@cejel/cejel 0.6.3 → 0.6.5

package/dist/{chunk-FA72HEWJ.js → chunk-7XQVE76B.js}

@@ -532,6 +532,8 @@ var WITAN_RUBRIC_VERSION_V21 = "witan-rubric-v21-prospective-2026-08-10";
 var WITAN_RUBRIC_VERSION_V22 = "witan-rubric-v22-prospective-2026-08-10";
 var WITAN_RUBRIC_VERSION_V23 = "witan-rubric-v23-prospective-2026-09-06";
 var WITAN_RUBRIC_VERSION_V24 = "witan-rubric-v24-prospective-2026-09-15";
+var WITAN_RUBRIC_VERSION_V25 = "witan-rubric-v25-prospective-2026-10-12";
+var WITAN_RUBRIC_VERSION_V26 = "witan-rubric-v26-prospective-2026-10-14";
 var WITAN_LAST_CALIBRATED_RUBRIC_VERSION = WITAN_RUBRIC_VERSION_V17;
 var WITAN_PROSPECTIVE_RUBRIC_VERSIONS = Object.freeze([
   WITAN_RUBRIC_VERSION_V18,
@@ -540,7 +542,9 @@ var WITAN_PROSPECTIVE_RUBRIC_VERSIONS = Object.freeze([
   WITAN_RUBRIC_VERSION_V21,
   WITAN_RUBRIC_VERSION_V22,
   WITAN_RUBRIC_VERSION_V23,
-  WITAN_RUBRIC_VERSION_V24
+  WITAN_RUBRIC_VERSION_V24,
+  WITAN_RUBRIC_VERSION_V25,
+  WITAN_RUBRIC_VERSION_V26
 ]);
 var WITAN_SELECTABLE_RUBRIC_VERSIONS = Object.freeze([
   WITAN_LAST_CALIBRATED_RUBRIC_VERSION,
@@ -566,6 +570,8 @@ var WITAN_NO_MEASUREMENT_REASON = "No free-core rubric criterion produced a meas
 var WITAN_AUTHENTICATED_A1_ABSENCE_SUMMARY = "Reviewable source is present, but the tracked scan-eligible inventory matched no concrete test file, configured test runner, CI test command, or coverage configuration.";
 var WITAN_DIRECTORY_WALK_AUTHENTICATED_A1_ABSENCE_SUMMARY = "Reviewable source is present, but the bounded directory walk matched no concrete test file, configured test runner, CI test command, or coverage configuration.";
 var WITAN_LEGACY_AUTHENTICATED_A1_ABSENCE_SUMMARY = "Reviewable source is present, but the complete tracked inventory contains no concrete test file, configured test runner, CI test command, or coverage configuration.";
+var WITAN_A5_RECONCILIATION_UNSETTLED_DISCLOSURE = "Whether this repository's claims are reconciled against its implementation cannot be settled from static evidence; Cejel makes no finding on it.";
+var WITAN_A2_TENANT_ISOLATION_UNSETTLED_DISCLOSURE = "Whether tenant isolation is enforced outside the database cannot be settled from static evidence; Cejel makes no finding on it.";
 function isWitanNoMeasurementAbstention(report) {
   return report.verdict === "insufficient_source" && report.insufficientSourceReason.startsWith(WITAN_NO_MEASUREMENT_REASON) && report.criteria.every(
     ({ status }) => status === "not_applicable" || status === "insufficient_data"
@@ -642,14 +648,21 @@ init_esm_shims();
 init_esm_shims();
 import { createHash } from "crypto";
 var WITAN_RUBRIC_BEHAVIOUR_FINGERPRINTS = Object.freeze({
-  [WITAN_RUBRIC_VERSION_V17]: "sha256:2da86acf64c39d2edb7824df46250ea23c396264266a2cd925953e9c6ad25858",
-  [WITAN_RUBRIC_VERSION_V18]: "sha256:60917d1d81efe7cda6f6adbfaa05293e2d9bf1db37b39d084e47f9011a996b67",
-  [WITAN_RUBRIC_VERSION_V19]: "sha256:e050ce8563de0736d9cfb6c23e2ba04725d88465d378a8632576269b9bc9f269",
-  [WITAN_RUBRIC_VERSION_V20]: "sha256:0433adc34b58c0fd5500a0bdeaa910c854eedbadbeaabb9045238d4ba9be8878",
-  [WITAN_RUBRIC_VERSION_V21]: "sha256:d3796b78a45ea3593f6abe71c77c2d00a0056d0f2d88476a01329dc342166aa6",
-  [WITAN_RUBRIC_VERSION_V22]: "sha256:932bc09cbe555c6058a95be581ccf7a286c43887f90d32698f5273b7623824bf",
-  [WITAN_RUBRIC_VERSION_V23]: "sha256:db97dc999d37e3c39c3bd3e4b1778c94eb9ad3176fb5c7d7264a7e510b162fc1",
-  [WITAN_RUBRIC_VERSION_V24]: "sha256:e313fab25ae1779a11e86b23696881cd6f8fe2a845609dc93e2ff6f3ff8c16d5"
+  [WITAN_RUBRIC_VERSION_V17]: "sha256:5cd48f8c642300ae8736a09d4a24ce3a4f8885f6e099b5f27f99d950e0c944b4",
+  [WITAN_RUBRIC_VERSION_V18]: "sha256:4a5d17c84e265ec20cf54216d2e794dec1d299d859c69ac8ef1ab317fc479e2f",
+  [WITAN_RUBRIC_VERSION_V19]: "sha256:73dc0282a9ea2a481db8e86a9a5dc227a8b108356c358de029901f2dc38cef79",
+  [WITAN_RUBRIC_VERSION_V20]: "sha256:b5f4254a6056ff792d79a2d85892cdf05484eabded85ba13251a2c8fd5ac6336",
+  [WITAN_RUBRIC_VERSION_V21]: "sha256:f599d06354adb45af018639594cb6f44e7cb40445b84a0dcdd4438b8d7d069d0",
+  [WITAN_RUBRIC_VERSION_V22]: "sha256:34fb6ac5d1f6faf0912aa4d00924837eeee543614d7971247d005312b89928e1",
+  [WITAN_RUBRIC_VERSION_V23]: "sha256:ce24235861ce0f0dc4dafd22059a78d31f348e5c741e4056475867c29cc8b814",
+  [WITAN_RUBRIC_VERSION_V24]: "sha256:b221907d60d209cd3d57437892ae3dd873f4fa221ad8743954a30c8575d4e77c",
+  [WITAN_RUBRIC_VERSION_V25]: "sha256:0f2638a5088f95a610a0e12012442f1067af3e985b955f96ec71853d549693b9",
+  // v25's closure plus v26 item 6 (docs/calibration/v26/ruling-item-6.md and its amendment 1).
+  // The corpus holds no declared claim-reconciliation artifact, so the v25 A5 finding no longer
+  // fires on it and, by amendment 1, A5 is scored without reconciliation_artifact_depth. The A5
+  // component and the report components of the specimens whose code-trust score that moves differ
+  // from v25's. A2 does not move on this corpus.
+  [WITAN_RUBRIC_VERSION_V26]: "sha256:4530317d56fc73eb89287e344ad626e2b9a96908ef12eb9e9c13b839bd599dae"
 });
 function rubricBehaviourFingerprint(rubricVersion) {
   return WITAN_RUBRIC_BEHAVIOUR_FINGERPRINTS[rubricVersion];
@@ -717,7 +730,7 @@ var WITAN_RUBRIC = [
 
 // src/witan/scoring.ts
 function usesV17DetectorClosure(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V25 || rubricVersion === WITAN_RUBRIC_VERSION_V26 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V23;
 }
 var MAX_SIGNAL_ADJUSTMENT = 0.8;
 function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC, toolVersion) {
@@ -888,7 +901,7 @@ function statusForScore(score) {
 }
 function statusAfterInputAdjustment(nativeStatus, nativeScore, adjustment, rubricVersion) {
   if (adjustment === 0) return nativeStatus;
-  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22 && rubricVersion !== WITAN_RUBRIC_VERSION_V24 && rubricVersion !== WITAN_RUBRIC_VERSION_V23) {
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22 && rubricVersion !== WITAN_RUBRIC_VERSION_V25 && rubricVersion !== WITAN_RUBRIC_VERSION_V26 && rubricVersion !== WITAN_RUBRIC_VERSION_V24 && rubricVersion !== WITAN_RUBRIC_VERSION_V23) {
     return statusForScore(roundScore(Math.max(0, nativeScore - adjustment)));
   }
   const statusFloor = {
@@ -945,7 +958,7 @@ function mergeSignalsByCriterion(signals) {
   return merged;
 }
 function usesMetricScoring(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_RUBRIC_VERSION_V7 || rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_RUBRIC_VERSION_V7 || rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V25 || rubricVersion === WITAN_RUBRIC_VERSION_V26 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
 }
 function unmeasuredStatus(rubricVersion) {
   return rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0 ? "unverified" : "insufficient_data";
@@ -1333,7 +1346,7 @@ function calibratedCriterionStateV11(criterionId, metrics) {
   return void 0;
 }
 function ensureFindingsExplainStatus(criterionId, score, status, findings, evidence, rubricVersion) {
-  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22 && rubricVersion !== WITAN_RUBRIC_VERSION_V24 && rubricVersion !== WITAN_RUBRIC_VERSION_V23 && findings.length > 0) {
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && rubricVersion !== WITAN_RUBRIC_VERSION_V20 && rubricVersion !== WITAN_RUBRIC_VERSION_V21 && rubricVersion !== WITAN_RUBRIC_VERSION_V22 && rubricVersion !== WITAN_RUBRIC_VERSION_V25 && rubricVersion !== WITAN_RUBRIC_VERSION_V26 && rubricVersion !== WITAN_RUBRIC_VERSION_V24 && rubricVersion !== WITAN_RUBRIC_VERSION_V23 && findings.length > 0) {
     return [...findings];
   }
   if (status !== "critical" && status !== "warning") return [...findings];
@@ -1479,7 +1492,7 @@ var CERTIFICATE_GLOSSARY = [
   {
     key: "production-readiness-basic-checks",
     term: "Production-readiness basic checks",
-    definition: "A count of six named checks: a build or type-check command, a CI workflow, deployment configuration, an environment template, a health or readiness signal, and an error boundary.",
+    definition: "A count of six named checks: a build or type-check command, a CI workflow, deployment configuration, an environment template, a health or readiness signal, and an error boundary. In the calibrated rubric the health or readiness signal is credited only for a dedicated health or readiness file (such as health.ts or readiness.ts), a Dockerfile HEALTHCHECK, or Kubernetes liveness or readiness probes. A health route declared inline in an application file does not count there. The prospective witan-rubric-v25 and witan-rubric-v26 also credit such an inline route.",
     metricNames: ["prod_readiness_primitives"]
   },
   {
@@ -1611,7 +1624,7 @@ var CERTIFICATE_GLOSSARY = [
   {
     key: "protected-path-review-gate",
     term: "Protected-path review gate",
-    definition: "A binary check for a CODEOWNERS file or documentation of required review or branch protection. This is the repository-visible proxy for human review of sensitive-path changes.",
+    definition: "A binary check for a CODEOWNERS file in a location GitHub reads (the repository root, .github/ or docs/), or a document stating a required-review or branch-protection policy. A changelog, an experiment or calibration record, a review note or a report does not count. This is the repository-visible proxy for human review of sensitive-path changes.",
     metricNames: ["protected_path_review_gate"]
   }
 ];
@@ -1710,7 +1723,7 @@ var BINARY_METRIC_COPY = {
   },
   protected_path_review_gate: {
     positive: "present \u2014 CODEOWNERS or a documented required-review policy was detected",
-    negative: "missing \u2014 no CODEOWNERS or documented required-review policy detected"
+    negative: "missing \u2014 no CODEOWNERS file in a location GitHub reads, and no documented required-review or branch-protection policy detected"
   }
 };
 var CONDITIONAL_METRIC_COPY = {
@@ -1958,6 +1971,17 @@ function buildWithheldPathsGapSentence(report) {
   const reportsOnWhatItRead = signals.length === 1 ? "that signal reports on what it read" : "these signals report on what they read";
   return `${count} ${entryWord} withheld (${reasonLabel}); ${signalList} would have read ${pronoun}. Under this rubric ${reportsOnWhatItRead}; the prospective v23 rubric abstains instead.`;
 }
+var SETTLING_EVIDENCE_DISCLOSURES = [
+  { criterionId: "A2", sentence: WITAN_A2_TENANT_ISOLATION_UNSETTLED_DISCLOSURE },
+  { criterionId: "A5", sentence: WITAN_A5_RECONCILIATION_UNSETTLED_DISCLOSURE }
+];
+function settlingEvidenceDisclosures(report) {
+  return SETTLING_EVIDENCE_DISCLOSURES.filter(
+    ({ criterionId, sentence }) => report.criteria.some(
+      (criterion) => criterion.id === criterionId && criterion.status !== "not_applicable" && criterion.notes?.includes(sentence) === true
+    )
+  ).map(({ sentence }) => sentence);
+}
 function describeEstablishedDimensions(report, measured, applicable) {
   const total = report.criteria.length;
   const counts = formatMeasuredDimensionCounts(computeMeasuredCoverage(report));
@@ -2016,6 +2040,7 @@ function buildRelyingPartySummary(report) {
       `${contentEntries(excludedByExtension, "was", "were")} not read because ${excludedByExtension === 1 ? "its file type is" : "their file types are"} outside what Cejel reads. This is a fixed limit of the tool, not something the repository needs to fix.`
     );
   }
+  gaps.push(...settlingEvidenceDisclosures(report));
   const withheldPathsSentence = buildWithheldPathsGapSentence(report);
   if (withheldPathsSentence !== void 0) {
     gaps.push(withheldPathsSentence);
@@ -2892,7 +2917,7 @@ import {
   realpathSync,
   statSync
 } from "fs";
-import { basename, dirname, extname, join, relative, resolve, sep } from "path";
+import { basename, dirname, extname, join, posix, relative, resolve, sep } from "path";
 
 // src/witan/json-safe.ts
 init_esm_shims();
@@ -2902,7 +2927,7 @@ function stripBom(text) {
 
 // src/witan/repo-signals.ts
 function usesV17DetectorClosure2(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V25 || rubricVersion === WITAN_RUBRIC_VERSION_V26;
 }
 var LEGACY_INVENTORY_ABSENCE_CONTEXT = {
   rubricGeneration: "legacy",
@@ -2917,13 +2942,28 @@ var INVENTORY_SCAN_PATTERN_SETS = {
     id: "cejel.core-a1.concrete-test-files.v1",
     count: 16
   },
-  a1CoverageConfigurationV1: {
-    id: "cejel.core-a1.coverage-configuration.v1",
-    count: 10
+  // v1 (10 branches, every rubric but v23) and v2 (14, v23) were retired on 2026-10-14
+  // (goal_cejel_v26_coverage_config_recognition_2026-10-14), when v23's command-flag recognition
+  // and eleven documented configuration locations shipped under every rubric. Branches, counted
+  // the way v2 counted runners (one runner-flag branch however many runners it knows):
+  //   configuration (19): nyc/c8/coverage/codecov .json|.yml|.yaml; .coveragerc; lcov.info;
+  //     .coveralls.yml; vitest.config coverage with disabled values; jest.config coverage keys;
+  //     pyproject [tool.coverage]; package.json nyc/c8/istanbul objects; .codecov.yml|.yaml;
+  //     .nycrc family; .c8rc family; setup.cfg/tox.ini [coverage:run|report]; package.json
+  //     "jest" coverage keys; vite.config test.coverage; .simplecov; phpunit <coverage>; JaCoCo
+  //     in pom.xml; JaCoCo in build.gradle(.kts); tarpaulin.toml.
+  //   commands (6): CI run steps; reachable package scripts; reachable Make/just recipes; tracked
+  //     shell wrappers; coverage-tool invocation; runner coverage flags.
+  // v4 is those 25. v3 adds the four v17 heuristics v23 replaced rather than kept: a bare
+  // `coverage:` key in vitest.config, a jest.config coverage key of any value, a package script
+  // anywhere invoking nyc/c8/istanbul, and a script named `coverage`.
+  a1CoverageConfigurationV3: {
+    id: "cejel.core-a1.coverage-configuration.v3",
+    count: 29
   },
-  a1CoverageConfigurationV2: {
-    id: "cejel.core-a1.coverage-configuration.v2",
-    count: 14
+  a1CoverageConfigurationV4: {
+    id: "cejel.core-a1.coverage-configuration.v4",
+    count: 25
   },
   a2CurrentSecret: {
     id: "cejel.core-a2.current-secret-shape.v1",
@@ -2944,6 +2984,11 @@ var INVENTORY_SCAN_PATTERN_SETS = {
   a5ClaimRealityArtifact: {
     id: "cejel.core-a5.claim-reality-artifact.v1",
     count: 3
+  },
+  // v26 item 6: the one path the repository itself declared, looked up in the inventory.
+  a5DeclaredClaimArtifactPath: {
+    id: "cejel.core-a5.declared-claim-artifact-path.v1",
+    count: 1
   }
 };
 function inventoryScanDerivation(inventoryCount, patternSet, matchCount) {
@@ -3149,15 +3194,17 @@ function buildWitanInputFromRepoUntracked(options) {
     rubricGeneration: usesV17Detectors ? "current" : "legacy",
     inventoryProvenance: fileInventory.repoFileInventoryScope === "tracked-scan-eligible" ? "tracked-scan-eligible" : "directory-walk"
   };
-  const usesV18NativeRls = rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24;
-  const usesV19CommitYear = rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24;
-  const usesV20A3ExplicitGaps = rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24;
-  const usesV21ExecutedEscalations = rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24;
-  const usesV22PackageStartEntrypoint = rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24;
-  const usesV23CommandCoverage = rubricVersion === WITAN_RUBRIC_VERSION_V23;
+  const usesV18NativeRls = rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V25 || rubricVersion === WITAN_RUBRIC_VERSION_V26;
+  const usesV19CommitYear = rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V25 || rubricVersion === WITAN_RUBRIC_VERSION_V26;
+  const usesV20A3ExplicitGaps = rubricVersion === WITAN_RUBRIC_VERSION_V20 || rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V25 || rubricVersion === WITAN_RUBRIC_VERSION_V26;
+  const usesV21ExecutedEscalations = rubricVersion === WITAN_RUBRIC_VERSION_V21 || rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V25 || rubricVersion === WITAN_RUBRIC_VERSION_V26;
+  const usesV22PackageStartEntrypoint = rubricVersion === WITAN_RUBRIC_VERSION_V22 || rubricVersion === WITAN_RUBRIC_VERSION_V23 || rubricVersion === WITAN_RUBRIC_VERSION_V24 || rubricVersion === WITAN_RUBRIC_VERSION_V25 || rubricVersion === WITAN_RUBRIC_VERSION_V26;
+  const usesV23StrictCoverageAndRecipeRunners = rubricVersion === WITAN_RUBRIC_VERSION_V23;
   const usesV23PemPrivateKeyGrammar = rubricVersion === WITAN_RUBRIC_VERSION_V23;
   const usesV23WithheldPathAbstention = rubricVersion === WITAN_RUBRIC_VERSION_V23;
   const usesV24SecretContentContext = rubricVersion === WITAN_RUBRIC_VERSION_V24;
+  const usesV25InlineHealthRoute = rubricVersion === WITAN_RUBRIC_VERSION_V25 || rubricVersion === WITAN_RUBRIC_VERSION_V26;
+  const usesV26SettlingEvidence = rubricVersion === WITAN_RUBRIC_VERSION_V26;
   const structuralArchetype = classifyRepoArchetype(inventoryFiles, rubricVersion);
   const readableArchetype = rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure2(rubricVersion) ? applyReadableSourceRepresentationGate(
     options.repoPath,
@@ -3193,10 +3240,12 @@ function buildWitanInputFromRepoUntracked(options) {
     usesV20A3ExplicitGaps,
     usesV21ExecutedEscalations,
     usesV22PackageStartEntrypoint,
-    usesV23CommandCoverage,
+    usesV23StrictCoverageAndRecipeRunners,
     usesV23PemPrivateKeyGrammar,
     usesV23WithheldPathAbstention,
     usesV24SecretContentContext,
+    usesV25InlineHealthRoute,
+    usesV26SettlingEvidence,
     reviewableSourceProof,
     inventoryAbsenceContext,
     scanLimitations
@@ -3811,7 +3860,7 @@ function buildNotApplicableSignal(criterionId, reason) {
     notApplicable: true
   };
 }
-function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, useV23CommandCoverage, useV23PemPrivateKeyGrammar, useV23WithheldPathAbstention, useV24SecretContentContext, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, scanLimitations = /* @__PURE__ */ new Set()) {
+function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, useV20A3ExplicitGaps, useV21ExecutedEscalations, useV22PackageStartEntrypoint, useV23StrictCoverageAndRecipeRunners, useV23PemPrivateKeyGrammar, useV23WithheldPathAbstention, useV24SecretContentContext, useV25InlineHealthRoute, useV26SettlingEvidence, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, scanLimitations = /* @__PURE__ */ new Set()) {
   const signals = [];
   const mono = resolveMonorepoContext(repoPath, scanLimitations);
   const collectCriterion = (criterionId, collect) => withContentReadCriterion(criterionId, collect);
@@ -3823,7 +3872,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       useV27Detectors,
       useV33Detectors,
       useV36Detectors,
-      useV23CommandCoverage,
+      useV23StrictCoverageAndRecipeRunners,
       reviewableSourceProof,
       inventoryAbsenceContext
     )
@@ -3842,7 +3891,8 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       useV24SecretContentContext,
       useV18NativeRls,
       inventoryAbsenceContext,
-      scanLimitations
+      scanLimitations,
+      useV26SettlingEvidence
     )
   );
   const a3Signal = collectCriterion(
@@ -3854,7 +3904,8 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       useV20A3ExplicitGaps,
       useV22PackageStartEntrypoint,
       useV23WithheldPathAbstention,
-      inventoryAbsenceContext
+      inventoryAbsenceContext,
+      useV25InlineHealthRoute
     )
   );
   const a4Signal = collectCriterion(
@@ -3875,7 +3926,8 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
       repoFiles,
       useV27Detectors,
       useV23WithheldPathAbstention,
-      inventoryAbsenceContext
+      inventoryAbsenceContext,
+      useV26SettlingEvidence
     )
   );
   const b1Signal = buildNotApplicableSignal(
@@ -3927,7 +3979,7 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
   }
   return signals;
 }
-function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV23CommandCoverage, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
+function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV23StrictCoverageAndRecipeRunners, reviewableSourceProof, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
   const evidence = [];
   const findings = [];
   const allTestFiles = findConcreteTestFiles(
@@ -3938,10 +3990,10 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
   const testFiles = allTestFiles.slice(0, 8);
   const sourceFiles = repoFiles.filter(isSourceFile);
   const runnerFiles = repoFiles.filter(
-    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && (isTestRunnerConfig(repoPath, file) || useV23CommandCoverage && isRecipeTestEntry(repoPath, file))
+    (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && (isTestRunnerConfig(repoPath, file) || useV23StrictCoverageAndRecipeRunners && isRecipeTestEntry(repoPath, file))
   ).slice(0, 6);
   const baseConfiguredRunnerFiles = useV33Detectors ? findConfiguredTestRunnerFiles(repoPath, repoFiles) : runnerFiles;
-  const configuredRunnerFiles = useV23CommandCoverage ? [
+  const configuredRunnerFiles = useV23StrictCoverageAndRecipeRunners ? [
     .../* @__PURE__ */ new Set([
       ...baseConfiguredRunnerFiles,
       ...repoFiles.filter((file) => isRecipeTestEntry(repoPath, file))
@@ -3950,11 +4002,12 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
   const packageJson = findRootPackageJson(repoFiles);
   const packageScripts = packageJson ? readPackageScripts(join(repoPath, packageJson)) : /* @__PURE__ */ new Map();
   const { coverageAnalysis, coveragePercent } = withContentReadSignal("A1", "coverage_percent", () => {
-    const analysis = useV23CommandCoverage ? analyzeCoverageConfiguration(repoPath, repoFiles, useV27Detectors) : {
-      coverageFiles: findCoverageConfigFiles(repoPath, repoFiles, useV27Detectors),
-      unresolvedFiles: [],
-      hasCoverageCommand: packageScripts.has("coverage")
-    };
+    const commandAnalysis = analyzeCoverageConfiguration(repoPath, repoFiles, useV27Detectors);
+    const analysis = useV23StrictCoverageAndRecipeRunners ? commandAnalysis : unionWithLegacyCoverageRecognition(
+      commandAnalysis,
+      findCoverageConfigFiles(repoPath, repoFiles, useV27Detectors),
+      packageScripts.has("coverage")
+    );
     return {
       coverageAnalysis: analysis,
       coveragePercent: readCoveragePercent(repoPath, analysis.coverageFiles.slice(0, 4))
@@ -4106,7 +4159,7 @@ function collectA1TestIntegrityEvidence(repoPath, repoFiles, useV27Detectors, us
           evidence: firstEvidence,
           context: inventoryAbsenceContext,
           inventoryCount: repoFiles.length,
-          patternSet: useV23CommandCoverage ? INVENTORY_SCAN_PATTERN_SETS.a1CoverageConfigurationV2 : INVENTORY_SCAN_PATTERN_SETS.a1CoverageConfigurationV1,
+          patternSet: useV23StrictCoverageAndRecipeRunners ? INVENTORY_SCAN_PATTERN_SETS.a1CoverageConfigurationV4 : INVENTORY_SCAN_PATTERN_SETS.a1CoverageConfigurationV3,
           matchCount: 0
         })
       );
@@ -4253,7 +4306,7 @@ function buildA1AuthenticatedAbsenceSignal(repoPath, proof, inventoryCount, inve
     notes: `V17 authenticated absence: ${proof.eligibleSourceFileCount} criterion-ratable of ${proof.sourceShapedFileCount} source-shaped files; sampled ${proof.sampledFileCount}; ${proof.readableSampledFileCount} representative-text files. Verification-script signals (lint/typecheck/coverage/CI commands) are independent of test-file presence and are still credited above where detected.`
   };
 }
-function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV23PemPrivateKeyGrammar, useV24SecretContentContext, useV18NativeRls, inventoryAbsenceContext, scanLimitations) {
+function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV23PemPrivateKeyGrammar, useV24SecretContentContext, useV18NativeRls, inventoryAbsenceContext, scanLimitations, useV26SettlingEvidence = false) {
   const evidence = [];
   const findings = [];
   const gitignore = repoFiles.find((file) => basename(file) === ".gitignore");
@@ -4539,7 +4592,7 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
       evidence: historySecretScan.envPathEvidence
     });
   }
-  const hasTenantWithoutRlsGap = rlsPolicyCount === 0 && (useV18NativeRls ? tenantWithoutRlsPremiseFiles.length > 0 : isMultiTenant);
+  const hasTenantWithoutRlsGap = !useV26SettlingEvidence && rlsPolicyCount === 0 && (useV18NativeRls ? tenantWithoutRlsPremiseFiles.length > 0 : isMultiTenant);
   if (hasTenantWithoutRlsGap) {
     const gapEvidence = rlsMigration ?? tenantScopedFile ?? tenantWithoutRlsPremiseFiles[0];
     if (gapEvidence) {
@@ -4565,6 +4618,28 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
       );
     }
   }
+  let tenantIsolationUnsettled = false;
+  if (useV26SettlingEvidence) {
+    const uncoveredTables = withContentReadSignals(
+      "A2",
+      ["rls_policy_count", "tenant_scope_ratio"],
+      () => findUncoveredTenantTables(repoPath, repoFiles)
+    );
+    for (const table of uncoveredTables) {
+      findings.push({
+        severity: "warning",
+        summary: `Table \`${table.name}\` carries a tenant column and no row-level-security policy, while this repository enforces tenant isolation with row-level security elsewhere.`,
+        evidence: evidenceForRelativeAtLine(
+          repoPath,
+          table.file,
+          "artifact",
+          "Tenant table without a row-level-security policy",
+          table.line
+        )
+      });
+    }
+    tenantIsolationUnsettled = uncoveredTables.length === 0 && tenantWithoutRlsPremiseFiles.length > 0;
+  }
   evidence.push(...cryptoHygiene.evidence);
   findings.push(...cryptoHygiene.findings);
   if (evidence.length === 0 && findings.length === 0) return null;
@@ -4652,7 +4727,8 @@ function collectA2IsolationEvidence(repoPath, repoFiles, useV27Detectors, useV33
       useV18NativeRls ? "History secret scanning covers all reachable git history for credential-pattern paths unless the explicit credential-blob safety valve is reported. Positive multi-tenancy credit is derived only from this repository\u2019s own CREATE POLICY USING/WITH CHECK clauses; no fixed tenant-token vocabulary can create isolation credit. A conservative schema premise is retained only to fail closed when a tenant-shaped schema has zero RLS policies." : "History secret scanning covers all reachable git history for credential-pattern paths unless the explicit credential-blob safety valve is reported.",
       ...abstainsSecretCleanliness ? [
         "Cejel abstained on secret cleanliness: the current-tree scan matched a secret-shaped value it could not classify from content as either a credential or an example. The metric is withheld rather than scored; every other A2 signal is unaffected."
-      ] : []
+      ] : [],
+      ...tenantIsolationUnsettled ? [WITAN_A2_TENANT_ISOLATION_UNSETTLED_DISCLOSURE] : []
     ].join(" ")
   };
 }
@@ -4752,7 +4828,7 @@ function collectCryptoHygieneEvidence(repoPath, implFiles, useV39Detectors = fal
   }
   return { evidence, findings, hasSurface, clean: hasSurface && !insecureFound };
 }
-function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, useV20ExplicitGaps = false, useV22PackageStartEntrypoint = false, useV23WithheldPathAbstention = false, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
+function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, useV20ExplicitGaps = false, useV22PackageStartEntrypoint = false, useV23WithheldPathAbstention = false, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, useV25InlineHealthRoute = false) {
   const v20DirectHttpEntrypoint = useV20ExplicitGaps ? findV20DirectHttpServerEntrypointFile(repoPath, repoFiles) : null;
   const v22PackageStartHttpEntrypoint = useV22PackageStartEntrypoint ? findV22PackageStartHttpServerEntrypointFile(repoPath, repoFiles) : null;
   const v20RuntimeContainer = useV20ExplicitGaps ? findRuntimeContainerEntrypointFile(repoPath, repoFiles, true) : null;
@@ -4790,8 +4866,16 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
     )
   );
   const healthCheck = healthChecks[0];
-  const healthReadinessRouteReads = (file) => isAuthoredProductionPath(file) && (isImplementationFile(file) || HEALTH_ROUTE_FUNCTIONS_DIR_PATTERN.test(file));
+  const healthReadinessRouteReads = (file) => isAuthoredProductionPath(file) && (isImplementationFile(file) || HEALTH_ROUTE_FUNCTIONS_DIR_PATTERN.test(file) || HEALTH_ROUTE_ENTRYPOINT_HOME_PATTERN.test(file));
   const observabilityDepthReads = (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isImplementationFile(file);
+  const inlineHealthRouteFile = useV25InlineHealthRoute && healthChecks.length === 0 ? withContentReadSignal(
+    "A3",
+    "prod_readiness_primitives",
+    () => repoFiles.find(
+      (file) => healthReadinessRouteReads(file) && fileMatchesOutsideComments(repoPath, file, V20_HEALTH_OR_READINESS_ROUTE_PATTERN)
+    )
+  ) : void 0;
+  const hasHealthOrReadinessSignal = healthChecks.length > 0 || inlineHealthRouteFile !== void 0;
   const { hasV20HealthOrReadinessRoute, hasV22PackageStartHealthOrReadinessRoute } = withContentReadSignal("A3", "health_readiness_route", () => ({
     hasV20HealthOrReadinessRoute: useV20ExplicitGaps && repoFiles.some(
       (file) => healthReadinessRouteReads(file) && fileContains(repoPath, file, V20_HEALTH_OR_READINESS_ROUTE_PATTERN)
@@ -4855,12 +4939,28 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
       /rollback|roll back|migration safety|down migration|reversible|undo migration/i
     )
   );
+  const rootOnlyScriptsNote = rootOnlyPackageScriptsDisclosure(repoFiles, packageJson);
   if (packageJson && (scripts.has("build") || scripts.has("typecheck"))) {
     evidence.push(
       evidenceForRelative(repoPath, packageJson, "prod_check", "Build or typecheck script")
     );
   }
-  if (workflow) evidence.push(evidenceForRelative(repoPath, workflow, "ci_run", "CI workflow"));
+  if (workflow) {
+    evidence.push(
+      evidenceForRelative(
+        repoPath,
+        workflow,
+        "ci_run",
+        ciWorkflowCitationLabel(
+          "CI workflow",
+          "counted",
+          workflows.length,
+          1,
+          unreadCiWorkflowReasons((file) => !useV27Detectors || isAuthoredProductionPath(file))
+        )
+      )
+    );
+  }
   if (releaseDeployConfig)
     evidence.push(
       evidenceForRelative(
@@ -4889,6 +4989,24 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
         evidenceForRelative(repoPath, healthCheck, "prod_check", "Health/readiness signal")
       )
     );
+  } else if (inlineHealthRouteFile) {
+    withContentReadSignal(
+      "A3",
+      "prod_readiness_primitives",
+      () => evidence.push(
+        evidenceForRelativeAtLine(
+          repoPath,
+          inlineHealthRouteFile,
+          "prod_check",
+          "Health/readiness route",
+          findFirstMatchingLineOutsideComments(
+            repoPath,
+            inlineHealthRouteFile,
+            V20_HEALTH_OR_READINESS_ROUTE_PATTERN
+          )
+        )
+      )
+    );
   }
   if (errorBoundary) {
     evidence.push(
@@ -4928,8 +5046,13 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
   }
   if (evidence.length === 0) return null;
   if (useV20ExplicitGaps) {
-    const hasBuildOrTypecheck = scripts.has("build") || scripts.has("typecheck");
+    const workspaceManifests = packageJson ? findDeclaredWorkspaceManifests(repoPath, repoFiles, packageJson) : NO_DECLARED_WORKSPACE_MANIFESTS;
+    const hasBuildOrTypecheck = scripts.has("build") || scripts.has("typecheck") || workspaceManifests.declared > workspaceManifests.read.length || workspaceManifests.read.some((file) => {
+      const workspaceScripts = readPackageScripts(join(repoPath, file));
+      return workspaceScripts.has("build") || workspaceScripts.has("typecheck");
+    });
     if (packageJson && !hasBuildOrTypecheck) {
+      const workspaceRead = workspaceManifests.read.length;
       findings.push({
         severity: "info",
         summary: "A deployable service package manifest declares neither a build nor a typecheck script.",
@@ -4937,7 +5060,7 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
           repoPath,
           packageJson,
           "prod_check",
-          "Deployable service manifest without a build or typecheck script"
+          workspaceRead > 0 ? `Deployable service manifest without a build or typecheck script (${workspaceRead} declared workspace package.json file${workspaceRead === 1 ? "" : "s"} read)` : "Deployable service manifest without a build or typecheck script"
         )
       });
     } else if (runtimeContainer) {
@@ -5016,7 +5139,7 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
           workflows.length > 0,
           deployConfigs.length > 0,
           envTemplate,
-          healthChecks.length > 0,
+          hasHealthOrReadinessSignal,
           errorBoundary !== void 0
         ].filter(Boolean).length,
         6,
@@ -5033,9 +5156,10 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
             { label: "CI workflow", count: workflows.length > 0 ? 1 : 0 },
             { label: "deployment configuration", count: deployConfigs.length > 0 ? 1 : 0 },
             { label: "environment template", count: envTemplate ? 1 : 0 },
-            { label: "health or readiness signal", count: healthChecks.length > 0 ? 1 : 0 },
+            { label: "health or readiness signal", count: hasHealthOrReadinessSignal ? 1 : 0 },
             { label: "error boundary", count: errorBoundary !== void 0 ? 1 : 0 }
-          ]
+          ],
+          ...rootOnlyScriptsNote ? { condition: rootOnlyScriptsNote } : {}
         }
       ),
       metric(
@@ -5278,7 +5402,7 @@ function hasDeclaredVersionConstraint(dependency) {
   if (/[~^<>=!]/.test(trimmed)) return true;
   return /^v?\d/.test(trimmed);
 }
-function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors, useV23WithheldPathAbstention, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
+function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors, useV23WithheldPathAbstention, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT, useV26SettlingEvidence = false) {
   const claimImplementationReads = claimImplementationFileReads(useV27Detectors);
   abstainSignalOnWithheldPaths(
     "A5",
@@ -5372,10 +5496,40 @@ function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors, use
       )
     );
   }
+  const claimArtifactDeclarations = useV26SettlingEvidence && reconciliationArtifacts.length === 0 ? withContentReadSignal(
+    "A5",
+    "reconciliation_artifact_depth",
+    () => scanClaimArtifactDeclarations(repoPath, repoFiles)
+  ) : void 0;
+  const declaredAbsentArtifact = claimArtifactDeclarations?.firstAbsent;
+  const reconciliationUnsettled = useV26SettlingEvidence && reconciliationArtifacts.length === 0 && declaredAbsentArtifact === void 0;
+  const omitReconciliationArtifactDepth = claimArtifactDeclarations !== void 0 && !claimArtifactDeclarations.declared;
   return {
     criterionId: "A5",
     positiveEvidence: evidence,
-    findings: reconciliationArtifacts.length > 0 ? [] : [
+    findings: reconciliationArtifacts.length > 0 ? [] : useV26SettlingEvidence ? declaredAbsentArtifact === void 0 ? [] : [
+      inventoryAbsenceFinding({
+        // Same severity rule as the finding it replaces: documented negative space is
+        // itself claim-reality discipline.
+        severity: negativeSpaceDoc ? "info" : "warning",
+        summaries: {
+          legacy: `This repository declares a claim-reconciliation artifact at \`${declaredAbsentArtifact.path}\`, and that path is not present in the tracked scan-eligible inventory.`,
+          currentTracked: `This repository declares a claim-reconciliation artifact at \`${declaredAbsentArtifact.path}\`, and that path is not present in the tracked scan-eligible inventory.`,
+          currentDirectoryWalk: `This repository declares a claim-reconciliation artifact at \`${declaredAbsentArtifact.path}\`, and that path is not present in the bounded directory walk.`
+        },
+        evidence: evidenceForRelativeAtLine(
+          repoPath,
+          declaredAbsentArtifact.declaringFile,
+          "claim_reconciliation",
+          "Declares a claim-reconciliation artifact that is absent",
+          declaredAbsentArtifact.line
+        ),
+        context: inventoryAbsenceContext,
+        inventoryCount: repoFiles.length,
+        patternSet: INVENTORY_SCAN_PATTERN_SETS.a5DeclaredClaimArtifactPath,
+        matchCount: 0
+      })
+    ] : [
       inventoryAbsenceFinding({
         // Proxy-only A5: cap at warning (never critical) — a static proxy is lower-confidence
         // than a curated registry or reconciliation artifact. Downgraded to info when the repo
@@ -5422,16 +5576,19 @@ function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors, use
         "Credits multiple claim-bearing documents without judging unverified prose as truth.",
         "saturating_count"
       ),
-      metric(
-        "reconciliation_artifact_depth",
-        "Reconciliation artifact depth",
-        reconciliationArtifacts.length,
-        3,
-        0.15,
-        "artifacts",
-        "Requires a specific claim-reality artifact to reach full depth."
-      )
-    ]
+      ...omitReconciliationArtifactDepth ? [] : [
+        metric(
+          "reconciliation_artifact_depth",
+          "Reconciliation artifact depth",
+          reconciliationArtifacts.length,
+          3,
+          0.15,
+          "artifacts",
+          "Requires a specific claim-reality artifact to reach full depth."
+        )
+      ]
+    ],
+    ...reconciliationUnsettled ? { notes: WITAN_A5_RECONCILIATION_UNSETTLED_DISCLOSURE } : {}
   };
 }
 function collectB2PrTraceEvidence(repoPath, repoFiles) {
@@ -5442,8 +5599,16 @@ function collectB2PrTraceEvidence(repoPath, repoFiles) {
   const branchProtectionDoc = repoFiles.find(
     (file) => /branch.*protection|review.*gate/i.test(file) || GITHUB_CODEOWNERS_PATH_PATTERN.test(file)
   );
+  const citedWorkflows = workflows.slice(0, 3);
+  const workflowLabel = ciWorkflowCitationLabel(
+    "Pull-request CI workflow",
+    "counted",
+    workflows.length,
+    citedWorkflows.length,
+    unreadCiWorkflowReasons(() => true)
+  );
   const evidence = [
-    ...workflows.slice(0, 3).map((file) => evidenceForRelative(repoPath, file, "ci_run", "Pull-request CI workflow")),
+    ...citedWorkflows.map((file) => evidenceForRelative(repoPath, file, "ci_run", workflowLabel)),
     ...prTemplate ? [evidenceForRelative(repoPath, prTemplate, "pull_request", "Pull request template")] : [],
     ...branchProtectionDoc ? [
       evidenceForRelative(
@@ -5516,11 +5681,35 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
   if (packageJson && scripts.has("lint")) {
     evidence.push(evidenceForRelative(repoPath, packageJson, "ci_run", "Lint script"));
   }
+  const unreadWorkflows = unreadCiWorkflowReasons(() => true);
+  const workflowsRead = workflows.length + rootWorkflows.length;
+  const delegatedSteps = withContentReadSignal(
+    "B3",
+    "default_branch_ci_depth",
+    () => sumDelegatedCiSteps(
+      countDelegatedCiSteps(repoPath, workflows),
+      mono ? countDelegatedCiSteps(mono.root, rootWorkflows) : NO_DELEGATED_CI_STEPS
+    )
+  );
   if (workflow) {
     withContentReadSignals(
       "B3",
       ["ci_script_depth", "default_branch_ci_depth"],
-      () => evidence.push(evidenceForRelative(repoPath, workflow, "ci_run", "CI workflow"))
+      () => evidence.push(
+        evidenceForRelative(
+          repoPath,
+          workflow,
+          "ci_run",
+          ciWorkflowCitationLabel(
+            "CI workflow",
+            "read",
+            workflowsRead,
+            1,
+            unreadWorkflows,
+            delegatedSteps
+          )
+        )
+      )
     );
   } else if (rootWorkflows[0] && mono) {
     const rootWorkflow = rootWorkflows[0];
@@ -5528,7 +5717,19 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
       "B3",
       ["ci_script_depth", "default_branch_ci_depth"],
       () => evidence.push(
-        evidenceForRelative(mono.root, rootWorkflow, "ci_run", "CI workflow (monorepo root)")
+        evidenceForRelative(
+          mono.root,
+          rootWorkflow,
+          "ci_run",
+          ciWorkflowCitationLabel(
+            "CI workflow (monorepo root)",
+            "read",
+            workflowsRead,
+            1,
+            unreadWorkflows,
+            delegatedSteps
+          )
+        )
       )
     );
   }
@@ -5540,9 +5741,16 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
     CI_TYPECHECK_COMMAND_PATTERN,
     CI_BUILD_COMMAND_PATTERN
   ];
-  const scriptDepth = ["test", "lint", "typecheck", "build"].filter(
-    (s) => s === "test" ? hasCredibleTestScript(scripts) : scripts.has(s)
-  ).length;
+  const workspaceManifests = findDeclaredWorkspaceManifests(repoPath, repoFiles, packageJson);
+  const scriptSources = [
+    scripts,
+    ...workspaceManifests.read.map((file) => readPackageScripts(join(repoPath, file)))
+  ];
+  const declaresScript = (name) => scriptSources.some(
+    (source) => name === "test" ? hasCredibleTestScript(source) : source.has(name)
+  );
+  const rootOnlyScriptsNote = workspaceManifests.read.length > 0 ? workspacePackageScriptsDisclosure(repoFiles, packageJson, workspaceManifests) : rootOnlyPackageScriptsDisclosure(repoFiles, packageJson);
+  const scriptDepth = ["test", "lint", "typecheck", "build"].filter(declaresScript).length;
   const { repoCategoryHits, rootCategoryHits } = withContentReadSignal(
     "B3",
     "ci_script_depth",
@@ -5575,7 +5783,7 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
           components: [
             ...["test", "lint", "typecheck", "build"].map((name) => ({
               label: `package script: ${name === "typecheck" ? "type-check" : name}`,
-              count: (name === "test" ? hasCredibleTestScript(scripts) : scripts.has(name)) ? 1 : 0
+              count: declaresScript(name) ? 1 : 0
             })),
             ...CI_COMMAND_CATEGORIES.map((_pattern, index) => ({
               label: `repository CI command: ${["test", "lint", "type-check", "build"][index]}`,
@@ -5585,7 +5793,8 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
               label: `monorepo-root CI command: ${["test", "lint", "type-check", "build"][index]}`,
               count: rootCategoryHits[index] ? 1 : 0
             })) : []
-          ]
+          ],
+          ...rootOnlyScriptsNote ? { condition: rootOnlyScriptsNote } : {}
         }
       ),
       metric(
@@ -6018,7 +6227,7 @@ var HEAVY_TEST_DEPENDENCY_NAME_PATTERN = /^(?:(?:jest|mocha|ava|tape|jasmine|kar
 var TIMING_SAFE_COMPARE_PATTERN = /\btiming[-_]?safe[-_]?(?:equal|compare)\b|crypto\.timingSafeEqual\s*\(/i;
 var CANONICAL_SERIALIZE_PATTERN = /\bcanonicalize\s*\(|\bcanonicalJson\b|\bstableStringify\s*\(|json-stable-stringify|safe-stable-stringify|\bsortKeys\s*\(/i;
 var SIGN_OR_HMAC_CALL_PATTERN = /\bcreateHmac\s*\(|\bcreateSign\s*\(|\.sign\s*\(/;
-var INSECURE_SECRET_COMPARE_LINE_PATTERN = /\b\w*(?:hmac|signature|\bmac|digest)\w*\s*(===|!==)\s*(?!['"`]|undefined\b|null\b)([\w.]+(?:\s*[-+]\s*\d+)?)/i;
+var INSECURE_SECRET_COMPARE_LINE_PATTERN = /\b\w*(?:hmac|signature|\bmac)\w*\s*(===|!==)\s*(?!['"`]|undefined\b|null\b)([\w.]+(?:\s*[-+]\s*\d+)?)/i;
 var DEFAULT_SECRET_SENTINEL_COMPARE_LINE_PATTERN = /\b(?:secret|token|password|apiKey)\w*\s*(?:===|!==|==|!=)\s*[\w.]*default(?:Secret|Token|Password|ApiKey)\b/i;
 var NUMERIC_SHAPED_OPERAND_PATTERN = /^-?\d+$|\.(?:length|len|size|count)\b|(?:length|index|idx|offset|count|size|len)$/i;
 function lineHasInsecureSecretCompare(line, useV39Detectors = false) {
@@ -6031,9 +6240,124 @@ function lineHasInsecureSecretCompare(line, useV39Detectors = false) {
 function findInsecureSecretCompareLine(repoPath, file, useV39Detectors = false) {
   const fullPath = join(repoPath, file);
   if (!isRegularFile(fullPath)) return null;
-  const lines = readRepoText(fullPath, "utf8").split("\n");
+  const contents = readRepoText(fullPath, "utf8");
+  const lines = contents.split("\n");
   const index = lines.findIndex((line) => lineHasInsecureSecretCompare(line, useV39Detectors));
-  return index === -1 ? null : index + 1;
+  const keyedDigestLine = findKeyedHmacDigestCompareLine(file, contents);
+  if (keyedDigestLine === null) return index === -1 ? null : index + 1;
+  return index === -1 ? keyedDigestLine : Math.min(index + 1, keyedDigestLine);
+}
+var KEYED_HMAC_GRAMMARS = [
+  [
+    /\.(?:ts|tsx|js|jsx)$/,
+    {
+      keyed: /\bcreateHmac\s*\(|\bsubtle\s*\.\s*sign\s*\(\s*(?:['"]HMAC['"]|\{\s*name\s*:\s*['"]HMAC['"])/,
+      produces: /\.\s*digest\s*\(|\bsubtle\s*\.\s*sign\s*\(/,
+      objectDigestCall: String.raw`\.\s*digest\s*\(`,
+      equality: "===|!==",
+      hashComments: false
+    }
+  ],
+  [
+    /\.py$/,
+    {
+      keyed: /\bhmac\s*\.\s*(?:new|digest)\s*\(/,
+      produces: /\.\s*(?:hex)?digest\s*\(/,
+      objectDigestCall: String.raw`\.\s*(?:hex)?digest\s*\(`,
+      equality: "==|!=",
+      hashComments: true
+    }
+  ],
+  [
+    /\.go$/,
+    {
+      keyed: /\bhmac\s*\.\s*New\s*\(/,
+      produces: /\.\s*Sum\s*\(/,
+      objectDigestCall: String.raw`\.\s*Sum\s*\(`,
+      equality: "==|!=",
+      hashComments: false
+    }
+  ],
+  [
+    /\.rb$/,
+    {
+      keyed: /\bOpenSSL\s*::\s*HMAC\s*\.\s*(?:new|(?:hex|base64)?digest)\b/,
+      produces: /\.\s*(?:hex|base64)?digest\b/,
+      objectDigestCall: String.raw`\.\s*(?:hex|base64)?digest\b`,
+      equality: "==|!=",
+      hashComments: true
+    }
+  ]
+];
+var VARIABLE_ASSIGNMENT_PATTERN = /(?<![\w$.])([A-Za-z_$][\w$]*)(?:\s*:\s*[A-Za-z_$][\w$.<>[\]]*)?\s*:?=(?![=>])/g;
+var ASSIGNED_EXPRESSION_MAX_CHARS = 512;
+function assignedExpressionEnd(code, start) {
+  const limit = Math.min(code.length, start + ASSIGNED_EXPRESSION_MAX_CHARS);
+  let depth = 0;
+  for (let i = start; i < limit; i += 1) {
+    const ch = code[i];
+    if (ch === "(" || ch === "[" || ch === "{") depth += 1;
+    else if (ch === ")" || ch === "]" || ch === "}") {
+      if (depth === 0) return i;
+      depth -= 1;
+    } else if (depth === 0 && (ch === ";" || ch === ",")) return i;
+    else if (depth === 0 && ch === "\n" && !/^\s*\./.test(code.slice(i + 1, i + 65))) return i;
+  }
+  return limit;
+}
+var escapeIdentifier = (identifier) => identifier.replace(/\$/g, "\\$");
+function findKeyedHmacDigestCompareLine(file, contents) {
+  const grammar = KEYED_HMAC_GRAMMARS.find(([extension]) => extension.test(file))?.[1];
+  if (!grammar || !/digest/i.test(contents) || !grammar.produces.test(contents)) return null;
+  const { commentFree, code } = maskCommentsAndStrings(contents, grammar.hashComments);
+  const startsInCode = (pattern, from, to) => {
+    for (const match of commentFree.slice(from, to).matchAll(new RegExp(pattern.source, "g"))) {
+      if (code[from + match.index] === commentFree[from + match.index]) return true;
+    }
+    return false;
+  };
+  const boundAt = /* @__PURE__ */ new Map();
+  const hmacValues = [];
+  const hmacObjects = [];
+  for (const assignment of code.matchAll(VARIABLE_ASSIGNMENT_PATTERN)) {
+    const name = assignment[1];
+    const start = assignment.index + assignment[0].length;
+    const end = assignedExpressionEnd(code, start);
+    const keyed = startsInCode(grammar.keyed, start, end);
+    let bound = false;
+    if (keyed && startsInCode(grammar.produces, start, end)) {
+      hmacValues.push(name);
+      bound = true;
+    } else if (keyed) {
+      hmacObjects.push(name);
+    } else {
+      bound = hmacValues.some(
+        (value) => startsInCode(new RegExp(`(?<![\\w$.])${escapeIdentifier(value)}(?![\\w$])`), start, end)
+      ) || hmacObjects.some(
+        (object) => startsInCode(
+          new RegExp(`(?<![\\w$.])${escapeIdentifier(object)}\\s*${grammar.objectDigestCall}`),
+          start,
+          end
+        )
+      );
+    }
+    if (bound && !boundAt.has(name)) boundAt.set(name, assignment.index);
+  }
+  if (boundAt.size === 0) return null;
+  const comparison = new RegExp(
+    `(?<![\\w$.])([A-Za-z_$][\\w$]*)\\s*(?:${grammar.equality})(?!=)\\s*(?!['"\`]|undefined\\b|null\\b|None\\b|nil\\b)([\\w.]+(?:\\s*[-+]\\s*\\d+)?)`,
+    "g"
+  );
+  for (const match of commentFree.matchAll(comparison)) {
+    const at = match.index;
+    const name = match[1];
+    if (code[at] !== commentFree[at] || !/digest/i.test(name)) continue;
+    const assignedAt = boundAt.get(name);
+    if (assignedAt === void 0 || assignedAt > at) continue;
+    if (NUMERIC_SHAPED_OPERAND_PATTERN.test(match[2].trim())) continue;
+    return contents.slice(0, at).split("\n").length;
+  }
+  return null;
 }
 function findFirstMatchingLine(repoPath, file, pattern) {
   const fullPath = join(repoPath, file);
@@ -6412,6 +6736,166 @@ var JS_TEST_ASSERTION_PATTERN = /(expect\(|assert\.|should\.|toEqual\(|toBe\(|as
 var CPP_TEST_ASSERTION_PATTERN = /\bEXPECT_|ASSERT_EQ\b|ASSERT_TRUE\b|ASSERT_FALSE\b|\bREQUIRE\s*\(|\bCHECK\s*\(|\bTEST\s*\(|\bTEST_F\s*\(|\bTEST_CASE\s*\(|\bSECTION\s*\(/;
 var MULTI_ECOSYSTEM_TEST_ASSERTION_PATTERN = /\.assert[A-Z_]\w*\s*\(|\bassert[A-Z]\w*\s*\(|\bpytest\.raises\b|\bself\.fail\s*\(|\bt\.(?:Error|Errorf|Fatal|Fatalf|Fail|FailNow)\b|\brequire\.[A-Z]\w*\s*\(|\b(?:debug_)?assert(?:_eq|_ne)?!\s*\(|\bassert_\w+\b|\$this->assert\w+\s*\(/;
 var SUITE_LEVEL_SKIP_PATTERN = /\b(?:describe|suite|context)\.skip\s*\(/;
+function hasLiveAvaAssertion(contents) {
+  const uncommented = stripJavaScriptComments(contents);
+  const imports = [...uncommented.matchAll(/\bimport\s+([A-Za-z_$][\w$]*)\s+from\s*['"]ava['"]|\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\s*\(\s*['"]ava['"]\s*\)/g)];
+  if (!imports.length) return false;
+  let quote = "";
+  let escaped = false;
+  const characters = uncommented.split("");
+  for (let i = 0; i < characters.length; i += 1) {
+    const ch = characters[i];
+    if (quote) {
+      characters[i] = ch === "\n" ? "\n" : " ";
+      if (escaped) escaped = false;
+      else if (ch === "\\") escaped = true;
+      else if (ch === quote) quote = "";
+    } else if (ch === "'" || ch === '"' || ch === "`") {
+      quote = ch;
+      characters[i] = " ";
+    }
+  }
+  const code = characters.join("");
+  const imported = imports.find((candidate) => code[candidate.index] === uncommented[candidate.index]);
+  const runner = imported?.[1] ?? imported?.[2];
+  if (!runner) return false;
+  const escape = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const calls = new RegExp(`\\b${escape(runner)}((?:\\.\\w+)*)\\s*\\(`, "g");
+  const closeAt = (open, left, right) => {
+    let depth = 1;
+    for (let i = open + 1; i < code.length; i += 1) {
+      if (code[i] === left) depth += 1;
+      else if (code[i] === right && --depth === 0) return i;
+    }
+    return -1;
+  };
+  for (const call of code.matchAll(calls)) {
+    const modifiers = call[1].split(".").filter(Boolean);
+    if (modifiers.some((modifier) => !["serial", "only", "failing"].includes(modifier))) continue;
+    const open = call.index + call[0].length - 1;
+    const close = closeAt(open, "(", ")");
+    if (close < 0) continue;
+    const args = code.slice(open + 1, close);
+    const callback = /(?:\basync\s+)?(?:\(\s*([A-Za-z_$][\w$]*)\s*\)|(?<![\w$])([A-Za-z_$][\w$]*))\s*=>|\bfunction(?:\s+\w+)?\s*\(\s*([A-Za-z_$][\w$]*)\s*\)/.exec(args);
+    const parameter = callback?.[1] ?? callback?.[2] ?? callback?.[3];
+    if (!callback || !parameter) continue;
+    let start = open + 1 + callback.index + callback[0].length;
+    while (/\s/.test(code[start] ?? "") && start < close) start += 1;
+    const end = code[start] === "{" ? closeAt(start, "{", "}") : close;
+    if (end < 0 || end > close) continue;
+    const assertion = new RegExp(`\\b${escape(parameter)}\\.(?:assert|pass|fail|truthy|falsy|true|false|is|not|deepEqual|notDeepEqual|throws|throwsAsync|notThrows|notThrowsAsync|regex|notRegex|snapshot|like)\\s*\\(`);
+    const body = code.slice(start, end);
+    const active = body.split("");
+    let maskedThrough = -1;
+    for (const nested of body.matchAll(/=>\s*|\bfunction(?:\s+\w+)?\s*\([^)]*\)\s*/g)) {
+      if (nested.index < maskedThrough) continue;
+      const begin = nested.index + nested[0].length;
+      let stop = begin;
+      if (body[begin] === "{") {
+        stop = closeAt(start + begin, "{", "}") - start + 1;
+      } else {
+        let depth = 0;
+        while (stop < body.length) {
+          const ch = body[stop];
+          if (depth === 0 && /[;,)]/.test(ch)) break;
+          if (ch === "(" || ch === "[") depth += 1;
+          else if (ch === ")" || ch === "]") depth -= 1;
+          stop += 1;
+        }
+      }
+      if (stop <= begin) continue;
+      for (let i = nested.index; i < Math.min(stop, active.length); i += 1) active[i] = " ";
+      maskedThrough = stop;
+    }
+    if (assertion.test(active.join(""))) return true;
+  }
+  return false;
+}
+var DOTNET_ASSERTION_PATTERN = /\b(?:Classic|Collection|String)?Assert\.[A-Z]\w*\s*(?:<[^<>()]*>\s*)?\(/;
+var XCTEST_ASSERTION_PATTERN = /\bXCT(?:Assert\w*|Fail|Unwrap)\s*\(/;
+var SCALATEST_IMPORT_PATTERN = /\bimport\s+org\.scalatest\b/;
+var SCALATEST_ASSERTION_PATTERN = /\b(?:assert|assertResult)\s*\(|\b(?:assertThrows|intercept)\s*\[/;
+var SCALATEST_MATCHERS_IMPORT_PATTERN = /\bimport\s+org\.scalatest\.(?:matchers\b|(?:Should|Must)?Matchers\b|_|\*|\{[^}]*\b(?:Should|Must)?Matchers\b)/;
+var SCALATEST_MATCHER_PATTERN = /\b(?:should|must)(?:Be|Equal)\b|\b(?:should|must)\s+(?:not\s+)?(?:be|equal|have|contain|include|startWith|endWith|matchPattern)\b|\b(?:should|must)\s*===/;
+var KOTEST_MATCHERS_IMPORT_PATTERN = /\bimport\s+io\.kotest\.(?:matchers|assertions)\b/;
+var KOTEST_MATCHER_PATTERN = /\bshould[A-Z]\w*\b/;
+var TAPE_OR_TAP_BINDING_PATTERN = /\bfrom\s*['"]tape?['"]|\brequire\s*\(\s*['"]tape?['"]\s*\)/g;
+var TAPE_OR_TAP_ASSERTION_PATTERN = /\bt\.(?:ok|notOk|notok|true|false|assert|error|ifError|ifErr|iferror|equal|equals|isEqual|strictEqual|strictEquals|is|notEqual|notEquals|isNotEqual|doesNotEqual|isInequal|notStrictEqual|notStrictEquals|isNot|not|looseEqual|looseEquals|notLooseEqual|notLooseEquals|deepEqual|deepEquals|isEquivalent|same|notDeepEqual|notDeepEquals|notEquivalent|notDeeply|notSame|deepLooseEqual|notDeepLooseEqual|strictSame|strictNotSame|has|notHas|hasStrict|notHasStrict|match|notMatch|doesNotMatch|matchOnly|notMatchOnly|matchStrict|notMatchStrict|matchOnlyStrict|notMatchOnlyStrict|type|throws|doesNotThrow|rejects|resolves|resolveMatch|emits|pass|fail)\s*\(/;
+var DOTNET_IGNORED_CLASS_PATTERN = /\[[^[\]]*\b(?:NUnit\.Framework\.|Microsoft\.VisualStudio\.TestTools\.UnitTesting\.)?Ignore(?:Attribute)?\b[^[\]]*\](?:\s*\[[^[\]]*\])*\s*(?:(?:public|internal|private|protected|sealed|abstract|static|partial|file)\s+)*class\b/;
+var SCALATEST_IGNORED_CLASS_PATTERN = /@(?:org\.scalatest\.)?Ignore\b(?:\s*@[\w.]+(?:\([^)]*\))?)*\s*(?:(?:final|abstract|sealed|private|protected)\s+)*class\b/;
+var KOTEST_IMPORT_PATTERN = /\bimport\s+io\.kotest\b/;
+var KOTEST_IGNORED_CLASS_PATTERN = /@(?:io\.kotest\.core\.annotation\.)?Ignored\b(?:\s*@[\w.]+(?:\([^)]*\))?)*\s*(?:(?:public|internal|private|open|abstract)\s+)*class\b/;
+var SUITE_SKIP_NAME_SHAPED_TEST_FILE_PATTERN = /Tests?\.cs$|(?:Spec|Test|Suite)\.scala$/;
+function maskCommentsAndStrings(contents, hashComments = false) {
+  const commentFree = contents.split("");
+  const code = contents.split("");
+  const blank = (target, from, to) => {
+    for (let i2 = from; i2 < to; i2 += 1) if (target[i2] !== "\n") target[i2] = " ";
+  };
+  let i = 0;
+  while (i < contents.length) {
+    const ch = contents[i];
+    const next = contents[i + 1];
+    let end = i + 1;
+    if (hashComments ? ch === "#" : ch === "/" && next === "/") {
+      end = contents.indexOf("\n", i);
+      if (end < 0) end = contents.length;
+      blank(commentFree, i, end);
+      blank(code, i, end);
+    } else if (!hashComments && ch === "/" && next === "*") {
+      let depth = 1;
+      end = i + 2;
+      while (end < contents.length && depth > 0) {
+        if (contents.startsWith("/*", end)) {
+          depth += 1;
+          end += 2;
+        } else if (contents.startsWith("*/", end)) {
+          depth -= 1;
+          end += 2;
+        } else end += 1;
+      }
+      blank(commentFree, i, end);
+      blank(code, i, end);
+    } else if (contents.startsWith('"""', i) || hashComments && contents.startsWith("'''", i)) {
+      const close = contents.indexOf(contents.slice(i, i + 3), i + 3);
+      end = close < 0 ? contents.length : close + 3;
+      blank(code, i, end);
+    } else if (ch === '"' || ch === "'" || ch === "`") {
+      const verbatim = ch === '"' && contents[i - 1] === "@";
+      end = i + 1;
+      while (end < contents.length) {
+        const c = contents[end];
+        if (verbatim && c === '"' && contents[end + 1] === '"') {
+          end += 2;
+          continue;
+        }
+        if (!verbatim && c === "\\") {
+          end += 2;
+          continue;
+        }
+        end += 1;
+        if (c === ch) break;
+      }
+      blank(code, i, end);
+    }
+    i = Math.max(end, i + 1);
+  }
+  return { commentFree: commentFree.join(""), code: code.join("") };
+}
+function hasLiveFrameworkAssertion({ commentFree, code }) {
+  const body = code.replace(/^[ \t]*import\b.*$/gm, (line) => " ".repeat(line.length));
+  if (DOTNET_ASSERTION_PATTERN.test(body) || XCTEST_ASSERTION_PATTERN.test(body)) return true;
+  if (SCALATEST_IMPORT_PATTERN.test(code) && SCALATEST_ASSERTION_PATTERN.test(body)) return true;
+  if (SCALATEST_MATCHERS_IMPORT_PATTERN.test(code) && SCALATEST_MATCHER_PATTERN.test(body)) return true;
+  if (KOTEST_MATCHERS_IMPORT_PATTERN.test(code) && KOTEST_MATCHER_PATTERN.test(body)) return true;
+  const tapeBound = [...commentFree.matchAll(TAPE_OR_TAP_BINDING_PATTERN)].some(
+    (binding) => code[binding.index] === commentFree[binding.index]
+  );
+  return tapeBound && TAPE_OR_TAP_ASSERTION_PATTERN.test(body);
+}
+function hasFrameworkSuiteLevelSkip({ code }) {
+  return DOTNET_IGNORED_CLASS_PATTERN.test(code) || SCALATEST_IMPORT_PATTERN.test(code) && SCALATEST_IGNORED_CLASS_PATTERN.test(code) || KOTEST_IMPORT_PATTERN.test(code) && KOTEST_IGNORED_CLASS_PATTERN.test(code);
+}
 function measureNonHollowTestShare(repoPath, files, useV17Detectors = false) {
   let nonHollowCount = 0;
   let ratedCount = 0;
@@ -6419,11 +6903,14 @@ function measureNonHollowTestShare(repoPath, files, useV17Detectors = false) {
     const fullPath = join(repoPath, file);
     if (!isRegularFile(fullPath)) continue;
     const contents = readRepoText(fullPath, "utf8");
-    const nonHollow = (JS_TEST_ASSERTION_PATTERN.test(contents) || CPP_TEST_ASSERTION_PATTERN.test(contents) || MULTI_ECOSYSTEM_TEST_ASSERTION_PATTERN.test(contents)) && !SUITE_LEVEL_SKIP_PATTERN.test(contents);
+    let maskedSource;
+    const masked = () => maskedSource ??= maskCommentsAndStrings(contents);
+    const frameworkSuiteSkipped = /\bIgnored?\b/.test(contents) && hasFrameworkSuiteLevelSkip(masked());
+    const nonHollow = (JS_TEST_ASSERTION_PATTERN.test(contents) || CPP_TEST_ASSERTION_PATTERN.test(contents) || MULTI_ECOSYSTEM_TEST_ASSERTION_PATTERN.test(contents) || hasLiveAvaAssertion(contents) || hasLiveFrameworkAssertion(masked())) && !SUITE_LEVEL_SKIP_PATTERN.test(contents) && !frameworkSuiteSkipped;
     if (nonHollow) {
       nonHollowCount += 1;
       ratedCount += 1;
-    } else if (NAME_SHAPED_TEST_FILE_PATTERN.test(file) || useV17Detectors && NAME_SHAPED_TEST_FILE_PATTERN_V17.test(file)) {
+    } else if (NAME_SHAPED_TEST_FILE_PATTERN.test(file) || useV17Detectors && NAME_SHAPED_TEST_FILE_PATTERN_V17.test(file) || frameworkSuiteSkipped && SUITE_SKIP_NAME_SHAPED_TEST_FILE_PATTERN.test(file)) {
       ratedCount += 1;
     }
   }
@@ -6930,6 +7417,354 @@ function deriveRlsPolicyScopeInventory(repoPath, repoFiles) {
     storageFiles
   };
 }
+var DATA_LAYER_PATH_PATTERN = /(^|\/)(?:migrations?|drizzle|prisma)\/|\.(?:sql|prisma)$/i;
+var RLS_STATEMENT_PHRASE_PATTERN = /\b(?:enable|disable)\s+row\s+level\s+security\b|\bcreate\s+(?:or\s+replace\s+)?policy\b/i;
+var SQL_TABLE_REMOVAL_PHRASE_PATTERN = /\bdrop\s+table\b|\brename\s+to\b/i;
+var SQL_CREATE_TABLE_HEAD = /^create\s+(?:(?:global|local)\s+)?(?:(?:temporary|temp|unlogged)\s+)?table\s+(?:if\s+not\s+exists\s+)?/i;
+var SQL_ALTER_TABLE_HEAD = /^alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?/i;
+var SQL_DROP_TABLE_HEAD = /^drop\s+table\s+(?:if\s+exists\s+)?/i;
+var SQL_RENAME_TO_CLAUSE = /^\s+rename\s+to\s+/i;
+var SQL_CREATE_POLICY_HEAD = /^create\s+(?:or\s+replace\s+)?policy\s+/i;
+var SQL_RLS_TOGGLE_PATTERN = /\b(enable|disable)\s+row\s+level\s+security\b/gi;
+var SQL_PLAIN_IDENTIFIER_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+var SQL_TABLE_CONSTRAINT_PATTERN = /^(?:constraint|primary|foreign|unique|check|exclude|like)\b/i;
+var MAX_UNCOVERED_TENANT_TABLES = 3;
+function compareMigrationPaths(left, right) {
+  const leftChunks = left.match(/\d+|\D+/g) ?? [];
+  const rightChunks = right.match(/\d+|\D+/g) ?? [];
+  for (let index = 0; index < Math.min(leftChunks.length, rightChunks.length); index += 1) {
+    const a = leftChunks[index];
+    const b = rightChunks[index];
+    if (a === b) continue;
+    if (/^\d/.test(a) && /^\d/.test(b)) {
+      const x = a.replace(/^0+(?=\d)/, "");
+      const y = b.replace(/^0+(?=\d)/, "");
+      if (x.length !== y.length) return x.length - y.length;
+      if (x !== y) return x < y ? -1 : 1;
+      return a.length - b.length;
+    }
+    return a < b ? -1 : 1;
+  }
+  return leftChunks.length - rightChunks.length;
+}
+function blankSqlNonCode(text) {
+  const out = text.split("");
+  let dynamic = false;
+  const blank = (from, to) => {
+    for (let index2 = from; index2 < to; index2 += 1) {
+      if (out[index2] !== "\n" && out[index2] !== "\r") out[index2] = " ";
+    }
+  };
+  const noteBody = (from, to) => {
+    const body = text.slice(from, to);
+    if (RLS_STATEMENT_PHRASE_PATTERN.test(body) || SQL_TABLE_REMOVAL_PHRASE_PATTERN.test(body)) {
+      dynamic = true;
+    }
+  };
+  let index = 0;
+  while (index < text.length) {
+    const character = text[index];
+    const next = text[index + 1];
+    if (character === "-" && next === "-") {
+      const newline = text.indexOf("\n", index);
+      const end = newline === -1 ? text.length : newline;
+      blank(index, end);
+      index = end;
+    } else if (character === "/" && next === "*") {
+      let depth = 1;
+      let cursor = index + 2;
+      while (cursor < text.length && depth > 0) {
+        if (text[cursor] === "/" && text[cursor + 1] === "*") {
+          depth += 1;
+          cursor += 2;
+        } else if (text[cursor] === "*" && text[cursor + 1] === "/") {
+          depth -= 1;
+          cursor += 2;
+        } else {
+          cursor += 1;
+        }
+      }
+      blank(index, cursor);
+      index = cursor;
+    } else if (character === "'") {
+      const escapes = index > 0 && /[Ee]/.test(text[index - 1] ?? "") && !/[A-Za-z0-9_$]/.test(text[index - 2] ?? "");
+      let cursor = index + 1;
+      while (cursor < text.length) {
+        if (escapes && text[cursor] === "\\") {
+          cursor += 2;
+        } else if (text[cursor] === "'") {
+          if (text[cursor + 1] !== "'") break;
+          cursor += 2;
+        } else {
+          cursor += 1;
+        }
+      }
+      noteBody(index + 1, cursor);
+      blank(index + 1, cursor);
+      index = cursor + 1;
+    } else if (character === '"') {
+      let cursor = index + 1;
+      while (cursor < text.length) {
+        if (text[cursor] === '"') {
+          if (text[cursor + 1] !== '"') break;
+          cursor += 2;
+        } else {
+          cursor += 1;
+        }
+      }
+      index = cursor + 1;
+    } else if (character === "$" && !/[A-Za-z0-9_$]/.test(text[index - 1] ?? "")) {
+      const tag = /^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/.exec(text.slice(index, index + 66))?.[0];
+      if (tag === void 0) {
+        index += 1;
+        continue;
+      }
+      const close = text.indexOf(tag, index + tag.length);
+      const end = close === -1 ? text.length : close;
+      noteBody(index + tag.length, end);
+      blank(index + tag.length, end);
+      index = close === -1 ? text.length : close + tag.length;
+    } else {
+      index += 1;
+    }
+  }
+  return { code: out.join(""), dynamic };
+}
+function splitSqlStatements(code) {
+  const statements = [];
+  let start = 0;
+  let quoted = false;
+  for (let index = 0; index <= code.length; index += 1) {
+    const character = code[index];
+    if (character === '"') quoted = !quoted;
+    if (index === code.length || character === ";" && !quoted) {
+      const raw = code.slice(start, index);
+      const lead = raw.length - raw.trimStart().length;
+      if (raw.trim() !== "") statements.push({ text: raw.slice(lead), start: start + lead });
+      start = index + 1;
+    }
+  }
+  return statements;
+}
+function readSqlIdentifier(text, from) {
+  let index = from;
+  while (/\s/.test(text[index] ?? "")) index += 1;
+  if (text[index] === '"') {
+    let cursor = index + 1;
+    while (cursor < text.length) {
+      if (text[cursor] === '"') {
+        if (text[cursor + 1] !== '"') break;
+        cursor += 2;
+      } else {
+        cursor += 1;
+      }
+    }
+    if (cursor >= text.length) return null;
+    const inner = text.slice(index + 1, cursor).replace(/""/g, '"');
+    return { value: SQL_PLAIN_IDENTIFIER_PATTERN.test(inner) ? inner : null, end: cursor + 1 };
+  }
+  const bare = /^[^\s(),;.]+/.exec(text.slice(index))?.[0];
+  if (bare === void 0) return null;
+  return { value: SQL_PLAIN_IDENTIFIER_PATTERN.test(bare) ? bare : null, end: index + bare.length };
+}
+function readSqlTableName(text, from) {
+  const segments = [];
+  let normalisable = true;
+  let index = from;
+  for (; ; ) {
+    const identifier = readSqlIdentifier(text, index);
+    if (identifier === null) return { segments: null, end: index };
+    if (identifier.value === null) normalisable = false;
+    else segments.push(identifier.value.toLowerCase());
+    index = identifier.end;
+    let cursor = index;
+    while (/\s/.test(text[cursor] ?? "")) cursor += 1;
+    if (text[cursor] !== ".") break;
+    index = cursor + 1;
+  }
+  return {
+    segments: normalisable && segments.length >= 1 && segments.length <= 2 ? segments : null,
+    end: index
+  };
+}
+function sqlColumnListHasTenantColumn(text, open) {
+  let depth = 0;
+  let quoted = false;
+  let elementStart = open + 1;
+  const elements = [];
+  for (let index = open; index < text.length; index += 1) {
+    const character = text[index];
+    if (character === '"') quoted = !quoted;
+    if (quoted) continue;
+    if (character === "(") depth += 1;
+    else if (character === ")") {
+      depth -= 1;
+      if (depth === 0) {
+        elements.push(text.slice(elementStart, index));
+        break;
+      }
+    } else if (character === "," && depth === 1) {
+      elements.push(text.slice(elementStart, index));
+      elementStart = index + 1;
+    }
+  }
+  return elements.some((element) => {
+    const trimmed = element.trim();
+    if (trimmed === "" || SQL_TABLE_CONSTRAINT_PATTERN.test(trimmed)) return false;
+    const column = readSqlIdentifier(trimmed, 0)?.value;
+    return column != null && TENANT_SCOPE_PATTERN_V11.test(column);
+  });
+}
+function lineAtOffset(text, offset) {
+  let line = 1;
+  for (let index = 0; index < offset && index < text.length; index += 1) {
+    if (text[index] === "\n") line += 1;
+  }
+  return line;
+}
+function findUncoveredTenantTables(repoPath, repoFiles) {
+  const events = [];
+  const nameEvents = [];
+  const tenantTables = [];
+  let order = 0;
+  const dataLayerFiles = repoFiles.filter((file) => DATA_LAYER_PATH_PATTERN.test(file)).sort(compareMigrationPaths);
+  for (const file of dataLayerFiles) {
+    const fullPath = join(repoPath, file);
+    if (!isRegularFile(fullPath)) continue;
+    const contents = readRepoText(fullPath, "utf8");
+    if (!/\.sql$/i.test(file)) {
+      if (RLS_STATEMENT_PHRASE_PATTERN.test(contents)) return [];
+      continue;
+    }
+    const { code, dynamic } = blankSqlNonCode(contents);
+    if (dynamic) return [];
+    const dir = posix.dirname(file);
+    for (const statement of splitSqlStatements(code)) {
+      order += 1;
+      const createTable = SQL_CREATE_TABLE_HEAD.exec(statement.text);
+      if (createTable) {
+        const { segments, end } = readSqlTableName(statement.text, createTable[0].length);
+        const open = statement.text.slice(end).search(/\S/);
+        if (segments === null || open === -1 || statement.text[end + open] !== "(") continue;
+        if (sqlColumnListHasTenantColumn(statement.text, end + open)) {
+          tenantTables.push({
+            key: segments[segments.length - 1],
+            segments,
+            file,
+            line: lineAtOffset(contents, statement.start),
+            order,
+            dir
+          });
+        }
+        continue;
+      }
+      const dropTable = SQL_DROP_TABLE_HEAD.exec(statement.text);
+      if (dropTable) {
+        let cursor = dropTable[0].length;
+        for (; ; ) {
+          const { segments, end } = readSqlTableName(statement.text, cursor);
+          if (segments === null) return [];
+          nameEvents.push({ key: segments[segments.length - 1], order, dir });
+          const comma = /^\s*,/.exec(statement.text.slice(end));
+          if (!comma) break;
+          cursor = end + comma[0].length;
+        }
+        continue;
+      }
+      const alterTable = SQL_ALTER_TABLE_HEAD.exec(statement.text);
+      if (alterTable) {
+        const { segments: renamed, end: renamedEnd } = readSqlTableName(
+          statement.text,
+          alterTable[0].length
+        );
+        const renameTo = renamed === null ? null : SQL_RENAME_TO_CLAUSE.exec(statement.text.slice(renamedEnd));
+        if (renamed !== null && renameTo) {
+          const { segments: to } = readSqlTableName(statement.text, renamedEnd + renameTo[0].length);
+          if (to === null) return [];
+          nameEvents.push({
+            key: renamed[renamed.length - 1],
+            to: to[to.length - 1],
+            order,
+            dir
+          });
+          continue;
+        }
+        const toggles = [...statement.text.matchAll(SQL_RLS_TOGGLE_PATTERN)];
+        if (toggles.length === 0) {
+          if (SQL_TABLE_REMOVAL_PHRASE_PATTERN.test(statement.text)) return [];
+          continue;
+        }
+        const { segments } = readSqlTableName(statement.text, alterTable[0].length);
+        if (segments === null) return [];
+        const key = segments[segments.length - 1];
+        for (const toggle of toggles) {
+          order += 1;
+          events.push({ key, covers: toggle[1]?.toLowerCase() === "enable", order, dir });
+        }
+        continue;
+      }
+      const createPolicy = SQL_CREATE_POLICY_HEAD.exec(statement.text);
+      if (createPolicy) {
+        const policyName = readSqlIdentifier(statement.text, createPolicy[0].length);
+        const on = policyName ? /^\s+on\s+/i.exec(statement.text.slice(policyName.end)) : null;
+        if (!policyName || !on) return [];
+        const { segments } = readSqlTableName(statement.text, policyName.end + on[0].length);
+        if (segments === null) return [];
+        events.push({ key: segments[segments.length - 1], covers: true, order, dir });
+        continue;
+      }
+      if (RLS_STATEMENT_PHRASE_PATTERN.test(statement.text)) return [];
+    }
+  }
+  if (!events.some((event) => event.covers)) return [];
+  const followTable = (table) => {
+    const spans = [];
+    let key = table.key;
+    let from = Number.NEGATIVE_INFINITY;
+    for (; ; ) {
+      const current = key;
+      if (nameEvents.some((event) => event.key === current && event.dir !== table.dir)) return null;
+      const next = nameEvents.find(
+        (event) => event.key === current && event.dir === table.dir && event.order > Math.max(from, table.order)
+      );
+      if (next === void 0) {
+        spans.push({ key, from, until: Number.POSITIVE_INFINITY });
+        return spans;
+      }
+      if (next.to === void 0) return null;
+      spans.push({ key, from, until: next.order });
+      key = next.to;
+      from = next.order;
+    }
+  };
+  const isCovered = (table, spans) => {
+    const forTable = events.filter(
+      (event) => spans.some(
+        (span) => span.key === event.key && (event.dir !== table.dir || event.order > span.from && event.order < span.until)
+      )
+    );
+    const lastCover = forTable.filter((event) => event.covers).at(-1);
+    const lastDisable = forTable.filter((event) => !event.covers).at(-1);
+    if (lastCover === void 0) return false;
+    if (lastDisable === void 0) return true;
+    if (lastCover.dir !== lastDisable.dir) return true;
+    return lastCover.order > lastDisable.order;
+  };
+  const uncovered = /* @__PURE__ */ new Map();
+  for (const table of tenantTables) {
+    const spans = followTable(table);
+    const current = spans?.at(-1)?.key;
+    if (spans === null || current === void 0 || uncovered.has(current)) continue;
+    if (isCovered(table, spans)) continue;
+    uncovered.set(current, {
+      name: [...table.segments.slice(0, -1), current].join("."),
+      file: table.file,
+      line: table.line,
+      order: table.order
+    });
+  }
+  return [...uncovered.values()].sort((left, right) => left.order - right.order).slice(0, MAX_UNCOVERED_TENANT_TABLES).map(({ name, file, line }) => ({ name, file, line }));
+}
 function findDeployableServicePremiseFiles(repoPath, repoFiles, strictOperationalBoundary = false) {
   const explicitTargets = repoFiles.filter(
     (file) => isAuthoredProductionPath(file) && isExplicitDeployTarget(file) && (!strictOperationalBoundary || isV47OperationalApplicationPath(file))
@@ -7019,10 +7854,190 @@ function isAuthenticatedClaimRealityArtifact(repoPath, file) {
   }
   return false;
 }
+var DECLARED_CLAIM_ARTIFACT_BASENAME_PATTERN = /^claims?[-_.]?(?:reality[-_.]?)?(?:reconciliation|register|ledger)\.(?:md|mdx|json|ya?ml)$/i;
+var DECLARED_CLAIM_ARTIFACT_PATH_PATTERN = /^[A-Za-z0-9._/-]{1,160}$/;
+var MARKDOWN_FENCE_PATTERN = /^\s{0,3}(`{3,}|~{3,})/;
+var MARKDOWN_INLINE_LINK_PATTERN = /(!?)\[[^\]]*\]\(\s*<?([^\s)>]+)>?[^)]*\)/g;
+var MARKDOWN_REFERENCE_DEFINITION_PATTERN = /^\s{0,3}\[[^\]]+\]:\s*<?([^\s>]+)>?/;
+var MARKDOWN_CODE_SPAN_PATTERN = /`([^`]+)`/g;
+function isClaimArtifactDeclaringDocument(file) {
+  return isClaimSourceFile(file) || /^CONTRIBUTING\.md$/i.test(file);
+}
+function isClaimArtifactDeclaringWorkflow(file) {
+  return /^\.github\/workflows\/[^/]+\.ya?ml$/.test(file);
+}
+function normaliseDeclaredClaimArtifactPath(candidate, baseDir) {
+  if (!DECLARED_CLAIM_ARTIFACT_PATH_PATTERN.test(candidate)) return null;
+  const joined = candidate.startsWith("/") ? posix.normalize(candidate.slice(1)) : posix.normalize(posix.join(baseDir, candidate));
+  const path = joined.replace(/\/+$/, "");
+  if (path === "" || path === "." || path === ".." || path.startsWith("../") || path.startsWith("/")) {
+    return null;
+  }
+  return DECLARED_CLAIM_ARTIFACT_BASENAME_PATTERN.test(posix.basename(path)) ? path : null;
+}
+function markdownLinkTarget(target) {
+  if (/^[a-z][a-z0-9+.-]*:/i.test(target) || target.startsWith("//") || target.startsWith("#")) {
+    return null;
+  }
+  const withoutSuffix = target.replace(/[?#].*$/, "");
+  try {
+    return decodeURIComponent(withoutSuffix);
+  } catch {
+    return null;
+  }
+}
+function markdownClaimArtifactDeclarations(file, contents) {
+  const baseDir = posix.dirname(file);
+  const declarations = [];
+  let fence = null;
+  let inHtmlComment = false;
+  contents.split(/\r?\n/).forEach((rawLine, index) => {
+    const marker = MARKDOWN_FENCE_PATTERN.exec(rawLine)?.[1];
+    if (fence !== null) {
+      if (marker !== void 0 && marker[0] === fence[0] && marker.length >= fence.length) fence = null;
+      return;
+    }
+    if (marker !== void 0) {
+      fence = marker;
+      return;
+    }
+    let line = rawLine;
+    if (inHtmlComment) {
+      const close = line.indexOf("-->");
+      if (close === -1) return;
+      line = line.slice(close + 3);
+      inHtmlComment = false;
+    }
+    line = line.replace(/<!--[\s\S]*?-->/g, " ");
+    const open = line.indexOf("<!--");
+    if (open !== -1) {
+      line = line.slice(0, open);
+      inHtmlComment = true;
+    }
+    const lineNumber = index + 1;
+    for (const match of line.matchAll(MARKDOWN_CODE_SPAN_PATTERN)) {
+      const span = (match[1] ?? "").trim().replace(/^\.\//, "");
+      const candidates = [
+        normaliseDeclaredClaimArtifactPath(span, "."),
+        normaliseDeclaredClaimArtifactPath(span, baseDir)
+      ].filter((path) => path !== null);
+      if (candidates.length > 0) declarations.push({ candidates: [...new Set(candidates)], line: lineNumber });
+    }
+    const prose = line.replace(MARKDOWN_CODE_SPAN_PATTERN, " ");
+    const targets = [];
+    for (const match of prose.matchAll(MARKDOWN_INLINE_LINK_PATTERN)) {
+      if (match[1] === "!") continue;
+      targets.push(match[2] ?? "");
+    }
+    const reference = MARKDOWN_REFERENCE_DEFINITION_PATTERN.exec(prose);
+    if (reference?.[1]) targets.push(reference[1]);
+    for (const target of targets) {
+      const decoded = markdownLinkTarget(target);
+      const path = decoded === null ? null : normaliseDeclaredClaimArtifactPath(decoded, baseDir);
+      if (path !== null) declarations.push({ candidates: [path], line: lineNumber });
+    }
+  });
+  return declarations;
+}
+var WORKFLOW_WRITE_OPERATOR_PATTERN = />|(?:^|[\s|;&(])(?:tee|-o|--out[\w-]*)(?=[\s=]|$)/;
+var WORKFLOW_ARTIFACT_ACTION_PATTERN = /^\s*(?:-\s+)?uses\s*:\s*["']?actions\/(?:upload|download)-artifact(?:[/@]|["']?\s*$)/i;
+function workflowClaimArtifactDeclarations(contents) {
+  if (/^\s*(?:-\s+)?working-directory\s*:/m.test(contents)) return [];
+  const declarations = [];
+  let stepsIndent = null;
+  let stepItemIndent = null;
+  let step = null;
+  let writeContinues = false;
+  const closeStep = () => {
+    if (step !== null && !step.movesArtifact) declarations.push(...step.declarations);
+    step = null;
+    writeContinues = false;
+  };
+  contents.split(/\r?\n/).forEach((rawLine, index) => {
+    const line = rawLine.replace(/(^|\s)#.*$/, "");
+    if (line.trim() === "") return;
+    const indent = line.length - line.trimStart().length;
+    if (stepsIndent !== null && (indent < stepsIndent || indent === stepsIndent && !line.trimStart().startsWith("- "))) {
+      closeStep();
+      stepsIndent = null;
+    }
+    const stepsKey = /^(\s*)steps\s*:\s*$/.exec(line);
+    if (stepsKey) {
+      closeStep();
+      stepsIndent = stepsKey[1]?.length ?? 0;
+      stepItemIndent = null;
+      return;
+    }
+    if (stepsIndent === null) return;
+    if (line.trimStart().startsWith("- ") && (stepItemIndent === null || indent <= stepItemIndent)) {
+      closeStep();
+      stepItemIndent = indent;
+    }
+    step ??= { declarations: [], movesArtifact: false };
+    if (WORKFLOW_ARTIFACT_ACTION_PATTERN.test(line)) step.movesArtifact = true;
+    const writeAt = writeContinues ? 0 : line.search(WORKFLOW_WRITE_OPERATOR_PATTERN);
+    writeContinues = writeAt !== -1 && /\\\s*$/.test(line);
+    const read = writeAt === -1 ? line : line.slice(0, writeAt);
+    for (const token of read.split(/[\s'"`=,;:()[\]{}<>|&]+/)) {
+      const path = normaliseDeclaredClaimArtifactPath(token.replace(/^\.\//, ""), ".");
+      if (path !== null) step.declarations.push({ candidates: [path], line: index + 1 });
+    }
+  });
+  closeStep();
+  return declarations;
+}
+function scanClaimArtifactDeclarations(repoPath, repoFiles) {
+  const declaringFiles = repoFiles.filter((file) => isClaimArtifactDeclaringDocument(file) || isClaimArtifactDeclaringWorkflow(file)).sort();
+  let declared = false;
+  if (declaringFiles.length === 0) return { declared };
+  const known = [...repoFiles, ...withheldRepoPaths().map(({ path }) => path)].map(
+    (path) => path.toLowerCase()
+  );
+  const isPresent = (path) => {
+    const lower = path.toLowerCase();
+    return known.some((file) => file === lower || file.startsWith(`${lower}/`));
+  };
+  for (const file of declaringFiles) {
+    const fullPath = join(repoPath, file);
+    if (!isRegularFile(fullPath)) continue;
+    const contents = readRepoText(fullPath, "utf8");
+    const declarations = isClaimArtifactDeclaringWorkflow(file) ? workflowClaimArtifactDeclarations(contents) : markdownClaimArtifactDeclarations(file, contents);
+    for (const declaration of declarations) {
+      declared = true;
+      if (declaration.candidates.some(isPresent)) continue;
+      const [path] = declaration.candidates;
+      if (path !== void 0) {
+        return { declared, firstAbsent: { path, declaringFile: file, line: declaration.line } };
+      }
+    }
+  }
+  return { declared };
+}
 function isCoverageConfig(repoPath, file) {
   if (/(^|\/)(nyc|c8|coverage|codecov)\.(json|yml|yaml)$/.test(file) || /(^|\/)\.coveragerc$/.test(file) || /(^|\/)lcov\.info$/.test(file) || /(^|\/)\.coveralls\.yml$/.test(file)) {
     return true;
   }
+  if (/(^|\/)\.codecov\.ya?ml$/.test(file) || /(^|\/)\.nycrc(?:\.json|\.ya?ml)?$/.test(file) || /(^|\/)\.c8rc(?:\.json)?$/.test(file) || /(^|\/)\.?tarpaulin\.toml$/.test(file)) {
+    return true;
+  }
+  if (/(^|\/)(?:setup\.cfg|tox\.ini)$/.test(file)) {
+    return fileContains(repoPath, file, /^\s*\[coverage:(?:run|report)\]\s*$/m);
+  }
+  if (/(^|\/)vite\.config\.[cm]?[jt]s$/.test(file)) {
+    return viteConfigCollectsCoverage(repoPath, file);
+  }
+  if (/(^|\/)\.simplecov$/.test(file)) {
+    return fileContains(repoPath, file, /^(?!\s*#).*\bSimpleCov\b/m);
+  }
+  if (/(^|\/)phpunit\.xml(?:\.dist)?$/.test(file)) {
+    return /<coverage(?=[\s>/])/.test(stripXmlComments(readRepoText(join(repoPath, file), "utf8")));
+  }
+  if (/(^|\/)pom\.xml$/.test(file)) {
+    return pomAppliesJacoco(readRepoText(join(repoPath, file), "utf8"));
+  }
+  if (/(^|\/)build\.gradle(?:\.kts)?$/.test(file)) {
+    return gradleAppliesJacoco(readRepoText(join(repoPath, file), "utf8"));
+  }
   if (/(^|\/)vitest\.config\.[cm]?[jt]s$/.test(file)) {
     return fileContains(repoPath, file, /\bcoverage\s*:/i);
   }
@@ -7054,19 +8069,76 @@ function packageJsonHasCoverageTooling(repoPath, file) {
       }
     }
   }
-  for (const key of ["nyc", "c8", "istanbul"]) {
-    const config = parsed[key];
-    if (typeof config === "object" && config !== null && !Array.isArray(config)) return true;
+  return packageJsonHasStaticCoverageTooling(repoPath, file);
+}
+function vitestCoveragePropertyCollects(contents) {
+  const property = /(?:^|[{,])\s*["']?coverage["']?\s*:\s*([^,\r\n}]*)/im.exec(contents)?.[1]?.trim();
+  if (!property || /^(?:false\b|null\b|undefined\b)/i.test(property)) return false;
+  if (/^\{/.test(property) && /\benabled\s*:\s*false\b/i.test(contents)) return false;
+  return true;
+}
+function viteConfigCollectsCoverage(repoPath, file) {
+  const directory = dirname(file);
+  for (const extension of ["ts", "mts", "cts", "js", "mjs", "cjs"]) {
+    const sibling = join(repoPath, directory, `vitest.config.${extension}`);
+    if (!isRegularFile(sibling)) continue;
+    const vitestConfig = stripJavaScriptComments(readRepoText(sibling, "utf8"));
+    if (!/["']\.\/vite\.config(?:\.[cm]?[jt]s)?["']/.test(vitestConfig)) return false;
+  }
+  const contents = stripJavaScriptComments(readRepoText(join(repoPath, file), "utf8"));
+  const testProperty = /(?:^|[{,])\s*["']?test["']?\s*:\s*\{/m.exec(contents);
+  if (!testProperty) return false;
+  const block = balancedBraceBlock(contents, testProperty.index + testProperty[0].length - 1);
+  return vitestCoveragePropertyCollects(block);
+}
+function balancedBraceBlock(contents, open) {
+  let depth = 0;
+  let quote = null;
+  for (let index = open; index < contents.length; index += 1) {
+    const character = contents[index];
+    if (quote) {
+      if (character === "\\") index += 1;
+      else if (character === quote) quote = null;
+      continue;
+    }
+    if (character === '"' || character === "'" || character === "`") quote = character;
+    else if (character === "{") depth += 1;
+    else if (character === "}") {
+      depth -= 1;
+      if (depth === 0) return contents.slice(open, index + 1);
+    }
+  }
+  return contents.slice(open);
+}
+function stripXmlComments(contents) {
+  return contents.replace(/<!--[\s\S]*?-->/g, "");
+}
+function pomAppliesJacoco(contents) {
+  const pom = stripXmlComments(contents).replace(/<pluginManagement>[\s\S]*?<\/pluginManagement>/g, "");
+  if (/<jacoco\.skip>\s*true\s*<\/jacoco\.skip>/i.test(pom)) return false;
+  for (const plugin of pom.matchAll(/<plugin>([\s\S]*?)<\/plugin>/g)) {
+    const body = plugin[1] ?? "";
+    if (!/<artifactId>\s*jacoco-maven-plugin\s*<\/artifactId>/.test(body)) continue;
+    if (/<skip>\s*true\s*<\/skip>/i.test(body)) continue;
+    return true;
+  }
+  return false;
+}
+function gradleAppliesJacoco(contents) {
+  const script = stripJavaScriptComments(contents);
+  if (/\bapply\s*\(?\s*plugin\s*[:=]\s*["']jacoco["']/.test(script)) return true;
+  for (const block of script.matchAll(/\bplugins\s*\{([^{}]*)\}/g)) {
+    if (/(?:^|[\s;])(?:id\s*\(?\s*["']jacoco["']\s*\)?|jacoco)[ \t]*(?:$|[\s;])/m.test(block[1] ?? "")) {
+      return true;
+    }
   }
   return false;
 }
 function isV23CoverageConfig(repoPath, file) {
   if (/(^|\/)vitest\.config\.[cm]?[jt]s$/.test(file)) {
-    const contents = stripJavaScriptComments(readRepoText(join(repoPath, file), "utf8"));
-    const property = /(?:^|[{,])\s*["']?coverage["']?\s*:\s*([^,\r\n}]*)/im.exec(contents)?.[1]?.trim();
-    if (!property || /^(?:false\b|null\b|undefined\b)/i.test(property)) return false;
-    if (/^\{/.test(property) && /\benabled\s*:\s*false\b/i.test(contents)) return false;
-    return true;
+    return vitestCoveragePropertyCollects(
+      stripJavaScriptComments(readRepoText(join(repoPath, file), "utf8"))
+    );
   }
   if (/(^|\/)jest\.config\.[cm]?[jt]s$/.test(file)) {
     const contents = stripJavaScriptComments(readRepoText(join(repoPath, file), "utf8"));
@@ -7126,6 +8198,10 @@ function packageJsonHasStaticCoverageTooling(repoPath, file) {
   if (!isRegularFile(fullPath)) return false;
   const parsed = parseJsonObject(readRepoText(fullPath, "utf8"));
   if (!parsed) return false;
+  const jest = parsed.jest;
+  if (isRecord(jest) && (jest.collectCoverage === true || isRecord(jest.coverageThreshold) || typeof jest.coverageProvider === "string")) {
+    return true;
+  }
   return ["nyc", "c8", "istanbul"].some((key) => {
     const config = parsed[key];
     return typeof config === "object" && config !== null && !Array.isArray(config);
@@ -7207,6 +8283,19 @@ function analyzeCoverageConfiguration(repoPath, repoFiles, authoredOnly = false)
     detectorDecisions
   };
 }
+function unionWithLegacyCoverageRecognition(analysis, legacyFiles, hasLegacyCoverageScript) {
+  const legacy = new Set(legacyFiles);
+  const coverageFiles = [
+    ...legacyFiles,
+    ...analysis.coverageFiles.filter((file) => !legacy.has(file))
+  ];
+  return {
+    coverageFiles,
+    unresolvedFiles: analysis.unresolvedFiles.filter((file) => !legacy.has(file)),
+    hasCoverageCommand: hasLegacyCoverageScript || analysis.hasCoverageCommand,
+    detectorDecisions: analysis.detectorDecisions
+  };
+}
 function stripJavaScriptComments(contents) {
   let output = "";
   let quote = null;
@@ -7577,14 +8666,89 @@ function coverageFlagCommandState(words) {
   if (executable === "vitest" || executable === "bnt") {
     return flagState(args, ["--coverage"], ["--no-coverage"]);
   }
+  if (isPythonModuleRunner(executable, args)) {
+    return flagState(args.slice(2), ["--cov"], ["--no-cov"]);
+  }
+  if (executable === "go") {
+    if (args[0]?.toLowerCase() !== "test") return "none";
+    const end = args.findIndex((arg, index) => index > 0 && /^--?args$/i.test(arg));
+    return goTestCoverageState(end < 0 ? args.slice(1) : args.slice(1, end));
+  }
+  if (executable === "dotnet") {
+    if (args[0]?.toLowerCase() !== "test") return "none";
+    const end = args.indexOf("--", 1);
+    return dotnetTestCoverageState(end < 0 ? args.slice(1) : args.slice(1, end));
+  }
+  if (executable === "cargo") {
+    const subcommand = args[0]?.startsWith("+") ? args.slice(1) : args;
+    if (subcommand[0]?.toLowerCase() !== "llvm-cov") return "none";
+    if (["report", "clean", "show-env", "run"].includes(subcommand[1]?.toLowerCase() ?? "")) {
+      return "none";
+    }
+    const end = subcommand.indexOf("--");
+    const owned = end < 0 ? subcommand.slice(1) : subcommand.slice(1, end);
+    return owned.some((arg) => arg.toLowerCase() === "--no-run") ? "none" : "collects";
+  }
   return "none";
 }
+function isPythonModuleRunner(executable, args) {
+  return /^(?:python[0-9.]*|py)$/.test(executable) && args[0] === "-m" && (args[1] === "pytest" || args[1] === "py.test");
+}
+function goTestCoverageState(args) {
+  let enabled = false;
+  let disabled = false;
+  let unresolved = false;
+  for (const raw of args) {
+    const [name, assigned] = raw.toLowerCase().replace(/^--/u, "-").split("=", 2);
+    if (name === "-covermode" || name === "-coverpkg" || name === "-coverprofile") {
+      enabled = true;
+    } else if (name === "-cover") {
+      if (assigned === void 0 || /^(?:true|t|1)$/u.test(assigned)) enabled = true;
+      else if (/^(?:false|f|0)$/u.test(assigned)) disabled = true;
+      else unresolved = true;
+    }
+  }
+  if (unresolved || enabled && disabled) return "unresolved";
+  return enabled ? "collects" : "none";
+}
+function dotnetTestCoverageState(args) {
+  let enabled = false;
+  let disabled = false;
+  let unresolved = false;
+  for (let index = 0; index < args.length; index += 1) {
+    const lower = (args[index] ?? "").toLowerCase();
+    const collect = /^--collect(?:[:=]([\s\S]*))?$/u.exec(lower);
+    if (collect) {
+      const value = (collect[1] ?? args[index += 1]?.toLowerCase() ?? "").trim();
+      if (/\$|\{|\}/u.test(value)) unresolved = true;
+      else if (value === "xplat code coverage" || value === "code coverage") enabled = true;
+      continue;
+    }
+    const property = /^(?:[/-]p|--property):([\s\S]*)$/u.exec(lower);
+    if (!property) continue;
+    for (const assignment of (property[1] ?? "").split(/[;,]/u)) {
+      const [name, value] = assignment.split("=", 2).map((part) => part.trim());
+      if (name !== "collectcoverage" || value === void 0) continue;
+      if (value === "true") enabled = true;
+      else if (value === "false") disabled = true;
+      else unresolved = true;
+    }
+  }
+  if (unresolved || enabled && disabled) return "unresolved";
+  return enabled ? "collects" : "none";
+}
 function isRecognizedCoverageFlagRunner(words) {
   const command = unwrapPackageManagerExecutable(words);
   const executable = basename(command[0] ?? "").replace(/\.cmd$/i, "").toLowerCase();
   if (["bnt", "vitest", "jest", "pytest", "py.test"].includes(executable)) return true;
   if (executable === "node") return command.slice(1).includes("--test");
-  return (executable === "bun" || executable === "deno") && command[1]?.toLowerCase() === "test";
+  if (isPythonModuleRunner(executable, command.slice(1))) return true;
+  const subcommand = command[1]?.toLowerCase();
+  if (executable === "go" || executable === "dotnet") return subcommand === "test";
+  if (executable === "cargo") {
+    return (subcommand?.startsWith("+") ? command[2] : command[1])?.toLowerCase() === "llvm-cov";
+  }
+  return (executable === "bun" || executable === "deno") && subcommand === "test";
 }
 function flagState(args, enablingNames, disablingNames) {
   let enabled = false;
@@ -8057,8 +9221,9 @@ var RACK_ENTRYPOINT_FILE_PATTERN = /(^|\/)(?:config\.ru|(?:main|server|app|start
 var SERVER_ENTRYPOINT_PATTERN = /\bapp\.listen\s*\(|\bserver\.listen\s*\(\s*(?:PORT|port|\d+)|http\.ListenAndServe\s*\(|http\.ListenAndServeTLS\s*\(|axum::Server(?:::|\.)|actix_web::HttpServer(?:::|\.)|uvicorn\.run\s*\(/;
 var V20_DIRECT_HTTP_SERVER_PATTERN = /\b(?:http|https)\.createServer\s*\([\s\S]{0,1500}?\)\.listen\s*\(\s*(?:PORT|port|\d+)/;
 var HEALTH_ROUTE_FUNCTIONS_DIR_PATTERN = /(^|\/)functions\/.*\.(?:ts|tsx|js|jsx|py|go|rs|java|rb|cpp|cc|cxx|c|h|hpp|kt|swift|php)$/;
+var HEALTH_ROUTE_ENTRYPOINT_HOME_PATTERN = /^(?:(?:server|index|app|main)\.(?:ts|tsx|js|jsx|mjs|cjs)|(?:server|backend|api)\/.*\.(?:ts|tsx|js|jsx|mjs|cjs|py|go|rs|java|rb|php))$/;
 var V20_HEALTH_OR_READINESS_ROUTE_PATTERN = /["'`](?:[\w${}./-]{0,60}\/[_-]?(?:(?:health|ready|live)z?|readiness|liveness|up)(?=["'`/])|(?:healthz|readiness|liveness)(?=["'`]))|@Get\s*\(\s*(["'`])health\1\s*\)/i;
-var EXPRESS_ERROR_MIDDLEWARE_PATTERN = /\(\s*(?:_?err|_?error)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*(?:req|request)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*(?:res|response)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*_?next(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*\)\s*(?:=>|\{)/i;
+var EXPRESS_ERROR_MIDDLEWARE_PATTERN = /\(\s*(?:_?err|_?error)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*_?(?:req|request)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*_?(?:res|response)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*_?next(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,?\s*\)\s*(?:=>|\{)/i;
 var EXPRESS_MIDDLEWARE_REACHABLE_PATTERN = /\.use\s*\(|\bmodule\.exports\b|\bexport\s+(?:default\b|function\b|const\b|class\b)/;
 var ERROR_BOUNDARY_FILENAME_PATTERN = /(^|\/)(?:error-boundary|error)\.(?:tsx|jsx|ts|js)$/;
 var RACK_SERVER_ENTRYPOINT_PATTERN = /Rack::(?:Server|Handler(?:::\w+)?)\.(?:start|run)\s*\(/;
@@ -8243,6 +9408,231 @@ function isV24IgnoredScanFile(file) {
 function findRootPackageJson(repoFiles) {
   return repoFiles.includes("package.json") ? "package.json" : null;
 }
+var WORKSPACE_PATTERN_LIMIT = 64;
+var WORKSPACE_PACKAGE_MANIFEST_LIMIT = 200;
+var NO_DECLARED_WORKSPACE_MANIFESTS = { read: [], declared: 0 };
+function findDeclaredWorkspaceManifests(repoPath, repoFiles, rootPackageJson) {
+  const patterns = [];
+  if (rootPackageJson) {
+    const declared = readPackageJsonWorkspacePatterns(join(repoPath, rootPackageJson));
+    if (declared === null) return NO_DECLARED_WORKSPACE_MANIFESTS;
+    patterns.push(...declared);
+  }
+  if (repoFiles.includes("pnpm-workspace.yaml")) {
+    const declared = readPnpmWorkspacePatterns(join(repoPath, "pnpm-workspace.yaml"));
+    if (declared === null) return NO_DECLARED_WORKSPACE_MANIFESTS;
+    patterns.push(...declared);
+  }
+  if (patterns.length === 0 || patterns.length > WORKSPACE_PATTERN_LIMIT) {
+    return NO_DECLARED_WORKSPACE_MANIFESTS;
+  }
+  const include = [];
+  const exclude = [];
+  for (const pattern of patterns) {
+    const negated = pattern.startsWith("!");
+    const regex = workspaceGlobToRegExp(negated ? pattern.slice(1) : pattern);
+    if (negated) {
+      if (regex === null) return NO_DECLARED_WORKSPACE_MANIFESTS;
+      exclude.push(regex);
+    } else if (regex !== null) {
+      include.push(regex);
+    }
+  }
+  const matched = repoFiles.filter((file) => {
+    if (file === rootPackageJson || !file.endsWith("/package.json")) return false;
+    if (!isAuthoredProductionPath(file)) return false;
+    const dir = file.slice(0, -"/package.json".length);
+    return include.some((regex) => regex.test(dir)) && !exclude.some((regex) => regex.test(dir));
+  }).sort();
+  return { read: matched.slice(0, WORKSPACE_PACKAGE_MANIFEST_LIMIT), declared: matched.length };
+}
+function readPackageJsonWorkspacePatterns(packageJsonPath) {
+  if (!isRegularFile(packageJsonPath)) return [];
+  const parsed = parseJsonObject(readRepoText(packageJsonPath, "utf8"));
+  const workspaces = parsed?.workspaces;
+  if (workspaces === void 0) return [];
+  const list = isRecord(workspaces) ? workspaces.packages : workspaces;
+  if (list === void 0 && isRecord(workspaces)) return [];
+  if (!Array.isArray(list) || !list.every((entry) => typeof entry === "string")) return null;
+  return list;
+}
+function readPnpmWorkspacePatterns(yamlPath) {
+  if (!isRegularFile(yamlPath)) return [];
+  const patterns = [];
+  let inPackages = false;
+  for (const line of readRepoText(yamlPath, "utf8").split(/\r?\n/)) {
+    if (!inPackages) {
+      const key = /^packages\s*:(.*)$/.exec(line);
+      if (!key) continue;
+      const rest = stripYamlLineComment(key[1] ?? "").trim();
+      if (rest === "") {
+        inPackages = true;
+        continue;
+      }
+      const flow = /^\[(.*)\]$/.exec(rest);
+      if (!flow) return null;
+      if ((flow[1] ?? "").trim() === "") return [];
+      for (const item2 of (flow[1] ?? "").split(",")) {
+        const scalar = yamlScalar(item2.trim());
+        if (scalar === null) return null;
+        patterns.push(scalar);
+      }
+      return patterns;
+    }
+    if (/^\s*(?:#.*)?$/.test(line)) continue;
+    const item = /^\s*-\s+(.*)$/.exec(line);
+    if (item) {
+      const scalar = yamlScalar((item[1] ?? "").trim());
+      if (scalar === null) return null;
+      patterns.push(scalar);
+      continue;
+    }
+    if (/^\S/.test(line)) break;
+    return null;
+  }
+  return patterns;
+}
+function stripYamlLineComment(text) {
+  return /^\s*#/.test(text) ? "" : text.replace(/\s+#.*$/, "");
+}
+function yamlScalar(raw) {
+  const single = /^'((?:[^']|'')*)'\s*(?:#.*)?$/.exec(raw);
+  if (single) return (single[1] ?? "").replace(/''/g, "'");
+  const double = /^"([^"\\]*)"\s*(?:#.*)?$/.exec(raw);
+  if (double) return double[1] ?? "";
+  const plain = stripYamlLineComment(raw).trim();
+  return plain === "" || /^["'[{&*|>]/.test(plain) ? null : plain;
+}
+function workspaceGlobToRegExp(pattern) {
+  const normalised = pattern.trim().replace(/^\.\//, "").replace(/\/+$/, "");
+  if (normalised === "" || normalised.startsWith("/") || /(^|\/)\.\.?(\/|$)/.test(normalised) || /[[\]{}()!+@\\]/.test(normalised)) {
+    return null;
+  }
+  const segments = normalised.split("/").filter((segment, index, all) => !(segment === "**" && all[index - 1] === "**"));
+  const anySegment = "(?!\\.)[^/]+";
+  if (segments.length === 1 && segments[0] === "**") return new RegExp(`^${anySegment}(?:/${anySegment})*$`);
+  let source = "";
+  segments.forEach((segment, index) => {
+    if (segment === "**") {
+      source += index === 0 ? `(?:${anySegment}/)*` : `(?:/${anySegment})*`;
+      return;
+    }
+    if (index > 0 && !(index === 1 && segments[0] === "**")) source += "/";
+    const body = segment.split("").map(
+      (char) => char === "*" ? "[^/]*" : char === "?" ? "[^/]" : char.replace(/[.^$|]/g, "\\$&")
+    ).join("");
+    source += /^[*?]/.test(segment) ? `(?!\\.)${body}` : body;
+  });
+  return new RegExp(`^${source}$`);
+}
+function ciWorkflowCitationLabel(baseLabel, verb, considered, cited, unread, delegated = NO_DELEGATED_CI_STEPS) {
+  const unreadTotal = [...unread.values()].reduce((sum, count) => sum + count, 0);
+  const { crossRepositoryReusableWorkflows: crossRepository, compositeActions } = delegated;
+  const delegatedTotal = crossRepository + compositeActions;
+  if (considered <= cited && unreadTotal === 0 && delegatedTotal === 0) return baseLabel;
+  const parts = [
+    `${considered} workflow file${considered === 1 ? "" : "s"} ${verb}`,
+    `${cited} cited`
+  ];
+  if (unreadTotal > 0) {
+    const reasons = [...unread.keys()].sort().join(", ");
+    parts.push(`${unreadTotal} not read (${reasons})`);
+  }
+  if (delegatedTotal === 0) return `${baseLabel} (${parts.join("; ")})`;
+  const delegatedCount = `${delegatedTotal} delegated step${delegatedTotal === 1 ? "" : "s"} not read`;
+  const kinds = [
+    ...crossRepository > 0 ? [
+      `${crossRepository} reusable workflow${crossRepository === 1 ? " in another repository" : "s in other repositories"}`
+    ] : [],
+    ...compositeActions > 0 ? [`${compositeActions} local action${compositeActions === 1 ? "" : "s"}`] : []
+  ];
+  const full = `${baseLabel} (${[...parts, `${delegatedCount} (${kinds.join(", ")})`].join("; ")})`;
+  return full.length <= EVIDENCE_LABEL_MAX_LENGTH ? full : `${baseLabel} (${[...parts, delegatedCount].join("; ")})`;
+}
+var EVIDENCE_LABEL_MAX_LENGTH = 180;
+var NO_DELEGATED_CI_STEPS = {
+  crossRepositoryReusableWorkflows: 0,
+  compositeActions: 0
+};
+function sumDelegatedCiSteps(left, right) {
+  return {
+    crossRepositoryReusableWorkflows: left.crossRepositoryReusableWorkflows + right.crossRepositoryReusableWorkflows,
+    compositeActions: left.compositeActions + right.compositeActions
+  };
+}
+var CROSS_REPOSITORY_REUSABLE_WORKFLOW_PATTERN = /^[^./\s][^/\s]*\/[^/\s]+\/\.github\/workflows\/[^@\s]+\.ya?ml@\S+$/u;
+function countDelegatedCiSteps(root, workflows) {
+  let crossRepositoryReusableWorkflows = 0;
+  let compositeActions = 0;
+  for (const file of workflows) {
+    if (!/^\.github\/workflows\//.test(file)) continue;
+    const fullPath = join(root, file);
+    if (!isRegularFile(fullPath)) continue;
+    for (const uses of extractWorkflowUsesValues(readRepoText(fullPath, "utf8"))) {
+      if (CROSS_REPOSITORY_REUSABLE_WORKFLOW_PATTERN.test(uses)) {
+        crossRepositoryReusableWorkflows += 1;
+        continue;
+      }
+      if (!uses.startsWith("./") || /^\.\/\.github\/workflows\//.test(uses)) continue;
+      const directory = uses.slice(2).replace(/\/+$/u, "");
+      if (directory.length === 0 || directory.split("/").includes("..")) continue;
+      if (isRegularFile(join(root, directory, "action.yml")) || isRegularFile(join(root, directory, "action.yaml"))) {
+        compositeActions += 1;
+      }
+    }
+  }
+  return { crossRepositoryReusableWorkflows, compositeActions };
+}
+function extractWorkflowUsesValues(contents) {
+  const values = [];
+  let blockScalarIndentation = null;
+  for (const line of contents.split(/\r?\n/u)) {
+    const indentation = /^\s*/u.exec(line)?.[0].length ?? 0;
+    if (blockScalarIndentation !== null) {
+      if (line.trim().length === 0 || indentation > blockScalarIndentation) continue;
+      blockScalarIndentation = null;
+    }
+    const match = /^\s*(?:-\s*)?uses\s*:\s*(.*)$/u.exec(line);
+    if (match) {
+      const value = (match[1] ?? "").replace(/\s+#.*$/u, "").trim();
+      const quoted = /^(?:"(.*)"|'(.*)')$/u.exec(value);
+      values.push(quoted ? quoted[1] ?? quoted[2] ?? "" : value);
+      continue;
+    }
+    if (/:\s*[|>][-+0-9]*\s*(?:#.*)?$/u.test(line)) blockScalarIndentation = indentation;
+  }
+  return values;
+}
+function unreadCiWorkflowReasons(includes) {
+  const unread = /* @__PURE__ */ new Map();
+  for (const { path, reasons } of withheldRepoPaths()) {
+    if (!isCiWorkflow(path) || !includes(path)) continue;
+    const reason = [...reasons].sort()[0];
+    if (reason !== void 0) unread.set(reason, (unread.get(reason) ?? 0) + 1);
+  }
+  return unread;
+}
+function rootOnlyPackageScriptsDisclosure(repoFiles, rootPackageJson) {
+  const others = repoFiles.filter(
+    (file) => file !== rootPackageJson && /(^|\/)package\.json$/.test(file) && isAuthoredProductionPath(file)
+  ).length;
+  if (others === 0) return null;
+  const present = `${others}${rootPackageJson ? " other" : ""} package.json file${others === 1 ? "" : "s"} present`;
+  return `${rootPackageJson ? "" : "no root package.json found; "}package scripts for this metric are read from the root package.json only; ${present}`;
+}
+function workspacePackageScriptsDisclosure(repoFiles, rootPackageJson, workspace) {
+  const readCount = workspace.read.length;
+  const workspaceRead = workspace.declared > readCount ? `the first ${readCount} of ${workspace.declared} declared workspace package.json files` : `${readCount} declared workspace package.json file${readCount === 1 ? "" : "s"}`;
+  const read = new Set(workspace.read);
+  const others = repoFiles.filter(
+    (file) => file !== rootPackageJson && !read.has(file) && /(^|\/)package\.json$/.test(file) && isAuthoredProductionPath(file)
+  ).length;
+  return [
+    ...rootPackageJson ? [] : ["no root package.json found"],
+    `package scripts for this metric are read from ${rootPackageJson ? `the root package.json and ${workspaceRead}` : workspaceRead}`,
+    ...others > 0 ? [`${others} other package.json file${others === 1 ? "" : "s"} present`] : []
+  ].join("; ");
+}
 function isRegularFile(path) {
   try {
     return lstatSync(path).isFile();