", "Environment template"));
+    }
+  });
   if (rlsMigration) {
-    evidence.push(
-      evidenceForRelative(repoPath, rlsMigration, "artifact", "RLS or tenant migration")
+    withContentReadSignals(
+      "A2",
+      ["rls_policy_count", "tenant_scope_ratio"],
+      () => evidence.push(
+        evidenceForRelative(repoPath, rlsMigration, "artifact", "RLS or tenant migration")
+      )
     );
   }
   if (tenantScopedFile) {
-    evidence.push(
-      evidenceForRelative(
-        repoPath,
-        tenantScopedFile,
-        "artifact",
-        useV18NativeRls ? `Repository-native RLS scope (${nativeRlsInventory?.scopeIdentifiers.join(", ")})` : "Tenant scoping signal"
+    withContentReadSignals(
+      "A2",
+      ["rls_policy_count", "tenant_scope_ratio"],
+      () => evidence.push(
+        evidenceForRelative(
+          repoPath,
+          tenantScopedFile,
+          "artifact",
+          useV18NativeRls ? `Repository-native RLS scope (${nativeRlsInventory?.scopeIdentifiers.join(", ")})` : "Tenant scoping signal"
+        )
       )
     );
   }
@@ -2964,16 +3395,26 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
       )
     });
   } else if (committedEnvFilePath) {
-    findings.push({
-      severity: useV33Detectors ? "info" : "warning",
-      summary: "A non-template .env file is committed in the current repository tree; no secret-shaped value was detected.",
-      evidence: evidenceForRelative(
-        repoPath,
-        committedEnvFilePath,
-        "secret_scan",
-        "Committed .env file (no confirmed secret value found)"
-      )
-    });
+    findings.push(
+      inventoryAbsenceFinding({
+        severity: useV33Detectors ? "info" : "warning",
+        summaries: {
+          legacy: "A non-template .env file is committed in the current repository tree; no secret-shaped value was detected.",
+          currentTracked: "A tracked non-template .env file is present, while the bounded scan over the tracked scan-eligible inventory matched no secret-shaped value.",
+          currentDirectoryWalk: "A non-template .env file is present in the bounded directory walk, which matched no secret-shaped value."
+        },
+        evidence: evidenceForRelative(
+          repoPath,
+          committedEnvFilePath,
+          "secret_scan",
+          "Committed .env file (no confirmed secret value found)"
+        ),
+        context: inventoryAbsenceContext,
+        inventoryCount: repoFiles.length,
+        patternSet: INVENTORY_SCAN_PATTERN_SETS.a2CurrentSecret,
+        matchCount: 0
+      })
+    );
   }
   if (historySecretScan?.evidence) {
     const historyPath = historySecretScan.evidence.path ?? "";
@@ -3005,16 +3446,26 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
   if (hasTenantWithoutRlsGap) {
     const gapEvidence = rlsMigration ?? tenantScopedFile ?? tenantWithoutRlsPremiseFiles[0];
     if (gapEvidence) {
-      findings.push({
-        severity: "warning",
-        summary: "Tenant-scoped schema detected but no row-level-security policies found \u2014 isolation gap.",
-        evidence: evidenceForRelative(
-          repoPath,
-          gapEvidence,
-          "artifact",
-          "Tenant schema without RLS policies"
-        )
-      });
+      findings.push(
+        inventoryAbsenceFinding({
+          severity: "warning",
+          summaries: {
+            legacy: "Tenant-scoped schema detected but no row-level-security policies found \u2014 isolation gap.",
+            currentTracked: "A tenant-scoped schema signal is present, while the tracked scan-eligible inventory matched no row-level-security policy.",
+            currentDirectoryWalk: "A tenant-scoped schema signal is present, while the bounded directory walk matched no row-level-security policy."
+          },
+          evidence: evidenceForRelative(
+            repoPath,
+            gapEvidence,
+            "artifact",
+            "Tenant schema without RLS policies"
+          ),
+          context: inventoryAbsenceContext,
+          inventoryCount: repoFiles.length,
+          patternSet: INVENTORY_SCAN_PATTERN_SETS.a2RlsPolicy,
+          matchCount: 0
+        })
+      );
     }
   }
   evidence.push(...cryptoHygiene.evidence);
@@ -3046,11 +3497,7 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
           { label: ".gitignore environment-file rule", count: gitignoreEnvFile ? 1 : 0 },
           {
             label: "environment reads in implementation code",
-            count: countFilesContaining(
-              repoPath,
-              repoFiles.filter(isImplementationFile),
-              ENV_READ_PATTERN
-            ) > 0 ? 1 : 0
+            count: hasEnvReadsInImplementation ? 1 : 0
           }
         ]
       }
@@ -3199,7 +3646,7 @@ function collectCryptoHygieneEvidence(repoPath, implFiles, useV39Detectors = fal
   }
   return { evidence, findings, hasSurface, clean: hasSurface && !insecureFound };
 }
-function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, useV20ExplicitGaps = false, useV22PackageStartEntrypoint = false) {
+function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, useV20ExplicitGaps = false, useV22PackageStartEntrypoint = false, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
   const v20DirectHttpEntrypoint = useV20ExplicitGaps ? findV20DirectHttpServerEntrypointFile(repoPath, repoFiles) : null;
   const v22PackageStartHttpEntrypoint = useV22PackageStartEntrypoint ? findV22PackageStartHttpServerEntrypointFile(repoPath, repoFiles) : null;
   const v20RuntimeContainer = useV20ExplicitGaps ? findRuntimeContainerEntrypointFile(repoPath, repoFiles, true) : null;
@@ -3229,37 +3676,51 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
   const envTemplate = repoFiles.find(
     (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isEnvTemplatePath(file)
   );
-  const healthChecks = repoFiles.filter(
-    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isHealthCheckSignalFile(repoPath, file)
+  const healthChecks = withContentReadSignal(
+    "A3",
+    "prod_readiness_primitives",
+    () => repoFiles.filter(
+      (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isHealthCheckSignalFile(repoPath, file)
+    )
   );
   const healthCheck = healthChecks[0];
-  const hasV20HealthOrReadinessRoute = useV20ExplicitGaps && repoFiles.some(
-    (file) => isAuthoredProductionPath(file) && isImplementationFile(file) && fileContains(repoPath, file, V20_HEALTH_OR_READINESS_ROUTE_PATTERN)
-  );
-  const hasV22PackageStartHealthOrReadinessRoute = v22PackageStartHttpEntrypoint !== null && fileContains(
-    repoPath,
-    v22PackageStartHttpEntrypoint,
-    V20_HEALTH_OR_READINESS_ROUTE_PATTERN
-  );
+  const { hasV20HealthOrReadinessRoute, hasV22PackageStartHealthOrReadinessRoute } = withContentReadSignal("A3", "health_readiness_route", () => ({
+    hasV20HealthOrReadinessRoute: useV20ExplicitGaps && repoFiles.some(
+      (file) => isAuthoredProductionPath(file) && isImplementationFile(file) && fileContains(repoPath, file, V20_HEALTH_OR_READINESS_ROUTE_PATTERN)
+    ),
+    hasV22PackageStartHealthOrReadinessRoute: v22PackageStartHttpEntrypoint !== null && fileContains(
+      repoPath,
+      v22PackageStartHttpEntrypoint,
+      V20_HEALTH_OR_READINESS_ROUTE_PATTERN
+    )
+  }));
   const serverEntrypoint = v22PackageStartHttpEntrypoint ?? findServerEntrypointFile(repoPath, repoFiles, useV27Detectors) ?? v20DirectHttpEntrypoint ?? null;
   const runtimeContainer = useV27Detectors ? findRuntimeContainerEntrypointFile(repoPath, repoFiles, useV20ExplicitGaps) : null;
   const errorBoundaries = repoFiles.filter(
     (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && /error-boundary|error\.(tsx|jsx|ts|js)$/.test(file)
   );
   const errorBoundary = errorBoundaries[0];
-  const observabilityCount = countFilesContaining(
-    repoPath,
-    repoFiles.filter(
-      (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isImplementationFile(file)
-    ),
-    /sentry|otel|opentelemetry|datadog|prometheus|metrics|logger|logtail/i
+  const observabilityCount = withContentReadSignal(
+    "A3",
+    "observability_depth",
+    () => countFilesContaining(
+      repoPath,
+      repoFiles.filter(
+        (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isImplementationFile(file)
+      ),
+      /sentry|otel|opentelemetry|datadog|prometheus|metrics|logger|logtail/i
+    )
   );
-  const rollbackSafetyCount = countFilesContaining(
-    repoPath,
-    repoFiles.filter(
-      (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && /(^|\/)(docs|migrations?|drizzle|prisma|scripts)\//.test(file)
-    ),
-    /rollback|roll back|migration safety|down migration|reversible|undo migration/i
+  const rollbackSafetyCount = withContentReadSignal(
+    "A3",
+    "rollback_safety_depth",
+    () => countFilesContaining(
+      repoPath,
+      repoFiles.filter(
+        (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && /(^|\/)(docs|migrations?|drizzle|prisma|scripts)\//.test(file)
+      ),
+      /rollback|roll back|migration safety|down migration|reversible|undo migration/i
+    )
   );
   if (packageJson && (scripts.has("build") || scripts.has("typecheck"))) {
     evidence.push(
@@ -3287,10 +3748,15 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
     );
   if (envTemplate)
     evidence.push(evidenceForRelative(repoPath, envTemplate, "prod_check", "Environment template"));
-  if (healthCheck)
-    evidence.push(
-      evidenceForRelative(repoPath, healthCheck, "prod_check", "Health/readiness signal")
+  if (healthCheck) {
+    withContentReadSignal(
+      "A3",
+      "prod_readiness_primitives",
+      () => evidence.push(
+        evidenceForRelative(repoPath, healthCheck, "prod_check", "Health/readiness signal")
+      )
     );
+  }
   if (errorBoundary)
     evidence.push(evidenceForRelative(repoPath, errorBoundary, "prod_check", "Error boundary"));
   if (evidence.length === 0) {
@@ -3329,7 +3795,12 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
         )
       });
     } else if (runtimeContainer) {
-      if (!fileContains(repoPath, runtimeContainer, /^\s*HEALTHCHECK\s+(?!NONE\b)/im)) {
+      const hasActiveHealthcheck = withContentReadSignal(
+        "A3",
+        "dockerfile_healthcheck",
+        () => fileContains(repoPath, runtimeContainer, /^\s*HEALTHCHECK\s+(?!NONE\b)/im)
+      );
+      if (!hasActiveHealthcheck) {
         findings.push({
           severity: "info",
           summary: "A runtime Dockerfile declares no active HEALTHCHECK instruction.",
@@ -3341,10 +3812,14 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
           )
         });
       }
-    } else if (serverEntrypoint && fileContains(
-      repoPath,
-      serverEntrypoint,
-      /\b(?:request|req)\.(?:url|path|pathname|method)\b/i
+    } else if (serverEntrypoint && withContentReadSignal(
+      "A3",
+      "health_readiness_route",
+      () => fileContains(
+        repoPath,
+        serverEntrypoint,
+        /\b(?:request|req)\.(?:url|path|pathname|method)\b/i
+      )
     ) && healthChecks.length === 0 && !hasV20HealthOrReadinessRoute && !hasV22PackageStartHealthOrReadinessRoute) {
       findings.push({
         severity: "info",
@@ -3361,11 +3836,21 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
   if (!workflow && releaseDeployConfigs.length === 0) {
     const firstEvidence = evidence[0];
     if (!firstEvidence) return null;
-    findings.push({
-      severity: "info",
-      summary: "A deployable service surface exists, but no CI or release-deployment automation was detected.",
-      evidence: firstEvidence
-    });
+    findings.push(
+      inventoryAbsenceFinding({
+        severity: "info",
+        summaries: {
+          legacy: "A deployable service surface exists, but no CI or release-deployment automation was detected.",
+          currentTracked: "A deployable service signal is present, while the tracked scan-eligible inventory matched no CI workflow or release-deployment automation.",
+          currentDirectoryWalk: "A deployable service signal is present, while the bounded directory walk matched no CI workflow or release-deployment automation."
+        },
+        evidence: firstEvidence,
+        context: inventoryAbsenceContext,
+        inventoryCount: repoFiles.length,
+        patternSet: INVENTORY_SCAN_PATTERN_SETS.a3CiOrReleaseDeploy,
+        matchCount: 0
+      })
+    );
   }
   return {
     criterionId: "A3",
@@ -3435,27 +3920,46 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
     ]
   };
 }
-function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors, useV47Detectors) {
+function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors, useV47Detectors, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
   const evidence = [];
   const findings = [];
   const manifests = repoFiles.filter(isDependencyManifest);
   const lockfiles = repoFiles.filter(isLockfile);
-  const manifest = pickPrimaryDependencyManifest(repoPath, manifests);
   const lockfile = lockfiles[0];
   const rootLockfile = mono ? mono.sharedFiles.find(isLockfile) : void 0;
   const rootUpdateConfig = mono ? mono.sharedFiles.find(isDependencyUpdateConfig) : void 0;
   const hasLockfile = Boolean(lockfile) || Boolean(rootLockfile);
   const updateConfig = repoFiles.find(isDependencyUpdateConfig);
   const hasUpdateConfig = Boolean(updateConfig) || Boolean(rootUpdateConfig);
-  const auditConfig = manifests.some((file) => packageJsonHasAuditScript(repoPath, file));
-  const dependencySpecs = readDependencySpecs(repoPath, manifests);
+  const auditConfig = withContentReadSignal(
+    "A4",
+    "dependency_automation_ratio",
+    () => manifests.some((file) => packageJsonHasAuditScript(repoPath, file))
+  );
+  const { manifest, dependencySpecs } = withContentReadSignals(
+    "A4",
+    ["pinned_dependency_ratio", "declared_version_range_ratio", "dependency_count_sanity"],
+    () => ({
+      // Cite the manifest that actually carries dependencies for evidence/findings, not
+      // whichever sorts first (e.g. a near-empty requirements-windows.txt that precedes the
+      // real requirements.txt), so the evidence pointer reflects the file the A4 score is
+      // derived from. The score itself is unaffected: it aggregates specs across ALL manifests.
+      manifest: pickPrimaryDependencyManifest(repoPath, manifests),
+      dependencySpecs: readDependencySpecs(repoPath, manifests)
+    })
+  );
   const pinnedDependencyCount = dependencySpecs.filter(
     (dependency) => isPinnedDependencyVersion(dependency.version)
   ).length;
-  if (manifest)
-    evidence.push(
-      evidenceForRelative(repoPath, manifest, "dependency_report", "Dependency manifest")
+  if (manifest) {
+    withContentReadSignals(
+      "A4",
+      ["pinned_dependency_ratio", "declared_version_range_ratio", "dependency_count_sanity"],
+      () => evidence.push(
+        evidenceForRelative(repoPath, manifest, "dependency_report", "Dependency manifest")
+      )
     );
+  }
   if (lockfile)
     evidence.push(
       evidenceForRelative(repoPath, lockfile, "dependency_report", "Dependency lockfile")
@@ -3488,13 +3992,36 @@ function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors,
   const deployableServiceFiles = useV47Detectors ? findDeployableServicePremiseFiles(repoPath, repoFiles, true) : [];
   const isAppOrService = (useV47Detectors ? deployableServiceFiles.length > 0 : isDeployableService(repoPath, repoFiles, useV27Detectors)) || packagedApplicationFiles.length > 0;
   if (isAppOrService && !hasLockfile && manifest) {
-    findings.push({
-      severity: "critical",
-      summary: "Dependency manifest is present without a detected lockfile \u2014 non-reproducible installs.",
-      evidence: evidenceForRelative(repoPath, manifest, "dependency_report", "Dependency manifest")
-    });
+    withContentReadSignals(
+      "A4",
+      ["pinned_dependency_ratio", "declared_version_range_ratio", "dependency_count_sanity"],
+      () => findings.push(
+        inventoryAbsenceFinding({
+          severity: "critical",
+          summaries: {
+            legacy: "Dependency manifest is present without a detected lockfile \u2014 non-reproducible installs.",
+            currentTracked: "Dependency manifest is present, but the tracked scan-eligible inventory matched no recognized lockfile.",
+            currentDirectoryWalk: "Dependency manifest is present, but the bounded directory walk matched no recognized lockfile."
+          },
+          evidence: evidenceForRelative(
+            repoPath,
+            manifest,
+            "dependency_report",
+            "Dependency manifest"
+          ),
+          context: inventoryAbsenceContext,
+          inventoryCount: repoFiles.length + (mono?.sharedFiles.length ?? 0),
+          patternSet: INVENTORY_SCAN_PATTERN_SETS.a4Lockfile,
+          matchCount: 0
+        })
+      )
+    );
   }
-  if (manifest && hasSuspiciousDependencies(repoPath, manifest, useV47Detectors)) {
+  if (manifest && withContentReadSignal(
+    "A4",
+    "suspicious_dependencies",
+    () => hasSuspiciousDependencies(repoPath, manifest, useV47Detectors)
+  )) {
     findings.push({
       severity: "critical",
       summary: "Dependency manifest contains obviously suspicious placeholder dependency names.",
@@ -3600,7 +4127,7 @@ function hasDeclaredVersionConstraint(dependency) {
   if (/[~^<>=!]/.test(trimmed)) return true;
   return /^v?\d/.test(trimmed);
 }
-function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors) {
+function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
   const reconciliationArtifacts = useV27Detectors ? findClaimRealityReconciliationArtifacts(repoPath, repoFiles) : [];
   const claimSourceFiles = useV27Detectors ? findClaimSourceFiles(repoFiles) : repoFiles.filter(
     (file) => /^(?:README|readme)\.md$/.test(file) || /^docs\/[^/]+\.(?:md|mdx)$/.test(file)
@@ -3648,16 +4175,24 @@ function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors) {
     ...allDocFiles,
     ...repoFiles.filter((file) => /(^|\/)(SECURITY|THREAT[_-]?MODEL)\.md$/i.test(file))
   ]);
-  const negativeSpaceDoc = [...negativeSpaceCandidates].find(
-    (file) => fileContains(repoPath, file, NEGATIVE_SPACE_SECTION_PATTERN) || fileContains(repoPath, file, NEGATIVE_SPACE_PHRASE_PATTERN)
+  const negativeSpaceDoc = withContentReadSignal(
+    "A5",
+    "negative_space_documentation",
+    () => [...negativeSpaceCandidates].find(
+      (file) => fileContains(repoPath, file, NEGATIVE_SPACE_SECTION_PATTERN) || fileContains(repoPath, file, NEGATIVE_SPACE_PHRASE_PATTERN)
+    )
   );
   if (negativeSpaceDoc) {
-    evidence.push(
-      evidenceForRelative(
-        repoPath,
-        negativeSpaceDoc,
-        "claim_reconciliation",
-        'Documented limitations / threat model / "not covered" section'
+    withContentReadSignal(
+      "A5",
+      "negative_space_documentation",
+      () => evidence.push(
+        evidenceForRelative(
+          repoPath,
+          negativeSpaceDoc,
+          "claim_reconciliation",
+          'Documented limitations / threat model / "not covered" section'
+        )
       )
     );
   }
@@ -3665,15 +4200,23 @@ function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors) {
     criterionId: "A5",
     positiveEvidence: evidence,
     findings: reconciliationArtifacts.length > 0 ? [] : [
-      {
+      inventoryAbsenceFinding({
         // Proxy-only A5: cap at warning (never critical) — a static proxy is lower-confidence
         // than a curated registry or reconciliation artifact. Downgraded to info when the repo
         // documents honest negative space: that scoping IS a form of claim-reality discipline,
         // not an additional gap on top of the missing dedicated artifact.
         severity: negativeSpaceDoc ? "info" : "warning",
-        summary: negativeSpaceDoc ? "Claim source and implementation files are present; no dedicated claim-reality report artifact was supplied, but the repo explicitly documents what it does NOT cover/protect against \u2014 honest scoping, not overclaiming." : "Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied.",
-        evidence: firstEvidence
-      }
+        summaries: {
+          legacy: negativeSpaceDoc ? "Claim source and implementation files are present; no dedicated claim-reality report artifact was supplied, but the repo explicitly documents what it does NOT cover/protect against \u2014 honest scoping, not overclaiming." : "Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied.",
+          currentTracked: negativeSpaceDoc ? "Claim-source and implementation-file signals are present, while the tracked scan-eligible inventory matched no dedicated claim-reality report artifact; the repo separately documents what it does NOT cover or protect against." : "Claim-source and implementation-file signals are present, while the tracked scan-eligible inventory matched no dedicated claim-reality report artifact.",
+          currentDirectoryWalk: negativeSpaceDoc ? "Claim-source and implementation-file signals are present, while the bounded directory walk matched no dedicated claim-reality report artifact; the repo separately documents what it does NOT cover or protect against." : "Claim-source and implementation-file signals are present, while the bounded directory walk matched no dedicated claim-reality report artifact."
+        },
+        evidence: firstEvidence,
+        context: inventoryAbsenceContext,
+        inventoryCount: repoFiles.length,
+        patternSet: INVENTORY_SCAN_PATTERN_SETS.a5ClaimRealityArtifact,
+        matchCount: 0
+      })
     ],
     // Recalibrated (goal_cejel_launch_hardening_combined_2026-07-06, Phase 3 H1):
     // reconciliation_artifact_depth is usually 0 on the generic-proxy path, so its prior 0.3
@@ -3786,18 +4329,33 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
   const workflows = repoFiles.filter(isCiWorkflow);
   const workflow = workflows[0];
   const rootWorkflows = mono ? mono.sharedFiles.filter(isCiWorkflow) : [];
-  const defaultBranchCiCount = workflows.filter((file) => workflowTargetsDefaultBranch(repoPath, file)).length + (mono ? rootWorkflows.filter((file) => workflowTargetsDefaultBranch(mono.root, file)).length : 0);
+  const defaultBranchCiCount = withContentReadSignal(
+    "B3",
+    "default_branch_ci_depth",
+    () => workflows.filter((file) => workflowTargetsDefaultBranch(repoPath, file)).length + (mono ? rootWorkflows.filter((file) => workflowTargetsDefaultBranch(mono.root, file)).length : 0)
+  );
   if (packageJson && scripts.has("test")) {
     evidence.push(evidenceForRelative(repoPath, packageJson, "test_run", "Test script"));
   }
   if (packageJson && scripts.has("lint")) {
     evidence.push(evidenceForRelative(repoPath, packageJson, "ci_run", "Lint script"));
   }
-  if (workflow) evidence.push(evidenceForRelative(repoPath, workflow, "ci_run", "CI workflow"));
-  else if (rootWorkflows[0] && mono)
-    evidence.push(
-      evidenceForRelative(mono.root, rootWorkflows[0], "ci_run", "CI workflow (monorepo root)")
+  if (workflow) {
+    withContentReadSignals(
+      "B3",
+      ["ci_script_depth", "default_branch_ci_depth"],
+      () => evidence.push(evidenceForRelative(repoPath, workflow, "ci_run", "CI workflow"))
     );
+  } else if (rootWorkflows[0] && mono) {
+    const rootWorkflow = rootWorkflows[0];
+    withContentReadSignals(
+      "B3",
+      ["ci_script_depth", "default_branch_ci_depth"],
+      () => evidence.push(
+        evidenceForRelative(mono.root, rootWorkflow, "ci_run", "CI workflow (monorepo root)")
+      )
+    );
+  }
   if (evidence.length === 0) return null;
   const CI_BUILD_COMMAND_PATTERN = /\b(cargo\s+build|cmake|ninja|make\s+(build|all))\b/i;
   const CI_COMMAND_CATEGORIES = [
@@ -3807,10 +4365,19 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
     CI_BUILD_COMMAND_PATTERN
   ];
   const scriptDepth = ["test", "lint", "typecheck", "build"].filter((s) => scripts.has(s)).length;
-  const countCiCommandCategories = (root, files) => CI_COMMAND_CATEGORIES.filter(
-    (pattern) => files.some((file) => fileContains(root, file, pattern))
-  ).length;
-  const ciCommandDepth = countCiCommandCategories(repoPath, workflows) + (mono ? countCiCommandCategories(mono.root, rootWorkflows) : 0);
+  const { repoCategoryHits, rootCategoryHits } = withContentReadSignal(
+    "B3",
+    "ci_script_depth",
+    () => ({
+      repoCategoryHits: CI_COMMAND_CATEGORIES.map(
+        (pattern) => workflows.some((file) => fileContains(repoPath, file, pattern))
+      ),
+      rootCategoryHits: mono ? CI_COMMAND_CATEGORIES.map(
+        (pattern) => rootWorkflows.some((file) => fileContains(mono.root, file, pattern))
+      ) : []
+    })
+  );
+  const ciCommandDepth = repoCategoryHits.filter(Boolean).length + rootCategoryHits.filter(Boolean).length;
   const combinedDepth = scriptDepth + ciCommandDepth;
   return {
     criterionId: "B3",
@@ -3832,13 +4399,13 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
               label: `package script: ${name === "typecheck" ? "type-check" : name}`,
               count: scripts.has(name) ? 1 : 0
             })),
-            ...CI_COMMAND_CATEGORIES.map((pattern, index) => ({
+            ...CI_COMMAND_CATEGORIES.map((_pattern, index) => ({
               label: `repository CI command: ${["test", "lint", "type-check", "build"][index]}`,
-              count: workflows.some((file) => fileContains(repoPath, file, pattern)) ? 1 : 0
+              count: repoCategoryHits[index] ? 1 : 0
             })),
-            ...mono ? CI_COMMAND_CATEGORIES.map((pattern, index) => ({
+            ...mono ? CI_COMMAND_CATEGORIES.map((_pattern, index) => ({
               label: `monorepo-root CI command: ${["test", "lint", "type-check", "build"][index]}`,
-              count: rootWorkflows.some((file) => fileContains(mono.root, file, pattern)) ? 1 : 0
+              count: rootCategoryHits[index] ? 1 : 0
             })) : []
           ]
         }
@@ -3883,9 +4450,11 @@ function readAuditFreshnessCommitterYear(repoPath, scanLimitations) {
 function collectB4AuditEvidence(repoPath, repoFiles, generatedAt, useV19CommitYear = false, scanLimitations = /* @__PURE__ */ new Set()) {
   const evidence = [];
   const auditFiles = repoFiles.filter(isAuditFile);
-  for (const file of auditFiles.slice(0, 5)) {
-    evidence.push(evidenceForRelative(repoPath, file, "audit_log", "Audit or changelog artifact"));
-  }
+  withContentReadSignal("B4", "audit_freshness_depth", () => {
+    for (const file of auditFiles.slice(0, 5)) {
+      evidence.push(evidenceForRelative(repoPath, file, "audit_log", "Audit or changelog artifact"));
+    }
+  });
   if (evidence.length === 0) {
     return buildNotApplicableSignal(
       "B4",
@@ -3930,7 +4499,11 @@ function collectB4AuditEvidence(repoPath, repoFiles, generatedAt, useV19CommitYe
       metric(
         "audit_freshness_depth",
         "Audit freshness depth",
-        countFilesContaining(repoPath, auditFiles, freshnessPattern),
+        withContentReadSignal(
+          "B4",
+          "audit_freshness_depth",
+          () => countFilesContaining(repoPath, auditFiles, freshnessPattern)
+        ),
         Math.max(auditFiles.length, 1),
         0.2,
         "ratio",
@@ -3943,93 +4516,128 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detecto
   const evidence = [];
   const findings = [];
   const docFiles = repoFiles.filter((file) => /\.(md|mdx)$/i.test(file));
-  const humanGateDoc = docFiles.find(
-    (file) => fileContains(repoPath, file, HUMAN_GATE_MARKER_PATTERN)
+  const humanGateDoc = withContentReadSignal(
+    "B6",
+    "human_gate_documented",
+    () => docFiles.find((file) => fileContains(repoPath, file, HUMAN_GATE_MARKER_PATTERN))
   );
   const implFiles = repoFiles.filter(isImplementationFile);
-  const gatedPrivilegeCheckFile = implFiles.find(
-    (file) => fileContains(repoPath, file, GATED_PRIVILEGE_CHECK_PATTERN) && fileContains(repoPath, file, SET_ROLE_PATTERN)
+  const gatedPrivilegeCheckFile = withContentReadSignal(
+    "B6",
+    "fail_closed_privilege_check",
+    () => implFiles.find(
+      (file) => fileContains(repoPath, file, GATED_PRIVILEGE_CHECK_PATTERN) && fileContains(repoPath, file, SET_ROLE_PATTERN)
+    )
   );
-  const killSwitchFile = implFiles.find(
-    (file) => fileContains(repoPath, file, KILL_SWITCH_NAME_PATTERN) && fileContains(repoPath, file, KILL_SWITCH_FAIL_CLOSED_PATTERN)
+  const killSwitchFile = withContentReadSignal(
+    "B6",
+    "kill_switch_fail_safe_present",
+    () => implFiles.find(
+      (file) => fileContains(repoPath, file, KILL_SWITCH_NAME_PATTERN) && fileContains(repoPath, file, KILL_SWITCH_FAIL_CLOSED_PATTERN)
+    )
   );
   const codeownersFile = repoFiles.find((file) => /(^|\/)CODEOWNERS$/.test(file));
-  const reviewGateDoc = docFiles.find(
-    (file) => fileContains(repoPath, file, REQUIRED_REVIEW_PATTERN)
+  const reviewGateDoc = withContentReadSignal(
+    "B6",
+    "protected_path_review_gate",
+    () => docFiles.find((file) => fileContains(repoPath, file, REQUIRED_REVIEW_PATTERN))
   );
   const protectedPathReviewGate = codeownersFile ?? reviewGateDoc;
-  const executableFiles = implFiles.filter(
-    (file) => fileContains(repoPath, file, SQL_EXEC_PATTERN)
-  );
-  const historicalUngatedEscalationFiles = executableFiles.filter((file) => {
-    if (useV39Detectors && !fileHasExecutedPrivilegeEscalation(repoPath, file)) return false;
-    const hasEscalation = fileContains(repoPath, file, ROLE_MEMBERSHIP_GRANT_PATTERN) || fileContains(repoPath, file, SUPERUSER_ESCALATION_PATTERN);
-    if (!hasEscalation) return false;
-    return !fileContains(repoPath, file, HUMAN_GATE_MARKER_PATTERN);
+  const { executableFiles, v21ExecutedEscalationFileSet, productionUngatedEscalationFiles } = withContentReadSignal("B6", "privilege_escalation_cleanliness", () => {
+    const executable = implFiles.filter((file) => fileContains(repoPath, file, SQL_EXEC_PATTERN));
+    const historicalUngated = executable.filter((file) => {
+      if (useV39Detectors && !fileHasExecutedPrivilegeEscalation(repoPath, file)) return false;
+      const hasEscalation = fileContains(repoPath, file, ROLE_MEMBERSHIP_GRANT_PATTERN) || fileContains(repoPath, file, SUPERUSER_ESCALATION_PATTERN);
+      if (!hasEscalation) return false;
+      return !fileContains(repoPath, file, HUMAN_GATE_MARKER_PATTERN);
+    });
+    const v21Executed = useV21ExecutedEscalations ? repoFiles.filter(
+      (file) => isV39AuthoredProductionPath(file) && (fileHasV21RawSqlEscalation(repoPath, file) || isImplementationFile(file) && fileHasV21DriverEscalation(repoPath, file))
+    ) : [];
+    const v21ExecutedSet = new Set(v21Executed);
+    const ungated = [.../* @__PURE__ */ new Set([...historicalUngated, ...v21Executed])].filter(
+      (file) => !fileContains(repoPath, file, HUMAN_GATE_MARKER_PATTERN)
+    );
+    const productionUngated = ungated.filter(
+      (file) => useV39Detectors ? isV39AuthoredProductionPath(file) : !isTestOrFixturePath(file)
+    );
+    return {
+      executableFiles: executable,
+      v21ExecutedEscalationFileSet: v21ExecutedSet,
+      productionUngatedEscalationFiles: productionUngated
+    };
   });
-  const v21ExecutedEscalationFiles = useV21ExecutedEscalations ? repoFiles.filter(
-    (file) => isV39AuthoredProductionPath(file) && (fileHasV21RawSqlEscalation(repoPath, file) || isImplementationFile(file) && fileHasV21DriverEscalation(repoPath, file))
-  ) : [];
-  const v21ExecutedEscalationFileSet = new Set(v21ExecutedEscalationFiles);
-  const ungatedEscalationFiles = [
-    .../* @__PURE__ */ new Set([...historicalUngatedEscalationFiles, ...v21ExecutedEscalationFiles])
-  ].filter((file) => !fileContains(repoPath, file, HUMAN_GATE_MARKER_PATTERN));
-  const productionUngatedEscalationFiles = ungatedEscalationFiles.filter(
-    (file) => useV39Detectors ? isV39AuthoredProductionPath(file) : !isTestOrFixturePath(file)
-  );
   if (humanGateDoc) {
-    evidence.push(
-      evidenceForRelative(
-        repoPath,
-        humanGateDoc,
-        "artifact",
-        "Documents privileged operations as human-executed/gated"
+    withContentReadSignal(
+      "B6",
+      "human_gate_documented",
+      () => evidence.push(
+        evidenceForRelative(
+          repoPath,
+          humanGateDoc,
+          "artifact",
+          "Documents privileged operations as human-executed/gated"
+        )
       )
     );
   }
   if (gatedPrivilegeCheckFile) {
-    evidence.push(
-      evidenceForRelative(
-        repoPath,
-        gatedPrivilegeCheckFile,
-        "artifact",
-        "Fail-closed privilege-membership check before role elevation"
+    withContentReadSignal(
+      "B6",
+      "fail_closed_privilege_check",
+      () => evidence.push(
+        evidenceForRelative(
+          repoPath,
+          gatedPrivilegeCheckFile,
+          "artifact",
+          "Fail-closed privilege-membership check before role elevation"
+        )
       )
     );
   }
   if (killSwitchFile) {
-    evidence.push(
-      evidenceForRelative(
-        repoPath,
-        killSwitchFile,
-        "artifact",
-        "Un-overridable kill-switch / fail-safe governance toggle"
+    withContentReadSignal(
+      "B6",
+      "kill_switch_fail_safe_present",
+      () => evidence.push(
+        evidenceForRelative(
+          repoPath,
+          killSwitchFile,
+          "artifact",
+          "Un-overridable kill-switch / fail-safe governance toggle"
+        )
       )
     );
   }
   if (protectedPathReviewGate) {
-    evidence.push(
-      evidenceForRelative(
-        repoPath,
-        protectedPathReviewGate,
-        "artifact",
-        "CODEOWNERS/required-review gate on protected paths"
+    withContentReadSignal(
+      "B6",
+      "protected_path_review_gate",
+      () => evidence.push(
+        evidenceForRelative(
+          repoPath,
+          protectedPathReviewGate,
+          "artifact",
+          "CODEOWNERS/required-review gate on protected paths"
+        )
       )
     );
   }
-  for (const file of productionUngatedEscalationFiles.slice(0, 5)) {
-    const isV21ExecutedShape = v21ExecutedEscalationFileSet.has(file);
-    findings.push({
-      severity: "critical",
-      summary: isV21ExecutedShape ? "An authored SQL artifact contains, or a direct database-driver call executes, an administrative role grant, SUPERUSER escalation, or schema-wide table privilege grant with no documented human gate." : "Role-membership GRANT or SUPERUSER escalation executes in code with no documented human gate.",
-      evidence: evidenceForRelative(
-        repoPath,
-        file,
-        "artifact",
-        isV21ExecutedShape ? "Ungated authored or directly executed administrative SQL statement" : "Ungated privilege-escalation statement"
-      )
-    });
-  }
+  withContentReadSignal("B6", "privilege_escalation_cleanliness", () => {
+    for (const file of productionUngatedEscalationFiles.slice(0, 5)) {
+      const isV21ExecutedShape = v21ExecutedEscalationFileSet.has(file);
+      findings.push({
+        severity: "critical",
+        summary: isV21ExecutedShape ? "This file contains an authored administrative SQL statement \u2014 role-membership grant, SUPERUSER escalation, or schema-wide table privilege grant \u2014 or executes one through a direct database-driver call, and does not itself contain text matching the human-gate marker pattern." : "This file executes a role-membership GRANT or SUPERUSER escalation and does not itself contain text matching the human-gate marker pattern.",
+        evidence: evidenceForRelative(
+          repoPath,
+          file,
+          "artifact",
+          isV21ExecutedShape ? "Ungated authored or directly executed administrative SQL statement" : "Ungated privilege-escalation statement"
+        )
+      });
+    }
+  });
   if (evidence.length === 0 && findings.length === 0) {
     return buildNotApplicableSignal(
       "B6",
@@ -4051,7 +4659,7 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detecto
       }
     )
   ] : [];
-  const hasPrivilegedOpsSurface = humanGateDoc != null || gatedPrivilegeCheckFile != null || executableFiles.length > 0 || v21ExecutedEscalationFiles.length > 0;
+  const hasPrivilegedOpsSurface = humanGateDoc != null || gatedPrivilegeCheckFile != null || executableFiles.length > 0 || v21ExecutedEscalationFileSet.size > 0;
   return {
     criterionId: "B6",
     positiveEvidence: evidence,
@@ -4348,10 +4956,20 @@ function parseGitTrackedFiles(repoPath, output, includeHardExcluded) {
       continue;
     }
     try {
-      if (!lstatSync(fullPath).isFile()) {
+      const stat = lstatSync(fullPath);
+      if (!stat.isFile()) {
         recordContentSkip(fullPath, "non_regular_file", true);
         continue;
       }
+      if (stat.size > MAX_REPOSITORY_CONTENT_BYTES) {
+        const affectedCriteria = affectedCriteriaForUnavailablePath(file);
+        if (affectedCriteria.length > 0) {
+          recordContentSkipForCriteria(fullPath, "too_large", affectedCriteria, true);
+        } else {
+          recordContentSkip(fullPath, "too_large", true);
+        }
+        continue;
+      }
     } catch (error) {
       recordFilesystemSkip(fullPath, error, false, true);
       continue;
@@ -4363,6 +4981,39 @@ function parseGitTrackedFiles(repoPath, output, includeHardExcluded) {
   }
   return files.sort();
 }
+function affectedCriteriaForUnavailablePath(file) {
+  const affected = /* @__PURE__ */ new Set();
+  if (isDependencyManifest(file) || isLockfile(file)) affected.add("A4");
+  if (isCiWorkflow(file)) {
+    affected.add("A1");
+    affected.add("A3");
+    affected.add("B2");
+    affected.add("B3");
+  }
+  if (isDeployConfig(file)) {
+    affected.add("A3");
+    affected.add("B2");
+  }
+  if (isTestFile(file)) {
+    affected.add("A1");
+    affected.add("A2");
+  }
+  if (isImplementationFile(file)) {
+    affected.add("A1");
+    affected.add("A2");
+    affected.add("A3");
+    affected.add("B1");
+    affected.add("B6");
+  }
+  if (/\.(?:md|mdx|rst|txt)$/i.test(file)) {
+    affected.add("A5");
+    affected.add("B4");
+    affected.add("B5");
+    affected.add("B6");
+  }
+  if (isAuditFile(file)) affected.add("B5");
+  return [...affected];
+}
 function directoryInventory(repoPath) {
   const files = [];
   const rootDevice = statSync(repoPath).dev;
@@ -4375,6 +5026,7 @@ function collectRepoFileInventory(repoPath) {
     return {
       repoFiles: parseGitTrackedFiles(repoPath, tracked.stdout, false),
       inventoryFiles: parseGitTrackedFiles(repoPath, tracked.stdout, true),
+      repoFileInventoryScope: "tracked-scan-eligible",
       scanLimitations: []
     };
   }
@@ -4482,8 +5134,13 @@ function visitRepoDir(repoPath, dirPath, files, rootDevice) {
       continue;
     }
     const repoRelativePath = relative(repoPath, fullPath);
-    if (size > 512e3) {
-      recordContentSkip(fullPath, "too_large");
+    if (size > MAX_REPOSITORY_CONTENT_BYTES) {
+      const affectedCriteria = affectedCriteriaForUnavailablePath(repoRelativePath);
+      if (affectedCriteria.length > 0) {
+        recordContentSkipForCriteria(fullPath, "too_large", affectedCriteria);
+      } else {
+        recordContentSkip(fullPath, "too_large");
+      }
       continue;
     }
     if (!isPotentialContentPath(repoRelativePath)) {
@@ -4925,6 +5582,9 @@ function isRecord(value) {
 function isTestRunnerConfig(repoPath, file) {
   return /(^|\/)(vitest|jest|pytest|playwright|cypress|mocha)\.config\.[cm]?[jt]s$/.test(file) || /(^|\/)(pytest\.ini|tox\.ini)$/.test(file) || /(^|\/)phpunit\.xml(\.dist)?$/.test(file) || /(^|\/)pyproject\.toml$/.test(file) && fileContains(repoPath, file, /^\[tool\.pytest(?:\.|\])/m) || /(^|\/)CMakeLists\.txt$/.test(file) && fileContains(repoPath, file, /\b(?:enable_testing|add_test|ctest_add_tests)\s*\(/i) || /(^|\/)Makefile$/.test(file) && fileContains(repoPath, file, /^\s*(?:test|tests|check)\s*:/m);
 }
+function isRecipeTestEntry(repoPath, file) {
+  return isRecipeFile(file) && fileContains(repoPath, file, /^\s*(?:test|tests|check)\s*:/m);
+}
 function findCoverageConfigFiles(repoPath, repoFiles, authoredOnly = false) {
   return repoFiles.filter(
     (file) => (!authoredOnly || isAuthoredProductionPath(file)) && isCoverageConfig(repoPath, file)
@@ -5218,6 +5878,580 @@ function packageJsonHasCoverageTooling(repoPath, file) {
   }
   return false;
 }
+function isV23CoverageConfig(repoPath, file) {
+  if (/(^|\/)vitest\.config\.[cm]?[jt]s$/.test(file)) {
+    const contents = stripJavaScriptComments(readRepoText(join(repoPath, file), "utf8"));
+    const property = /(?:^|[{,])\s*["']?coverage["']?\s*:\s*([^,\r\n}]*)/im.exec(contents)?.[1]?.trim();
+    if (!property || /^(?:false\b|null\b|undefined\b)/i.test(property)) return false;
+    if (/^\{/.test(property) && /\benabled\s*:\s*false\b/i.test(contents)) return false;
+    return true;
+  }
+  if (/(^|\/)jest\.config\.[cm]?[jt]s$/.test(file)) {
+    const contents = stripJavaScriptComments(readRepoText(join(repoPath, file), "utf8"));
+    return /(?:^|[{,])\s*["']?collectCoverage["']?\s*:\s*true\b/m.test(contents) || /(?:^|[{,])\s*["']?(?:coverageThreshold|coverageProvider|coverageDirectory)["']?\s*:/m.test(
+      contents
+    );
+  }
+  if (/(^|\/)package\.json$/.test(file)) {
+    return packageJsonHasStaticCoverageTooling(repoPath, file);
+  }
+  return isCoverageConfig(repoPath, file);
+}
+function coverageConfigurationDecision(repoPath, file) {
+  const detectorState = isV23CoverageConfig(repoPath, file) ? "collects" : "none";
+  if (/(^|\/)vitest\.config\.[cm]?[jt]s$/.test(file)) {
+    const rawContents = readRepoText(join(repoPath, file), "utf8");
+    const contents = stripJavaScriptComments(rawContents);
+    const match = /(?:^|[{,])\s*["']?coverage["']?\s*:\s*([^,\r\n}]*)/im.exec(contents);
+    if (!match) return null;
+    return {
+      path: file,
+      source: "runner-configuration",
+      locator: "coverage",
+      evidence: rawContents.slice(match.index, match.index + match[0].length).trim(),
+      detectorRecognized: true,
+      detectorState
+    };
+  }
+  if (/(^|\/)jest\.config\.[cm]?[jt]s$/.test(file)) {
+    const rawContents = readRepoText(join(repoPath, file), "utf8");
+    const contents = stripJavaScriptComments(rawContents);
+    const match = /(?:^|[{,])\s*["']?(collectCoverage|coverageThreshold|coverageProvider|coverageDirectory)["']?\s*:\s*([^,\r\n}]*)/m.exec(
+      contents
+    );
+    if (!match) return null;
+    return {
+      path: file,
+      source: "runner-configuration",
+      locator: match[1] ?? "coverage",
+      evidence: rawContents.slice(match.index, match.index + match[0].length).trim(),
+      detectorRecognized: true,
+      detectorState
+    };
+  }
+  if (detectorState === "none") return null;
+  return {
+    path: file,
+    source: "runner-configuration",
+    locator: "coverage",
+    evidence: file,
+    detectorRecognized: true,
+    detectorState
+  };
+}
+function packageJsonHasStaticCoverageTooling(repoPath, file) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return false;
+  const parsed = parseJsonObject(readRepoText(fullPath, "utf8"));
+  if (!parsed) return false;
+  return ["nyc", "c8", "istanbul"].some((key) => {
+    const config = parsed[key];
+    return typeof config === "object" && config !== null && !Array.isArray(config);
+  });
+}
+function analyzeCoverageConfiguration(repoPath, repoFiles, authoredOnly = false) {
+  const eligibleFiles = repoFiles.filter(
+    (file) => !authoredOnly || isAuthoredProductionPath(file)
+  );
+  const eligibleSet = new Set(eligibleFiles);
+  const coverageFiles = /* @__PURE__ */ new Set();
+  const unresolvedFiles = /* @__PURE__ */ new Set();
+  const ciCommandsByFile = /* @__PURE__ */ new Map();
+  const detectorDecisions = [];
+  let hasCoverageCommand = false;
+  for (const file of eligibleFiles.filter(isCiWorkflow)) {
+    const commands = extractCiRunCommands(readRepoText(join(repoPath, file), "utf8"));
+    ciCommandsByFile.set(file, commands);
+    const commandDecisions = commands.map(
+      (command, index) => coverageDetectorDecision(repoPath, eligibleSet, {
+        path: file,
+        source: "ci-run",
+        locator: String(index),
+        command
+      })
+    );
+    detectorDecisions.push(...commandDecisions);
+    const state = combineCoverageCommandStates(
+      commandDecisions.map((decision) => decision.detectorState)
+    );
+    if (state === "collects") {
+      coverageFiles.add(file);
+      hasCoverageCommand = true;
+    }
+    if (state === "unresolved") unresolvedFiles.add(file);
+  }
+  const ciCommands = [...ciCommandsByFile.values()].flat();
+  for (const file of eligibleFiles) {
+    if (isCiWorkflow(file) || isRecipeFile(file)) continue;
+    if (/(^|\/)package\.json$/.test(file)) {
+      if (packageJsonHasStaticCoverageTooling(repoPath, file)) coverageFiles.add(file);
+      const packageState = packageScriptCoverageState(
+        repoPath,
+        eligibleSet,
+        file,
+        file === "package.json" ? ciCommands : [],
+        detectorDecisions
+      );
+      if (packageState === "collects") {
+        coverageFiles.add(file);
+        hasCoverageCommand = true;
+      }
+      if (packageState === "unresolved") unresolvedFiles.add(file);
+      continue;
+    }
+    const configurationDecision = coverageConfigurationDecision(repoPath, file);
+    if (configurationDecision) detectorDecisions.push(configurationDecision);
+    if (configurationDecision?.detectorState === "collects") coverageFiles.add(file);
+  }
+  for (const file of eligibleFiles.filter(isRecipeFile)) {
+    const state = recipeCoverageState(
+      repoPath,
+      eligibleSet,
+      file,
+      ciCommands,
+      detectorDecisions
+    );
+    if (state === "collects") {
+      coverageFiles.add(file);
+      hasCoverageCommand = true;
+    }
+    if (state === "unresolved") unresolvedFiles.add(file);
+  }
+  for (const file of coverageFiles) unresolvedFiles.delete(file);
+  return {
+    coverageFiles: [...coverageFiles].sort(),
+    unresolvedFiles: [...unresolvedFiles].sort(),
+    hasCoverageCommand,
+    detectorDecisions
+  };
+}
+function stripJavaScriptComments(contents) {
+  let output = "";
+  let quote = null;
+  let escaped = false;
+  let lineComment = false;
+  let blockComment = false;
+  for (let index = 0; index < contents.length; index += 1) {
+    const character = contents[index] ?? "";
+    const next = contents[index + 1] ?? "";
+    if (lineComment) {
+      if (character === "\n") {
+        lineComment = false;
+        output += "\n";
+      } else {
+        output += " ";
+      }
+      continue;
+    }
+    if (blockComment) {
+      if (character === "*" && next === "/") {
+        output += "  ";
+        index += 1;
+        blockComment = false;
+      } else {
+        output += character === "\n" ? "\n" : " ";
+      }
+      continue;
+    }
+    if (escaped) {
+      output += character;
+      escaped = false;
+      continue;
+    }
+    if (quote) {
+      output += character;
+      if (character === "\\") escaped = true;
+      else if (character === quote) quote = null;
+      continue;
+    }
+    if (character === "'" || character === '"' || character === "`") {
+      quote = character;
+      output += character;
+      continue;
+    }
+    if (character === "/" && next === "/") {
+      output += "  ";
+      index += 1;
+      lineComment = true;
+      continue;
+    }
+    if (character === "/" && next === "*") {
+      output += "  ";
+      index += 1;
+      blockComment = true;
+      continue;
+    }
+    output += character;
+  }
+  return output;
+}
+function packageScriptCoverageState(repoPath, repoFiles, packageJson, ciCommands, detectorDecisions) {
+  const scripts = readPackageScripts(join(repoPath, packageJson));
+  if (scripts.size === 0) return "none";
+  const roots = /* @__PURE__ */ new Set();
+  let unresolved = false;
+  if (scripts.has("test")) roots.add("test");
+  for (const command of ciCommands) {
+    const references = packageScriptReferences(command, scripts);
+    for (const name of references.names) roots.add(name);
+    if (references.dynamic && [...scripts.values()].some(
+      (candidate) => commandInvokesCoverageTool(candidate) || containsPotentialCoverageFlag(candidate)
+    )) {
+      unresolved = true;
+    }
+  }
+  const queue = [...roots];
+  const visited = /* @__PURE__ */ new Set();
+  while (queue.length > 0) {
+    const name = queue.shift();
+    if (!name || visited.has(name)) continue;
+    const command = scripts.get(name);
+    if (command === void 0) continue;
+    visited.add(name);
+    const decision = coverageDetectorDecision(repoPath, repoFiles, {
+      path: packageJson,
+      source: "package-script",
+      locator: name,
+      command
+    });
+    detectorDecisions.push(decision);
+    const state = decision.detectorState;
+    if (state === "collects") return "collects";
+    if (state === "unresolved") unresolved = true;
+    const references = packageScriptReferences(command, scripts);
+    for (const referenced of references.names) {
+      if (!visited.has(referenced)) queue.push(referenced);
+    }
+    for (const lifecycle of [`pre${name}`, `post${name}`]) {
+      if (scripts.has(lifecycle) && !visited.has(lifecycle)) queue.push(lifecycle);
+    }
+    if (references.dynamic && [...scripts.values()].some(
+      (candidate) => commandInvokesCoverageTool(candidate) || containsPotentialCoverageFlag(candidate)
+    )) {
+      unresolved = true;
+    }
+  }
+  return unresolved ? "unresolved" : "none";
+}
+function packageScriptReferences(command, scripts) {
+  const names = /* @__PURE__ */ new Set();
+  let dynamic = false;
+  for (const segment of splitShellCommandSegments(command)) {
+    for (const match of segment.matchAll(
+      /\bpnpm\s+run\s+\/((?:\\.|[^/])+)\/([dgimsuvy]*)/giu
+    )) {
+      const source = match[1];
+      if (!source) continue;
+      try {
+        const flags = (match[2] ?? "").replace(/[dgy]/g, "");
+        const selector = new RegExp(source, flags);
+        for (const name of scripts.keys()) {
+          if (selector.test(name)) names.add(name);
+          selector.lastIndex = 0;
+        }
+      } catch {
+        dynamic = true;
+      }
+    }
+    for (const match of segment.matchAll(
+      /\b(?:npm|pnpm|yarn)\s+(?:run\s+)?([A-Za-z0-9][A-Za-z0-9:._-]*)/giu
+    )) {
+      const name = match[1];
+      if (name && scripts.has(name)) names.add(name);
+    }
+    if (/\b(?:npm|pnpm|yarn)\s+run\s+(?:\$|["']\$|`)/u.test(segment)) dynamic = true;
+  }
+  return { names: [...names], dynamic };
+}
+function extractCiRunCommands(contents) {
+  const lines = contents.split(/\r?\n/);
+  const commands = [];
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index] ?? "";
+    const match = /^(\s*)(?:-\s*)?run\s*:\s*(.*)$/u.exec(line);
+    if (!match) continue;
+    const indentation = match[1]?.length ?? 0;
+    const value = match[2]?.trim() ?? "";
+    if (value === "|" || value === ">" || value.startsWith("|-") || value.startsWith(">-")) {
+      const block = [];
+      for (index += 1; index < lines.length; index += 1) {
+        const nested = lines[index] ?? "";
+        if (nested.trim().length === 0) {
+          block.push("");
+          continue;
+        }
+        const nestedIndentation = /^\s*/u.exec(nested)?.[0].length ?? 0;
+        if (nestedIndentation <= indentation) {
+          index -= 1;
+          break;
+        }
+        block.push(nested.slice(Math.min(nested.length, indentation + 2)));
+      }
+      commands.push(block.join(value.startsWith(">") ? " " : "\n"));
+      continue;
+    }
+    if (value.length === 0) continue;
+    const quoted = /^(?:"([\s\S]*)"|'([\s\S]*)')$/u.exec(value);
+    commands.push(quoted ? quoted[1] ?? quoted[2] ?? "" : value);
+  }
+  return commands;
+}
+function isRecipeFile(file) {
+  return /(^|\/)(?:Makefile|makefile|GNUmakefile|[Jj]ustfile)$/.test(file);
+}
+function recipeCoverageState(repoPath, repoFiles, file, ciCommands, detectorDecisions) {
+  const targets = readRecipeTargets(readRepoText(join(repoPath, file), "utf8"));
+  const roots = new Set(["test", "tests", "check"].filter((target) => targets.has(target)));
+  const runner = /[Jj]ustfile$/.test(file) ? "just" : "make";
+  for (const command of ciCommands) {
+    for (const match of command.matchAll(new RegExp(`\\b${runner}\\s+([A-Za-z0-9._-]+)`, "gu"))) {
+      const target = match[1];
+      if (target && targets.has(target)) roots.add(target);
+    }
+  }
+  const queue = [...roots];
+  const visited = /* @__PURE__ */ new Set();
+  let unresolved = false;
+  while (queue.length > 0) {
+    const name = queue.shift();
+    if (!name || visited.has(name)) continue;
+    const target = targets.get(name);
+    if (!target) continue;
+    visited.add(name);
+    const commandDecisions = target.commands.map(
+      (command, index) => coverageDetectorDecision(repoPath, repoFiles, {
+        path: file,
+        source: "recipe-command",
+        locator: `${name}:${index}`,
+        command
+      })
+    );
+    detectorDecisions.push(...commandDecisions);
+    const state = combineCoverageCommandStates(
+      commandDecisions.map((decision) => decision.detectorState)
+    );
+    if (state === "collects") return "collects";
+    if (state === "unresolved") unresolved = true;
+    for (const dependency of target.dependencies) {
+      if (targets.has(dependency) && !visited.has(dependency)) queue.push(dependency);
+    }
+    for (const command of target.commands) {
+      const pattern = new RegExp(`(?:\\$\\(MAKE\\)|\\b${runner})\\s+([A-Za-z0-9._-]+)`, "gu");
+      for (const match of command.matchAll(pattern)) {
+        const referenced = match[1];
+        if (referenced && targets.has(referenced) && !visited.has(referenced)) queue.push(referenced);
+      }
+    }
+  }
+  return unresolved ? "unresolved" : "none";
+}
+function readRecipeTargets(contents) {
+  const targets = /* @__PURE__ */ new Map();
+  let active = null;
+  for (const line of contents.split(/\r?\n/)) {
+    const header = /^([A-Za-z0-9][A-Za-z0-9._-]*)\s*:\s*([^#]*)/u.exec(line);
+    if (header) {
+      const name = header[1];
+      if (!name) continue;
+      active = {
+        dependencies: (header[2] ?? "").trim().split(/\s+/u).filter(Boolean),
+        commands: []
+      };
+      targets.set(name, active);
+      continue;
+    }
+    if (active && /^\s+/u.test(line) && line.trim().length > 0) {
+      active.commands.push(line.trim().replace(/^[@+-]+/u, ""));
+      continue;
+    }
+    if (line.trim().length > 0 && !line.trimStart().startsWith("#")) active = null;
+  }
+  return targets;
+}
+function coverageCommandEvaluation(repoPath, repoFiles, command, depth = 0) {
+  if (depth > 4) {
+    const recognized = containsPotentialCoverageFlag(command);
+    return { recognized, state: recognized ? "unresolved" : "none" };
+  }
+  const normalized = normalizeCoverageCommandPrefixes(command);
+  const segments = normalized.splitShellOperators ? splitShellCommandSegments(normalized.segment) : [normalized.segment];
+  const evaluations = segments.map((rawSegment) => {
+    const candidate = normalizeCoverageCommandPrefixes(rawSegment);
+    if (commandInvokesCoverageTool(candidate.segment)) {
+      return { recognized: true, state: "collects" };
+    }
+    const words = shellWords(candidate.segment);
+    if (words.length === 0) return { recognized: false, state: "none" };
+    const direct = coverageFlagCommandState(words);
+    if (direct !== "none") return { recognized: true, state: direct };
+    const hasCoverageSyntax = containsPotentialCoverageFlag(candidate.segment);
+    if (isRecognizedCoverageFlagRunner(words)) {
+      return { recognized: hasCoverageSyntax, state: "none" };
+    }
+    const wrapper = reachableShellWrapper(words, repoFiles);
+    if (wrapper) {
+      return coverageCommandEvaluation(
+        repoPath,
+        repoFiles,
+        readRepoText(join(repoPath, wrapper), "utf8"),
+        depth + 1
+      );
+    }
+    const executable = commandExecutable(words);
+    const potentialFlagState = flagState(
+      words.slice(1),
+      ["--experimental-test-coverage", "--collectcoverage", "--collect-coverage", "--coverage", "--cov"],
+      [
+        "--no-experimental-test-coverage",
+        "--no-collectcoverage",
+        "--no-collect-coverage",
+        "--no-coverage",
+        "--no-cov"
+      ]
+    );
+    if (hasCoverageSyntax && potentialFlagState !== "none" && executable && /(?:test|spec|runner)/i.test(executable) && !/(?:docs?|map|report|upload|codecov|coveralls)/i.test(executable)) {
+      return { recognized: true, state: "unresolved" };
+    }
+    return { recognized: false, state: "none" };
+  });
+  return {
+    recognized: evaluations.some((evaluation) => evaluation.recognized),
+    state: combineCoverageCommandStates(
+      evaluations.map((evaluation) => evaluation.state)
+    )
+  };
+}
+function coverageDetectorDecision(repoPath, repoFiles, input) {
+  const evaluation = coverageCommandEvaluation(repoPath, repoFiles, input.command);
+  return {
+    path: input.path,
+    source: input.source,
+    locator: input.locator,
+    evidence: input.command,
+    detectorRecognized: evaluation.recognized,
+    detectorState: evaluation.state
+  };
+}
+function combineCoverageCommandStates(states) {
+  if (states.includes("collects")) return "collects";
+  return states.includes("unresolved") ? "unresolved" : "none";
+}
+function shellWords(segment) {
+  const words = [];
+  let offset = 0;
+  while (offset < segment.length) {
+    const scanned = scanShellWord(segment, offset);
+    if (!scanned) break;
+    words.push(scanned.word);
+    if (scanned.end <= offset) break;
+    offset = scanned.end;
+  }
+  return words;
+}
+function commandExecutable(words) {
+  const normalized = unwrapPackageManagerExecutable(words);
+  const executable = normalized[0];
+  return executable ? basename(executable).replace(/\.cmd$/i, "").toLowerCase() : void 0;
+}
+function unwrapPackageManagerExecutable(words) {
+  if (words.length === 0) return [];
+  const first = basename(words[0] ?? "").toLowerCase();
+  if (first === "pnpm" || first === "yarn") {
+    const second = words[1]?.toLowerCase();
+    return words.slice(second === "exec" || second === "dlx" ? 2 : 1);
+  }
+  if (first === "npx") return words.slice(1).filter((word) => !/^--(?:yes|no-install)$/u.test(word));
+  if (first === "npm" && words[1]?.toLowerCase() === "exec") {
+    let offset = 2;
+    while (/^--(?:yes|no-install)$/u.test(words[offset] ?? "")) offset += 1;
+    if (words[offset] === "--") offset += 1;
+    return words.slice(offset);
+  }
+  return [...words];
+}
+function coverageFlagCommandState(words) {
+  const command = unwrapPackageManagerExecutable(words);
+  const executable = basename(command[0] ?? "").replace(/\.cmd$/i, "").toLowerCase();
+  const args = command.slice(1);
+  if (!executable) return "none";
+  if (executable === "node") {
+    if (!args.includes("--test")) return "none";
+    return flagState(args, ["--experimental-test-coverage"], ["--no-experimental-test-coverage"]);
+  }
+  if (executable === "pytest" || executable === "py.test") {
+    return flagState(args, ["--cov"], ["--no-cov"]);
+  }
+  if (executable === "bun" || executable === "deno") {
+    if (args[0]?.toLowerCase() !== "test") return "none";
+    return flagState(args.slice(1), ["--coverage"], ["--no-coverage"]);
+  }
+  if (executable === "jest") {
+    return flagState(
+      args,
+      ["--coverage", "--collectcoverage", "--collect-coverage"],
+      ["--no-coverage", "--no-collectcoverage", "--no-collect-coverage"]
+    );
+  }
+  if (executable === "vitest" || executable === "bnt") {
+    return flagState(args, ["--coverage"], ["--no-coverage"]);
+  }
+  return "none";
+}
+function isRecognizedCoverageFlagRunner(words) {
+  const command = unwrapPackageManagerExecutable(words);
+  const executable = basename(command[0] ?? "").replace(/\.cmd$/i, "").toLowerCase();
+  if (["bnt", "vitest", "jest", "pytest", "py.test"].includes(executable)) return true;
+  if (executable === "node") return command.slice(1).includes("--test");
+  return (executable === "bun" || executable === "deno") && command[1]?.toLowerCase() === "test";
+}
+function flagState(args, enablingNames, disablingNames) {
+  let enabled = false;
+  let disabled = false;
+  let unresolved = false;
+  const enabling = new Set(enablingNames.map((name) => name.toLowerCase()));
+  const disabling = new Set(disablingNames.map((name) => name.toLowerCase()));
+  for (let index = 0; index < args.length; index += 1) {
+    const raw = args[index] ?? "";
+    const lower = raw.toLowerCase();
+    if (disabling.has(lower)) {
+      disabled = true;
+      continue;
+    }
+    const [name, assigned] = lower.split("=", 2);
+    if (!name || !enabling.has(name)) continue;
+    if (assigned !== void 0) {
+      if (assigned === "false" || assigned === "0" || assigned === "off") disabled = true;
+      else if (/\$|\{|\}/u.test(assigned)) unresolved = true;
+      else enabled = true;
+      continue;
+    }
+    const next = args[index + 1]?.toLowerCase();
+    if (next === "false" || next === "0" || next === "off") {
+      disabled = true;
+      index += 1;
+    } else if (next && /\$|\{|\}/u.test(next)) {
+      unresolved = true;
+      index += 1;
+    } else {
+      enabled = true;
+    }
+  }
+  if (unresolved || enabled && disabled) return "unresolved";
+  return enabled && !disabled ? "collects" : "none";
+}
+function containsPotentialCoverageFlag(command) {
+  return /(?:^|\s)--(?:experimental-test-coverage|collect-?coverage|no-coverage|coverage|no-cov|cov)(?:[=\s]|$)/iu.test(
+    command
+  );
+}
+function reachableShellWrapper(words, repoFiles) {
+  const executable = basename(words[0] ?? "").toLowerCase();
+  const candidate = /^(?:ba|da|k|z)?sh$/u.test(executable) ? words[1] : words[0];
+  if (!candidate || !/(?:^|\/)\.?[^\s]*\.sh$/i.test(candidate)) return void 0;
+  const normalized = candidate.replace(/^\.\//u, "");
+  if (normalized.startsWith("/") || normalized.split("/").includes("..")) return void 0;
+  return repoFiles.has(normalized) ? normalized : void 0;
+}
 function commandInvokesCoverageTool(command) {
   return normalizedCommandInvokesCoverageTool(normalizeCoverageCommandPrefixes(command), 0);
 }
@@ -6475,12 +7709,11 @@ function hasEnvPathInGitHistory(repoPath, scanLimitations) {
 
 // src/witan/public-scan.ts
 init_esm_shims();
-import { resolve as resolve2 } from "path";
 
 // src/witan/ingest.ts
 init_esm_shims();
-import { readFileSync as readFileSync4, readdirSync as readdirSync2 } from "fs";
-import { join as join2 } from "path";
+import { lstatSync as lstatSync3, opendirSync, readFileSync as readFileSync4, realpathSync as realpathSync3 } from "fs";
+import { join as join2, resolve as resolve3 } from "path";
 
 // src/witan/finding-limits.ts
 init_esm_shims();
@@ -6504,49 +7737,118 @@ function clampFinding(finding) {
 // src/witan/generic-adapter.ts
 init_esm_shims();
 import { readFileSync } from "fs";
-var VALID_DIMENSIONS = /* @__PURE__ */ new Set([
-  "A1",
-  "A2",
-  "A3",
-  "A4",
-  "A5",
-  "B1",
-  "B2",
-  "B3",
-  "B4",
-  "B5",
-  "B6"
-]);
-var VALID_SEVERITIES = /* @__PURE__ */ new Set(["critical", "warning", "info"]);
+
+// src/witan/ingest-files.ts
+init_esm_shims();
+import { lstatSync as lstatSync2, realpathSync as realpathSync2 } from "fs";
+import { dirname as dirname2, isAbsolute, relative as relative2, resolve as resolve2, sep as sep2 } from "path";
+var MAX_INGEST_DOCUMENT_BYTES = 8 * 1024 * 1024;
+function isContainedPath(candidate, directory) {
+  const relativePath = relative2(directory, candidate);
+  return relativePath === "" || relativePath !== ".." && !relativePath.startsWith(`..${sep2}`) && !isAbsolute(relativePath);
+}
+function isMissingIngestPath(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+function resolveIngestFilePath(filePath, inputDirectory = dirname2(filePath)) {
+  const lexicalDirectory = resolve2(inputDirectory);
+  const lexicalCandidate = resolve2(filePath);
+  const directoryStat = lstatSync2(lexicalDirectory);
+  if (directoryStat.isSymbolicLink()) {
+    throw new Error(`Cejel: refusing symlinked ingest directory: ${inputDirectory}`);
+  }
+  if (!directoryStat.isDirectory()) {
+    throw new Error(`Cejel: refusing non-directory ingest boundary: ${inputDirectory}`);
+  }
+  const candidateStat = lstatSync2(lexicalCandidate);
+  if (candidateStat.isSymbolicLink()) {
+    throw new Error(`Cejel: refusing symlinked ingest file: ${filePath}`);
+  }
+  if (!candidateStat.isFile()) {
+    throw new Error(`Cejel: refusing non-regular ingest file: ${filePath}`);
+  }
+  if (candidateStat.size > MAX_INGEST_DOCUMENT_BYTES) {
+    throw new Error(
+      `Cejel: ingest file exceeds the ${MAX_INGEST_DOCUMENT_BYTES.toLocaleString("en-US")} byte budget: ${filePath}`
+    );
+  }
+  const resolvedDirectory = realpathSync2(lexicalDirectory);
+  const resolvedCandidate = realpathSync2(lexicalCandidate);
+  if (!isContainedPath(resolvedCandidate, resolvedDirectory)) {
+    throw new Error(`Cejel: refusing ingest file outside its resolved input directory: ${filePath}`);
+  }
+  return resolvedCandidate;
+}
+function isResolvedIngestPathContained(candidate, directory) {
+  return isContainedPath(candidate, directory);
+}
+
+// src/witan/generic-adapter.ts
+var CEJEL_GENERIC_INGEST_CONTRACT_VERSION = "1.0";
+var CEJEL_GENERIC_INGEST_CONTRACT_MAJOR = 1;
+var GenericFindingV1Schema = external_exports.object({
+  ruleId: external_exports.string().min(1),
+  severity: external_exports.enum(["critical", "warning", "info"]),
+  message: external_exports.string().min(1),
+  location: external_exports.string().min(1).optional()
+}).passthrough();
+var GenericSignalV1Schema = external_exports.object({
+  dimension: external_exports.enum(["A1", "A2", "A3", "A4", "A5", "B1", "B2", "B3", "B4", "B5", "B6"]),
+  weight: external_exports.number().min(0).max(1).default(0.5),
+  findings: external_exports.array(GenericFindingV1Schema).min(1)
+}).passthrough();
+var GenericSignalDocumentV1Schema = external_exports.object({
+  version: external_exports.string().regex(/^1\.\d+$/),
+  tool: external_exports.string().trim().min(1),
+  signals: external_exports.array(GenericSignalV1Schema)
+}).passthrough();
 function isGenericSignalDocument(raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
   const doc = raw;
   return typeof doc.tool === "string" && doc.tool.length > 0 && Array.isArray(doc.signals);
 }
+function assertSupportedContractVersion(version) {
+  if (typeof version !== "string") {
+    throw new Error(
+      `Cejel: generic ingest contract version is required; expected "version": "${CEJEL_GENERIC_INGEST_CONTRACT_VERSION}". Refusing to guess an unversioned contract.`
+    );
+  }
+  const match = /^(\d+)\.(\d+)$/.exec(version);
+  if (!match) {
+    throw new Error(
+      `Cejel: invalid generic ingest contract version "${version}"; expected <major>.<minor> (current ${CEJEL_GENERIC_INGEST_CONTRACT_VERSION}).`
+    );
+  }
+  const major = Number(match[1]);
+  if (major !== CEJEL_GENERIC_INGEST_CONTRACT_MAJOR) {
+    throw new Error(
+      `Cejel: unsupported generic ingest contract major version ${major} (declared "${version}"); this Cejel build supports major ${CEJEL_GENERIC_INGEST_CONTRACT_MAJOR}. Refusing to guess.`
+    );
+  }
+}
+function formatValidationIssues(error) {
+  return error.issues.map((issue) => `${issue.path.length > 0 ? issue.path.join(".") : "<document>"}: ${issue.message}`).join("; ");
+}
 function parseGenericJson(raw) {
   if (!isGenericSignalDocument(raw)) return [];
-  const source = raw.tool ?? "unknown";
-  const signals = [];
-  for (const signal of raw.signals ?? []) {
-    const dimension = signal.dimension;
-    if (!dimension || !VALID_DIMENSIONS.has(dimension)) continue;
-    const weight = typeof signal.weight === "number" && Number.isFinite(signal.weight) ? Math.min(Math.max(signal.weight, 0), 1) : 0.5;
-    const findings = [];
-    for (const finding of signal.findings ?? []) {
-      const severity = finding.severity;
-      if (!severity || !VALID_SEVERITIES.has(severity)) continue;
-      const ruleId = finding.ruleId ?? "unknown";
-      findings.push({
-        ruleId,
-        severity,
-        message: finding.message ?? ruleId,
-        ...finding.location ? { location: finding.location } : {}
-      });
-    }
-    if (findings.length === 0) continue;
-    signals.push({ source, dimension, weight, findings });
+  assertSupportedContractVersion(raw.version);
+  const parsed = GenericSignalDocumentV1Schema.safeParse(raw);
+  if (!parsed.success) {
+    throw new Error(
+      `Cejel: invalid generic ingest contract v${raw.version}: ${formatValidationIssues(parsed.error)}`
+    );
   }
-  return signals;
+  return parsed.data.signals.map((signal) => ({
+    source: parsed.data.tool,
+    dimension: signal.dimension,
+    weight: signal.weight,
+    findings: signal.findings.map((finding) => ({
+      ruleId: finding.ruleId,
+      severity: finding.severity,
+      message: finding.message,
+      ...finding.location ? { location: finding.location } : {}
+    }))
+  }));
 }
 
 // src/witan/sarif-adapter.ts
@@ -6808,30 +8110,35 @@ function rawToolName(raw) {
 }
 var MAX_INGEST_SOURCE_LENGTH = 120;
 function sanitizeIngestSource(source) {
-  const withoutControls = source.replace(/[\p{Cc}\p{Cf}]/gu, "").trim();
-  const safeSource = withoutControls.length > 0 ? withoutControls : "unknown";
-  const codePoints = Array.from(safeSource);
-  if (codePoints.length <= MAX_INGEST_SOURCE_LENGTH) return safeSource;
-  return `${codePoints.slice(0, MAX_INGEST_SOURCE_LENGTH - 3).join("")}...`;
+  return sanitizePresentationLine(source, {
+    fallback: "unknown",
+    maxLength: MAX_INGEST_SOURCE_LENGTH
+  });
 }
 function parseIngestFile(filePath, options = {}) {
+  const resolvedFilePath = resolveIngestFilePath(filePath);
   let raw;
   try {
-    raw = JSON.parse(stripBom(readFileSync4(filePath, "utf8")));
+    raw = JSON.parse(stripBom(readFileSync4(resolvedFilePath, "utf8")));
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`Cejel: could not parse ingest file as JSON: ${filePath} (${message})`);
   }
+  const rawCount = countRawEntries(raw);
+  if (options.maxFindingCandidates !== void 0 && rawCount > options.maxFindingCandidates) {
+    throw new Error(
+      `Cejel: ${rawCount.toLocaleString("en-US")} ingest finding candidates exceed the ${options.maxFindingCandidates.toLocaleString("en-US")} remaining retained ingest finding budget; refusing before adapter materialization.`
+    );
+  }
   let signals;
   if (looksLikeSarif(raw)) signals = parseSarifJson(raw, options.extraSarifDimensionRules);
   else if (looksLikeScorecard(raw)) signals = parseScorecardJson(raw);
   else if (isGenericSignalDocument(raw)) signals = parseGenericJson(raw);
   if (!signals) {
     throw new Error(
-      `Cejel: unrecognized ingest file format: ${filePath} \u2014 expected SARIF (a "runs" array), OpenSSF Scorecard JSON (a "checks" array), or the generic Cejel external-signal shape (a "tool" string + "signals" array). See the cejel README "Aggregate your scanners".`
+      `Cejel: unrecognized ingest file format: ${filePath} \u2014 expected SARIF (a "runs" array), OpenSSF Scorecard JSON (a "checks" array), or the versioned generic Cejel external-signal shape (a "version" string + "tool" string + "signals" array). See the cejel README "Aggregate your scanners".`
     );
   }
-  const rawCount = countRawEntries(raw);
   const mappedCount = signals.reduce((sum, signal) => sum + signal.findings.length, 0);
   if (rawCount > 0 && mappedCount === 0) {
     process.stderr.write(
@@ -6846,30 +8153,83 @@ function parseIngestFile(filePath, options = {}) {
     findings: signal.findings.map(clampFinding)
   }));
 }
-function expandIngestPattern(pattern) {
+function expandIngestPattern(pattern, maxMatches = Number.POSITIVE_INFINITY) {
   if (!pattern.includes("*")) return [pattern];
   const lastSlash = pattern.lastIndexOf("/");
   const dir = lastSlash === -1 ? "." : pattern.slice(0, lastSlash);
   const filePattern = lastSlash === -1 ? pattern : pattern.slice(lastSlash + 1);
   const regexSource = filePattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
   const regex = new RegExp(`^${regexSource}$`);
-  let entries;
+  const entries = [];
   try {
-    entries = readdirSync2(dir);
-  } catch {
+    const directoryStat = lstatSync3(resolve3(dir));
+    if (directoryStat.isSymbolicLink()) {
+      throw new Error(`Cejel: refusing symlinked ingest directory: ${dir}`);
+    }
+    if (!directoryStat.isDirectory()) return [];
+    const directory = opendirSync(dir);
+    try {
+      for (; ; ) {
+        const entry = directory.readSync();
+        if (!entry) break;
+        if (!regex.test(entry.name)) continue;
+        entries.push(entry.name);
+        if (entries.length >= maxMatches) break;
+      }
+    } finally {
+      directory.closeSync();
+    }
+  } catch (error) {
+    if (!isMissingIngestPath(error)) throw error;
     return [];
   }
-  return entries.filter((name) => regex.test(name)).sort().map((name) => join2(dir, name));
+  return entries.sort().map((name) => {
+    const candidate = join2(dir, name);
+    resolveIngestFilePath(candidate, dir);
+    return candidate;
+  });
 }
-function discoverIngestInputs(repoPath) {
+function discoverIngestInputs(repoPath, maxMatches = Number.POSITIVE_INFINITY) {
+  const resolvedRoot = realpathSync3(repoPath);
+  const cejelDir = join2(repoPath, ".cejel");
   const inputsDir = join2(repoPath, ".cejel", "inputs");
-  let entries;
+  const entries = [];
   try {
-    entries = readdirSync2(inputsDir);
-  } catch {
+    const cejelStat = lstatSync3(cejelDir);
+    if (cejelStat.isSymbolicLink()) {
+      throw new Error(`Cejel: refusing symlinked ingest path component: ${cejelDir}`);
+    }
+    if (!cejelStat.isDirectory()) {
+      throw new Error(`Cejel: refusing non-directory ingest path component: ${cejelDir}`);
+    }
+    const inputsStat = lstatSync3(inputsDir);
+    if (inputsStat.isSymbolicLink()) {
+      throw new Error(`Cejel: refusing symlinked ingest path component: ${inputsDir}`);
+    }
+    if (!inputsStat.isDirectory()) {
+      throw new Error(`Cejel: refusing non-directory ingest path component: ${inputsDir}`);
+    }
+    const resolvedInputs = realpathSync3(inputsDir);
+    if (!isResolvedIngestPathContained(resolvedInputs, resolvedRoot)) {
+      throw new Error(`Cejel: refusing auto-discovery directory outside the repository root.`);
+    }
+    const directory = opendirSync(inputsDir);
+    try {
+      for (; ; ) {
+        const entry = directory.readSync();
+        if (!entry) break;
+        if (!/\.(sarif|json)$/i.test(entry.name)) continue;
+        entries.push(entry.name);
+        if (entries.length >= maxMatches) break;
+      }
+    } finally {
+      directory.closeSync();
+    }
+  } catch (error) {
+    if (!isMissingIngestPath(error)) throw error;
     return [];
   }
-  return entries.filter((name) => /\.(sarif|json)$/i.test(name)).sort().map((name) => join2(inputsDir, name));
+  return entries.sort().map((name) => resolveIngestFilePath(join2(inputsDir, name), inputsDir));
 }
 
 // src/witan/scoring.ts
@@ -6937,7 +8297,7 @@ var WITAN_RUBRIC = [
 
 // src/witan/scoring.ts
 function usesV17DetectorClosure2(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
 }
 var MAX_SIGNAL_ADJUSTMENT = 0.8;
 function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
@@ -7096,7 +8456,7 @@ function statusForScore(score) {
 }
 function statusAfterInputAdjustment(nativeStatus, nativeScore, adjustment, rubricVersion) {
   if (adjustment === 0) return nativeStatus;
-  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22) {
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22 && rubricVersion !== WITAN_RUBRIC_VERSION_V23) {
     return statusForScore(roundScore(Math.max(0, nativeScore - adjustment)));
   }
   const statusFloor = {
@@ -7141,7 +8501,7 @@ function mergeSignalsByCriterion(signals) {
   return merged;
 }
 function usesMetricScoring(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_RUBRIC_VERSION_V7 || rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_RUBRIC_VERSION_V7 || rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
 }
 function unmeasuredStatus(rubricVersion) {
   return rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0 ? "unverified" : "insufficient_data";
@@ -7281,7 +8641,11 @@ function scoreMetrics(metrics) {
 function capScoreForFindings(score, findings, rubricVersion, criterionId) {
   if (findings.some((finding) => finding.severity === "critical")) {
     const criticalFindings = findings.filter(({ severity }) => severity === "critical");
-    const authenticatedA1Absence = usesV17DetectorClosure2(rubricVersion) && criterionId === "A1" && criticalFindings.length === 1 && criticalFindings[0]?.summary === WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY;
+    const authenticatedA1Absence = usesV17DetectorClosure2(rubricVersion) && criterionId === "A1" && criticalFindings.length === 1 && [
+      WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY,
+      WITAN_DIRECTORY_WALK_AUTHENTICATED_A1_ABSENCE_SUMMARY,
+      WITAN_LEGACY_AUTHENTICATED_A1_ABSENCE_SUMMARY
+    ].includes(criticalFindings[0]?.summary ?? "");
     return authenticatedA1Absence ? Math.min(score, 1.4) : 1.4;
   }
   if (findings.some((finding) => finding.severity === "warning")) return Math.min(score, 2.4);
@@ -7517,7 +8881,7 @@ function calibratedCriterionStateV11(criterionId, metrics) {
   return void 0;
 }
 function ensureFindingsExplainStatus(criterionId, score, status, findings, evidence, rubricVersion) {
-  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22 && findings.length > 0) {
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22 && rubricVersion !== WITAN_RUBRIC_VERSION_V23 && findings.length > 0) {
     return [...findings];
   }
   if (status !== "critical" && status !== "warning") return [...findings];
@@ -7553,6 +8917,8 @@ function roundScore(score) {
 }
 
 // src/witan/public-scan.ts
+var MAX_INGEST_DOCUMENTS = 128;
+var MAX_RETAINED_INGEST_FINDINGS = 1e4;
 function scoreRepoWithPublicCejel(options) {
   if (options.rubricVersion !== void 0) {
     assertSelectableRubricVersion(options.rubricVersion);
@@ -7580,36 +8946,58 @@ function scoreRepoWithPublicCejel(options) {
 }
 function resolvePublicIngestSignals(options) {
   const seen = /* @__PURE__ */ new Set();
-  const explicitFiles = [];
+  const documents = [];
+  const addDocument = (file, provenance) => {
+    const resolved = resolveIngestFilePath(file);
+    if (seen.has(resolved)) return;
+    seen.add(resolved);
+    documents.push({ file: resolved, provenance });
+    if (documents.length > MAX_INGEST_DOCUMENTS) {
+      throw new Error(
+        `Cejel: ${documents.length} unique ingest documents exceed the ${MAX_INGEST_DOCUMENTS} ingest document budget; refusing to produce a partial certificate.`
+      );
+    }
+  };
   for (const pattern of options.ingestPatterns ?? []) {
-    const matches = expandIngestPattern(pattern);
+    const matches = expandIngestPattern(pattern, MAX_INGEST_DOCUMENTS + 1);
     if (matches.length === 0 && options.warnOnEmptyIngestMatch) {
       process.stderr.write(`Cejel: --ingest pattern matched no files: ${pattern}
 `);
     }
     for (const match of matches) {
-      const resolved = resolve2(match);
-      if (seen.has(resolved)) continue;
-      seen.add(resolved);
-      explicitFiles.push(match);
+      addDocument(match, "operator_supplied");
     }
   }
-  const signals = explicitFiles.flatMap(
-    (file) => parseIngestFile(file, { provenance: "operator_supplied" })
-  );
-  if (!options.autoDiscoverIngest) return signals;
-  for (const discovered of discoverIngestInputs(options.repoPath)) {
-    const resolved = resolve2(discovered);
-    if (seen.has(resolved)) continue;
-    seen.add(resolved);
-    signals.push(...parseIngestFile(discovered, { provenance: "auto_discovered" }));
+  if (options.autoDiscoverIngest) {
+    for (const discovered of discoverIngestInputs(
+      options.repoPath,
+      MAX_INGEST_DOCUMENTS + 1
+    )) {
+      addDocument(discovered, "auto_discovered");
+    }
+  }
+  const signals = [];
+  let retainedFindings = 0;
+  for (const document of documents) {
+    const parsed = parseIngestFile(document.file, {
+      maxFindingCandidates: MAX_RETAINED_INGEST_FINDINGS - retainedFindings,
+      provenance: document.provenance
+    });
+    const documentFindings = parsed.reduce((count, signal) => count + signal.findings.length, 0);
+    retainedFindings += documentFindings;
+    if (retainedFindings > MAX_RETAINED_INGEST_FINDINGS) {
+      throw new Error(
+        `Cejel: ${retainedFindings.toLocaleString("en-US")} retained findings exceed the ${MAX_RETAINED_INGEST_FINDINGS.toLocaleString("en-US")} retained ingest finding budget; refusing to truncate evidence.`
+      );
+    }
+    signals.push(...parsed);
   }
   return signals;
 }
 
 // src/product-identity.ts
 init_esm_shims();
-import { existsSync, readFileSync as readFileSync5 } from "fs";
+import { existsSync, lstatSync as lstatSync4, readFileSync as readFileSync5 } from "fs";
 import { basename as basename2, join as join3 } from "path";
 var SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/;
 var FALLBACK_SLUG = "repo";
@@ -7617,7 +9005,10 @@ var FALLBACK_DISPLAY_NAME = "Repository";
 function deriveProductIdentity(repoPath, productName) {
   const packageJsonPath = join3(repoPath, "package.json");
   const raw = productName ?? readPackageName(packageJsonPath) ?? basename2(repoPath);
-  const displayName = raw.trim().length > 0 ? raw.trim() : FALLBACK_DISPLAY_NAME;
+  const displayName = sanitizePresentationLine(raw, {
+    fallback: FALLBACK_DISPLAY_NAME,
+    maxLength: 120
+  });
   return {
     productSlug: slugify(raw),
     productDisplayName: displayName
@@ -7626,6 +9017,8 @@ function deriveProductIdentity(repoPath, productName) {
 function readPackageName(packageJsonPath) {
   if (!existsSync(packageJsonPath)) return void 0;
   try {
+    const stat = lstatSync4(packageJsonPath);
+    if (!stat.isFile() || stat.size > MAX_REPOSITORY_CONTENT_BYTES) return void 0;
     const parsed = JSON.parse(readFileSync5(packageJsonPath, "utf8"));
     if (typeof parsed === "object" && parsed !== null && "name" in parsed) {
       const name = parsed.name;
@@ -7808,6 +9201,7 @@ export {
   CALLER_CONTEXT_PRODUCT_IDENTITY_NOTICE,
   CERTIFICATE_GLOSSARY,
   formatCertificateMetricLabel,
+  formatCertificateMetricAppliedWeightPercent,
   formatCertificateMetricValue,
   buildRelyingPartySummary,
   WITAN_RUBRIC_VERSION_V22,