@cejel/cejel 0.6.11 → 0.7.0-rc.2

package/dist/{chunk-4YOIR3E6.js → chunk-G6AN4EDL.js}

@@ -739,20 +739,31 @@ function isWitanHistoryDepthUnknownAbstention(report) {
 function isWitanNoGitHistoryAbstention(report) {
   return report.verdict === "insufficient_source" && report.insufficientSourceReason === noGitHistoryAbstentionReason(report.rubricVersion);
 }
-function isShallowRepository(repoPath) {
-  const result = execGit(["rev-parse", "--is-shallow-repository"], { cwd: repoPath });
-  return result.ok && result.stdout.trim() === "true";
-}
-function readHistoryDepth(repoPath) {
+function readHistoryDepthAnswer(repoPath) {
   const result = execGit(["rev-parse", "--is-shallow-repository"], { cwd: repoPath });
   if (result.ok) {
     const answer = result.stdout.trim();
-    if (answer === "true") return "shallow";
-    if (answer === "false") return "complete";
+    if (answer === "true") return { depth: "shallow", answeredByGit: true };
+    if (answer === "false") return { depth: "complete", answeredByGit: true };
   }
+  const failure = result.ok ? { noAnswer: true } : isExpectedGitAbsence(result) ? {} : { failure: result.reason };
   const entry = findVisibleGitMetadata(repoPath);
-  if (entry === void 0) return result.ok ? "unknown" : "not_a_repository";
-  return historyDepthFromFiles(entry);
+  if (entry === void 0) {
+    return { depth: result.ok ? "unknown" : "not_a_repository", answeredByGit: false, ...failure };
+  }
+  return { depth: historyDepthFromFiles(entry), answeredByGit: false, ...failure };
+}
+function isShallowHistoryDepth(answer) {
+  return answer.depth === "shallow";
+}
+function isHistoryDepthUnsettledByFailure(answer) {
+  return answer.failure !== void 0 && answer.depth !== "shallow" && answer.depth !== "complete";
+}
+var HISTORY_DEPTH_NO_ANSWER = "Cejel: local git history-depth check gave no answer (git printed neither true nor false).";
+function historyDepthFailureLimitation(answer) {
+  if (answer.failure === void 0 && answer.noAnswer !== true) return void 0;
+  const failed = answer.failure !== void 0 ? describeGitFailure(answer.failure, "history-depth check") : HISTORY_DEPTH_NO_ANSWER;
+  return answer.depth !== "shallow" && answer.depth !== "complete" ? `${failed} Cejel could not read the history depth from the repository's files either.` : `${failed} Cejel read the history depth from the repository's own shallow file, which is the file git reads to answer.`;
 }
 function isDefinitelyAbsent(error) {
   const code = typeof error === "object" && error !== null ? error.code : void 0;
@@ -820,9 +831,8 @@ function historyDepthAbstentionReason(depth, rubricVersion, v27Wording) {
   if (depth === "not_a_repository") return noGitHistoryAbstentionReason(rubricVersion);
   return void 0;
 }
-function detectHistoryLimitations(repoPath) {
-  if (!isShallowRepository(repoPath)) return void 0;
-  return [SHALLOW_HISTORY_V27_ABSTENTION];
+function detectHistoryLimitations(repoPath, answer = readHistoryDepthAnswer(repoPath)) {
+  return answer.answeredByGit && answer.depth === "shallow" ? [SHALLOW_HISTORY_V27_ABSTENTION] : void 0;
 }
 
 // src/witan/abstention.ts
@@ -885,6 +895,172 @@ function witanHistoryAbstentionInstruction(label) {
 // src/witan/certificate-presentation.ts
 init_esm_shims();
 
+// src/witan/path-limits.ts
+init_esm_shims();
+
+// src/witan/finding-limits.ts
+init_esm_shims();
+var RULE_ID_MAX = 200;
+var MESSAGE_MAX = 500;
+var LOCATION_MAX = 700;
+function clamp(value, max) {
+  if (value.length <= max) return value;
+  const ellipsis = "...";
+  return `${value.slice(0, Math.max(max - ellipsis.length, 0))}${ellipsis}`;
+}
+function clampFinding(finding) {
+  return {
+    ...finding,
+    ruleId: clamp(finding.ruleId, RULE_ID_MAX),
+    message: clamp(finding.message, MESSAGE_MAX),
+    ...finding.location ? { location: clamp(finding.location, LOCATION_MAX) } : {}
+  };
+}
+
+// src/witan/path-limits.ts
+var REPORT_PATH_MAX = 700;
+var MARKER_PREFIX = "\0cejel:path-over-report-limit:";
+var MARKER_SUFFIX = "\0";
+var OVER_LIMIT_ANCHOR_LABEL = `Path longer than the report's ${REPORT_PATH_MAX}-character limit; not cited`;
+var OVER_LIMIT_ANCHOR = Object.freeze({
+  kind: "repository",
+  label: OVER_LIMIT_ANCHOR_LABEL,
+  path: "."
+});
+function overReportPathLimit(path) {
+  return path !== void 0 && path.length > REPORT_PATH_MAX;
+}
+function markSignal(signal, markerFor) {
+  const marks = (signal.positiveEvidence ?? []).some(({ path }) => overReportPathLimit(path)) || (signal.findings ?? []).some(({ evidence }) => overReportPathLimit(evidence.path));
+  if (!marks) return signal;
+  const markPointer = (pointer) => pointer.path !== void 0 && overReportPathLimit(pointer.path) ? { ...pointer, path: markerFor(pointer.path) } : pointer;
+  return {
+    ...signal,
+    ...signal.positiveEvidence ? { positiveEvidence: signal.positiveEvidence.map(markPointer) } : {},
+    ...signal.findings ? {
+      findings: signal.findings.map(
+        (finding) => overReportPathLimit(finding.evidence.path) ? { ...finding, evidence: markPointer(finding.evidence) } : finding
+      )
+    } : {}
+  };
+}
+function markOverLimitPaths(input) {
+  const markers = /* @__PURE__ */ new Map();
+  const markerFor = (path) => {
+    let marker = markers.get(path);
+    if (marker === void 0) {
+      marker = `${MARKER_PREFIX}${markers.size}${MARKER_SUFFIX}`;
+      markers.set(path, marker);
+    }
+    return marker;
+  };
+  const signals = input.signals?.map((signal) => markSignal(signal, markerFor));
+  const signalsMarked = signals?.some((signal, index) => signal !== input.signals?.[index]) ?? false;
+  const droppedWithheldPaths = (input.withheldPaths ?? []).filter(({ path }) => overReportPathLimit(path));
+  if (!signalsMarked && droppedWithheldPaths.length === 0) return { input, droppedWithheldPaths };
+  return {
+    input: {
+      ...input,
+      ...signalsMarked ? { signals } : {},
+      ...droppedWithheldPaths.length > 0 ? { withheldPaths: input.withheldPaths?.filter(({ path }) => !overReportPathLimit(path)) } : {}
+    },
+    droppedWithheldPaths
+  };
+}
+function isMarked(pointer) {
+  return pointer.path?.startsWith(MARKER_PREFIX) === true;
+}
+function isCitablePointer(pointer) {
+  return !isMarked(pointer);
+}
+var NO_SHORTENING = "No path is shortened, since a shortened path would name a file that does not exist.";
+function overLimitCitationDisclosure(count) {
+  const one = count === 1;
+  return `Cejel did not cite ${count} repository ${one ? "path" : "paths"} here because ${one ? "it is" : "they are"} longer than the report's ${REPORT_PATH_MAX}-character path limit. Every finding that cited ${one ? "it" : "one"} is kept, with that citation left out, and the score and status were computed with ${one ? "it" : "them"}. ${NO_SHORTENING}`;
+}
+var OVER_LIMIT_WITHHELD_MARK = "not listed in withheldPaths because";
+function overLimitWithheldPathsDisclosure(count, signals) {
+  const one = count === 1;
+  const it = one ? "it" : "them";
+  const head = `${count} withheld repository ${one ? "path is" : "paths are"} ${OVER_LIMIT_WITHHELD_MARK} ${one ? "it is" : "they are"} longer than the report's ${REPORT_PATH_MAX}-character path limit; contentReadSummary still counts ${it}.`;
+  const named = signals.length > 0 ? ` Checks that would have read ${it}: ${signals.join(", ")}.` : "";
+  const counted = signals.length > 0 ? ` ${signals.length} ${signals.length === 1 ? "check" : "checks"} would have read ${it}.` : "";
+  const withNames = `${head}${named} ${NO_SHORTENING}`;
+  return withNames.length <= STATEMENT_MAX ? withNames : `${head}${counted} ${NO_SHORTENING}`;
+}
+function statesUnlistedWithheldPaths(criteria) {
+  return criteria.some(
+    ({ disclosures, notes }) => (disclosures ?? []).some((sentence) => sentence.includes(OVER_LIMIT_WITHHELD_MARK)) || notes?.includes(OVER_LIMIT_WITHHELD_MARK) === true
+  );
+}
+var DISCLOSURES_MAX = 4;
+var STATEMENT_MAX = 1e3;
+function overLimitCitationNote(count) {
+  const one = count === 1;
+  return `${count} ${one ? "path" : "paths"} over the report's ${REPORT_PATH_MAX}-character limit ${one ? "is" : "are"} not cited; scoring counted ${one ? "it" : "them"}.`;
+}
+function overLimitWithheldPathsNote(count) {
+  const one = count === 1;
+  return `${count} withheld ${one ? "path is" : "paths are"} ${OVER_LIMIT_WITHHELD_MARK} ${one ? "it is" : "they are"} over the report's ${REPORT_PATH_MAX}-character limit.`;
+}
+function stateOn(criterion, statements) {
+  const disclosures = criterion.disclosures ?? [];
+  const room = Math.max(0, DISCLOSURES_MAX - disclosures.length);
+  const disclosed = statements.slice(0, room).map(({ full }) => full);
+  const rest = statements.slice(room);
+  const withDisclosures = disclosed.length > 0 ? { ...criterion, disclosures: [...disclosures, ...disclosed] } : criterion;
+  if (rest.length === 0) return withDisclosures;
+  const join5 = (notes, sentences) => notes ? `${notes} ${sentences}` : sentences;
+  const whole = join5(criterion.notes, rest.map(({ full }) => full).join(" "));
+  if (whole.length <= STATEMENT_MAX) return { ...withDisclosures, notes: whole };
+  const countOnly = rest.map(({ countOnly: sentence }) => sentence).join(" ");
+  const counted = join5(criterion.notes, countOnly);
+  if (counted.length <= STATEMENT_MAX) return { ...withDisclosures, notes: counted };
+  const kept = clamp(criterion.notes, STATEMENT_MAX - countOnly.length - 1);
+  return { ...withDisclosures, notes: `${kept} ${countOnly}` };
+}
+function dropMarkedCitations(criteria, droppedWithheldPaths = []) {
+  const statements = criteria.map(() => []);
+  const cited = criteria.map((criterion, index) => {
+    const dropped = /* @__PURE__ */ new Set();
+    const evidence = criterion.evidence.filter((pointer) => {
+      if (!isMarked(pointer)) return true;
+      dropped.add(pointer.path);
+      return false;
+    });
+    const findings = criterion.findings.map((finding) => {
+      if (!isMarked(finding.evidence)) return finding;
+      dropped.add(finding.evidence.path);
+      return { ...finding, evidence: { ...OVER_LIMIT_ANCHOR } };
+    });
+    if (dropped.size === 0) return criterion;
+    statements[index]?.push({
+      full: overLimitCitationDisclosure(dropped.size),
+      countOnly: overLimitCitationNote(dropped.size)
+    });
+    return { ...criterion, evidence, findings };
+  });
+  if (droppedWithheldPaths.length > 0) {
+    if (cited.length === 0) {
+      throw new Error("Cejel invariant: a report with withheld paths has at least one criterion");
+    }
+    const signals = [...new Set(droppedWithheldPaths.flatMap(({ signalsAdmitting }) => signalsAdmitting))].sort();
+    const admitting = new Set(signals.map((signal) => signal.split(".")[0]));
+    const index = Math.max(
+      0,
+      cited.findIndex(({ id }) => admitting.has(id))
+    );
+    statements[index]?.push({
+      full: overLimitWithheldPathsDisclosure(droppedWithheldPaths.length, signals),
+      countOnly: overLimitWithheldPathsNote(droppedWithheldPaths.length)
+    });
+  }
+  return cited.map((criterion, index) => {
+    const own = statements[index] ?? [];
+    return own.length === 0 ? criterion : stateOn(criterion, own);
+  });
+}
+
 // src/witan/repo-signals.ts
 init_esm_shims();
 import { createHash } from "crypto";
@@ -979,6 +1155,51 @@ function isShellScriptPath(text) {
 function execOnTerminatorFreeLine(pattern, line) {
   return LINE_TERMINATOR_PATTERN.test(line) ? null : pattern.exec(line);
 }
+function firstLineStart(text, from, to) {
+  for (let index = from; index < to; index += 1) {
+    if (index === 0 || LINE_TERMINATOR_PATTERN.test(text[index - 1] ?? "")) return index;
+  }
+  return to;
+}
+function stripLineLedHashCommentLines(text) {
+  const pattern = /^[^\S\n\r\u2028\u2029]*#.*$/gm;
+  let result = "";
+  let kept = 0;
+  for (let match = pattern.exec(text); match !== null; match = pattern.exec(text)) {
+    let blankStart = match.index;
+    while (blankStart > kept && WHITESPACE_PATTERN.test(text[blankStart - 1] ?? "")) blankStart -= 1;
+    result += text.slice(kept, firstLineStart(text, blankStart, match.index));
+    kept = match.index + match[0].length;
+  }
+  return result + text.slice(kept);
+}
+function widenToLeadingBlankRun(match, text) {
+  if (match === null || text[match.index] === "{" || text[match.index] === ",") return match;
+  const end = match.index + match[0].length;
+  let blankStart = match.index;
+  while (blankStart > 0 && WHITESPACE_PATTERN.test(text[blankStart - 1] ?? "")) blankStart -= 1;
+  const before = text[blankStart - 1];
+  const start = before === "{" || before === "," ? blankStart - 1 : firstLineStart(text, blankStart, match.index);
+  match[0] = text.slice(start, end);
+  match.index = start;
+  return match;
+}
+var IDENTIFIER_START_PATTERN = /[A-Za-z_$]/;
+var IDENTIFIER_CHARACTER_PATTERN = /[\w$.-]/;
+function execFromIdentifierRunStarts(sticky, text, from) {
+  let runHasStart = false;
+  for (let index = from; index < text.length; index += 1) {
+    const character = text[index] ?? "";
+    if (character === '"' || character === "'" || !runHasStart && IDENTIFIER_START_PATTERN.test(character)) {
+      sticky.lastIndex = index;
+      const match = sticky.exec(text);
+      if (match !== null) return match;
+    }
+    if (!IDENTIFIER_CHARACTER_PATTERN.test(character)) runHasStart = false;
+    else if (IDENTIFIER_START_PATTERN.test(character)) runHasStart = true;
+  }
+  return null;
+}
 var VERSION_OPERATOR_CHARACTERS = /* @__PURE__ */ new Set([">", "<", "=", "~", "!", "^"]);
 var VERSION_DIGIT_PATTERN = /[\d.]/;
 function firstVersionConstraint(text) {
@@ -1308,7 +1529,8 @@ function buildWitanInputFromRepoUntracked(options) {
   const usesV26SettlingEvidence = rubricVersion === WITAN_RUBRIC_VERSION_V26;
   const usesV26BuildStepEvidence = rubricVersion === WITAN_RUBRIC_VERSION_V26;
   const usesV27Closure = usesV27FalseAssuranceClosure(rubricVersion);
-  const unreadHistory = unreadHistoryDepth(readHistoryDepth(options.repoPath));
+  const historyDepth = options.historyDepth ?? readHistoryDepthAnswer(options.repoPath);
+  const unreadHistory = unreadHistoryDepth(historyDepth.depth);
   const structuralArchetype = classifyRepoArchetype(inventoryFiles, rubricVersion);
   const readableArchetype = rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion) ? applyReadableSourceRepresentationGate(
     options.repoPath,
@@ -1330,6 +1552,8 @@ function buildWitanInputFromRepoUntracked(options) {
   const usesV47Detectors = rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion);
   const reviewableSourceProof = usesV17Detectors ? buildReviewableSourceProof(options.repoPath, inventoryFiles, headSha, rubricVersion) : void 0;
   const scanLimitations = new Set(fileInventory.scanLimitations);
+  const historyDepthLimitation = historyDepthFailureLimitation(historyDepth);
+  if (historyDepthLimitation !== void 0) scanLimitations.add(historyDepthLimitation);
   const coreSignals = collectRepoSignals(
     options.repoPath,
     generatedAt,
@@ -1355,7 +1579,8 @@ function buildWitanInputFromRepoUntracked(options) {
     reviewableSourceProof,
     inventoryAbsenceContext,
     scanLimitations,
-    unreadHistory
+    unreadHistory,
+    historyDepth
   );
   const archetype = usesV17Detectors && reviewableSourceProof?.passes === true && isV17RescuableAbstention(gatedArchetype.abstentionKind) && coreSignals.some(isMeasuredCriterionSignal) ? {
     archetype: isLikelyMonorepo(inventoryFiles) ? "monorepo" : "source",
@@ -1626,7 +1851,7 @@ var SEMANTIC_AUXILIARY_PATH_PATTERN_V14 = /(^|\/)(?:locales?|i18n|l10n|translati
 var HTML_SOURCE_EXTENSION_PATTERN = /\.(?:html?|xhtml)$/i;
 var HTML_META_REFRESH_PATTERN = /<meta\b(?=[^>]*\bhttp-equiv\s*=\s*["']?\s*refresh\b)(?=[^>]*\bcontent\s*=\s*["'][^"']*\burl\s*=)[^>]*>/i;
 var RUBY_PACKAGE_RECIPE_CLASS_PATTERN = /\bclass\s+[A-Za-z0-9_:]+\s*<\s*(?:Formula|Cask)\b/;
-var RUBY_PACKAGE_RECIPE_URL_PATTERN = /^\s*url\s+["'][^"']+["']/m;
+var RUBY_PACKAGE_RECIPE_URL_PATTERN = /^[^\S\n\r\u2028\u2029]*url\s+["'][^"']+["']/m;
 var RUBY_PACKAGE_RECIPE_PATH_PATTERN = /(^|\/)(?:Formula|Casks?)(\/|$)/;
 function selectProportionalRepresentativeSourceFiles(files, rankKey, limit) {
   const eligibleFiles = [...new Set(files)];
@@ -1846,7 +2071,7 @@ function isHtmlRedirectMetadataSource(repoPath, file) {
 function isRubyPackageRecipeMetadataSource(repoPath, file) {
   if (!/\.rb$/i.test(file) || !RUBY_PACKAGE_RECIPE_PATH_PATTERN.test(file)) return false;
   const contents = readSemanticMetadataPrefix(repoPath, file);
-  const operativeContents = contents?.replace(/^\s*#.*$/gm, "");
+  const operativeContents = contents === null ? void 0 : stripLineLedHashCommentLines(contents);
   return operativeContents !== void 0 && RUBY_PACKAGE_RECIPE_CLASS_PATTERN.test(operativeContents) && RUBY_PACKAGE_RECIPE_URL_PATTERN.test(operativeContents);
 }
 function readSemanticMetadataPrefix(repoPath, file) {
@@ -1968,7 +2193,7 @@ function buildNotApplicableSignal(criterionId, reason) {
     notApplicable: true
   };
 }
-function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, useV23StrictCoverageAndRecipeRunners, useV23PemPrivateKeyGrammar, useV23WithheldPathAbstention, useV24SecretContentContext, useV25InlineHealthRoute, useV26SettlingEvidence, useV26BuildStepEvidence, useV27FalseAssuranceClosure, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, scanLimitations = /* @__PURE__ */ new Set(), unreadHistory) {
+function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, useV23StrictCoverageAndRecipeRunners, useV23PemPrivateKeyGrammar, useV23WithheldPathAbstention, useV24SecretContentContext, useV25InlineHealthRoute, useV26SettlingEvidence, useV26BuildStepEvidence, useV27FalseAssuranceClosure, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, scanLimitations = /* @__PURE__ */ new Set(), unreadHistory, historyDepth = COMPLETE_HISTORY_DEPTH) {
   const signals = [];
   const mono = resolveMonorepoContext(repoPath, scanLimitations);
   const collectCriterion = (criterionId, collect) => withContentReadCriterion(criterionId, collect);
@@ -1983,7 +2208,8 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       useV23StrictCoverageAndRecipeRunners,
       reviewableSourceProof,
       inventoryAbsenceContext,
-      useV27FalseAssuranceClosure
+      useV27FalseAssuranceClosure,
+      scanLimitations
     )
   );
   const a2Signal = collectCriterion(
@@ -2003,7 +2229,8 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       scanLimitations,
       useV26SettlingEvidence,
       useV27FalseAssuranceClosure,
-      unreadHistory
+      unreadHistory,
+      historyDepth
     )
   );
   const a3Signal = collectCriterion(
@@ -2049,7 +2276,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
   );
   const b2Signal = collectCriterion(
     "B2",
-    () => collectB2PrTraceEvidence(repoPath, repoFiles, useV27FalseAssuranceClosure)
+    () => collectB2PrTraceEvidence(repoPath, repoFiles, useV27FalseAssuranceClosure, historyDepth)
   );
   const b3Signal = collectCriterion(
     "B3",
@@ -2095,7 +2322,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
   }
   return signals;
 }
-function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV23StrictCoverageAndRecipeRunners, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, useV27FalseAssuranceClosure = false) {
+function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV23StrictCoverageAndRecipeRunners, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, useV27FalseAssuranceClosure = false, scanLimitations = /* @__PURE__ */ new Set()) {
   const evidence = [];
   const findings = [];
   const v17TestFiles = findConcreteTestFiles(
@@ -2107,7 +2334,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
   const allTestFiles = pytestSettings !== void 0 ? v17TestFiles.filter(
     (file) => !PYTEST_CONFTEST_PATTERN.test(file) || pytestSettings.forFile(file).pythonFiles !== void 0
   ) : v17TestFiles;
-  const runWideHooks = pytestSettings ? findPytestRunWideSkips(repoPath, repoFiles) : [];
+  const runWideHooks = pytestSettings ? findPytestRunWideSkips(repoPath, repoFiles, scanLimitations) : [];
   const runWideSkips = runWideHooks.filter((skip) => skip.withheld === void 0);
   const hookWithheldFor = (skip, file) => {
     if (skip.withheld !== void 0) {
@@ -2609,7 +2836,7 @@ function buildA1AuthenticatedAbsenceSignal(repoPath, proof, inventoryCount, inve
     notes: `V17 authenticated absence: ${proof.eligibleSourceFileCount} criterion-ratable of ${proof.sourceShapedFileCount} source-shaped files; sampled ${proof.sampledFileCount}; ${proof.readableSampledFileCount} representative-text files. Verification-script signals (lint/typecheck/coverage/CI commands) are independent of test-file presence and are still credited above where detected.`
   };
 }
-function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV23PemPrivateKeyGrammar, useV24SecretContentContext, useV18NativeRls, inventoryAbsenceContext, scanLimitations, useV26SettlingEvidence = false, useV27FalseAssuranceClosure = false, unreadHistory) {
+function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV23PemPrivateKeyGrammar, useV24SecretContentContext, useV18NativeRls, inventoryAbsenceContext, scanLimitations, useV26SettlingEvidence = false, useV27FalseAssuranceClosure = false, unreadHistory, historyDepth = COMPLETE_HISTORY_DEPTH) {
   const abstainsOnIncompleteHistory = useV27FalseAssuranceClosure || unreadHistory !== void 0;
   const noGitHistory = unreadHistory === "not_a_repository";
   const evidence = [];
@@ -2724,7 +2951,8 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
   const historyIncompleteness = a2HistoryIncompleteness(
     repoPath,
     a2HistoryReads,
-    historySecretScan?.truncated === true
+    historySecretScan?.truncated === true,
+    historyDepth
   );
   const dbLayerImportFile = migrationFiles.length === 0 ? implFiles.slice(0, 30).find((f) => fileContains(repoPath, f, DB_CLIENT_PATTERN)) : void 0;
   const hasDataLayer = migrationFiles.length > 0 || dbLayerImportFile !== void 0;
@@ -3444,7 +3672,7 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
       const hasActiveHealthcheck = withContentReadSignal(
         "A3",
         "dockerfile_healthcheck",
-        () => fileContains(repoPath, runtimeContainer, /^\s*HEALTHCHECK\s+(?!NONE\b)/im)
+        () => fileContains(repoPath, runtimeContainer, /^[^\S\n\r\u2028\u2029]*HEALTHCHECK\s+(?!NONE\b)/im)
       );
       if (!hasActiveHealthcheck) {
         findings.push({
@@ -4764,8 +4992,11 @@ function unreadHistoryA2Sentence(depth) {
   }
   return depth === "shallow" ? "This repository is a shallow clone, so history secret scanning read only the commits present (reason: shallow_history); the critical finding stands on what was read." : "Cejel could not read the history depth of this checkout, so history secret scanning may have read only part of it (reason: history_depth_unknown); the critical finding stands on what was read.";
 }
-function a2HistoryIncompleteness(repoPath, reads, blobCapHit) {
-  const shallow = isShallowRepository(repoPath);
+function a2HistoryIncompleteness(repoPath, reads, blobCapHit, historyDepth) {
+  if (isHistoryDepthUnsettledByFailure(historyDepth) && historyDepth.failure !== void 0) {
+    reads.noteFailure(historyDepth.failure);
+  }
+  const shallow = isShallowHistoryDepth(historyDepth);
   const limitHits = [...reads.limitHits].sort();
   const controlCharacterSkip = reads.controlCharacterCandidate;
   const gitUnavailable = reads.gitAbsent && hasVisibleGitMetadata(repoPath);
@@ -4906,6 +5137,8 @@ function a2HistoryApplicabilityDisclosure(incompleteness) {
 }
 var B2_SHALLOW_HISTORY_NOTE = `B2 abstained: this repository is a shallow clone with fewer than ${RECENT_COMMIT_WINDOW} commits visible, so the pull-request merge ratio cannot be read over its window. B2 is left out of the composite rather than scored on the commits present. Re-scan a full clone (for actions/checkout, set fetch-depth: 0).`;
 var B2_SHALLOW_RATIO_WITHHELD_NOTE = `B2 abstained from the pull-request merge ratio only: this repository is a shallow clone with fewer than ${RECENT_COMMIT_WINDOW} commits visible, so the pull-request merge ratio cannot be read over its window. B2 is scored on the CI workflows, pull-request template and review-gate record in the checked-out files, with the ratio left out of its score rather than scored on the commits present. Re-scan a full clone (for actions/checkout, set fetch-depth: 0).`;
+var B2_SHALLOW_CHECK_FAILED_NOTE = `B2 abstained: Cejel could not tell whether this clone is shallow, because git failed to answer and the repository's files did not settle it (the scan limitations name the failed read), and fewer than ${RECENT_COMMIT_WINDOW} commits are visible, so the pull-request merge ratio may be read over a truncated window. Under v27 B2 is not scored on that ratio; it stays in the composite at 0. Re-scan once the local git failure is resolved.`;
+var COMPLETE_HISTORY_DEPTH = { depth: "complete", answeredByGit: true };
 function shallowHistoryAbstention(criterionId, notes) {
   return {
     criterionId,
@@ -4916,7 +5149,7 @@ function shallowHistoryAbstention(criterionId, notes) {
     notes
   };
 }
-function collectB2PrTraceEvidence(repoPath, repoFiles, useV27FalseAssuranceClosure = false) {
+function collectB2PrTraceEvidence(repoPath, repoFiles, useV27FalseAssuranceClosure = false, historyDepth = COMPLETE_HISTORY_DEPTH) {
   const workflows = repoFiles.filter(isCiWorkflow);
   const prTemplate = repoFiles.find(
     (file) => /(^|\/)(pull_request_template|PULL_REQUEST_TEMPLATE)(\.md$|\/[^/]+\.md$)/.test(file)
@@ -4958,12 +5191,19 @@ function collectB2PrTraceEvidence(repoPath, repoFiles, useV27FalseAssuranceClosu
   ];
   if (evidence.length === 0) return null;
   const prTracePrimitives = creditedWorkflowCount + (prTemplate ? 1 : 0) + (branchProtectionDoc ? 1 : 0);
-  const ratioWithheld = isShallowRepository(repoPath) && readRecentCommits(repoPath).length < RECENT_COMMIT_WINDOW;
+  const ratioWithheld = isShallowHistoryDepth(historyDepth) && readRecentCommits(repoPath).length < RECENT_COMMIT_WINDOW;
+  const shallowCheckDecidesRatio = useV27FalseAssuranceClosure && isHistoryDepthUnsettledByFailure(historyDepth) && readRecentCommits(repoPath).length < RECENT_COMMIT_WINDOW;
   const uncreditedDisclosures = uncredited.size > 0 ? {
     disclosures: [uncreditedCiWorkflowDisclosure(WITAN_B2_UNCREDITED_CI_WORKFLOW_PREFIX, uncredited)]
   } : {};
   const uncreditedNote = uncredited.size > 0 ? uncreditedCiWorkflowNote(uncredited, "a PR-trace CI workflow") : void 0;
   const withUncreditedNote = (note) => uncreditedNote ? `${note} ${uncreditedCiWorkflowNote(uncredited, "a PR-trace CI workflow", CRITERION_NOTES_MAX_LENGTH - note.length - 1)}` : note;
+  if (shallowCheckDecidesRatio) {
+    return {
+      ...shallowHistoryAbstention("B2", withUncreditedNote(B2_SHALLOW_CHECK_FAILED_NOTE)),
+      ...uncreditedDisclosures
+    };
+  }
   if (ratioWithheld && prTracePrimitives === 0) {
     return {
       ...shallowHistoryAbstention("B2", withUncreditedNote(B2_SHALLOW_HISTORY_NOTE)),
@@ -11344,6 +11584,8 @@ function readShellCommands(text, directory, addopts, visit, unknownDirectory, me
   let current = directory;
   let why = directory === null ? unknownDirectory : void 0;
   let exported = addopts;
+  let exports = 0;
+  let exportReachesOther = false;
   const joined = stripShellHeredocBodies(text).replace(/\\\r?\n/g, " ");
   for (const segment of splitShellCommandSegments(joined)) {
     const all = shellWords(segment.trim());
@@ -11371,7 +11613,7 @@ function readShellCommands(text, directory, addopts, visit, unknownDirectory, me
       for (const word of words.slice(1)) {
         if (word.startsWith(PYTEST_ADDOPTS_ASSIGNMENT)) {
           exported = shellWords(word.slice(PYTEST_ADDOPTS_ASSIGNMENT.length));
-          if (mentions !== void 0) mentions.read += 1;
+          exports += 1;
         }
       }
       continue;
@@ -11392,8 +11634,23 @@ function readShellCommands(text, directory, addopts, visit, unknownDirectory, me
       current = null;
       continue;
     }
+    if (mentions !== void 0 && makeCommandOf(words) === void 0 && !writesGithubEnvOnly(words)) {
+      mentions.reachesOther = true;
+      if (exports > 0) exportReachesOther = true;
+    }
     visit(words, current, local, current === null ? why : void 0);
   }
+  if (mentions !== void 0 && !exportReachesOther) mentions.read += exports;
+}
+function writesGithubEnvOnly(words) {
+  const name = basename(words[0] ?? "");
+  if (name !== "echo" && name !== "printf") return false;
+  let names = false;
+  for (const word of words) {
+    if (word.includes("$(") || word.includes("`")) return false;
+    if (word.includes("GITHUB_ENV")) names = true;
+  }
+  return names;
 }
 var PYTHON_INTERPRETER_PATTERN = /^(?:python(?:\d+(?:\.\d+)*)?|pypy\d*(?:\.\d+)?|py)(?:\.exe)?$/i;
 var PYTHON_INTERPRETER_VARIABLE_PATTERN = /^(?:\{envpython\}|\$[({]?[A-Za-z_]*PY[A-Za-z_]*[)}]?)$/i;
@@ -11641,7 +11898,7 @@ function yamlPlainScalar(value) {
   const comment = trailingCommentStart(value);
   return (comment === -1 ? value : value.slice(0, comment)).trim();
 }
-function readGithubRunSteps(text) {
+function readGithubRunSteps(text, usesSteps) {
   const lines = readYamlLines(text);
   const raw = text.split(/\r?\n/);
   const steps = [];
@@ -11710,6 +11967,7 @@ function readGithubRunSteps(text) {
   const firstRootLine = lines.findIndex((line) => !line.blank);
   const root = factsOf(firstRootLine === -1 ? /* @__PURE__ */ new Map() : mappingKeys(firstRootLine, lines[firstRootLine]?.keyColumn ?? 0));
   const jobs = /* @__PURE__ */ new Map();
+  const stepKeysAt = /* @__PURE__ */ new Map();
   const jobFacts = (header, column) => {
     let facts = jobs.get(header);
     if (facts === void 0) {
@@ -11722,21 +11980,35 @@ function readGithubRunSteps(text) {
   };
   for (let index = 0; index < lines.length; index += 1) {
     const line = lines[index];
-    if (!line || line.blank || line.key !== "run" || line.value === "") continue;
+    if (!line || line.blank || line.key !== "run" && line.key !== "uses" || line.value === "") continue;
     const column = line.keyColumn;
     const stepStart = itemStart[index] ?? -1;
     if (stepStart === -1) continue;
-    const stepKeys = mappingKeys(stepStart, column);
+    let stepKeys = stepKeysAt.get(stepStart);
+    if (stepKeys === void 0) {
+      stepKeys = mappingKeys(stepStart, column);
+      stepKeysAt.set(stepStart, stepKeys);
+    }
     const list = parent[stepStart] ?? -1;
     const jobHeader = list === -1 ? -1 : parent[list] ?? -1;
     const job = jobHeader === -1 ? { never: false } : jobFacts(jobHeader, lines[list]?.keyColumn ?? 0);
     if (isFalse(scalarAt(stepKeys.get("if"))) || job.never) continue;
+    if (line.key === "uses") {
+      if (!stepKeys.has("run")) {
+        usesSteps?.push({
+          line: index,
+          addoptsKeyLines: [root.addoptsLine, job.addoptsLine, addoptsLineIn(stepKeys)].filter((at) => at !== void 0)
+        });
+      }
+      continue;
+    }
     const directoryValue = scalarAt(stepKeys.get("working-directory")) ?? job.directory ?? root.directory;
     const directory = directoryValue === void 0 ? "" : directoryValue.includes("${{") ? null : resolveCommandPath("", directoryValue);
     const stepAddopts = addoptsIn(stepKeys);
     const addoptsValue = stepAddopts ?? job.addopts ?? root.addopts;
     const addoptsLine = stepAddopts !== void 0 ? addoptsLineIn(stepKeys) : job.addopts !== void 0 ? job.addoptsLine : root.addoptsLine;
     let command;
+    let lastLine = index;
     if (/^[|>]/.test(line.value)) {
       const block = [];
       for (let next = index + 1; next < raw.length; next += 1) {
@@ -11744,6 +12016,7 @@ function readGithubRunSteps(text) {
         if (text2.trim() !== "" && text2.length - text2.trimStart().length <= column) break;
         block.push(text2);
       }
+      lastLine = index + block.length;
       let indent = Number.POSITIVE_INFINITY;
       for (const text2 of block) if (text2.trim() !== "") indent = Math.min(indent, text2.length - text2.trimStart().length);
       const dedented = block.map((text2) => text2.slice(Number.isFinite(indent) ? indent : 0));
@@ -11757,6 +12030,7 @@ function readGithubRunSteps(text) {
       command,
       directory,
       line: index,
+      lastLine,
       addoptsKeyLines: [root.addoptsLine, job.addoptsLine, stepAddoptsLine].filter((at) => at !== void 0),
       ...directory === null && directoryValue !== void 0 ? { unknownDirectory: `working-directory: ${directoryValue}` } : {},
       ...addoptsValue === void 0 || expression ? {} : { addopts: shellWords(addoptsValue) },
@@ -11778,9 +12052,13 @@ function readPytestInvocations(repoFiles, readText) {
   let hatchScripts;
   let hatchExpansionsLeft = HATCH_EXPANSION_BUDGET;
   const environmentTexts = [];
-  let addoptsMentionNotRead = false;
-  const noteAddoptsMentions = (text, read) => {
-    if (wordCount(text, "PYTEST_ADDOPTS") !== read) addoptsMentionNotRead = true;
+  let addoptsMentionNotRead;
+  const noteAddoptsMentions = (text, read, readLines, file) => {
+    if (addoptsMentionNotRead !== void 0 || wordCount(text, "PYTEST_ADDOPTS") === read) return;
+    const lines = text.split(/\r?\n/);
+    let at = lines.findIndex((line, index) => !readLines.has(index) && containsWord(line, "PYTEST_ADDOPTS"));
+    if (at === -1) at = lines.findIndex((line) => containsWord(line, "PYTEST_ADDOPTS"));
+    addoptsMentionNotRead = { text: (lines[at] ?? "").trim(), source: a1NotePath(file), file, line: Math.max(at, 0) };
   };
   const makeEnvironments = [];
   let readingCi = true;
@@ -11883,23 +12161,47 @@ function readPytestInvocations(repoFiles, readText) {
     const writesAddopts = text.includes("GITHUB_ENV") && text.includes("PYTEST_ADDOPTS") ? "PYTEST_ADDOPTS written to $GITHUB_ENV" : void 0;
     const unreadWhy = writesAddopts ?? remote.checkoutPath;
     const keyLines = /* @__PURE__ */ new Set();
-    const shellMentions = writesAddopts === void 0 && text.includes("PYTEST_ADDOPTS") ? { read: 0 } : void 0;
-    for (const step of readGithubRunSteps(text)) {
+    const keysReachingOther = /* @__PURE__ */ new Set();
+    const readLines = /* @__PURE__ */ new Set();
+    let fileReachesOther = false;
+    let shellRead = 0;
+    const mentioned = text.includes("PYTEST_ADDOPTS");
+    const usesSteps = [];
+    for (const step of readGithubRunSteps(text, usesSteps)) {
       for (const at of step.addoptsKeyLines) keyLines.add(at);
+      const shellMentions = mentioned ? { read: 0, reachesOther: false } : void 0;
       const envAddopts = step.addopts !== void 0 && step.addoptsLine !== void 0 ? { words: step.addopts, line: step.addoptsLine } : void 0;
       const notKnownReason = writesAddopts ?? step.addoptsNotKnown;
       const envNotKnown = notKnownReason === void 0 ? void 0 : { reason: notKnownReason, source, file, line: writesAddopts === void 0 && step.addoptsLine !== void 0 ? step.addoptsLine : step.line };
       if (unreadWhy !== void 0) readShellCommands(step.command, null, step.addopts, visitor(source, file, step.line, 0, envAddopts, envNotKnown), unreadWhy, shellMentions);
       else readShellCommands(step.command, step.directory, step.addopts, visitor(source, file, step.line, 0, envAddopts, envNotKnown), step.unknownDirectory, shellMentions);
+      if (shellMentions === void 0) continue;
+      if (shellMentions.reachesOther) {
+        fileReachesOther = true;
+        for (const at of step.addoptsKeyLines) keysReachingOther.add(at);
+      }
+      if (writesAddopts !== void 0) continue;
+      shellRead += shellMentions.read;
+      if (!shellMentions.reachesOther && wordCount(step.command, "PYTEST_ADDOPTS") === shellMentions.read) {
+        for (let at = step.line; at <= step.lastLine; at += 1) readLines.add(at);
+      }
     }
-    if (text.includes("PYTEST_ADDOPTS")) {
-      let read = keyLines.size + (shellMentions?.read ?? 0);
-      if (writesAddopts !== void 0) {
+    if (mentioned) {
+      for (const step of usesSteps) {
+        fileReachesOther = true;
+        for (const at of step.addoptsKeyLines) keysReachingOther.add(at);
+      }
+      for (const at of keyLines) if (!keysReachingOther.has(at)) readLines.add(at);
+      let read = shellRead;
+      for (const at of keyLines) if (!keysReachingOther.has(at)) read += 1;
+      if (writesAddopts !== void 0 && !fileReachesOther) {
         text.split(/\r?\n/).forEach((line, index) => {
-          if (!keyLines.has(index) && line.includes("GITHUB_ENV")) read += wordCount(line, "PYTEST_ADDOPTS");
+          if (keyLines.has(index) || !line.includes("GITHUB_ENV")) return;
+          read += wordCount(line, "PYTEST_ADDOPTS");
+          readLines.add(index);
         });
       }
-      noteAddoptsMentions(text, read);
+      noteAddoptsMentions(text, read, readLines, file);
     }
     for (const step of remote.pytestInputs) {
       invocations.push({ source, file, anchor: step.line, directory: "", args: [], text: step.uses, unread: step.uses });
@@ -11934,13 +12236,15 @@ function readPytestInvocations(repoFiles, readText) {
     environmentTexts.push(text);
     const jenkinsDir = file === "Jenkinsfile" ? jenkinsDirCall(text) : void 0;
     const addopts = readCiAddopts(text);
-    const shellMentions = text.includes("PYTEST_ADDOPTS") ? { read: 0 } : void 0;
+    const shellMentions = text.includes("PYTEST_ADDOPTS") ? { read: 0, reachesOther: false } : void 0;
     for (const command of ciShellTexts(text)) {
       readShellCommands(command, jenkinsDir === void 0 ? "" : null, addopts, visitor(source, file, 0), jenkinsDir, shellMentions);
     }
     if (shellMentions !== void 0) {
-      const keyLine = text.split(/\r?\n/).find((line) => PYTEST_ADDOPTS_LINE_PATTERN.test(line));
-      noteAddoptsMentions(text, shellMentions.read + (keyLine !== void 0 && PYTEST_ADDOPTS_KEY_PATTERN.test(keyLine) ? 1 : 0));
+      const lines = text.split(/\r?\n/);
+      const keyAt = lines.findIndex((line) => PYTEST_ADDOPTS_LINE_PATTERN.test(line));
+      const keyRead = keyAt !== -1 && PYTEST_ADDOPTS_KEY_PATTERN.test(lines[keyAt] ?? "") && !shellMentions.reachesOther;
+      noteAddoptsMentions(text, shellMentions.read + (keyRead ? 1 : 0), new Set(keyRead ? [keyAt] : []), file);
     }
   }
   const noxAt = invocations.length;
@@ -11952,7 +12256,7 @@ function readPytestInvocations(repoFiles, readText) {
     const unreadPosargs = () => hidden ??= [...partitioned.unread, ...noxUnread, ...noxCommandsInUnreadFiles(repoFiles, readText, readActions)];
     const passedSets = [[], ...literal.map((entry) => entry.words)];
     const callCost = passedSets.reduce((sum, words) => sum + 1 + words.length, 0);
-    let noxLeft = NOX_POSARGS_BUDGET;
+    let noxLeft = POSARGS_BUDGET;
     let unreadSaid = false;
     for (const file of usable.filter((candidate) => basename(candidate) === "noxfile.py")) {
       const text = readText(file);
@@ -12003,7 +12307,7 @@ function readPytestInvocations(repoFiles, readText) {
     const just = /[Jj]ustfile$/.test(file);
     const targets = just ? readJustRecipes(text) : readRecipeTargets(text);
     const headers = just ? new Map([...readJustRecipes(text)].map(([name, recipe]) => [name, recipe.line])) : makeTargetLines(text);
-    const setByEnvironment = (name) => name === "PYTEST_ADDOPTS" ? addoptsMentionNotRead : environmentTexts.some((ciText) => containsWord(ciText, name));
+    const setByEnvironment = (name) => name === "PYTEST_ADDOPTS" ? addoptsMentionNotRead !== void 0 : environmentTexts.some((ciText) => containsWord(ciText, name));
     const justVariables = just ? readJustVariables(text) : void 0;
     const make = just ? void 0 : readMakeVariables(text, setByEnvironment);
     const budget = { left: MAKE_EXPANSION_BUDGET };
@@ -12013,6 +12317,7 @@ function readPytestInvocations(repoFiles, readText) {
     const expand = expandWith(make);
     let addoptsUnknown = false;
     let addoptsText;
+    let addoptsNotKnownAt;
     if (justVariables !== void 0) {
       const exportsAll = /^set[ \t]+export(?:[ \t]*:=[ \t]*true)?[ \t]*$/m.test(text);
       const assigned = /^(?:export[ \t]+)?PYTEST_ADDOPTS[ \t]*:=/m.test(text);
@@ -12022,8 +12327,13 @@ function readPytestInvocations(repoFiles, readText) {
         addoptsUnknown = addoptsText === void 0;
       }
     } else {
-      const exported = /^(?:export[ \t]*|\.EXPORT_ALL_VARIABLES[ \t]*:.*|(?:override[ \t]+)?export[ \t]+PYTEST_ADDOPTS\b.*)$/m.test(text);
-      if (isUnknown("PYTEST_ADDOPTS")) addoptsUnknown = true;
+      const exported = /^ *(?:export[ \t]*|\.EXPORT_ALL_VARIABLES[ \t]*:.*|(?:override[ \t]+)?export[ \t]+PYTEST_ADDOPTS\b.*)$/m.test(text);
+      const assigns = make?.assigned.has("PYTEST_ADDOPTS") === true || make?.defaulted.has("PYTEST_ADDOPTS") === true;
+      const mentionAt = exported || !assigns || makeOverrides.has("PYTEST_ADDOPTS") ? void 0 : addoptsMentionNotRead;
+      if (mentionAt !== void 0) {
+        addoptsUnknown = true;
+        addoptsNotKnownAt = mentionAt;
+      } else if (isUnknown("PYTEST_ADDOPTS")) addoptsUnknown = true;
       else if (exported && make?.values.has("PYTEST_ADDOPTS")) {
         const expanded = expand(make.values.get("PYTEST_ADDOPTS") ?? "");
         if (expanded.unknown) addoptsUnknown = true;
@@ -12033,7 +12343,8 @@ function readPytestInvocations(repoFiles, readText) {
     const addopts = addoptsText === void 0 ? void 0 : shellWords(shellWords(addoptsText.trim()).join(" "));
     const unknownRunsPytest = (command, expanded) => command.toLowerCase().includes("pytest") || expanded.toLowerCase().includes("pytest") || makeReferencesIn(expanded).some((name) => make?.pytestNames.has(name) === true);
     const firstTarget = [...targets.keys()][0];
-    const readRecipes = (names, variables, inForceAddopts, notKnown, addoptsAt) => {
+    const readRecipes = (names, variables, inForceAddopts, notKnown, addoptsAt, notKnownAt) => {
+      const pointAt = notKnown === void 0 ? void 0 : notKnownAt;
       const expandHere = variables === make ? expand : expandWith(variables);
       const reached = /* @__PURE__ */ new Set();
       const queue = names.filter((name) => name !== void 0 && targets.has(name));
@@ -12053,14 +12364,21 @@ function readPytestInvocations(repoFiles, readText) {
           }
           readShellCommands(expanded.text, repoDirectory(file), inForceAddopts, (words, directory, inForce, why) => {
             queue.push(...recipeTargetsNamed(words).filter((named) => targets.has(named)));
-            const visit = visitor(a1NotePath(file), file, headers.get(name) ?? 0, 0, void 0, void 0, addoptsAt);
+            const visit = visitor(pointAt?.source ?? a1NotePath(file), pointAt?.file ?? file, pointAt?.line ?? headers.get(name) ?? 0, 0, void 0, void 0, addoptsAt);
             if (notKnown !== void 0) visit(words, null, inForce, notKnown);
             else visit(words, directory, inForce, why);
           });
         }
       }
     };
-    readRecipes([firstTarget, "test", "tests", "check", ...namedTargets], make, addopts, addoptsUnknown ? "PYTEST_ADDOPTS" : void 0);
+    readRecipes(
+      [firstTarget, "test", "tests", "check", ...namedTargets],
+      make,
+      addopts,
+      addoptsUnknown ? addoptsNotKnownAt?.text ?? "PYTEST_ADDOPTS" : void 0,
+      void 0,
+      addoptsNotKnownAt
+    );
     if (make === void 0 || addoptsUnknown) continue;
     const here = repoDirectory(file);
     const baseKey = addopts?.join("\0");
@@ -12093,11 +12411,12 @@ function readPytestInvocations(repoFiles, readText) {
   }
   const toxenv = readToxenvValues(environmentTexts);
   for (const name of toxenv.names) namedToxEnvironments.add(name);
+  const toxBudget = { left: POSARGS_BUDGET, characters: POSARGS_CHARACTER_BUDGET };
   for (const file of usable.filter((candidate) => basename(candidate) === "tox.ini")) {
     const text = readText(file);
     if (text === void 0) continue;
     const notRead = (entry) => invocations.push({ source: entry.source, file: entry.file, anchor: entry.anchor, directory: "", args: [], text: entry.text, unread: entry.text });
-    readToxCommands(file, text, namedToxEnvironments, (anchor) => visitor(a1NotePath(file), file, anchor), toxPosargs, notRead, toxenv.unknown);
+    readToxCommands(file, text, namedToxEnvironments, (anchor) => visitor(a1NotePath(file), file, anchor), toxPosargs, notRead, toxenv.unknown, toxBudget);
   }
   const after = invocations.splice(noxAt);
   for (const run of readNoxfiles()) invocations.push(run);
@@ -12364,6 +12683,8 @@ function readMakeVariables(text, setByEnvironment = () => false, environment) {
   const simple = /* @__PURE__ */ new Set();
   const unknown = /* @__PURE__ */ new Set();
   const pytestNames = /* @__PURE__ */ new Set();
+  const assigned = /* @__PURE__ */ new Map();
+  const defaulted = /* @__PURE__ */ new Set();
   const budget = { left: MAKE_EXPANSION_BUDGET };
   let fromEnvironment = environment !== void 0;
   if (environment !== void 0) values.set(environment.name, environment.value);
@@ -12373,7 +12694,9 @@ function readMakeVariables(text, setByEnvironment = () => false, environment) {
   };
   let conditional = 0;
   let defining;
+  let lineIndex = -1;
   for (const line of text.split(/\r?\n/)) {
+    lineIndex += 1;
     const trimmed = line.trim();
     if (defining !== void 0) {
       if (/^endef\b/.test(trimmed)) defining = void 0;
@@ -12381,6 +12704,7 @@ function readMakeVariables(text, setByEnvironment = () => false, environment) {
       continue;
     }
     if (line.startsWith("	")) continue;
+    const body = line.replace(/^[ \t]+/, "");
     const define = /^(?:override[ \t]+)?(?:export[ \t]+)?define[ \t]+([A-Za-z_][A-Za-z0-9_.-]*)/.exec(trimmed);
     if (define) {
       defining = define[1] ?? "";
@@ -12395,14 +12719,14 @@ function readMakeVariables(text, setByEnvironment = () => false, environment) {
       conditional = Math.max(0, conditional - 1);
       continue;
     }
-    const targetSpecific = /^[^#=:\t][^#=:]*:[ \t]*(?:(?:override|export|private)[ \t]+)*([A-Za-z_][A-Za-z0-9_.-]*)[ \t]*(?:\?=|:::=|::=|:=|\+=|!=|=)(.*)$/.exec(line);
+    const targetSpecific = /^[^#=:\t][^#=:]*:[ \t]*(?:(?:override|export|private)[ \t]+)*([A-Za-z_][A-Za-z0-9_.-]*)[ \t]*(?:\?=|:::=|::=|:=|\+=|!=|=)(.*)$/.exec(body);
     if (targetSpecific) {
       const name2 = targetSpecific[1] ?? "";
       if ((targetSpecific[2] ?? "").toLowerCase().includes("pytest")) pytestNames.add(name2);
       forget(name2);
       continue;
     }
-    const match = /^(?:override[ \t]+)?(?:export[ \t]+)?([A-Za-z_][A-Za-z0-9_.-]*)[ \t]*(\?=|:::=|::=|:=|\+=|!=|=)(.*)$/.exec(line);
+    const match = /^(?:override[ \t]+)?(?:export[ \t]+)?([A-Za-z_][A-Za-z0-9_.-]*)[ \t]*(\?=|:::=|::=|:=|\+=|!=|=)(.*)$/.exec(body);
     if (!match) continue;
     const name = match[1] ?? "";
     const operator = match[2] ?? "=";
@@ -12410,12 +12734,18 @@ function readMakeVariables(text, setByEnvironment = () => false, environment) {
     if (value.toLowerCase().includes("pytest")) pytestNames.add(name);
     if (unknown.has(name)) continue;
     const fromTheEnvironment = environment !== void 0 && name === environment.name;
-    if (fromTheEnvironment && environment.overrides && !/^override[ \t]/.test(line)) continue;
-    if (conditional > 0 || operator === "!=" || operator === ":::=" || operator === "?=" && setByEnvironment(name)) {
+    if (fromTheEnvironment && environment.overrides && !/^override[ \t]/.test(body)) continue;
+    if (conditional > 0 || operator === "!=" || operator === ":::=") {
+      forget(name);
+      continue;
+    }
+    if (operator === "?=" && setByEnvironment(name)) {
+      defaulted.add(name);
       forget(name);
       continue;
     }
     if (fromTheEnvironment && operator !== "?=") fromEnvironment = false;
+    if (operator !== "?=" && !assigned.has(name)) assigned.set(name, { text: line.trim(), line: lineIndex });
     if (operator === "?=") {
       if (!values.has(name)) {
         values.set(name, value);
@@ -12439,7 +12769,7 @@ function readMakeVariables(text, setByEnvironment = () => false, environment) {
       simple.delete(name);
     }
   }
-  return { values, unknown, pytestNames, fromEnvironment };
+  return { values, unknown, pytestNames, fromEnvironment, assigned, defaulted };
 }
 function expandMakeVariables(command, values, isUnknown, budget, depth = 0) {
   if (!command.includes("$")) return { text: command, unknown: false };
@@ -12632,7 +12962,8 @@ function substituteHatchArguments(command, args) {
   return out + command.slice(index);
 }
 var NOX_POSARGS_WORD = "\0session.posargs";
-var NOX_POSARGS_BUDGET = 4096;
+var POSARGS_BUDGET = 4096;
+var POSARGS_CHARACTER_BUDGET = 262144;
 function readNoxRunCalls(text) {
   const calls = [];
   const pattern = /\bsession\.run(?:_always)?[ \t]*\(/g;
@@ -12720,7 +13051,7 @@ function readCiAddopts(text) {
   }
   return void 0;
 }
-function readToxCommands(file, text, named, visitAt, posargs = [], notRead = () => void 0, factorsUnknown = false) {
+function readToxCommands(file, text, named, visitAt, posargs = [], notRead = () => void 0, factorsUnknown = false, budget = { left: POSARGS_BUDGET, characters: POSARGS_CHARACTER_BUDGET }) {
   const sections = readIniSections(text);
   const toxDirectory = repoDirectory(file);
   const tox = sections.get("tox");
@@ -12740,6 +13071,12 @@ function readToxCommands(file, text, named, visitAt, posargs = [], notRead = ()
     if (section) environments.push({ section, names: [name] });
   }
   const { literal: literalPosargs, unread: unreadPosargs } = partitionPosargs(posargs);
+  let posargsWords = 0;
+  let posargsCharacters = 0;
+  for (const entry of literalPosargs) {
+    posargsWords += entry.words.length;
+    for (const word of entry.words) posargsCharacters += word.length + 1;
+  }
   let unreadSaid = false;
   const seen = /* @__PURE__ */ new Set();
   for (const { section, names } of environments) {
@@ -12766,6 +13103,16 @@ function readToxCommands(file, text, named, visitAt, posargs = [], notRead = ()
         const anchor = lineOfText.get(raw.trim()) ?? 0;
         const relative3 = directory === null ? "." : posix.relative(directory === "" ? "." : directory, toxDirectory === "" ? "." : toxDirectory) || ".";
         const substitute = (passed) => line.replace(/\{posargs\}/g, passed === void 0 ? "" : passed.map((word) => /\s/.test(word) ? `'${word}'` : word).join(" ")).replace(/\{posargs:([^}]*)\}/g, (_, fallback) => passed === void 0 ? fallback : passed.join(" ")).replace(/\{(?:toxinidir|tox_root)\}/g, relative3);
+        if (line.includes("{posargs")) {
+          let occurrences = 0;
+          for (let at = line.indexOf("{posargs"); at !== -1; at = line.indexOf("{posargs", at + 1)) occurrences += 1;
+          budget.left -= 1 + literalPosargs.length + occurrences * posargsWords;
+          budget.characters -= occurrences * posargsCharacters;
+          if (budget.left < 0 || budget.characters < 0) {
+            notRead({ text: line, source: a1NotePath(file), file, anchor });
+            continue;
+          }
+        }
         readShellCommands(substitute(void 0), directory, addopts, visitAt(anchor));
         if (!line.includes("{posargs")) continue;
         for (const entry of literalPosargs) readShellCommands(substitute(entry.words), directory, addopts, visitAt(anchor));
@@ -14038,10 +14385,15 @@ var PYTHON_BUILTIN_COPY_CALL_PATTERN = /^(?:list|tuple)[ \t]*\(/;
 var PYTHON_BUILTINS_REACH_PATTERN = /builtins|(?<![A-Za-z0-9_])(?:modules|__dict__|__globals__|__getattr__|__getattribute__|__setattr__|__delattr__|__import__|importlib|setattr|delattr|getattr|attrgetter|_getframe|currentframe|f_globals|f_locals|f_back|tb_frame|gi_frame|cr_frame|ag_frame|gc|ctypes|__subclasses__|pickle|marshal|runpy|__loader__|__spec__)(?![A-Za-z0-9_])|(?<![A-Za-z0-9_.])(?:exec|eval|compile|globals|vars|locals)(?![A-Za-z0-9_])|\.[ \t]*(?:list|tuple)(?![A-Za-z0-9_])(?![ \t]*\()/;
 var PYTHON_SOURCE_FILE_PATTERN = /\.(?:py|pyw|pyx|pxd|pxi)$/i;
 var PYTHON_UNREAD_MODULE_FILE_PATTERN = /\.(?:pyc|pyo|so|pyd|egg|whl|zip|pth)$/i;
-function filesIncludingExcluded(repoPath) {
+function filesIncludingExcluded(repoPath, scanLimitations) {
   const tracked = readGitTrackedFileOutput(repoPath);
   if (tracked.ok) return tracked.stdout.split("\n").filter((line) => line !== "");
-  if (!isExpectedGitAbsence(tracked)) return void 0;
+  if (!isExpectedGitAbsence(tracked)) {
+    scanLimitations.add(
+      `${describeGitFailure(tracked.reason, "full tracked-file inventory")} A1 credited no copy of pytest's collected items made through a builtin, because the files that may replace the builtin could not be listed.`
+    );
+    return void 0;
+  }
   const files = [];
   const pending = [""];
   for (let next = pending.pop(); next !== void 0; next = pending.pop()) {
@@ -14060,8 +14412,8 @@ function filesIncludingExcluded(repoPath) {
   }
   return files;
 }
-function builtinCopyReplacedBy(repoPath) {
-  const files = filesIncludingExcluded(repoPath);
+function builtinCopyReplacedBy(repoPath, scanLimitations) {
+  const files = filesIncludingExcluded(repoPath, scanLimitations);
   if (files === void 0) return "and the repository's files could not be listed";
   for (const listed of files) {
     const quoted = listed.startsWith('"') && listed.endsWith('"') && listed.length > 1;
@@ -14398,7 +14750,7 @@ function readPytestCollectionHook(source, index, builtinsNamedIn = () => void 0)
   return void 0;
 }
 var A1_HOOK_NOT_READ = "hook not read: ";
-function findPytestRunWideSkips(repoPath, repoFiles) {
+function findPytestRunWideSkips(repoPath, repoFiles, scanLimitations = /* @__PURE__ */ new Set()) {
   const found = [];
   let ignoresCollection = false;
   let builtinsRead = false;
@@ -14406,7 +14758,7 @@ function findPytestRunWideSkips(repoPath, repoFiles) {
   const builtinsNamedIn = () => {
     if (!builtinsRead) {
       builtinsRead = true;
-      builtinsFile = builtinCopyReplacedBy(repoPath);
+      builtinsFile = builtinCopyReplacedBy(repoPath, scanLimitations);
     }
     return builtinsFile;
   };
@@ -15310,10 +15662,10 @@ function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isTestRunnerConfig(repoPath, file) {
-  return /(^|\/)(vitest|jest|pytest|playwright|cypress|mocha)\.config\.[cm]?[jt]s$/.test(file) || /(^|\/)(pytest\.ini|tox\.ini)$/.test(file) || /(^|\/)phpunit\.xml(\.dist)?$/.test(file) || /(^|\/)pyproject\.toml$/.test(file) && fileContains(repoPath, file, /^\[tool\.pytest(?:\.|\])/m) || /(^|\/)CMakeLists\.txt$/.test(file) && fileContains(repoPath, file, /\b(?:enable_testing|add_test|ctest_add_tests)\s*\(/i) || /(^|\/)Makefile$/.test(file) && fileContains(repoPath, file, /^\s*(?:test|tests|check)\s*:/m);
+  return /(^|\/)(vitest|jest|pytest|playwright|cypress|mocha)\.config\.[cm]?[jt]s$/.test(file) || /(^|\/)(pytest\.ini|tox\.ini)$/.test(file) || /(^|\/)phpunit\.xml(\.dist)?$/.test(file) || /(^|\/)pyproject\.toml$/.test(file) && fileContains(repoPath, file, /^\[tool\.pytest(?:\.|\])/m) || /(^|\/)CMakeLists\.txt$/.test(file) && fileContains(repoPath, file, /\b(?:enable_testing|add_test|ctest_add_tests)\s*\(/i) || /(^|\/)Makefile$/.test(file) && fileContains(repoPath, file, /^[^\S\n\r\u2028\u2029]*(?:test|tests|check)\s*:/m);
 }
 function isRecipeTestEntry(repoPath, file) {
-  return isRecipeFile(file) && fileContains(repoPath, file, /^\s*(?:test|tests|check)\s*:/m);
+  return isRecipeFile(file) && fileContains(repoPath, file, /^[^\S\n\r\u2028\u2029]*(?:test|tests|check)\s*:/m);
 }
 function findCoverageConfigFiles(repoPath, repoFiles, authoredOnly = false) {
   return repoFiles.filter(
@@ -16014,7 +16366,7 @@ function markdownClaimArtifactDeclarations(file, contents) {
 var WORKFLOW_WRITE_OPERATOR_PATTERN = />|(?:^|[\s|;&(])(?:tee|-o|--out[\w-]*)(?=[\s=]|$)/;
 var WORKFLOW_ARTIFACT_ACTION_PATTERN = /^\s*(?:-\s+)?uses\s*:\s*["']?actions\/(?:upload|download)-artifact(?:[/@]|["']?\s*$)/i;
 function workflowClaimArtifactDeclarations(contents) {
-  if (/^\s*(?:-\s+)?working-directory\s*:/m.test(contents)) return [];
+  if (/^[^\S\n\r\u2028\u2029]*(?:-\s+)?working-directory\s*:/m.test(contents)) return [];
   const declarations = [];
   let stepsIndent = null;
   let stepItemIndent = null;
@@ -16093,13 +16445,13 @@ function isCoverageConfig(repoPath, file) {
     return true;
   }
   if (/(^|\/)(?:setup\.cfg|tox\.ini)$/.test(file)) {
-    return fileContains(repoPath, file, /^\s*\[coverage:(?:run|report)\]\s*$/m);
+    return fileContains(repoPath, file, /^[^\S\n\r\u2028\u2029]*\[coverage:(?:run|report)\]\s*$/m);
   }
   if (/(^|\/)vite\.config\.[cm]?[jt]s$/.test(file)) {
     return viteConfigCollectsCoverage(repoPath, file);
   }
   if (/(^|\/)\.simplecov$/.test(file)) {
-    return fileContains(repoPath, file, /^(?!\s*#).*\bSimpleCov\b/m);
+    return fileContains(repoPath, file, /^(?![^\S\n\r\u2028\u2029]*#).*\bSimpleCov\b/m);
   }
   if (/(^|\/)phpunit\.xml(?:\.dist)?$/.test(file)) {
     return /<coverage(?=[\s>/])/.test(stripXmlComments(readRepoText(join2(repoPath, file), "utf8")));
@@ -16144,7 +16496,10 @@ function packageJsonHasCoverageTooling(repoPath, file) {
   return packageJsonHasStaticCoverageTooling(repoPath, file);
 }
 function vitestCoveragePropertyCollects(contents) {
-  const property = /(?:^|[{,])\s*["']?coverage["']?\s*:\s*([^,\r\n}]*)/im.exec(contents)?.[1]?.trim();
+  const property = widenToLeadingBlankRun(
+    /(?:^|[{,])[^\S\n\r\u2028\u2029]*["']?coverage["']?\s*:\s*([^,\r\n}]*)/im.exec(contents),
+    contents
+  )?.[1]?.trim();
   if (!property || /^(?:false\b|null\b|undefined\b)/i.test(property)) return false;
   if (/^\{/.test(property) && /\benabled\s*:\s*false\b/i.test(contents)) return false;
   return true;
@@ -16158,7 +16513,10 @@ function viteConfigCollectsCoverage(repoPath, file) {
     if (!/["']\.\/vite\.config(?:\.[cm]?[jt]s)?["']/.test(vitestConfig)) return false;
   }
   const contents = stripJavaScriptComments(readRepoText(join2(repoPath, file), "utf8"));
-  const testProperty = /(?:^|[{,])\s*["']?test["']?\s*:\s*\{/m.exec(contents);
+  const testProperty = widenToLeadingBlankRun(
+    /(?:^|[{,])[^\S\n\r\u2028\u2029]*["']?test["']?\s*:\s*\{/m.exec(contents),
+    contents
+  );
   if (!testProperty) return false;
   const block = balancedBraceBlock(contents, testProperty.index + testProperty[0].length - 1);
   return vitestCoveragePropertyCollects(block);
@@ -16214,7 +16572,7 @@ function isV23CoverageConfig(repoPath, file) {
   }
   if (/(^|\/)jest\.config\.[cm]?[jt]s$/.test(file)) {
     const contents = stripJavaScriptComments(readRepoText(join2(repoPath, file), "utf8"));
-    return /(?:^|[{,])\s*["']?collectCoverage["']?\s*:\s*true\b/m.test(contents) || /(?:^|[{,])\s*["']?(?:coverageThreshold|coverageProvider|coverageDirectory)["']?\s*:/m.test(
+    return /(?:^|[{,])[^\S\n\r\u2028\u2029]*["']?collectCoverage["']?\s*:\s*true\b/m.test(contents) || /(?:^|[{,])[^\S\n\r\u2028\u2029]*["']?(?:coverageThreshold|coverageProvider|coverageDirectory)["']?\s*:/m.test(
       contents
     );
   }
@@ -16228,7 +16586,10 @@ function coverageConfigurationDecision(repoPath, file) {
   if (/(^|\/)vitest\.config\.[cm]?[jt]s$/.test(file)) {
     const rawContents = readRepoText(join2(repoPath, file), "utf8");
     const contents = stripJavaScriptComments(rawContents);
-    const match = /(?:^|[{,])\s*["']?coverage["']?\s*:\s*([^,\r\n}]*)/im.exec(contents);
+    const match = widenToLeadingBlankRun(
+      /(?:^|[{,])[^\S\n\r\u2028\u2029]*["']?coverage["']?\s*:\s*([^,\r\n}]*)/im.exec(contents),
+      contents
+    );
     if (!match) return null;
     return {
       path: file,
@@ -16242,7 +16603,10 @@ function coverageConfigurationDecision(repoPath, file) {
   if (/(^|\/)jest\.config\.[cm]?[jt]s$/.test(file)) {
     const rawContents = readRepoText(join2(repoPath, file), "utf8");
     const contents = stripJavaScriptComments(rawContents);
-    const match = /(?:^|[{,])\s*["']?(collectCoverage|coverageThreshold|coverageProvider|coverageDirectory)["']?\s*:\s*([^,\r\n}]*)/m.exec(
+    const match = widenToLeadingBlankRun(
+      /(?:^|[{,])[^\S\n\r\u2028\u2029]*["']?(collectCoverage|coverageThreshold|coverageProvider|coverageDirectory)["']?\s*:\s*([^,\r\n}]*)/m.exec(
+        contents
+      ),
       contents
     );
     if (!match) return null;
@@ -17297,8 +17661,8 @@ var EXPRESS_ERROR_MIDDLEWARE_PATTERN = /\(\s*(?:_?err|_?error)(?:\s*:\s*(?:[^,()
 var EXPRESS_MIDDLEWARE_REACHABLE_PATTERN = /\.use\s*\(|\bmodule\.exports\b|\bexport\s+(?:default\b|function\b|const\b|class\b)/;
 var ERROR_BOUNDARY_FILENAME_PATTERN = /(^|\/)(?:error-boundary|error)\.(?:tsx|jsx|ts|js)$/;
 var RACK_SERVER_ENTRYPOINT_PATTERN = /Rack::(?:Server|Handler(?:::\w+)?)\.(?:start|run)\s*\(/;
-var RACK_CONFIG_RUN_PATTERN = /^\s*run\s+(?:(?:[A-Z]\w*(?:::\w+)*(?:\.new)?|lambda)\b|->)/m;
-var RUNTIME_CONTAINER_COMMAND_PATTERN = /^\s*(?:CMD|ENTRYPOINT)\s+.*(?:\b(?:start|serve|server|qgis|nginx|apache|gunicorn|uvicorn)\b|manage\.py\s+runserver).*$/im;
+var RACK_CONFIG_RUN_PATTERN = /^[^\S\n\r\u2028\u2029]*run\s+(?:(?:[A-Z]\w*(?:::\w+)*(?:\.new)?|lambda)\b|->)/m;
+var RUNTIME_CONTAINER_COMMAND_PATTERN = /^[^\S\n\r\u2028\u2029]*(?:CMD|ENTRYPOINT)\s+.*(?:\b(?:start|serve|server|qgis|nginx|apache|gunicorn|uvicorn)\b|manage\.py\s+runserver).*$/im;
 var NON_RUNTIME_CONTAINER_COMMAND_PATTERN = /\b(?:test|lint|build|compile|package|check)\b/i;
 var V20_NODE_RUNTIME_CONTAINER_COMMAND_PATTERN = /\bnode\b.*\b(?:main|server|app|service|index)\.(?:[cm]?js|ts)\b/i;
 var CI_DEPLOY_JOB_PATTERN = /(?:^\s{2,4}deploy\s*:|\b(?:fly|heroku|vercel|netlify|railway|render)\s+deploy\b|kubectl\s+apply\b|helm\s+(?:install|upgrade|deploy)\b|docker\s+push\b)/im;
@@ -18047,7 +18411,7 @@ function findFirstMatchingLineOutsideComments(repoPath, file, pattern) {
   const index = lines.findIndex((line) => pattern.test(line));
   return index === -1 ? null : index + 1;
 }
-var PEM_PRIVATE_KEY_ASSIGNMENT_PATTERN = /(?:["'])?([A-Za-z_$][\w$.-]*)(?:["'])?\s*[:=]\s*(?:\|[-+0-9]*\s*\r?\n[ \t]*)?["'`]?-----BEGIN((?: (?:RSA|DSA|EC|OPENSSH|ENCRYPTED))? PRIVATE KEY)-----([\s\S]{0,32768}?)-----END\2-----/g;
+var PEM_PRIVATE_KEY_ASSIGNMENT_PATTERN = /(?:["'])?([A-Za-z_$][\w$.-]*)(?:["'])?\s*[:=]\s*(?:\|[-+0-9]*\s*\r?\n[ \t]*)?["'`]?-----BEGIN((?: (?:RSA|DSA|EC|OPENSSH|ENCRYPTED))? PRIVATE KEY)-----([\s\S]{0,32768}?)-----END\2-----/y;
 var BARE_PEM_PRIVATE_KEY_PATTERN = /["'`]?-----BEGIN((?: (?:RSA|DSA|EC|OPENSSH|ENCRYPTED))? PRIVATE KEY)-----([\s\S]{0,32768}?)-----END\1-----/g;
 var BARE_PEM_KEY_FILE_PATTERN = /(?:^|\/)id_(?:rsa|dsa|ecdsa|ed25519)$|\.(?:pem|key)$/i;
 function isBarePemKeyFile(file) {
@@ -18062,9 +18426,13 @@ function isPlausiblePemKeyBody(rawBody) {
   return !isPlaceholderSecretValue(normalized);
 }
 function scanForPemPrivateKeyMatch(pattern, contents, lines, hasIdentifierGroup) {
-  pattern.lastIndex = 0;
+  const next = (from) => {
+    if (pattern.sticky) return execFromIdentifierRunStarts(pattern, contents, from);
+    pattern.lastIndex = from;
+    return pattern.exec(contents);
+  };
   let match;
-  while ((match = pattern.exec(contents)) !== null) {
+  for (let from = 0; (match = next(from)) !== null; from = match.index + match[0].length) {
     const full = match[0];
     const identifier = hasIdentifierGroup ? match[1] ?? "" : "";
     const body = (hasIdentifierGroup ? match[3] : match[2]) ?? "";
@@ -19302,21 +19670,26 @@ init_esm_shims();
 init_esm_shims();
 import { createHash as createHash2 } from "crypto";
 var WITAN_RUBRIC_BEHAVIOUR_FINGERPRINTS = Object.freeze({
-  [WITAN_RUBRIC_VERSION_V17]: "sha256:5cd48f8c642300ae8736a09d4a24ce3a4f8885f6e099b5f27f99d950e0c944b4",
-  [WITAN_RUBRIC_VERSION_V18]: "sha256:4a5d17c84e265ec20cf54216d2e794dec1d299d859c69ac8ef1ab317fc479e2f",
-  [WITAN_RUBRIC_VERSION_V19]: "sha256:73dc0282a9ea2a481db8e86a9a5dc227a8b108356c358de029901f2dc38cef79",
-  [WITAN_RUBRIC_VERSION_V20]: "sha256:b5f4254a6056ff792d79a2d85892cdf05484eabded85ba13251a2c8fd5ac6336",
-  [WITAN_RUBRIC_VERSION_V21]: "sha256:f599d06354adb45af018639594cb6f44e7cb40445b84a0dcdd4438b8d7d069d0",
-  [WITAN_RUBRIC_VERSION_V22]: "sha256:34fb6ac5d1f6faf0912aa4d00924837eeee543614d7971247d005312b89928e1",
-  [WITAN_RUBRIC_VERSION_V23]: "sha256:ce24235861ce0f0dc4dafd22059a78d31f348e5c741e4056475867c29cc8b814",
-  [WITAN_RUBRIC_VERSION_V24]: "sha256:b221907d60d209cd3d57437892ae3dd873f4fa221ad8743954a30c8575d4e77c",
-  [WITAN_RUBRIC_VERSION_V25]: "sha256:0f2638a5088f95a610a0e12012442f1067af3e985b955f96ec71853d549693b9",
+  // Re-pinned 2026-11-11 (#622), every entry: the corpus gained `history-shallow-depth-1` (a
+  // depth-1 clone of a repository whose full clone scores A2 and B2 from history) and
+  // `publish-after-check-workflow` (B3's check-before-publish shape, #620). No rubric's behaviour
+  // changed: scored without those two specimens, the corpus reproduces every previous value
+  // (rubric-behaviour-fingerprint.test.ts, "#622: the corpus extension ...").
+  [WITAN_RUBRIC_VERSION_V17]: "sha256:1017cbaa7a77b4cdf50177bd20536480d874e191b46a1fe65cd7aaedc794a375",
+  [WITAN_RUBRIC_VERSION_V18]: "sha256:d4479647b2ea561db907f2a0e890e1ea789aeb0ba93e8367a0c115df0084ba01",
+  [WITAN_RUBRIC_VERSION_V19]: "sha256:afc007665ad29b348054699e560fb8b51ccfa9909964dd299a5eccf9156e7652",
+  [WITAN_RUBRIC_VERSION_V20]: "sha256:2f81463b7b97591bfb5b22e25654d688947f19cc5a384f8b217a85a342475001",
+  [WITAN_RUBRIC_VERSION_V21]: "sha256:4afda89876135bc742511257e17f8c0b6db8c88ae90818adfc60ff382b8a49da",
+  [WITAN_RUBRIC_VERSION_V22]: "sha256:804ff598f785ef3a290d37db0617278f811755af49f9f14b1d68fa3d6299dfb2",
+  [WITAN_RUBRIC_VERSION_V23]: "sha256:3d5a16189c49fc10d9c08e1f309f4966ba1c7a3d1dea86ec1e841f67752fab7e",
+  [WITAN_RUBRIC_VERSION_V24]: "sha256:2b822b556a0ca073a0d7dc1ec7690a0b5b2b3e1581c00b03b4aebd987a4cbc0a",
+  [WITAN_RUBRIC_VERSION_V25]: "sha256:86da3a1603ddff9635033721fa41029d7eea06c4b2e39ed8b1da5dd703f177a2",
   // v25's closure plus v26 item 6 (docs/calibration/v26/ruling-item-6.md and its amendment 1).
   // The corpus holds no declared claim-reconciliation artifact, so the v25 A5 finding no longer
   // fires on it and, by amendment 1, A5 is scored without reconciliation_artifact_depth. The A5
   // component and the report components of the specimens whose code-trust score that moves differ
   // from v25's. A2 does not move on this corpus.
-  [WITAN_RUBRIC_VERSION_V26]: "sha256:4530317d56fc73eb89287e344ad626e2b9a96908ef12eb9e9c13b839bd599dae",
+  [WITAN_RUBRIC_VERSION_V26]: "sha256:0870e977698cf9fa3863c534007c8442fb9c61f274cbefa45fd724801bcc146f",
   // v17's closure plus the v27 false-assurance gate (#517-#520, #442, #527, #535). On this corpus
   // A4, B2 and B3 move against v17: specimens whose CI runs `npm ci` with no committed lockfile
   // score lockfile_coverage 0 under library norms, and `workspace-package-scripts`, whose only
@@ -19324,8 +19697,9 @@ var WITAN_RUBRIC_BEHAVIOUR_FINGERPRINTS = Object.freeze({
   // leaderboard/RUBRIC_CHANGELOG.md). That specimen's report component differs from v17's.
   // Re-pinned 2026-10-26 (#517, #520 follow-up): the specimen whose CI runs `npm ci` with no
   // committed lockfile now also carries A4's warning finding citing that line, so the A4 component
-  // moves; no score, status or report component does. B3's publishing rule reaches no specimen.
-  [WITAN_RUBRIC_VERSION_V27]: "sha256:dfe4e7e9ba37666f60b1ebcee4eb44917110798e9038c81eef079718db9ee7b1"
+  // moves; no score, status or report component does. Until 2026-11-11 B3's publishing rule reached
+  // no specimen; since #622, `publish-after-check-workflow` holds the shape it counts.
+  [WITAN_RUBRIC_VERSION_V27]: "sha256:8fa9d87e3047afb80e8e09d08c5cb88a651c8e8b69b6b35184d2ab98ddd3a8fb"
 });
 function rubricBehaviourFingerprint(rubricVersion) {
   return WITAN_RUBRIC_BEHAVIOUR_FINGERPRINTS[rubricVersion];
@@ -19397,7 +19771,8 @@ function usesV17DetectorClosure2(rubricVersion) {
 }
 var MAX_SIGNAL_ADJUSTMENT = 0.8;
 function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC, toolVersion) {
-  const parsedInput = WitanReportInputSchema.parse(input);
+  const marked = markOverLimitPaths(input);
+  const parsedInput = WitanReportInputSchema.parse(marked.input);
   const signalsByCriterion = mergeSignalsByCriterion(parsedInput.signals);
   const readFailureAbstentions = new Set(
     [...signalsByCriterion.values()].filter((signal) => signal.insufficientData === true && !isCompositeExcludedAbstention(signal)).map((signal) => signal.criterionId)
@@ -19412,7 +19787,7 @@ function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC, toolVersi
     }
   }
   const consumedSignals = [];
-  const criteria = rubric.map((rubricCriterion) => {
+  const scoredCriteria = rubric.map((rubricCriterion) => {
     const id = rubricCriterion.id;
     const signal = signalsByCriterion.get(id);
     const scored = scoreCriterion(signal, parsedInput.rubricVersion);
@@ -19462,6 +19837,7 @@ function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC, toolVersi
       ...signal?.disclosures ? { disclosures: signal.disclosures } : {}
     };
   });
+  const criteria = dropMarkedCitations(scoredCriteria, marked.droppedWithheldPaths);
   const categoryOrder = [];
   for (const rubricCriterion of rubric) {
     if (!categoryOrder.includes(rubricCriterion.category)) {
@@ -20030,7 +20406,7 @@ function ensureFindingsExplainStatus(criterionId, score, status, findings, evide
   )) {
     return [...findings];
   }
-  const anchor = evidence[0] ?? {
+  const anchor = evidence.find(isCitablePointer) ?? {
     kind: "repository",
     label: `${criterionId} metric-derived score`,
     path: "."
@@ -20659,11 +21035,13 @@ function describeWithheldReasons(entries) {
 function buildWithheldPathsGapSentence(report) {
   const withheldPaths = report.withheldPaths;
   if (withheldPaths === void 0) return void 0;
+  const unlisted = statesUnlistedWithheldPaths(report.criteria);
   if (withheldPaths.length === 0) {
-    return "No content was withheld from any signal.";
+    return unlisted ? "Content was withheld at a path longer than the report's 700-character path limit; withheldPaths does not list it, and a criterion's disclosures or notes say how much." : "No content was withheld from any signal.";
   }
   const count = withheldPaths.length;
-  const entryWord = count === 1 ? "content entry was" : "content entries were";
+  const listed = unlisted ? "listed " : "";
+  const entryWord = count === 1 ? `${listed}content entry was` : `${listed}content entries were`;
   const pronoun = count === 1 ? "it" : "them";
   const reasonLabel = describeWithheldReasons(withheldPaths);
   const intersecting = withheldPaths.filter((entry) => entry.signalsAdmitting.length > 0);
@@ -23417,25 +23795,6 @@ init_esm_shims();
 import { lstatSync as lstatSync4, opendirSync, readFileSync as readFileSync4, realpathSync as realpathSync4 } from "fs";
 import { join as join3, resolve as resolve4 } from "path";
 
-// src/witan/finding-limits.ts
-init_esm_shims();
-var RULE_ID_MAX = 200;
-var MESSAGE_MAX = 500;
-var LOCATION_MAX = 700;
-function clamp(value, max) {
-  if (value.length <= max) return value;
-  const ellipsis = "...";
-  return `${value.slice(0, Math.max(max - ellipsis.length, 0))}${ellipsis}`;
-}
-function clampFinding(finding) {
-  return {
-    ...finding,
-    ruleId: clamp(finding.ruleId, RULE_ID_MAX),
-    message: clamp(finding.message, MESSAGE_MAX),
-    ...finding.location ? { location: clamp(finding.location, LOCATION_MAX) } : {}
-  };
-}
-
 // src/witan/generic-adapter.ts
 init_esm_shims();
 import { readFileSync } from "fs";
@@ -23945,14 +24304,16 @@ function scoreRepoWithPublicCejel(options) {
   if (options.rubricVersion !== void 0) {
     assertSelectableRubricVersion(options.rubricVersion);
   }
+  const historyDepth = readHistoryDepthAnswer(options.repoPath);
   const input = buildWitanInputFromRepo({
     productSlug: options.productSlug,
     productDisplayName: options.productDisplayName,
     repoPath: options.repoPath,
+    historyDepth,
     ...options.generatedAt ? { generatedAt: options.generatedAt } : {},
     ...options.rubricVersion ? { rubricVersion: options.rubricVersion } : {}
   });
-  const scannedSubject = readScannedSubject(
+  const { subject: scannedSubject, commitTimeLimitation } = readScannedSubjectAnswer(
     options.repoPath,
     input.repo.headSha,
     options.subjectRepository
@@ -23961,12 +24322,12 @@ function scoreRepoWithPublicCejel(options) {
   const inputBinding = documents.length > 0 ? buildInputBinding(documents, scannedSubject, options.strictIngest ? "strict" : "record-only") : void 0;
   if (options.strictIngest && inputBinding) assertStrictIngestBinding(documents, inputBinding);
   const scored = createWitanReport(
-    input,
+    withScanLimitations(input, [documents.length > 0 ? commitTimeLimitation : void 0]),
     inputSignals.length > 0 ? inputSignals : void 0,
     void 0,
     options.toolVersion
   );
-  const historyLimitations = detectHistoryLimitations(options.repoPath);
+  const historyLimitations = detectHistoryLimitations(options.repoPath, historyDepth);
   const withHistory = historyLimitations ? { ...scored, historyLimitations } : scored;
   const report = inputBinding ? { ...withHistory, inputBinding } : withHistory;
   if (report.verdict !== "insufficient_source" || !isWitanNoMeasurementAbstention(report)) {
@@ -23995,7 +24356,7 @@ function assertReportVerifiable(report) {
     ].join("\n")
   );
 }
-function readScannedSubject(repoPath, headSha, subjectRepository) {
+function readScannedSubjectAnswer(repoPath, headSha, subjectRepository) {
   let repository;
   if (subjectRepository !== void 0) {
     repository = normalizeRepositoryIdentity(subjectRepository);
@@ -24006,19 +24367,34 @@ function readScannedSubject(repoPath, headSha, subjectRepository) {
     }
   }
   let commitTime;
+  let commitTimeLimitation;
   if (headSha) {
     const result = execGit(["show", "-s", "--format=%ct", "HEAD"], { cwd: repoPath });
+    if (!result.ok) {
+      commitTimeLimitation = `${describeGitFailure(result.reason, "HEAD committer-time discovery")} Cejel recorded each ingested input's freshness as unverifiable.`;
+    }
     const seconds = result.ok ? Number(result.stdout.trim()) : Number.NaN;
     if (Number.isSafeInteger(seconds) && seconds >= 0) {
       commitTime = plainIsoInstant(seconds * 1e3);
     }
   }
   return {
-    ...repository !== void 0 ? { repository } : {},
-    ...headSha ? { commit: headSha.toLowerCase() } : {},
-    ...commitTime !== void 0 ? { commitTime } : {}
+    subject: {
+      ...repository !== void 0 ? { repository } : {},
+      ...headSha ? { commit: headSha.toLowerCase() } : {},
+      ...commitTime !== void 0 ? { commitTime } : {}
+    },
+    ...commitTimeLimitation !== void 0 ? { commitTimeLimitation } : {}
   };
 }
+function withScanLimitations(input, extra) {
+  const existing = input.scanLimitations ?? [];
+  const added = [...new Set(extra.filter((entry) => entry !== void 0))].filter(
+    (entry) => !existing.includes(entry)
+  );
+  if (added.length === 0) return input;
+  return { ...input, scanLimitations: [...existing, ...added].slice(0, 16) };
+}
 function resolvePublicIngestInputs(options) {
   const seen = /* @__PURE__ */ new Set();
   const documents = [];