@cejel/cejel 0.4.6 → 0.4.7

package/dist/{chunk-VEJLHO5F.js → chunk-QTLLASOO.js}

@@ -5,12 +5,13 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-BZXBLDCJ.js";
+} from "./chunk-OIGCYULH.js";
 import {
   external_exports
-} from "./chunk-Y6NO5HAI.js";
+} from "./chunk-UYJBSQCV.js";
 import {
   MAX_REPOSITORY_CONTENT_BYTES,
+  contentReadSignalKey,
   init_esm_shims,
   readRepoText,
   readRepoTextPrefix,
@@ -18,8 +19,10 @@ import {
   recordContentSkipForCriteria,
   recordFilesystemSkip,
   trackContentReads,
-  withContentReadCriterion
-} from "./chunk-H55KECVT.js";
+  withContentReadCriterion,
+  withContentReadSignal,
+  withContentReadSignals
+} from "./chunk-ZNVILRHK.js";
 
 // src/witan/schemas.ts
 init_esm_shims();
@@ -374,6 +377,11 @@ var WitanAttestationStatementSchema = external_exports.object({
     // explicit report contract version.
     reportFormatVersion: external_exports.string().regex(/^1\.\d+$/).optional(),
     rubricVersion: external_exports.string().min(1).max(120),
+    // Only present when the scan ran under the GitHub Action (GITHUB_RUN_ATTEMPT observed in
+    // the runner environment). Absent, never fabricated or defaulted to "1", for a local CLI
+    // or any other CI. Not part of report.json: it is per-invocation, not per-repository-
+    // state, and report.json's reproducibility guarantee excludes exactly that kind of field.
+    githubRunAttempt: external_exports.string().regex(/^[1-9][0-9]*$/).optional(),
     repository: external_exports.object({
       productSlug: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/),
       url: external_exports.string().url().optional(),
@@ -415,13 +423,15 @@ var WITAN_RUBRIC_VERSION_V19 = "witan-rubric-v19-prospective-2026-08-09";
 var WITAN_RUBRIC_VERSION_V20 = "witan-rubric-v20-prospective-2026-08-10";
 var WITAN_RUBRIC_VERSION_V21 = "witan-rubric-v21-prospective-2026-08-10";
 var WITAN_RUBRIC_VERSION_V22 = "witan-rubric-v22-prospective-2026-08-10";
+var WITAN_RUBRIC_VERSION_V23 = "witan-rubric-v23-prospective-2026-09-06";
 var WITAN_LAST_CALIBRATED_RUBRIC_VERSION = WITAN_RUBRIC_VERSION_V17;
 var WITAN_PROSPECTIVE_RUBRIC_VERSIONS = Object.freeze([
   WITAN_RUBRIC_VERSION_V18,
   WITAN_RUBRIC_VERSION_V19,
   WITAN_RUBRIC_VERSION_V20,
   WITAN_RUBRIC_VERSION_V21,
-  WITAN_RUBRIC_VERSION_V22
+  WITAN_RUBRIC_VERSION_V22,
+  WITAN_RUBRIC_VERSION_V23
 ]);
 var WITAN_SELECTABLE_RUBRIC_VERSIONS = Object.freeze([
   WITAN_LAST_CALIBRATED_RUBRIC_VERSION,
@@ -810,6 +820,32 @@ function glossaryEntryForMetric(metric2) {
 function formatCertificateMetricLabel(metric2) {
   return CERTIFICATE_METRIC_REGISTRY[metric2.name]?.displayLabel ?? metric2.label;
 }
+function formatCertificateMetricAppliedWeightPercent(criterion, metric2) {
+  const metrics = criterion.metrics;
+  const index = metrics.indexOf(metric2);
+  if (index === -1) {
+    throw new Error(
+      "formatCertificateMetricAppliedWeightPercent: metric does not belong to criterion.metrics"
+    );
+  }
+  const totalWeight = metrics.reduce((sum, m) => sum + m.weight, 0);
+  if (totalWeight <= 0) return 0;
+  const shares = metrics.map((m, i) => {
+    const raw = m.weight / totalWeight * 100;
+    const floor = Math.floor(raw);
+    return { i, floor, fraction: raw - floor };
+  });
+  const flooredTotal = shares.reduce((sum, s) => sum + s.floor, 0);
+  const byLargestRemainder = [...shares].sort((a, b) => b.fraction - a.fraction);
+  const result = new Map(shares.map((s) => [s.i, s.floor]));
+  let remainder = Math.round(100 - flooredTotal);
+  for (const s of byLargestRemainder) {
+    if (remainder <= 0) break;
+    result.set(s.i, (result.get(s.i) ?? s.floor) + 1);
+    remainder -= 1;
+  }
+  return result.get(index) ?? 0;
+}
 function glossaryEntriesForReport(report) {
   const entries = new Map(CERTIFICATE_GLOSSARY.map((entry) => [entry.key, entry]));
   for (const metric2 of report.criteria.flatMap((criterion) => criterion.metrics)) {
@@ -925,6 +961,74 @@ function formatCertificateMetricValue(criterion, metric2) {
     `${formatMetricNumber(metric2.value)}/${formatMetricNumber(metric2.max)}${unit}`
   );
 }
+var NEXT_STEP_FINDING_SEVERITIES = /* @__PURE__ */ new Set(["critical", "warning"]);
+var NEXT_STEP_FINDING_SEVERITY_RANK = {
+  critical: 0,
+  warning: 1,
+  info: 2
+};
+var MAX_NEXT_STEP_FINDINGS = 3;
+function buildNextSteps(report, unmeasured, notApplicable, a1, coverageMetric) {
+  const steps = [];
+  if (unmeasured.length > 0) {
+    const ids = unmeasured.map((criterion) => criterion.id).join(", ");
+    steps.push(
+      `Obtain measurable evidence for ${ids} \u2014 ${unmeasured.length === 1 ? "this scored dimension has" : "these scored dimensions have"} no recorded result, and could change the verdict.`
+    );
+  }
+  const criterionFindings = report.criteria.flatMap(
+    (criterion) => criterion.findings.filter((finding) => NEXT_STEP_FINDING_SEVERITIES.has(finding.severity)).map((finding) => ({ criterionId: criterion.id, finding }))
+  );
+  const sortedFindings = [...criterionFindings].sort(
+    (a, b) => NEXT_STEP_FINDING_SEVERITY_RANK[a.finding.severity] - NEXT_STEP_FINDING_SEVERITY_RANK[b.finding.severity]
+  );
+  for (const { criterionId, finding } of sortedFindings.slice(0, MAX_NEXT_STEP_FINDINGS)) {
+    steps.push(
+      `Evidence is currently absent for the ${finding.severity} finding on ${criterionId}: obtain independent verification before relying on this criterion.`
+    );
+  }
+  if (sortedFindings.length > MAX_NEXT_STEP_FINDINGS) {
+    steps.push(
+      `${sortedFindings.length - MAX_NEXT_STEP_FINDINGS} more critical/warning finding(s) need the same independent verification; see the findings listed above for the complete set.`
+    );
+  }
+  if (a1 && coverageMetric && isCoverageNotMeasured(a1, coverageMetric)) {
+    steps.push(
+      "Obtain a coverage report or configured threshold for A1's static coverage metric; none was found, so it was not measured."
+    );
+  }
+  if (!report.repo.headSha && report.criteria.some(
+    (criterion) => criterion.metrics.some((metric2) => metric2.name === "pr_merge_ratio")
+  )) {
+    steps.push(
+      "Restore Git history access so the recent-commit PR-reference proxy has commit subjects to inspect; its scoring zero here is a conservative default, not a detected outcome."
+    );
+  }
+  if (notApplicable.length > 0) {
+    const ids = notApplicable.map((criterion) => criterion.id).join(", ");
+    steps.push(
+      `Confirm ${ids} ${notApplicable.length === 1 ? "is" : "are"} correctly marked not applicable to this repository; ${notApplicable.length === 1 ? "it was" : "they were"} not examined.`
+    );
+  }
+  const scanLimitationCount = report.scanLimitations?.length ?? 0;
+  if (scanLimitationCount > 0) {
+    steps.push(
+      `Resolve the ${scanLimitationCount} scan limitation${scanLimitationCount === 1 ? "" : "s"} qualifying the readable evidence, then reproduce the scan.`
+    );
+  }
+  const skippedCount = report.contentReadSummary?.skipped ?? 0;
+  if (skippedCount > 0) {
+    steps.push(
+      `Make the ${skippedCount} skipped content entr${skippedCount === 1 ? "y" : "ies"} readable (see the itemized reasons in the certificate), then reproduce the scan.`
+    );
+  }
+  if (steps.length === 0) {
+    steps.push(
+      "No unresolved evidence gaps were identified across the categories Cejel tracks; reproduce the scan at the reported revision when one is available before relying on this certificate."
+    );
+  }
+  return steps;
+}
 function buildRelyingPartySummary(report) {
   const applicable = report.criteria.filter((criterion) => criterion.status !== "not_applicable");
   const measured = applicable.filter((criterion) => criterion.status !== "insufficient_data");
@@ -972,7 +1076,7 @@ function buildRelyingPartySummary(report) {
     examined: `Cejel examined the repository evidence recorded for ${report.productDisplayName}${revision} under ${report.rubricVersion}.`,
     established: `The report established measured results for ${measured.length} of ${applicable.length} applicable rubric dimensions and recorded ${findings} evidence-backed finding${findings === 1 ? "" : "s"}.`,
     notEstablished: gaps.join(" "),
-    next: "Review the cited evidence and open or unverified items, reproduce the scan at the reported revision when one is available, and obtain missing measurements or resolve limitations before deciding whether to accept the code."
+    next: buildNextSteps(report, unmeasured, notApplicable, a1, coverageMetric).join(" ")
   };
 }
 function formatMetricNumber(value) {
@@ -1091,6 +1195,7 @@ function renderWitanHtmlReport(report, options = {}) {
             ${options.generatedAt ? `<div><dt>Date</dt><dd>${escapeHtml(formatDate(options.generatedAt))}</dd></div>` : ""}
             <div><dt>Run</dt><dd>${escapeHtml(renderRepo(report))}</dd></div>
             <div><dt>CLI</dt><dd>${escapeHtml(options.cliVersion ? `Cejel ${options.cliVersion}` : "Not recorded")}</dd></div>
+            ${options.runAttempt ? `<div><dt>Run attempt</dt><dd>${escapeHtml(options.runAttempt)}</dd></div>` : ""}
             <div><dt>Rubric</dt><dd>${escapeHtml(report.rubricVersion)}</dd></div>
             ${// Gated on the rubric actually being prospective — a calibrated (v17) certificate's
   // HTML stays byte-identical to before --rubric-pin existed.
@@ -1113,6 +1218,8 @@ function renderWitanHtmlReport(report, options = {}) {
       </div>
     </header>
 
+    ${renderFindingsFirstSummary(report)}
+
     ${renderRelyingPartySummary(relyingPartySummary)}
 
     ${(report.scanLimitations?.length ?? 0) > 0 ? `<section class="scan-limitations-section evidence-section" aria-label="Scan limitations">
@@ -1154,6 +1261,26 @@ function renderWitanHtmlReport(report, options = {}) {
 </html>
 `;
 }
+var FINDINGS_FIRST_SEVERITY_ORDER = {
+  critical: 0,
+  warning: 1,
+  info: 2
+};
+function collectFindingsFirstEntries(report) {
+  return report.criteria.flatMap(
+    (criterion) => criterion.findings.filter((finding) => finding.severity === "critical" || finding.severity === "warning").map((finding) => ({ criterion, finding }))
+  ).sort(
+    (a, b) => FINDINGS_FIRST_SEVERITY_ORDER[a.finding.severity] - FINDINGS_FIRST_SEVERITY_ORDER[b.finding.severity]
+  );
+}
+function renderFindingsFirstSummary(report) {
+  const entries = collectFindingsFirstEntries(report);
+  const body = entries.length > 0 ? `<ul>${entries.map(({ criterion, finding }) => `<li>${renderFindingEvidence(criterion, finding)}</li>`).join("")}</ul>` : '<p class="findings-first-empty">No critical or warning findings were identified across any criterion in this scan.</p>';
+  return `<section class="findings-first-summary" aria-labelledby="findings-first-heading">
+      <h2 id="findings-first-heading">Critical and warning findings</h2>
+      ${body}
+    </section>`;
+}
 function renderRelyingPartySummary(summary) {
   return `<section class="relying-party-summary" aria-labelledby="relying-party-heading">
       <h2 id="relying-party-heading">How to read this certificate</h2>
@@ -1167,10 +1294,12 @@ function renderRelyingPartySummary(summary) {
 }
 function renderGlossary(entries) {
   return `<section class="glossary" aria-labelledby="glossary-heading">
-      <h2 id="glossary-heading">Plain-language glossary</h2>
-      <dl>${entries.map(
+      <details>
+        <summary><h2 id="glossary-heading">Plain-language glossary</h2></summary>
+        <dl>${entries.map(
     (entry) => `<div><dt id="glossary-${escapeAttribute(entry.key)}">${escapeHtml(entry.term)}</dt><dd>${escapeHtml(entry.definition)}</dd></div>`
   ).join("")}</dl>
+      </details>
     </section>`;
 }
 function renderContentReadSummary(report) {
@@ -1245,12 +1374,12 @@ function renderCriterionColumn(title, criteria, gitHistoryUnavailable) {
       </section>`;
 }
 function renderNotApplicableGroup(criteria) {
-  return `<div class="na-group">
-          <h3 class="na-heading">Not applicable to this repository</h3>
+  return `<details class="na-group">
+          <summary><h3 class="na-heading">Not applicable to this repository</h3></summary>
           <ul class="na-list">
             ${criteria.map(renderNotApplicableItem).join("")}
           </ul>
-        </div>`;
+        </details>`;
 }
 function renderNotApplicableItem(criterion) {
   const reason = criterion.notes ?? "Not applicable to this repository.";
@@ -1310,15 +1439,21 @@ function scoreBandForPresentation(score) {
   if (score >= 1.5) return "warning";
   return "critical";
 }
+function renderMetricWeightBadge(criterion, metric2) {
+  const appliedSharePercent = formatCertificateMetricAppliedWeightPercent(criterion, metric2);
+  return `<span class="metric-weight">weight ${appliedSharePercent}% of ${escapeHtml(criterion.id)}</span>`;
+}
 function renderMetric(criterion, metric2) {
   const entry = glossaryEntryForMetric(metric2);
   const tooltipId = `tooltip-${criterion.id}-${entry.key}`;
   const formatted = formatCertificateMetricValue(criterion, metric2);
+  const weightBadge = renderMetricWeightBadge(criterion, metric2);
   const cappedEntry = formatted.includes("capped") ? CERTIFICATE_GLOSSARY.find((candidate) => candidate.key === "capped") : void 0;
   const label = `<span class="term-help" tabindex="0" aria-describedby="${escapeAttribute(tooltipId)}"><strong>${escapeHtml(formatCertificateMetricLabel(metric2))}</strong><span class="term-tooltip" id="${escapeAttribute(tooltipId)}" role="tooltip">${escapeHtml(entry.definition)}</span></span>`;
-  if (!cappedEntry) return `${label}<span class="metric-value">${escapeHtml(formatted)}</span>`;
+  if (!cappedEntry)
+    return `${label}<span class="metric-value">${escapeHtml(formatted)} ${weightBadge}</span>`;
   const cappedTooltipId = `${tooltipId}-capped`;
-  return `${label}<span class="term-help metric-value" tabindex="0" aria-describedby="${escapeAttribute(cappedTooltipId)}">${escapeHtml(formatted)}<span class="term-tooltip" id="${escapeAttribute(cappedTooltipId)}" role="tooltip">${escapeHtml(cappedEntry.definition)}</span></span>`;
+  return `${label}<span class="term-help metric-value" tabindex="0" aria-describedby="${escapeAttribute(cappedTooltipId)}">${escapeHtml(formatted)} ${weightBadge}<span class="term-tooltip" id="${escapeAttribute(cappedTooltipId)}" role="tooltip">${escapeHtml(cappedEntry.definition)}</span></span>`;
 }
 function renderCategoryScore(score, coverage, category) {
   const categoryCoverage = coverage.byCategory.find((entry) => entry.category === category);
@@ -1466,6 +1601,9 @@ dd { margin: 0; color: var(--muted); overflow-wrap: anywhere; }
 .subscores { display: flex; gap: 12px; flex-wrap: wrap; margin-top: 18px; color: var(--muted); font-family: var(--mono); font-size: 12px; }
 .coverage-note { margin-top: 8px; color: var(--faint); font-family: var(--mono); font-size: 11px; }
 .source-counts { margin: 8px 0 0; padding-left: 18px; font-family: var(--mono); font-size: 12px; color: var(--muted); }
+.findings-first-summary { margin-top: 20px; border: 1px solid var(--line-strong); border-radius: 8px; background: var(--surface); padding: 22px; }
+.findings-first-summary ul { margin: 0; padding-left: 18px; display: grid; gap: 10px; }
+.findings-first-empty { margin: 0; color: var(--muted); }
 .relying-party-summary, .glossary { margin-top: 28px; border: 1px solid var(--line-strong); border-radius: 8px; background: var(--surface); padding: 22px; }
 .relying-party-summary dl { display: grid; gap: 14px; margin: 0; }
 .relying-party-summary dl div { display: grid; grid-template-columns: 190px minmax(0, 1fr); gap: 18px; }
@@ -1473,6 +1611,14 @@ dd { margin: 0; color: var(--muted); overflow-wrap: anywhere; }
 .glossary dl { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 12px 22px; margin: 0; }
 .glossary dl div { border-top: 1px solid var(--line); padding-top: 10px; }
 .glossary dd { margin-top: 4px; font-size: 13px; }
+/* Track A3: native <details>/<summary> disclosure \u2014 the summary is the clickable control, a
+   heading nests inside it as its accessible label (still exposed as a heading), and the heading's
+   own vertical margin is neutralized by making it inline, so the marker sits flush against it. */
+summary { cursor: pointer; }
+summary h2, summary h3 { display: inline; }
+summary::marker { color: var(--periwinkle); }
+summary:focus-visible { outline: none; box-shadow: 0 0 0 2px var(--periwinkle); border-radius: 3px; }
+.glossary details[open] dl, .na-group[open] .na-list { margin-top: 16px; }
 .trust-grid, .evidence-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 18px; margin-top: 28px; }
 .scan-limitations-section { margin-top: 28px; border-color: rgba(231, 191, 114, .44); }
 .scan-limitations-section .scan-warning { list-style: none; margin-left: -18px; }
@@ -1504,6 +1650,7 @@ h3 { font-size: 15px; line-height: 1.35; font-weight: 600; margin-bottom: 0; }
 .criterion-metrics li { display: flex; justify-content: space-between; gap: 12px; border-bottom: 1px solid rgba(238, 244, 247, .08); padding-bottom: 6px; }
 .criterion-metrics strong { color: var(--text); font-weight: 650; }
 .criterion-metrics span { color: var(--muted); }
+.criterion-metrics .metric-weight { font-size: 10px; color: var(--faint); }
 .criterion-metrics > li > .metric-value {
   min-width: 0; white-space: normal; overflow-wrap: anywhere; text-align: right;
 }
@@ -1667,6 +1814,7 @@ function createWitanAttestation(report, options) {
       tool: { name: "cejel", version: options.toolVersion },
       generatedAt: options.generatedAt,
       reportFormatVersion: WITAN_REPORT_FORMAT_VERSION,
+      ...options.githubRunAttempt ? { githubRunAttempt: options.githubRunAttempt } : {},
       rubricVersion: report.rubricVersion,
       repository: {
         productSlug: report.productSlug,
@@ -1788,7 +1936,7 @@ function stripBom(text) {
 
 // src/witan/repo-signals.ts
 function usesV17DetectorClosure(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
 }
 var LEGACY_INVENTORY_ABSENCE_CONTEXT = {
   rubricGeneration: "legacy",
@@ -1803,10 +1951,14 @@ var INVENTORY_SCAN_PATTERN_SETS = {
     id: "cejel.core-a1.concrete-test-files.v1",
     count: 16
   },
-  a1CoverageConfiguration: {
+  a1CoverageConfigurationV1: {
     id: "cejel.core-a1.coverage-configuration.v1",
     count: 10
   },
+  a1CoverageConfigurationV2: {
+    id: "cejel.core-a1.coverage-configuration.v2",
+    count: 14
+  },
   a2CurrentSecret: {
     id: "cejel.core-a2.current-secret-shape.v1",
     count: 3
@@ -1855,25 +2007,77 @@ function inventoryAbsenceFinding(options) {
     } : {}
   };
 }
+function wholesaleCriterionAbstention(signal) {
+  return {
+    criterionId: signal.criterionId,
+    positiveEvidence: [],
+    findings: [],
+    metrics: [],
+    insufficientData: true,
+    notes: "Cejel abstained on this criterion because one or more relevant repository files could not be read. Resolve the content-read limitations and re-scan."
+  };
+}
 function buildWitanInputFromRepo(options) {
   const tracked = trackContentReads(options.repoPath, () => buildWitanInputFromRepoUntracked(options));
   const affectedCriteria = tracked.affectedCriteria;
+  const rubricVersion = options.rubricVersion ?? WITAN_RUBRIC_VERSION;
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V23) {
+    const signals2 = (tracked.value.signals ?? []).map(
+      (signal) => affectedCriteria.has(signal.criterionId) ? wholesaleCriterionAbstention(signal) : signal
+    );
+    const affectedCount = affectedCriteria.size;
+    const scanLimitations2 = [...tracked.value.scanLimitations ?? []];
+    if (affectedCount > 0 && scanLimitations2.length < 16) {
+      scanLimitations2.push(
+        `${affectedCount} ${affectedCount === 1 ? "criterion" : "criteria"} abstained because relevant repository content could not be read. Counts and errno classes are recorded in contentReadSummary; file paths are intentionally omitted.`
+      );
+    }
+    return {
+      ...tracked.value,
+      signals: signals2,
+      ...scanLimitations2.length > 0 ? { scanLimitations: scanLimitations2 } : {},
+      contentReadSummary: tracked.summary
+    };
+  }
+  const wholesaleAbstainedCriteria = [];
+  const partiallyAbstainedSignals = [];
   const signals = (tracked.value.signals ?? []).map((signal) => {
     if (!affectedCriteria.has(signal.criterionId)) return signal;
+    if (tracked.unattributedCriteria.has(signal.criterionId)) {
+      wholesaleAbstainedCriteria.push(signal.criterionId);
+      return wholesaleCriterionAbstention(signal);
+    }
+    const prefix = contentReadSignalKey(signal.criterionId, "");
+    const affectedNames = [...tracked.affectedSignals].filter((key) => key.startsWith(prefix)).map((key) => key.slice(prefix.length));
+    if (affectedNames.length === 0) {
+      wholesaleAbstainedCriteria.push(signal.criterionId);
+      return wholesaleCriterionAbstention(signal);
+    }
+    const affectedNameSet = new Set(affectedNames);
+    const metrics = (signal.metrics ?? []).filter((metric2) => !affectedNameSet.has(metric2.name));
+    const anythingSurvives = metrics.length > 0 || (signal.positiveEvidence?.length ?? 0) > 0 || (signal.findings?.length ?? 0) > 0;
+    if (!anythingSurvives) {
+      wholesaleAbstainedCriteria.push(signal.criterionId);
+      return wholesaleCriterionAbstention(signal);
+    }
+    for (const name of affectedNames) {
+      partiallyAbstainedSignals.push(`${signal.criterionId}.${name}`);
+    }
     return {
-      criterionId: signal.criterionId,
-      positiveEvidence: [],
-      findings: [],
-      metrics: [],
-      insufficientData: true,
-      notes: "Cejel abstained on this criterion because one or more relevant repository files could not be read. Resolve the content-read limitations and re-scan."
+      ...signal,
+      metrics,
+      notes: `Cejel abstained on ${[...affectedNames].sort().join(", ")} in this criterion because that content could not be read; other signals in this criterion were computed from readable files and are unaffected.`
     };
   });
-  const affectedCount = affectedCriteria.size;
   const scanLimitations = [...tracked.value.scanLimitations ?? []];
-  if (affectedCount > 0 && scanLimitations.length < 16) {
+  if (wholesaleAbstainedCriteria.length > 0 && scanLimitations.length < 16) {
     scanLimitations.push(
-      `${affectedCount} ${affectedCount === 1 ? "criterion" : "criteria"} abstained because relevant repository content could not be read. Counts and errno classes are recorded in contentReadSummary; file paths are intentionally omitted.`
+      `${wholesaleAbstainedCriteria.length} ${wholesaleAbstainedCriteria.length === 1 ? "criterion" : "criteria"} abstained because relevant repository content could not be read and the affected signal could not be isolated. Counts and errno classes are recorded in contentReadSummary; file paths are intentionally omitted.`
+    );
+  }
+  if (partiallyAbstainedSignals.length > 0 && scanLimitations.length < 16) {
+    scanLimitations.push(
+      `${partiallyAbstainedSignals.length} ${partiallyAbstainedSignals.length === 1 ? "signal" : "signals"} abstained because its own repository content could not be read, while other signals in the same criterion were unaffected: ${[...partiallyAbstainedSignals].sort().join(", ")}.`
     );
   }
   return {
@@ -1897,11 +2101,12 @@ function buildWitanInputFromRepoUntracked(options) {
     rubricGeneration: usesV17Detectors ? "current" : "legacy",
     inventoryProvenance: fileInventory.repoFileInventoryScope === "tracked-scan-eligible" ? "tracked-scan-eligible" : "directory-walk"
   };
-  const usesV18NativeRls = rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
-  const usesV19CommitYear = rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
-  const usesV20A3ExplicitGaps = rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
-  const usesV21ExecutedEscalations = rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
-  const usesV22PackageStartEntrypoint = rubricVersion === WITAN_RUBRIC_VERSION_V22;
+  const usesV18NativeRls = rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  const usesV19CommitYear = rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  const usesV20A3ExplicitGaps = rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  const usesV21ExecutedEscalations = rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  const usesV22PackageStartEntrypoint = rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  const usesV23CommandCoverage = rubricVersion === WITAN_RUBRIC_VERSION_V23;
   const structuralArchetype = classifyRepoArchetype(inventoryFiles, rubricVersion);
   const readableArchetype = rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion) ? applyReadableSourceRepresentationGate(
     options.repoPath,
@@ -1937,6 +2142,7 @@ function buildWitanInputFromRepoUntracked(options) {
     usesV20A3ExplicitGaps,
     usesV21ExecutedEscalations,
     usesV22PackageStartEntrypoint,
+    usesV23CommandCoverage,
     reviewableSourceProof,
     inventoryAbsenceContext,
     scanLimitations
@@ -2548,7 +2754,7 @@ function buildNotApplicableSignal(criterionId, reason) {
     notApplicable: true
   };
 }
-function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, scanLimitations = /* @__PURE__ */ new Set()) {
+function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, useV23CommandCoverage, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, scanLimitations = /* @__PURE__ */ new Set()) {
   const signals = [];
   const mono = resolveMonorepoContext(repoPath, scanLimitations);
   const collectCriterion = (criterionId, collect) => withContentReadCriterion(criterionId, collect);
@@ -2560,6 +2766,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       useV27Detectors,
       useV33Detectors,
       useV36Detectors,
+      useV23CommandCoverage,
       reviewableSourceProof,
       inventoryAbsenceContext
     )
@@ -2659,7 +2866,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
   }
   return signals;
 }
-function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
+function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV23CommandCoverage, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
   const evidence = [];
   const findings = [];
   const allTestFiles = findConcreteTestFiles(
@@ -2670,17 +2877,33 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
   const testFiles = allTestFiles.slice(0, 8);
   const sourceFiles = repoFiles.filter(isSourceFile);
   const runnerFiles = repoFiles.filter(
-    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isTestRunnerConfig(repoPath, file)
+    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && (isTestRunnerConfig(repoPath, file) || useV23CommandCoverage && isRecipeTestEntry(repoPath, file))
   ).slice(0, 6);
-  const configuredRunnerFiles = useV33Detectors ? findConfiguredTestRunnerFiles(repoPath, repoFiles) : runnerFiles;
-  const allCoverageFiles = findCoverageConfigFiles(repoPath, repoFiles, useV27Detectors);
-  const coverageFiles = allCoverageFiles.slice(0, 4);
+  const baseConfiguredRunnerFiles = useV33Detectors ? findConfiguredTestRunnerFiles(repoPath, repoFiles) : runnerFiles;
+  const configuredRunnerFiles = useV23CommandCoverage ? [
+    .../* @__PURE__ */ new Set([
+      ...baseConfiguredRunnerFiles,
+      ...repoFiles.filter((file) => isRecipeTestEntry(repoPath, file))
+    ])
+  ].sort() : baseConfiguredRunnerFiles;
   const packageJson = findRootPackageJson(repoFiles);
   const packageScripts = packageJson ? readPackageScripts(join(repoPath, packageJson)) : /* @__PURE__ */ new Map();
+  const { coverageAnalysis, coveragePercent } = withContentReadSignal("A1", "coverage_percent", () => {
+    const analysis = useV23CommandCoverage ? analyzeCoverageConfiguration(repoPath, repoFiles, useV27Detectors) : {
+      coverageFiles: findCoverageConfigFiles(repoPath, repoFiles, useV27Detectors),
+      unresolvedFiles: [],
+      hasCoverageCommand: packageScripts.has("coverage")
+    };
+    return {
+      coverageAnalysis: analysis,
+      coveragePercent: readCoveragePercent(repoPath, analysis.coverageFiles.slice(0, 4))
+    };
+  });
+  const allCoverageFiles = coverageAnalysis.coverageFiles;
+  const coverageFiles = allCoverageFiles.slice(0, 4);
   const packageJsonFiles = useV27Detectors ? repoFiles.filter(
     (file) => /(^|\/)package\.json$/.test(file) && isAuthoredProductionPath(file)
   ) : packageJson ? [packageJson] : [];
-  const coveragePercent = readCoveragePercent(repoPath, coverageFiles);
   const ciWorkflows = repoFiles.filter(
     (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isCiWorkflow(file)
   );
@@ -2695,7 +2918,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
   );
   const verificationScriptCount = [
     packageScripts.has("test") || Boolean(ciTestWorkflow),
-    packageScripts.has("coverage"),
+    coverageAnalysis.hasCoverageCommand,
     packageScripts.has("lint") || ciHasLintCommand,
     packageScripts.has("typecheck") || ciHasTypecheckCommand
   ].filter(Boolean).length;
@@ -2715,9 +2938,11 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
   if (packageJson && [...packageScripts.values()].some((script) => TEST_RUNNER_PATTERN.test(script))) {
     evidence.push(evidenceForRelative(repoPath, packageJson, "test_run", "Configured test runner"));
   }
-  for (const file of coverageFiles) {
-    evidence.push(evidenceForRelative(repoPath, file, "coverage", "Coverage configuration"));
-  }
+  withContentReadSignal("A1", "coverage_percent", () => {
+    for (const file of coverageFiles) {
+      evidence.push(evidenceForRelative(repoPath, file, "coverage", "Coverage configuration"));
+    }
+  });
   if (ciTestWorkflow) {
     evidence.push(
       evidenceForRelative(repoPath, ciTestWorkflow, "test_run", "CI workflow runs the test suite")
@@ -2787,7 +3012,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
         })
       );
     }
-  } else if (coverageFiles.length === 0 && (!useV33Detectors || configuredRunnerFiles.length > 0)) {
+  } else if (coverageFiles.length === 0 && coverageAnalysis.unresolvedFiles.length === 0 && (!useV33Detectors || configuredRunnerFiles.length > 0)) {
     if (isLeanTestToolchain) {
       const leanEvidenceFile = packageJson ?? testFiles[0];
       if (leanEvidenceFile) {
@@ -2814,16 +3039,16 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
           evidence: firstEvidence,
           context: inventoryAbsenceContext,
           inventoryCount: repoFiles.length,
-          patternSet: INVENTORY_SCAN_PATTERN_SETS.a1CoverageConfiguration,
+          patternSet: useV23CommandCoverage ? INVENTORY_SCAN_PATTERN_SETS.a1CoverageConfigurationV2 : INVENTORY_SCAN_PATTERN_SETS.a1CoverageConfigurationV1,
           matchCount: 0
         })
       );
     }
   }
-  const nonHollowShare = measureNonHollowTestShare(
-    repoPath,
-    allTestFiles,
-    reviewableSourceProof !== void 0
+  const nonHollowShare = withContentReadSignal(
+    "A1",
+    "non_hollow_test_share",
+    () => measureNonHollowTestShare(repoPath, allTestFiles, reviewableSourceProof !== void 0)
   );
   return {
     criterionId: "A1",
@@ -2864,7 +3089,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
               label: "test command",
               count: packageScripts.has("test") || Boolean(ciTestWorkflow) ? 1 : 0
             },
-            { label: "coverage command", count: packageScripts.has("coverage") ? 1 : 0 },
+            { label: "coverage command", count: coverageAnalysis.hasCoverageCommand ? 1 : 0 },
             {
               label: "lint command",
               count: packageScripts.has("lint") || ciHasLintCommand ? 1 : 0
@@ -2887,7 +3112,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
         "Penalizes skipped or placeholder-only test files; test-directory support scaffolding (helpers/fixtures with no test in them) is excluded from the denominator."
       )
     ],
-    notes: "A1 is detected from real test files, test runner configuration, and optional coverage configuration."
+    notes: coverageFiles.length === 0 && coverageAnalysis.unresolvedFiles.length > 0 ? `A1 is detected from real test files, test runner configuration, and optional coverage configuration. Coverage command reachability or flag ownership was unresolved in ${coverageAnalysis.unresolvedFiles.slice(0, 4).join(", ")}; the no-coverage absence claim was withheld.` : "A1 is detected from real test files, test runner configuration, and optional coverage configuration."
   };
 }
 function buildA1AuthenticatedAbsenceSignal(repoPath, proof, inventoryCount, inventoryAbsenceContext) {
@@ -2979,40 +3204,47 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
   const migrationFiles = repoFiles.filter(
     (file) => /(^|\/)(migrations?|drizzle|prisma)\//.test(file)
   );
-  let committedSecret;
-  for (const path of repoFiles) {
-    const authoredProductionPath = useV47Detectors ? isV47AuthoredProductionPath(path) : useV39Detectors ? isV39AuthoredProductionPath(path) : isAuthoredProductionPath(path);
-    if (isIgnoredScanFile(path, useV47Detectors) || useV33Detectors && !authoredProductionPath) {
-      continue;
-    }
-    const match = findCommittedSecretInFile(
-      repoPath,
-      path,
-      useV36Detectors,
-      useV39Detectors,
-      useV47Detectors
-    );
-    if (!match) continue;
-    committedSecret = { path, match };
-    break;
-  }
-  const currentSecretFingerprintsByPath = /* @__PURE__ */ new Map();
-  if (useV27Detectors) {
-    for (const path of repoFiles.filter((candidate) => isCredentialHistoryPath(candidate))) {
-      currentSecretFingerprintsByPath.set(
-        path,
-        new Set(
-          findSecretFingerprintsInFile(
-            repoPath,
+  const { committedSecret, currentSecretFingerprintsByPath } = withContentReadSignal(
+    "A2",
+    "secret_cleanliness",
+    () => {
+      let match_;
+      for (const path of repoFiles) {
+        const authoredProductionPath = useV47Detectors ? isV47AuthoredProductionPath(path) : useV39Detectors ? isV39AuthoredProductionPath(path) : isAuthoredProductionPath(path);
+        if (isIgnoredScanFile(path, useV47Detectors) || useV33Detectors && !authoredProductionPath) {
+          continue;
+        }
+        const found = findCommittedSecretInFile(
+          repoPath,
+          path,
+          useV36Detectors,
+          useV39Detectors,
+          useV47Detectors
+        );
+        if (!found) continue;
+        match_ = { path, match: found };
+        break;
+      }
+      const fingerprintsByPath = /* @__PURE__ */ new Map();
+      if (useV27Detectors) {
+        for (const path of repoFiles.filter((candidate) => isCredentialHistoryPath(candidate))) {
+          fingerprintsByPath.set(
             path,
-            useV36Detectors,
-            useV39Detectors,
-            useV47Detectors
-          )
-        )
-      );
+            new Set(
+              findSecretFingerprintsInFile(
+                repoPath,
+                path,
+                useV36Detectors,
+                useV39Detectors,
+                useV47Detectors
+              )
+            )
+          );
+        }
+      }
+      return { committedSecret: match_, currentSecretFingerprintsByPath: fingerprintsByPath };
     }
-  }
+  );
   const historySecretScan = committedSecret && !useV27Detectors ? null : collectHistorySecretEvidence(
     repoPath,
     useV27Detectors,
@@ -3024,10 +3256,14 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
     useV47Detectors
   );
   const hasConfirmedSecretFinding = committedSecret != null || historySecretScan?.evidence != null;
-  const cryptoHygiene = collectCryptoHygieneEvidence(
-    repoPath,
-    repoFiles.filter(isImplementationFile).slice(0, 60),
-    useV39Detectors
+  const cryptoHygiene = withContentReadSignal(
+    "A2",
+    "crypto_comparison_hygiene",
+    () => collectCryptoHygieneEvidence(
+      repoPath,
+      repoFiles.filter(isImplementationFile).slice(0, 60),
+      useV39Detectors
+    )
   );
   const implFiles = repoFiles.filter(isImplementationFile);
   const gitignoreHasEnvRule = gitignore != null && fileContains(repoPath, gitignore, /^\.env(\*|\b)|\.env\./m);
@@ -3067,42 +3303,77 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
   } else if (dbLayerImportFile != null) {
     evidence.push(evidenceForRelative(repoPath, dbLayerImportFile, "artifact", "DB client import"));
   }
-  const v47RlsPolicyFiles = useV47Detectors ? findRlsPolicyFiles(repoPath, repoFiles) : [];
-  const nativeRlsInventory = useV18NativeRls ? deriveRlsPolicyScopeInventory(repoPath, repoFiles) : null;
-  const tenantWithoutRlsPremiseFiles = useV18NativeRls ? findTenantStoragePremiseFiles(repoPath, repoFiles) : [];
-  const v47TenantStorageFiles = useV47Detectors && !useV18NativeRls ? findTenantStoragePremiseFiles(repoPath, repoFiles) : [];
-  const rlsMigration = useV47Detectors ? v47RlsPolicyFiles[0] : migrationFiles.find((file) => fileContains(repoPath, file, RLS_PATTERN));
   const tenantScopePattern = useV39Detectors ? TENANT_SCOPE_PATTERN_V11 : useV36Detectors ? TENANT_SCOPE_PATTERN_V10 : TENANT_SCOPE_PATTERN;
-  const tenantScopedFile = useV18NativeRls ? nativeRlsInventory?.storageFiles[0] : useV47Detectors ? v47TenantStorageFiles[0] : migrationFiles.find((file) => fileContains(repoPath, file, tenantScopePattern));
-  const rlsPolicyCount = useV18NativeRls ? nativeRlsInventory?.policyCount ?? 0 : useV47Detectors ? v47RlsPolicyFiles.length : countPatternMatches(
-    repoPath,
-    migrationFiles,
-    /create policy|enable row level security|force row level security/gi
+  const {
+    rlsMigration,
+    tenantScopedFile,
+    rlsPolicyCount,
+    tenantScopedMigrationFileCount,
+    nativeRlsInventory,
+    tenantWithoutRlsPremiseFiles
+  } = withContentReadSignals("A2", ["rls_policy_count", "tenant_scope_ratio"], () => {
+    const v47RlsPolicyFiles = useV47Detectors ? findRlsPolicyFiles(repoPath, repoFiles) : [];
+    const rlsInventory = useV18NativeRls ? deriveRlsPolicyScopeInventory(repoPath, repoFiles) : null;
+    const tenantWithoutRlsFiles = useV18NativeRls ? findTenantStoragePremiseFiles(repoPath, repoFiles) : [];
+    const v47TenantStorageFiles = useV47Detectors && !useV18NativeRls ? findTenantStoragePremiseFiles(repoPath, repoFiles) : [];
+    return {
+      rlsMigration: useV47Detectors ? v47RlsPolicyFiles[0] : migrationFiles.find((file) => fileContains(repoPath, file, RLS_PATTERN)),
+      tenantScopedFile: useV18NativeRls ? rlsInventory?.storageFiles[0] : useV47Detectors ? v47TenantStorageFiles[0] : migrationFiles.find((file) => fileContains(repoPath, file, tenantScopePattern)),
+      rlsPolicyCount: useV18NativeRls ? rlsInventory?.policyCount ?? 0 : useV47Detectors ? v47RlsPolicyFiles.length : countPatternMatches(
+        repoPath,
+        migrationFiles,
+        /create policy|enable row level security|force row level security/gi
+      ),
+      tenantScopedMigrationFileCount: useV18NativeRls ? rlsInventory?.storageFiles.length ?? 0 : useV47Detectors ? v47TenantStorageFiles.length : countFilesContaining(repoPath, migrationFiles, tenantScopePattern),
+      nativeRlsInventory: rlsInventory,
+      tenantWithoutRlsPremiseFiles: tenantWithoutRlsFiles
+    };
+  });
+  const { gitignoreEnvFile, hasEnvReadsInImplementation, envHandlingDepth } = withContentReadSignal(
+    "A2",
+    "env_handling_depth",
+    () => {
+      const envFile = gitignore && fileContains(repoPath, gitignore, /^\.env(\*|\b)|\.env\./m) ? gitignore : null;
+      const hasEnvReads = countFilesContaining(repoPath, repoFiles.filter(isImplementationFile), ENV_READ_PATTERN) > 0;
+      const depth = (envExamples.length > 0 ? 1 : 0) + (envFile ? 1 : 0) + (hasEnvReads ? 1 : 0);
+      return { gitignoreEnvFile: envFile, hasEnvReadsInImplementation: hasEnvReads, envHandlingDepth: depth };
+    }
   );
-  const tenantScopedMigrationFileCount = useV18NativeRls ? nativeRlsInventory?.storageFiles.length ?? 0 : useV47Detectors ? v47TenantStorageFiles.length : countFilesContaining(repoPath, migrationFiles, tenantScopePattern);
-  const gitignoreEnvFile = gitignore && fileContains(repoPath, gitignore, /^\.env(\*|\b)|\.env\./m) ? gitignore : null;
-  const envHandlingDepth = (envExamples.length > 0 ? 1 : 0) + (gitignoreEnvFile ? 1 : 0) + (countFilesContaining(repoPath, repoFiles.filter(isImplementationFile), ENV_READ_PATTERN) > 0 ? 1 : 0);
   const isMultiTenant = useV18NativeRls ? (nativeRlsInventory?.policyCount ?? 0) > 0 && (nativeRlsInventory?.scopeIdentifiers.length ?? 0) > 0 : tenantScopedMigrationFileCount > 0;
   if (gitignoreEnvFile) {
-    evidence.push(
-      evidenceForRelative(repoPath, gitignoreEnvFile, "secret_scan", ".env files are gitignored")
+    withContentReadSignal(
+      "A2",
+      "env_handling_depth",
+      () => evidence.push(
+        evidenceForRelative(repoPath, gitignoreEnvFile, "secret_scan", ".env files are gitignored")
+      )
     );
   }
-  for (const file of envExamples.slice(0, 3)) {
-    evidence.push(evidenceForRelative(repoPath, file, "secret_scan", "Environment template"));
-  }
+  withContentReadSignal("A2", "env_handling_depth", () => {
+    for (const file of envExamples.slice(0, 3)) {
+      evidence.push(evidenceForRelative(repoPath, file, "secret_scan", "Environment template"));
+    }
+  });
   if (rlsMigration) {
-    evidence.push(
-      evidenceForRelative(repoPath, rlsMigration, "artifact", "RLS or tenant migration")
+    withContentReadSignals(
+      "A2",
+      ["rls_policy_count", "tenant_scope_ratio"],
+      () => evidence.push(
+        evidenceForRelative(repoPath, rlsMigration, "artifact", "RLS or tenant migration")
+      )
     );
   }
   if (tenantScopedFile) {
-    evidence.push(
-      evidenceForRelative(
-        repoPath,
-        tenantScopedFile,
-        "artifact",
-        useV18NativeRls ? `Repository-native RLS scope (${nativeRlsInventory?.scopeIdentifiers.join(", ")})` : "Tenant scoping signal"
+    withContentReadSignals(
+      "A2",
+      ["rls_policy_count", "tenant_scope_ratio"],
+      () => evidence.push(
+        evidenceForRelative(
+          repoPath,
+          tenantScopedFile,
+          "artifact",
+          useV18NativeRls ? `Repository-native RLS scope (${nativeRlsInventory?.scopeIdentifiers.join(", ")})` : "Tenant scoping signal"
+        )
       )
     );
   }
@@ -3226,11 +3497,7 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
           { label: ".gitignore environment-file rule", count: gitignoreEnvFile ? 1 : 0 },
           {
             label: "environment reads in implementation code",
-            count: countFilesContaining(
-              repoPath,
-              repoFiles.filter(isImplementationFile),
-              ENV_READ_PATTERN
-            ) > 0 ? 1 : 0
+            count: hasEnvReadsInImplementation ? 1 : 0
           }
         ]
       }
@@ -3409,37 +3676,51 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
   const envTemplate = repoFiles.find(
     (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isEnvTemplatePath(file)
   );
-  const healthChecks = repoFiles.filter(
-    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isHealthCheckSignalFile(repoPath, file)
+  const healthChecks = withContentReadSignal(
+    "A3",
+    "prod_readiness_primitives",
+    () => repoFiles.filter(
+      (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isHealthCheckSignalFile(repoPath, file)
+    )
   );
   const healthCheck = healthChecks[0];
-  const hasV20HealthOrReadinessRoute = useV20ExplicitGaps && repoFiles.some(
-    (file) => isAuthoredProductionPath(file) && isImplementationFile(file) && fileContains(repoPath, file, V20_HEALTH_OR_READINESS_ROUTE_PATTERN)
-  );
-  const hasV22PackageStartHealthOrReadinessRoute = v22PackageStartHttpEntrypoint !== null && fileContains(
-    repoPath,
-    v22PackageStartHttpEntrypoint,
-    V20_HEALTH_OR_READINESS_ROUTE_PATTERN
-  );
+  const { hasV20HealthOrReadinessRoute, hasV22PackageStartHealthOrReadinessRoute } = withContentReadSignal("A3", "health_readiness_route", () => ({
+    hasV20HealthOrReadinessRoute: useV20ExplicitGaps && repoFiles.some(
+      (file) => isAuthoredProductionPath(file) && isImplementationFile(file) && fileContains(repoPath, file, V20_HEALTH_OR_READINESS_ROUTE_PATTERN)
+    ),
+    hasV22PackageStartHealthOrReadinessRoute: v22PackageStartHttpEntrypoint !== null && fileContains(
+      repoPath,
+      v22PackageStartHttpEntrypoint,
+      V20_HEALTH_OR_READINESS_ROUTE_PATTERN
+    )
+  }));
   const serverEntrypoint = v22PackageStartHttpEntrypoint ?? findServerEntrypointFile(repoPath, repoFiles, useV27Detectors) ?? v20DirectHttpEntrypoint ?? null;
   const runtimeContainer = useV27Detectors ? findRuntimeContainerEntrypointFile(repoPath, repoFiles, useV20ExplicitGaps) : null;
   const errorBoundaries = repoFiles.filter(
     (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && /error-boundary|error\.(tsx|jsx|ts|js)$/.test(file)
   );
   const errorBoundary = errorBoundaries[0];
-  const observabilityCount = countFilesContaining(
-    repoPath,
-    repoFiles.filter(
-      (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isImplementationFile(file)
-    ),
-    /sentry|otel|opentelemetry|datadog|prometheus|metrics|logger|logtail/i
+  const observabilityCount = withContentReadSignal(
+    "A3",
+    "observability_depth",
+    () => countFilesContaining(
+      repoPath,
+      repoFiles.filter(
+        (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isImplementationFile(file)
+      ),
+      /sentry|otel|opentelemetry|datadog|prometheus|metrics|logger|logtail/i
+    )
   );
-  const rollbackSafetyCount = countFilesContaining(
-    repoPath,
-    repoFiles.filter(
-      (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && /(^|\/)(docs|migrations?|drizzle|prisma|scripts)\//.test(file)
-    ),
-    /rollback|roll back|migration safety|down migration|reversible|undo migration/i
+  const rollbackSafetyCount = withContentReadSignal(
+    "A3",
+    "rollback_safety_depth",
+    () => countFilesContaining(
+      repoPath,
+      repoFiles.filter(
+        (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && /(^|\/)(docs|migrations?|drizzle|prisma|scripts)\//.test(file)
+      ),
+      /rollback|roll back|migration safety|down migration|reversible|undo migration/i
+    )
   );
   if (packageJson && (scripts.has("build") || scripts.has("typecheck"))) {
     evidence.push(
@@ -3467,10 +3748,15 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
     );
   if (envTemplate)
     evidence.push(evidenceForRelative(repoPath, envTemplate, "prod_check", "Environment template"));
-  if (healthCheck)
-    evidence.push(
-      evidenceForRelative(repoPath, healthCheck, "prod_check", "Health/readiness signal")
+  if (healthCheck) {
+    withContentReadSignal(
+      "A3",
+      "prod_readiness_primitives",
+      () => evidence.push(
+        evidenceForRelative(repoPath, healthCheck, "prod_check", "Health/readiness signal")
+      )
     );
+  }
   if (errorBoundary)
     evidence.push(evidenceForRelative(repoPath, errorBoundary, "prod_check", "Error boundary"));
   if (evidence.length === 0) {
@@ -3509,7 +3795,12 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
         )
       });
     } else if (runtimeContainer) {
-      if (!fileContains(repoPath, runtimeContainer, /^\s*HEALTHCHECK\s+(?!NONE\b)/im)) {
+      const hasActiveHealthcheck = withContentReadSignal(
+        "A3",
+        "dockerfile_healthcheck",
+        () => fileContains(repoPath, runtimeContainer, /^\s*HEALTHCHECK\s+(?!NONE\b)/im)
+      );
+      if (!hasActiveHealthcheck) {
         findings.push({
           severity: "info",
           summary: "A runtime Dockerfile declares no active HEALTHCHECK instruction.",
@@ -3521,10 +3812,14 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
           )
         });
       }
-    } else if (serverEntrypoint && fileContains(
-      repoPath,
-      serverEntrypoint,
-      /\b(?:request|req)\.(?:url|path|pathname|method)\b/i
+    } else if (serverEntrypoint && withContentReadSignal(
+      "A3",
+      "health_readiness_route",
+      () => fileContains(
+        repoPath,
+        serverEntrypoint,
+        /\b(?:request|req)\.(?:url|path|pathname|method)\b/i
+      )
     ) && healthChecks.length === 0 && !hasV20HealthOrReadinessRoute && !hasV22PackageStartHealthOrReadinessRoute) {
       findings.push({
         severity: "info",
@@ -3630,22 +3925,41 @@ function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors,
   const findings = [];
   const manifests = repoFiles.filter(isDependencyManifest);
   const lockfiles = repoFiles.filter(isLockfile);
-  const manifest = pickPrimaryDependencyManifest(repoPath, manifests);
   const lockfile = lockfiles[0];
   const rootLockfile = mono ? mono.sharedFiles.find(isLockfile) : void 0;
   const rootUpdateConfig = mono ? mono.sharedFiles.find(isDependencyUpdateConfig) : void 0;
   const hasLockfile = Boolean(lockfile) || Boolean(rootLockfile);
   const updateConfig = repoFiles.find(isDependencyUpdateConfig);
   const hasUpdateConfig = Boolean(updateConfig) || Boolean(rootUpdateConfig);
-  const auditConfig = manifests.some((file) => packageJsonHasAuditScript(repoPath, file));
-  const dependencySpecs = readDependencySpecs(repoPath, manifests);
+  const auditConfig = withContentReadSignal(
+    "A4",
+    "dependency_automation_ratio",
+    () => manifests.some((file) => packageJsonHasAuditScript(repoPath, file))
+  );
+  const { manifest, dependencySpecs } = withContentReadSignals(
+    "A4",
+    ["pinned_dependency_ratio", "declared_version_range_ratio", "dependency_count_sanity"],
+    () => ({
+      // Cite the manifest that actually carries dependencies for evidence/findings, not
+      // whichever sorts first (e.g. a near-empty requirements-windows.txt that precedes the
+      // real requirements.txt), so the evidence pointer reflects the file the A4 score is
+      // derived from. The score itself is unaffected: it aggregates specs across ALL manifests.
+      manifest: pickPrimaryDependencyManifest(repoPath, manifests),
+      dependencySpecs: readDependencySpecs(repoPath, manifests)
+    })
+  );
   const pinnedDependencyCount = dependencySpecs.filter(
     (dependency) => isPinnedDependencyVersion(dependency.version)
   ).length;
-  if (manifest)
-    evidence.push(
-      evidenceForRelative(repoPath, manifest, "dependency_report", "Dependency manifest")
+  if (manifest) {
+    withContentReadSignals(
+      "A4",
+      ["pinned_dependency_ratio", "declared_version_range_ratio", "dependency_count_sanity"],
+      () => evidence.push(
+        evidenceForRelative(repoPath, manifest, "dependency_report", "Dependency manifest")
+      )
     );
+  }
   if (lockfile)
     evidence.push(
       evidenceForRelative(repoPath, lockfile, "dependency_report", "Dependency lockfile")
@@ -3678,28 +3992,36 @@ function collectA4DependencyEvidence(repoPath, repoFiles, mono, useV27Detectors,
   const deployableServiceFiles = useV47Detectors ? findDeployableServicePremiseFiles(repoPath, repoFiles, true) : [];
   const isAppOrService = (useV47Detectors ? deployableServiceFiles.length > 0 : isDeployableService(repoPath, repoFiles, useV27Detectors)) || packagedApplicationFiles.length > 0;
   if (isAppOrService && !hasLockfile && manifest) {
-    findings.push(
-      inventoryAbsenceFinding({
-        severity: "critical",
-        summaries: {
-          legacy: "Dependency manifest is present without a detected lockfile \u2014 non-reproducible installs.",
-          currentTracked: "Dependency manifest is present, but the tracked scan-eligible inventory matched no recognized lockfile.",
-          currentDirectoryWalk: "Dependency manifest is present, but the bounded directory walk matched no recognized lockfile."
-        },
-        evidence: evidenceForRelative(
-          repoPath,
-          manifest,
-          "dependency_report",
-          "Dependency manifest"
-        ),
-        context: inventoryAbsenceContext,
-        inventoryCount: repoFiles.length + (mono?.sharedFiles.length ?? 0),
-        patternSet: INVENTORY_SCAN_PATTERN_SETS.a4Lockfile,
-        matchCount: 0
-      })
+    withContentReadSignals(
+      "A4",
+      ["pinned_dependency_ratio", "declared_version_range_ratio", "dependency_count_sanity"],
+      () => findings.push(
+        inventoryAbsenceFinding({
+          severity: "critical",
+          summaries: {
+            legacy: "Dependency manifest is present without a detected lockfile \u2014 non-reproducible installs.",
+            currentTracked: "Dependency manifest is present, but the tracked scan-eligible inventory matched no recognized lockfile.",
+            currentDirectoryWalk: "Dependency manifest is present, but the bounded directory walk matched no recognized lockfile."
+          },
+          evidence: evidenceForRelative(
+            repoPath,
+            manifest,
+            "dependency_report",
+            "Dependency manifest"
+          ),
+          context: inventoryAbsenceContext,
+          inventoryCount: repoFiles.length + (mono?.sharedFiles.length ?? 0),
+          patternSet: INVENTORY_SCAN_PATTERN_SETS.a4Lockfile,
+          matchCount: 0
+        })
+      )
     );
   }
-  if (manifest && hasSuspiciousDependencies(repoPath, manifest, useV47Detectors)) {
+  if (manifest && withContentReadSignal(
+    "A4",
+    "suspicious_dependencies",
+    () => hasSuspiciousDependencies(repoPath, manifest, useV47Detectors)
+  )) {
     findings.push({
       severity: "critical",
       summary: "Dependency manifest contains obviously suspicious placeholder dependency names.",
@@ -3853,16 +4175,24 @@ function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors, inv
     ...allDocFiles,
     ...repoFiles.filter((file) => /(^|\/)(SECURITY|THREAT[_-]?MODEL)\.md$/i.test(file))
   ]);
-  const negativeSpaceDoc = [...negativeSpaceCandidates].find(
-    (file) => fileContains(repoPath, file, NEGATIVE_SPACE_SECTION_PATTERN) || fileContains(repoPath, file, NEGATIVE_SPACE_PHRASE_PATTERN)
+  const negativeSpaceDoc = withContentReadSignal(
+    "A5",
+    "negative_space_documentation",
+    () => [...negativeSpaceCandidates].find(
+      (file) => fileContains(repoPath, file, NEGATIVE_SPACE_SECTION_PATTERN) || fileContains(repoPath, file, NEGATIVE_SPACE_PHRASE_PATTERN)
+    )
   );
   if (negativeSpaceDoc) {
-    evidence.push(
-      evidenceForRelative(
-        repoPath,
-        negativeSpaceDoc,
-        "claim_reconciliation",
-        'Documented limitations / threat model / "not covered" section'
+    withContentReadSignal(
+      "A5",
+      "negative_space_documentation",
+      () => evidence.push(
+        evidenceForRelative(
+          repoPath,
+          negativeSpaceDoc,
+          "claim_reconciliation",
+          'Documented limitations / threat model / "not covered" section'
+        )
       )
     );
   }
@@ -3999,18 +4329,33 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
   const workflows = repoFiles.filter(isCiWorkflow);
   const workflow = workflows[0];
   const rootWorkflows = mono ? mono.sharedFiles.filter(isCiWorkflow) : [];
-  const defaultBranchCiCount = workflows.filter((file) => workflowTargetsDefaultBranch(repoPath, file)).length + (mono ? rootWorkflows.filter((file) => workflowTargetsDefaultBranch(mono.root, file)).length : 0);
+  const defaultBranchCiCount = withContentReadSignal(
+    "B3",
+    "default_branch_ci_depth",
+    () => workflows.filter((file) => workflowTargetsDefaultBranch(repoPath, file)).length + (mono ? rootWorkflows.filter((file) => workflowTargetsDefaultBranch(mono.root, file)).length : 0)
+  );
   if (packageJson && scripts.has("test")) {
     evidence.push(evidenceForRelative(repoPath, packageJson, "test_run", "Test script"));
   }
   if (packageJson && scripts.has("lint")) {
     evidence.push(evidenceForRelative(repoPath, packageJson, "ci_run", "Lint script"));
   }
-  if (workflow) evidence.push(evidenceForRelative(repoPath, workflow, "ci_run", "CI workflow"));
-  else if (rootWorkflows[0] && mono)
-    evidence.push(
-      evidenceForRelative(mono.root, rootWorkflows[0], "ci_run", "CI workflow (monorepo root)")
+  if (workflow) {
+    withContentReadSignals(
+      "B3",
+      ["ci_script_depth", "default_branch_ci_depth"],
+      () => evidence.push(evidenceForRelative(repoPath, workflow, "ci_run", "CI workflow"))
+    );
+  } else if (rootWorkflows[0] && mono) {
+    const rootWorkflow = rootWorkflows[0];
+    withContentReadSignals(
+      "B3",
+      ["ci_script_depth", "default_branch_ci_depth"],
+      () => evidence.push(
+        evidenceForRelative(mono.root, rootWorkflow, "ci_run", "CI workflow (monorepo root)")
+      )
     );
+  }
   if (evidence.length === 0) return null;
   const CI_BUILD_COMMAND_PATTERN = /\b(cargo\s+build|cmake|ninja|make\s+(build|all))\b/i;
   const CI_COMMAND_CATEGORIES = [
@@ -4020,10 +4365,19 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
     CI_BUILD_COMMAND_PATTERN
   ];
   const scriptDepth = ["test", "lint", "typecheck", "build"].filter((s) => scripts.has(s)).length;
-  const countCiCommandCategories = (root, files) => CI_COMMAND_CATEGORIES.filter(
-    (pattern) => files.some((file) => fileContains(root, file, pattern))
-  ).length;
-  const ciCommandDepth = countCiCommandCategories(repoPath, workflows) + (mono ? countCiCommandCategories(mono.root, rootWorkflows) : 0);
+  const { repoCategoryHits, rootCategoryHits } = withContentReadSignal(
+    "B3",
+    "ci_script_depth",
+    () => ({
+      repoCategoryHits: CI_COMMAND_CATEGORIES.map(
+        (pattern) => workflows.some((file) => fileContains(repoPath, file, pattern))
+      ),
+      rootCategoryHits: mono ? CI_COMMAND_CATEGORIES.map(
+        (pattern) => rootWorkflows.some((file) => fileContains(mono.root, file, pattern))
+      ) : []
+    })
+  );
+  const ciCommandDepth = repoCategoryHits.filter(Boolean).length + rootCategoryHits.filter(Boolean).length;
   const combinedDepth = scriptDepth + ciCommandDepth;
   return {
     criterionId: "B3",
@@ -4045,13 +4399,13 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
               label: `package script: ${name === "typecheck" ? "type-check" : name}`,
               count: scripts.has(name) ? 1 : 0
             })),
-            ...CI_COMMAND_CATEGORIES.map((pattern, index) => ({
+            ...CI_COMMAND_CATEGORIES.map((_pattern, index) => ({
               label: `repository CI command: ${["test", "lint", "type-check", "build"][index]}`,
-              count: workflows.some((file) => fileContains(repoPath, file, pattern)) ? 1 : 0
+              count: repoCategoryHits[index] ? 1 : 0
             })),
-            ...mono ? CI_COMMAND_CATEGORIES.map((pattern, index) => ({
+            ...mono ? CI_COMMAND_CATEGORIES.map((_pattern, index) => ({
               label: `monorepo-root CI command: ${["test", "lint", "type-check", "build"][index]}`,
-              count: rootWorkflows.some((file) => fileContains(mono.root, file, pattern)) ? 1 : 0
+              count: rootCategoryHits[index] ? 1 : 0
             })) : []
           ]
         }
@@ -4096,9 +4450,11 @@ function readAuditFreshnessCommitterYear(repoPath, scanLimitations) {
 function collectB4AuditEvidence(repoPath, repoFiles, generatedAt, useV19CommitYear = false, scanLimitations = /* @__PURE__ */ new Set()) {
   const evidence = [];
   const auditFiles = repoFiles.filter(isAuditFile);
-  for (const file of auditFiles.slice(0, 5)) {
-    evidence.push(evidenceForRelative(repoPath, file, "audit_log", "Audit or changelog artifact"));
-  }
+  withContentReadSignal("B4", "audit_freshness_depth", () => {
+    for (const file of auditFiles.slice(0, 5)) {
+      evidence.push(evidenceForRelative(repoPath, file, "audit_log", "Audit or changelog artifact"));
+    }
+  });
   if (evidence.length === 0) {
     return buildNotApplicableSignal(
       "B4",
@@ -4143,7 +4499,11 @@ function collectB4AuditEvidence(repoPath, repoFiles, generatedAt, useV19CommitYe
       metric(
         "audit_freshness_depth",
         "Audit freshness depth",
-        countFilesContaining(repoPath, auditFiles, freshnessPattern),
+        withContentReadSignal(
+          "B4",
+          "audit_freshness_depth",
+          () => countFilesContaining(repoPath, auditFiles, freshnessPattern)
+        ),
         Math.max(auditFiles.length, 1),
         0.2,
         "ratio",
@@ -4156,93 +4516,128 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detecto
   const evidence = [];
   const findings = [];
   const docFiles = repoFiles.filter((file) => /\.(md|mdx)$/i.test(file));
-  const humanGateDoc = docFiles.find(
-    (file) => fileContains(repoPath, file, HUMAN_GATE_MARKER_PATTERN)
+  const humanGateDoc = withContentReadSignal(
+    "B6",
+    "human_gate_documented",
+    () => docFiles.find((file) => fileContains(repoPath, file, HUMAN_GATE_MARKER_PATTERN))
   );
   const implFiles = repoFiles.filter(isImplementationFile);
-  const gatedPrivilegeCheckFile = implFiles.find(
-    (file) => fileContains(repoPath, file, GATED_PRIVILEGE_CHECK_PATTERN) && fileContains(repoPath, file, SET_ROLE_PATTERN)
+  const gatedPrivilegeCheckFile = withContentReadSignal(
+    "B6",
+    "fail_closed_privilege_check",
+    () => implFiles.find(
+      (file) => fileContains(repoPath, file, GATED_PRIVILEGE_CHECK_PATTERN) && fileContains(repoPath, file, SET_ROLE_PATTERN)
+    )
   );
-  const killSwitchFile = implFiles.find(
-    (file) => fileContains(repoPath, file, KILL_SWITCH_NAME_PATTERN) && fileContains(repoPath, file, KILL_SWITCH_FAIL_CLOSED_PATTERN)
+  const killSwitchFile = withContentReadSignal(
+    "B6",
+    "kill_switch_fail_safe_present",
+    () => implFiles.find(
+      (file) => fileContains(repoPath, file, KILL_SWITCH_NAME_PATTERN) && fileContains(repoPath, file, KILL_SWITCH_FAIL_CLOSED_PATTERN)
+    )
   );
   const codeownersFile = repoFiles.find((file) => /(^|\/)CODEOWNERS$/.test(file));
-  const reviewGateDoc = docFiles.find(
-    (file) => fileContains(repoPath, file, REQUIRED_REVIEW_PATTERN)
+  const reviewGateDoc = withContentReadSignal(
+    "B6",
+    "protected_path_review_gate",
+    () => docFiles.find((file) => fileContains(repoPath, file, REQUIRED_REVIEW_PATTERN))
   );
   const protectedPathReviewGate = codeownersFile ?? reviewGateDoc;
-  const executableFiles = implFiles.filter(
-    (file) => fileContains(repoPath, file, SQL_EXEC_PATTERN)
-  );
-  const historicalUngatedEscalationFiles = executableFiles.filter((file) => {
-    if (useV39Detectors && !fileHasExecutedPrivilegeEscalation(repoPath, file)) return false;
-    const hasEscalation = fileContains(repoPath, file, ROLE_MEMBERSHIP_GRANT_PATTERN) || fileContains(repoPath, file, SUPERUSER_ESCALATION_PATTERN);
-    if (!hasEscalation) return false;
-    return !fileContains(repoPath, file, HUMAN_GATE_MARKER_PATTERN);
+  const { executableFiles, v21ExecutedEscalationFileSet, productionUngatedEscalationFiles } = withContentReadSignal("B6", "privilege_escalation_cleanliness", () => {
+    const executable = implFiles.filter((file) => fileContains(repoPath, file, SQL_EXEC_PATTERN));
+    const historicalUngated = executable.filter((file) => {
+      if (useV39Detectors && !fileHasExecutedPrivilegeEscalation(repoPath, file)) return false;
+      const hasEscalation = fileContains(repoPath, file, ROLE_MEMBERSHIP_GRANT_PATTERN) || fileContains(repoPath, file, SUPERUSER_ESCALATION_PATTERN);
+      if (!hasEscalation) return false;
+      return !fileContains(repoPath, file, HUMAN_GATE_MARKER_PATTERN);
+    });
+    const v21Executed = useV21ExecutedEscalations ? repoFiles.filter(
+      (file) => isV39AuthoredProductionPath(file) && (fileHasV21RawSqlEscalation(repoPath, file) || isImplementationFile(file) && fileHasV21DriverEscalation(repoPath, file))
+    ) : [];
+    const v21ExecutedSet = new Set(v21Executed);
+    const ungated = [.../* @__PURE__ */ new Set([...historicalUngated, ...v21Executed])].filter(
+      (file) => !fileContains(repoPath, file, HUMAN_GATE_MARKER_PATTERN)
+    );
+    const productionUngated = ungated.filter(
+      (file) => useV39Detectors ? isV39AuthoredProductionPath(file) : !isTestOrFixturePath(file)
+    );
+    return {
+      executableFiles: executable,
+      v21ExecutedEscalationFileSet: v21ExecutedSet,
+      productionUngatedEscalationFiles: productionUngated
+    };
   });
-  const v21ExecutedEscalationFiles = useV21ExecutedEscalations ? repoFiles.filter(
-    (file) => isV39AuthoredProductionPath(file) && (fileHasV21RawSqlEscalation(repoPath, file) || isImplementationFile(file) && fileHasV21DriverEscalation(repoPath, file))
-  ) : [];
-  const v21ExecutedEscalationFileSet = new Set(v21ExecutedEscalationFiles);
-  const ungatedEscalationFiles = [
-    .../* @__PURE__ */ new Set([...historicalUngatedEscalationFiles, ...v21ExecutedEscalationFiles])
-  ].filter((file) => !fileContains(repoPath, file, HUMAN_GATE_MARKER_PATTERN));
-  const productionUngatedEscalationFiles = ungatedEscalationFiles.filter(
-    (file) => useV39Detectors ? isV39AuthoredProductionPath(file) : !isTestOrFixturePath(file)
-  );
   if (humanGateDoc) {
-    evidence.push(
-      evidenceForRelative(
-        repoPath,
-        humanGateDoc,
-        "artifact",
-        "Documents privileged operations as human-executed/gated"
+    withContentReadSignal(
+      "B6",
+      "human_gate_documented",
+      () => evidence.push(
+        evidenceForRelative(
+          repoPath,
+          humanGateDoc,
+          "artifact",
+          "Documents privileged operations as human-executed/gated"
+        )
       )
     );
   }
   if (gatedPrivilegeCheckFile) {
-    evidence.push(
-      evidenceForRelative(
-        repoPath,
-        gatedPrivilegeCheckFile,
-        "artifact",
-        "Fail-closed privilege-membership check before role elevation"
+    withContentReadSignal(
+      "B6",
+      "fail_closed_privilege_check",
+      () => evidence.push(
+        evidenceForRelative(
+          repoPath,
+          gatedPrivilegeCheckFile,
+          "artifact",
+          "Fail-closed privilege-membership check before role elevation"
+        )
       )
     );
   }
   if (killSwitchFile) {
-    evidence.push(
-      evidenceForRelative(
-        repoPath,
-        killSwitchFile,
-        "artifact",
-        "Un-overridable kill-switch / fail-safe governance toggle"
+    withContentReadSignal(
+      "B6",
+      "kill_switch_fail_safe_present",
+      () => evidence.push(
+        evidenceForRelative(
+          repoPath,
+          killSwitchFile,
+          "artifact",
+          "Un-overridable kill-switch / fail-safe governance toggle"
+        )
       )
     );
   }
   if (protectedPathReviewGate) {
-    evidence.push(
-      evidenceForRelative(
-        repoPath,
-        protectedPathReviewGate,
-        "artifact",
-        "CODEOWNERS/required-review gate on protected paths"
+    withContentReadSignal(
+      "B6",
+      "protected_path_review_gate",
+      () => evidence.push(
+        evidenceForRelative(
+          repoPath,
+          protectedPathReviewGate,
+          "artifact",
+          "CODEOWNERS/required-review gate on protected paths"
+        )
       )
     );
   }
-  for (const file of productionUngatedEscalationFiles.slice(0, 5)) {
-    const isV21ExecutedShape = v21ExecutedEscalationFileSet.has(file);
-    findings.push({
-      severity: "critical",
-      summary: isV21ExecutedShape ? "This file contains an authored administrative SQL statement \u2014 role-membership grant, SUPERUSER escalation, or schema-wide table privilege grant \u2014 or executes one through a direct database-driver call, and does not itself contain text matching the human-gate marker pattern." : "This file executes a role-membership GRANT or SUPERUSER escalation and does not itself contain text matching the human-gate marker pattern.",
-      evidence: evidenceForRelative(
-        repoPath,
-        file,
-        "artifact",
-        isV21ExecutedShape ? "Ungated authored or directly executed administrative SQL statement" : "Ungated privilege-escalation statement"
-      )
-    });
-  }
+  withContentReadSignal("B6", "privilege_escalation_cleanliness", () => {
+    for (const file of productionUngatedEscalationFiles.slice(0, 5)) {
+      const isV21ExecutedShape = v21ExecutedEscalationFileSet.has(file);
+      findings.push({
+        severity: "critical",
+        summary: isV21ExecutedShape ? "This file contains an authored administrative SQL statement \u2014 role-membership grant, SUPERUSER escalation, or schema-wide table privilege grant \u2014 or executes one through a direct database-driver call, and does not itself contain text matching the human-gate marker pattern." : "This file executes a role-membership GRANT or SUPERUSER escalation and does not itself contain text matching the human-gate marker pattern.",
+        evidence: evidenceForRelative(
+          repoPath,
+          file,
+          "artifact",
+          isV21ExecutedShape ? "Ungated authored or directly executed administrative SQL statement" : "Ungated privilege-escalation statement"
+        )
+      });
+    }
+  });
   if (evidence.length === 0 && findings.length === 0) {
     return buildNotApplicableSignal(
       "B6",
@@ -4264,7 +4659,7 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles, useV39Detecto
       }
     )
   ] : [];
-  const hasPrivilegedOpsSurface = humanGateDoc != null || gatedPrivilegeCheckFile != null || executableFiles.length > 0 || v21ExecutedEscalationFiles.length > 0;
+  const hasPrivilegedOpsSurface = humanGateDoc != null || gatedPrivilegeCheckFile != null || executableFiles.length > 0 || v21ExecutedEscalationFileSet.size > 0;
   return {
     criterionId: "B6",
     positiveEvidence: evidence,
@@ -5187,6 +5582,9 @@ function isRecord(value) {
 function isTestRunnerConfig(repoPath, file) {
   return /(^|\/)(vitest|jest|pytest|playwright|cypress|mocha)\.config\.[cm]?[jt]s$/.test(file) || /(^|\/)(pytest\.ini|tox\.ini)$/.test(file) || /(^|\/)phpunit\.xml(\.dist)?$/.test(file) || /(^|\/)pyproject\.toml$/.test(file) && fileContains(repoPath, file, /^\[tool\.pytest(?:\.|\])/m) || /(^|\/)CMakeLists\.txt$/.test(file) && fileContains(repoPath, file, /\b(?:enable_testing|add_test|ctest_add_tests)\s*\(/i) || /(^|\/)Makefile$/.test(file) && fileContains(repoPath, file, /^\s*(?:test|tests|check)\s*:/m);
 }
+function isRecipeTestEntry(repoPath, file) {
+  return isRecipeFile(file) && fileContains(repoPath, file, /^\s*(?:test|tests|check)\s*:/m);
+}
 function findCoverageConfigFiles(repoPath, repoFiles, authoredOnly = false) {
   return repoFiles.filter(
     (file) => (!authoredOnly || isAuthoredProductionPath(file)) && isCoverageConfig(repoPath, file)
@@ -5480,6 +5878,580 @@ function packageJsonHasCoverageTooling(repoPath, file) {
   }
   return false;
 }
+function isV23CoverageConfig(repoPath, file) {
+  if (/(^|\/)vitest\.config\.[cm]?[jt]s$/.test(file)) {
+    const contents = stripJavaScriptComments(readRepoText(join(repoPath, file), "utf8"));
+    const property = /(?:^|[{,])\s*["']?coverage["']?\s*:\s*([^,\r\n}]*)/im.exec(contents)?.[1]?.trim();
+    if (!property || /^(?:false\b|null\b|undefined\b)/i.test(property)) return false;
+    if (/^\{/.test(property) && /\benabled\s*:\s*false\b/i.test(contents)) return false;
+    return true;
+  }
+  if (/(^|\/)jest\.config\.[cm]?[jt]s$/.test(file)) {
+    const contents = stripJavaScriptComments(readRepoText(join(repoPath, file), "utf8"));
+    return /(?:^|[{,])\s*["']?collectCoverage["']?\s*:\s*true\b/m.test(contents) || /(?:^|[{,])\s*["']?(?:coverageThreshold|coverageProvider|coverageDirectory)["']?\s*:/m.test(
+      contents
+    );
+  }
+  if (/(^|\/)package\.json$/.test(file)) {
+    return packageJsonHasStaticCoverageTooling(repoPath, file);
+  }
+  return isCoverageConfig(repoPath, file);
+}
+function coverageConfigurationDecision(repoPath, file) {
+  const detectorState = isV23CoverageConfig(repoPath, file) ? "collects" : "none";
+  if (/(^|\/)vitest\.config\.[cm]?[jt]s$/.test(file)) {
+    const rawContents = readRepoText(join(repoPath, file), "utf8");
+    const contents = stripJavaScriptComments(rawContents);
+    const match = /(?:^|[{,])\s*["']?coverage["']?\s*:\s*([^,\r\n}]*)/im.exec(contents);
+    if (!match) return null;
+    return {
+      path: file,
+      source: "runner-configuration",
+      locator: "coverage",
+      evidence: rawContents.slice(match.index, match.index + match[0].length).trim(),
+      detectorRecognized: true,
+      detectorState
+    };
+  }
+  if (/(^|\/)jest\.config\.[cm]?[jt]s$/.test(file)) {
+    const rawContents = readRepoText(join(repoPath, file), "utf8");
+    const contents = stripJavaScriptComments(rawContents);
+    const match = /(?:^|[{,])\s*["']?(collectCoverage|coverageThreshold|coverageProvider|coverageDirectory)["']?\s*:\s*([^,\r\n}]*)/m.exec(
+      contents
+    );
+    if (!match) return null;
+    return {
+      path: file,
+      source: "runner-configuration",
+      locator: match[1] ?? "coverage",
+      evidence: rawContents.slice(match.index, match.index + match[0].length).trim(),
+      detectorRecognized: true,
+      detectorState
+    };
+  }
+  if (detectorState === "none") return null;
+  return {
+    path: file,
+    source: "runner-configuration",
+    locator: "coverage",
+    evidence: file,
+    detectorRecognized: true,
+    detectorState
+  };
+}
+function packageJsonHasStaticCoverageTooling(repoPath, file) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return false;
+  const parsed = parseJsonObject(readRepoText(fullPath, "utf8"));
+  if (!parsed) return false;
+  return ["nyc", "c8", "istanbul"].some((key) => {
+    const config = parsed[key];
+    return typeof config === "object" && config !== null && !Array.isArray(config);
+  });
+}
+function analyzeCoverageConfiguration(repoPath, repoFiles, authoredOnly = false) {
+  const eligibleFiles = repoFiles.filter(
+    (file) => !authoredOnly || isAuthoredProductionPath(file)
+  );
+  const eligibleSet = new Set(eligibleFiles);
+  const coverageFiles = /* @__PURE__ */ new Set();
+  const unresolvedFiles = /* @__PURE__ */ new Set();
+  const ciCommandsByFile = /* @__PURE__ */ new Map();
+  const detectorDecisions = [];
+  let hasCoverageCommand = false;
+  for (const file of eligibleFiles.filter(isCiWorkflow)) {
+    const commands = extractCiRunCommands(readRepoText(join(repoPath, file), "utf8"));
+    ciCommandsByFile.set(file, commands);
+    const commandDecisions = commands.map(
+      (command, index) => coverageDetectorDecision(repoPath, eligibleSet, {
+        path: file,
+        source: "ci-run",
+        locator: String(index),
+        command
+      })
+    );
+    detectorDecisions.push(...commandDecisions);
+    const state = combineCoverageCommandStates(
+      commandDecisions.map((decision) => decision.detectorState)
+    );
+    if (state === "collects") {
+      coverageFiles.add(file);
+      hasCoverageCommand = true;
+    }
+    if (state === "unresolved") unresolvedFiles.add(file);
+  }
+  const ciCommands = [...ciCommandsByFile.values()].flat();
+  for (const file of eligibleFiles) {
+    if (isCiWorkflow(file) || isRecipeFile(file)) continue;
+    if (/(^|\/)package\.json$/.test(file)) {
+      if (packageJsonHasStaticCoverageTooling(repoPath, file)) coverageFiles.add(file);
+      const packageState = packageScriptCoverageState(
+        repoPath,
+        eligibleSet,
+        file,
+        file === "package.json" ? ciCommands : [],
+        detectorDecisions
+      );
+      if (packageState === "collects") {
+        coverageFiles.add(file);
+        hasCoverageCommand = true;
+      }
+      if (packageState === "unresolved") unresolvedFiles.add(file);
+      continue;
+    }
+    const configurationDecision = coverageConfigurationDecision(repoPath, file);
+    if (configurationDecision) detectorDecisions.push(configurationDecision);
+    if (configurationDecision?.detectorState === "collects") coverageFiles.add(file);
+  }
+  for (const file of eligibleFiles.filter(isRecipeFile)) {
+    const state = recipeCoverageState(
+      repoPath,
+      eligibleSet,
+      file,
+      ciCommands,
+      detectorDecisions
+    );
+    if (state === "collects") {
+      coverageFiles.add(file);
+      hasCoverageCommand = true;
+    }
+    if (state === "unresolved") unresolvedFiles.add(file);
+  }
+  for (const file of coverageFiles) unresolvedFiles.delete(file);
+  return {
+    coverageFiles: [...coverageFiles].sort(),
+    unresolvedFiles: [...unresolvedFiles].sort(),
+    hasCoverageCommand,
+    detectorDecisions
+  };
+}
+function stripJavaScriptComments(contents) {
+  let output = "";
+  let quote = null;
+  let escaped = false;
+  let lineComment = false;
+  let blockComment = false;
+  for (let index = 0; index < contents.length; index += 1) {
+    const character = contents[index] ?? "";
+    const next = contents[index + 1] ?? "";
+    if (lineComment) {
+      if (character === "\n") {
+        lineComment = false;
+        output += "\n";
+      } else {
+        output += " ";
+      }
+      continue;
+    }
+    if (blockComment) {
+      if (character === "*" && next === "/") {
+        output += "  ";
+        index += 1;
+        blockComment = false;
+      } else {
+        output += character === "\n" ? "\n" : " ";
+      }
+      continue;
+    }
+    if (escaped) {
+      output += character;
+      escaped = false;
+      continue;
+    }
+    if (quote) {
+      output += character;
+      if (character === "\\") escaped = true;
+      else if (character === quote) quote = null;
+      continue;
+    }
+    if (character === "'" || character === '"' || character === "`") {
+      quote = character;
+      output += character;
+      continue;
+    }
+    if (character === "/" && next === "/") {
+      output += "  ";
+      index += 1;
+      lineComment = true;
+      continue;
+    }
+    if (character === "/" && next === "*") {
+      output += "  ";
+      index += 1;
+      blockComment = true;
+      continue;
+    }
+    output += character;
+  }
+  return output;
+}
+function packageScriptCoverageState(repoPath, repoFiles, packageJson, ciCommands, detectorDecisions) {
+  const scripts = readPackageScripts(join(repoPath, packageJson));
+  if (scripts.size === 0) return "none";
+  const roots = /* @__PURE__ */ new Set();
+  let unresolved = false;
+  if (scripts.has("test")) roots.add("test");
+  for (const command of ciCommands) {
+    const references = packageScriptReferences(command, scripts);
+    for (const name of references.names) roots.add(name);
+    if (references.dynamic && [...scripts.values()].some(
+      (candidate) => commandInvokesCoverageTool(candidate) || containsPotentialCoverageFlag(candidate)
+    )) {
+      unresolved = true;
+    }
+  }
+  const queue = [...roots];
+  const visited = /* @__PURE__ */ new Set();
+  while (queue.length > 0) {
+    const name = queue.shift();
+    if (!name || visited.has(name)) continue;
+    const command = scripts.get(name);
+    if (command === void 0) continue;
+    visited.add(name);
+    const decision = coverageDetectorDecision(repoPath, repoFiles, {
+      path: packageJson,
+      source: "package-script",
+      locator: name,
+      command
+    });
+    detectorDecisions.push(decision);
+    const state = decision.detectorState;
+    if (state === "collects") return "collects";
+    if (state === "unresolved") unresolved = true;
+    const references = packageScriptReferences(command, scripts);
+    for (const referenced of references.names) {
+      if (!visited.has(referenced)) queue.push(referenced);
+    }
+    for (const lifecycle of [`pre${name}`, `post${name}`]) {
+      if (scripts.has(lifecycle) && !visited.has(lifecycle)) queue.push(lifecycle);
+    }
+    if (references.dynamic && [...scripts.values()].some(
+      (candidate) => commandInvokesCoverageTool(candidate) || containsPotentialCoverageFlag(candidate)
+    )) {
+      unresolved = true;
+    }
+  }
+  return unresolved ? "unresolved" : "none";
+}
+function packageScriptReferences(command, scripts) {
+  const names = /* @__PURE__ */ new Set();
+  let dynamic = false;
+  for (const segment of splitShellCommandSegments(command)) {
+    for (const match of segment.matchAll(
+      /\bpnpm\s+run\s+\/((?:\\.|[^/])+)\/([dgimsuvy]*)/giu
+    )) {
+      const source = match[1];
+      if (!source) continue;
+      try {
+        const flags = (match[2] ?? "").replace(/[dgy]/g, "");
+        const selector = new RegExp(source, flags);
+        for (const name of scripts.keys()) {
+          if (selector.test(name)) names.add(name);
+          selector.lastIndex = 0;
+        }
+      } catch {
+        dynamic = true;
+      }
+    }
+    for (const match of segment.matchAll(
+      /\b(?:npm|pnpm|yarn)\s+(?:run\s+)?([A-Za-z0-9][A-Za-z0-9:._-]*)/giu
+    )) {
+      const name = match[1];
+      if (name && scripts.has(name)) names.add(name);
+    }
+    if (/\b(?:npm|pnpm|yarn)\s+run\s+(?:\$|["']\$|`)/u.test(segment)) dynamic = true;
+  }
+  return { names: [...names], dynamic };
+}
+function extractCiRunCommands(contents) {
+  const lines = contents.split(/\r?\n/);
+  const commands = [];
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index] ?? "";
+    const match = /^(\s*)(?:-\s*)?run\s*:\s*(.*)$/u.exec(line);
+    if (!match) continue;
+    const indentation = match[1]?.length ?? 0;
+    const value = match[2]?.trim() ?? "";
+    if (value === "|" || value === ">" || value.startsWith("|-") || value.startsWith(">-")) {
+      const block = [];
+      for (index += 1; index < lines.length; index += 1) {
+        const nested = lines[index] ?? "";
+        if (nested.trim().length === 0) {
+          block.push("");
+          continue;
+        }
+        const nestedIndentation = /^\s*/u.exec(nested)?.[0].length ?? 0;
+        if (nestedIndentation <= indentation) {
+          index -= 1;
+          break;
+        }
+        block.push(nested.slice(Math.min(nested.length, indentation + 2)));
+      }
+      commands.push(block.join(value.startsWith(">") ? " " : "\n"));
+      continue;
+    }
+    if (value.length === 0) continue;
+    const quoted = /^(?:"([\s\S]*)"|'([\s\S]*)')$/u.exec(value);
+    commands.push(quoted ? quoted[1] ?? quoted[2] ?? "" : value);
+  }
+  return commands;
+}
+function isRecipeFile(file) {
+  return /(^|\/)(?:Makefile|makefile|GNUmakefile|[Jj]ustfile)$/.test(file);
+}
+function recipeCoverageState(repoPath, repoFiles, file, ciCommands, detectorDecisions) {
+  const targets = readRecipeTargets(readRepoText(join(repoPath, file), "utf8"));
+  const roots = new Set(["test", "tests", "check"].filter((target) => targets.has(target)));
+  const runner = /[Jj]ustfile$/.test(file) ? "just" : "make";
+  for (const command of ciCommands) {
+    for (const match of command.matchAll(new RegExp(`\\b${runner}\\s+([A-Za-z0-9._-]+)`, "gu"))) {
+      const target = match[1];
+      if (target && targets.has(target)) roots.add(target);
+    }
+  }
+  const queue = [...roots];
+  const visited = /* @__PURE__ */ new Set();
+  let unresolved = false;
+  while (queue.length > 0) {
+    const name = queue.shift();
+    if (!name || visited.has(name)) continue;
+    const target = targets.get(name);
+    if (!target) continue;
+    visited.add(name);
+    const commandDecisions = target.commands.map(
+      (command, index) => coverageDetectorDecision(repoPath, repoFiles, {
+        path: file,
+        source: "recipe-command",
+        locator: `${name}:${index}`,
+        command
+      })
+    );
+    detectorDecisions.push(...commandDecisions);
+    const state = combineCoverageCommandStates(
+      commandDecisions.map((decision) => decision.detectorState)
+    );
+    if (state === "collects") return "collects";
+    if (state === "unresolved") unresolved = true;
+    for (const dependency of target.dependencies) {
+      if (targets.has(dependency) && !visited.has(dependency)) queue.push(dependency);
+    }
+    for (const command of target.commands) {
+      const pattern = new RegExp(`(?:\\$\\(MAKE\\)|\\b${runner})\\s+([A-Za-z0-9._-]+)`, "gu");
+      for (const match of command.matchAll(pattern)) {
+        const referenced = match[1];
+        if (referenced && targets.has(referenced) && !visited.has(referenced)) queue.push(referenced);
+      }
+    }
+  }
+  return unresolved ? "unresolved" : "none";
+}
+function readRecipeTargets(contents) {
+  const targets = /* @__PURE__ */ new Map();
+  let active = null;
+  for (const line of contents.split(/\r?\n/)) {
+    const header = /^([A-Za-z0-9][A-Za-z0-9._-]*)\s*:\s*([^#]*)/u.exec(line);
+    if (header) {
+      const name = header[1];
+      if (!name) continue;
+      active = {
+        dependencies: (header[2] ?? "").trim().split(/\s+/u).filter(Boolean),
+        commands: []
+      };
+      targets.set(name, active);
+      continue;
+    }
+    if (active && /^\s+/u.test(line) && line.trim().length > 0) {
+      active.commands.push(line.trim().replace(/^[@+-]+/u, ""));
+      continue;
+    }
+    if (line.trim().length > 0 && !line.trimStart().startsWith("#")) active = null;
+  }
+  return targets;
+}
+function coverageCommandEvaluation(repoPath, repoFiles, command, depth = 0) {
+  if (depth > 4) {
+    const recognized = containsPotentialCoverageFlag(command);
+    return { recognized, state: recognized ? "unresolved" : "none" };
+  }
+  const normalized = normalizeCoverageCommandPrefixes(command);
+  const segments = normalized.splitShellOperators ? splitShellCommandSegments(normalized.segment) : [normalized.segment];
+  const evaluations = segments.map((rawSegment) => {
+    const candidate = normalizeCoverageCommandPrefixes(rawSegment);
+    if (commandInvokesCoverageTool(candidate.segment)) {
+      return { recognized: true, state: "collects" };
+    }
+    const words = shellWords(candidate.segment);
+    if (words.length === 0) return { recognized: false, state: "none" };
+    const direct = coverageFlagCommandState(words);
+    if (direct !== "none") return { recognized: true, state: direct };
+    const hasCoverageSyntax = containsPotentialCoverageFlag(candidate.segment);
+    if (isRecognizedCoverageFlagRunner(words)) {
+      return { recognized: hasCoverageSyntax, state: "none" };
+    }
+    const wrapper = reachableShellWrapper(words, repoFiles);
+    if (wrapper) {
+      return coverageCommandEvaluation(
+        repoPath,
+        repoFiles,
+        readRepoText(join(repoPath, wrapper), "utf8"),
+        depth + 1
+      );
+    }
+    const executable = commandExecutable(words);
+    const potentialFlagState = flagState(
+      words.slice(1),
+      ["--experimental-test-coverage", "--collectcoverage", "--collect-coverage", "--coverage", "--cov"],
+      [
+        "--no-experimental-test-coverage",
+        "--no-collectcoverage",
+        "--no-collect-coverage",
+        "--no-coverage",
+        "--no-cov"
+      ]
+    );
+    if (hasCoverageSyntax && potentialFlagState !== "none" && executable && /(?:test|spec|runner)/i.test(executable) && !/(?:docs?|map|report|upload|codecov|coveralls)/i.test(executable)) {
+      return { recognized: true, state: "unresolved" };
+    }
+    return { recognized: false, state: "none" };
+  });
+  return {
+    recognized: evaluations.some((evaluation) => evaluation.recognized),
+    state: combineCoverageCommandStates(
+      evaluations.map((evaluation) => evaluation.state)
+    )
+  };
+}
+function coverageDetectorDecision(repoPath, repoFiles, input) {
+  const evaluation = coverageCommandEvaluation(repoPath, repoFiles, input.command);
+  return {
+    path: input.path,
+    source: input.source,
+    locator: input.locator,
+    evidence: input.command,
+    detectorRecognized: evaluation.recognized,
+    detectorState: evaluation.state
+  };
+}
+function combineCoverageCommandStates(states) {
+  if (states.includes("collects")) return "collects";
+  return states.includes("unresolved") ? "unresolved" : "none";
+}
+function shellWords(segment) {
+  const words = [];
+  let offset = 0;
+  while (offset < segment.length) {
+    const scanned = scanShellWord(segment, offset);
+    if (!scanned) break;
+    words.push(scanned.word);
+    if (scanned.end <= offset) break;
+    offset = scanned.end;
+  }
+  return words;
+}
+function commandExecutable(words) {
+  const normalized = unwrapPackageManagerExecutable(words);
+  const executable = normalized[0];
+  return executable ? basename(executable).replace(/\.cmd$/i, "").toLowerCase() : void 0;
+}
+function unwrapPackageManagerExecutable(words) {
+  if (words.length === 0) return [];
+  const first = basename(words[0] ?? "").toLowerCase();
+  if (first === "pnpm" || first === "yarn") {
+    const second = words[1]?.toLowerCase();
+    return words.slice(second === "exec" || second === "dlx" ? 2 : 1);
+  }
+  if (first === "npx") return words.slice(1).filter((word) => !/^--(?:yes|no-install)$/u.test(word));
+  if (first === "npm" && words[1]?.toLowerCase() === "exec") {
+    let offset = 2;
+    while (/^--(?:yes|no-install)$/u.test(words[offset] ?? "")) offset += 1;
+    if (words[offset] === "--") offset += 1;
+    return words.slice(offset);
+  }
+  return [...words];
+}
+function coverageFlagCommandState(words) {
+  const command = unwrapPackageManagerExecutable(words);
+  const executable = basename(command[0] ?? "").replace(/\.cmd$/i, "").toLowerCase();
+  const args = command.slice(1);
+  if (!executable) return "none";
+  if (executable === "node") {
+    if (!args.includes("--test")) return "none";
+    return flagState(args, ["--experimental-test-coverage"], ["--no-experimental-test-coverage"]);
+  }
+  if (executable === "pytest" || executable === "py.test") {
+    return flagState(args, ["--cov"], ["--no-cov"]);
+  }
+  if (executable === "bun" || executable === "deno") {
+    if (args[0]?.toLowerCase() !== "test") return "none";
+    return flagState(args.slice(1), ["--coverage"], ["--no-coverage"]);
+  }
+  if (executable === "jest") {
+    return flagState(
+      args,
+      ["--coverage", "--collectcoverage", "--collect-coverage"],
+      ["--no-coverage", "--no-collectcoverage", "--no-collect-coverage"]
+    );
+  }
+  if (executable === "vitest" || executable === "bnt") {
+    return flagState(args, ["--coverage"], ["--no-coverage"]);
+  }
+  return "none";
+}
+function isRecognizedCoverageFlagRunner(words) {
+  const command = unwrapPackageManagerExecutable(words);
+  const executable = basename(command[0] ?? "").replace(/\.cmd$/i, "").toLowerCase();
+  if (["bnt", "vitest", "jest", "pytest", "py.test"].includes(executable)) return true;
+  if (executable === "node") return command.slice(1).includes("--test");
+  return (executable === "bun" || executable === "deno") && command[1]?.toLowerCase() === "test";
+}
+function flagState(args, enablingNames, disablingNames) {
+  let enabled = false;
+  let disabled = false;
+  let unresolved = false;
+  const enabling = new Set(enablingNames.map((name) => name.toLowerCase()));
+  const disabling = new Set(disablingNames.map((name) => name.toLowerCase()));
+  for (let index = 0; index < args.length; index += 1) {
+    const raw = args[index] ?? "";
+    const lower = raw.toLowerCase();
+    if (disabling.has(lower)) {
+      disabled = true;
+      continue;
+    }
+    const [name, assigned] = lower.split("=", 2);
+    if (!name || !enabling.has(name)) continue;
+    if (assigned !== void 0) {
+      if (assigned === "false" || assigned === "0" || assigned === "off") disabled = true;
+      else if (/\$|\{|\}/u.test(assigned)) unresolved = true;
+      else enabled = true;
+      continue;
+    }
+    const next = args[index + 1]?.toLowerCase();
+    if (next === "false" || next === "0" || next === "off") {
+      disabled = true;
+      index += 1;
+    } else if (next && /\$|\{|\}/u.test(next)) {
+      unresolved = true;
+      index += 1;
+    } else {
+      enabled = true;
+    }
+  }
+  if (unresolved || enabled && disabled) return "unresolved";
+  return enabled && !disabled ? "collects" : "none";
+}
+function containsPotentialCoverageFlag(command) {
+  return /(?:^|\s)--(?:experimental-test-coverage|collect-?coverage|no-coverage|coverage|no-cov|cov)(?:[=\s]|$)/iu.test(
+    command
+  );
+}
+function reachableShellWrapper(words, repoFiles) {
+  const executable = basename(words[0] ?? "").toLowerCase();
+  const candidate = /^(?:ba|da|k|z)?sh$/u.test(executable) ? words[1] : words[0];
+  if (!candidate || !/(?:^|\/)\.?[^\s]*\.sh$/i.test(candidate)) return void 0;
+  const normalized = candidate.replace(/^\.\//u, "");
+  if (normalized.startsWith("/") || normalized.split("/").includes("..")) return void 0;
+  return repoFiles.has(normalized) ? normalized : void 0;
+}
 function commandInvokesCoverageTool(command) {
   return normalizedCommandInvokesCoverageTool(normalizeCoverageCommandPrefixes(command), 0);
 }
@@ -7325,7 +8297,7 @@ var WITAN_RUBRIC = [
 
 // src/witan/scoring.ts
 function usesV17DetectorClosure2(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
 }
 var MAX_SIGNAL_ADJUSTMENT = 0.8;
 function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
@@ -7484,7 +8456,7 @@ function statusForScore(score) {
 }
 function statusAfterInputAdjustment(nativeStatus, nativeScore, adjustment, rubricVersion) {
   if (adjustment === 0) return nativeStatus;
-  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22) {
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22 && rubricVersion !== WITAN_RUBRIC_VERSION_V23) {
     return statusForScore(roundScore(Math.max(0, nativeScore - adjustment)));
   }
   const statusFloor = {
@@ -7529,7 +8501,7 @@ function mergeSignalsByCriterion(signals) {
   return merged;
 }
 function usesMetricScoring(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_RUBRIC_VERSION_V7 || rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_RUBRIC_VERSION_V7 || rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
 }
 function unmeasuredStatus(rubricVersion) {
   return rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0 ? "unverified" : "insufficient_data";
@@ -7909,7 +8881,7 @@ function calibratedCriterionStateV11(criterionId, metrics) {
   return void 0;
 }
 function ensureFindingsExplainStatus(criterionId, score, status, findings, evidence, rubricVersion) {
-  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22 && findings.length > 0) {
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22 && rubricVersion !== WITAN_RUBRIC_VERSION_V23 && findings.length > 0) {
     return [...findings];
   }
   if (status !== "critical" && status !== "warning") return [...findings];
@@ -8229,6 +9201,7 @@ export {
   CALLER_CONTEXT_PRODUCT_IDENTITY_NOTICE,
   CERTIFICATE_GLOSSARY,
   formatCertificateMetricLabel,
+  formatCertificateMetricAppliedWeightPercent,
   formatCertificateMetricValue,
   buildRelyingPartySummary,
   WITAN_RUBRIC_VERSION_V22,