@clear-capabilities/agentic-security-scanner 0.143.0 → 0.145.0

package/src/engine.js

@@ -8,7 +8,24 @@ import * as os from 'node:os';
 import * as crypto from 'node:crypto';
 import * as yaml from './util/yaml.js';
 import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
 const _require = createRequire(import.meta.url);
+
+// FR-202 phase 3b (D-0050): a worker thread must import.() the real, exports-bearing
+// engine.js -- NEVER `fileURLToPath(import.meta.url)` taken naively from inside this
+// module's own code, because once bundled by ncc that resolves to
+// dist/agentic-security.mjs, the CLI ENTRYPOINT (bin/agentic-security.js), which has
+// no _runFileCascade/_initCascadeWorkerState exports at all and runs CLI dispatch as
+// a side effect of being imported. `src/` and `dist/` are always shipped as SIBLING
+// directories (see package.json's "files"), in both a dev checkout and the published
+// npm package, so this is stable in both the unbundled (this file IS src/engine.js)
+// and bundled (this file's code now lives inside dist/agentic-security.mjs) cases.
+function _resolveEngineModulePathForWorkers() {
+  const hereFile = fileURLToPath(import.meta.url);
+  const hereDir = path.dirname(hereFile);
+  if (path.basename(hereDir) === 'src') return hereFile;
+  return path.join(hereDir, '..', 'src', 'engine.js');
+}
 import { scanLLM } from './sast/llm.js';
 import { scanLLMOwasp } from './sast/llm-owasp.js';
 import { scanLlmCost } from './sast/llm-cost-advisor.js';
@@ -38,6 +55,33 @@ import { scanQuarkusHardening } from './sast/quarkus-hardening.js';
 import { scanFastapiHardening } from './sast/fastapi-hardening.js';
 import { isDeterministic } from './posture/deterministic.js';
 import { proofCoverage } from './posture/proof-coverage.js';
+import { computeScanHealth, applyFreshness } from './pipeline/scan-health.js';
+import { computeCoverageLedger, summarizeCoverageForScanHealth } from './pipeline/coverage-ledger.js';
+import { runAnnotatorAsync } from './pipeline/annotator-runner.js';
+import { runDetector } from './pipeline/detector-runner.js';
+import { registerProducer } from './pipeline/producer-registry.js';
+import { collectProducerResult } from './pipeline/producer-collector.js';
+import { completeEnrichment } from './pipeline/enrichment-completion.js';
+
+// FR-101 (assurance-hardening PRD): the "late producers" — see
+// pipeline/producer-registry.js's header for why this list and not the
+// full ~90-detector set. Registered once at module load (this file is an
+// ESM singleton; registering inside runFullScan would throw "duplicate
+// producer id" on a second scan in the same process).
+for (const def of [
+  { id: 'cross-lang-openapi', version: '1.0.0', phase: 'cross-language', languages: [] },
+  { id: 'cross-lang-grpc', version: '1.0.0', phase: 'cross-language', languages: [] },
+  { id: 'cross-lang-graphql', version: '1.0.0', phase: 'cross-language', languages: [] },
+  { id: 'cross-lang-orm', version: '1.0.0', phase: 'cross-language', languages: [] },
+  { id: 'cross-lang-queues', version: '1.0.0', phase: 'cross-language', languages: [] },
+  { id: 'iac-reachability', version: '1.0.0', phase: 'cross-language', languages: [] },
+  { id: 'iam-policy', version: '1.0.0', phase: 'cross-language', languages: [] },
+  { id: 'container-runtime', version: '1.0.0', phase: 'cross-language', languages: [] },
+  { id: 'business-logic-v2', version: '1.0.0', phase: 'business-logic', languages: [] },
+  { id: 'specification-drift', version: '1.0.0', phase: 'business-logic', languages: [] },
+  { id: 'concurrency', version: '1.0.0', phase: 'business-logic', languages: [] },
+  { id: 'privacy-taint', version: '1.0.0', phase: 'privacy', languages: [] },
+]) registerProducer(def);
 import { scanAuthZ } from './sast/authz.js';
 import { scanApiBrokenAuthz } from './sast/api-authz.js';
 import { scanCloudTemplates, isCloudFormationTemplate } from './sast/iac-cloud-templates.js';
@@ -139,7 +183,7 @@ import { annotateExecutionProofs } from './posture/prove-findings.js';
 import { mineVulnHistory, annotateHistoricalRisk } from './posture/vuln-archaeology.js';
 import { annotateVerifierVerdicts } from './posture/verifier.js';
 import { annotateRegressionTests } from './posture/regression-test-gen.js';
-import { annotateCalibratedConfidence } from './posture/calibration.js';
+import { annotateCalibratedConfidence, calibrationFreshness } from './posture/calibration.js';
 import { annotateStableIds } from './posture/stable-id.js';
 import { clusterByRootCause } from './posture/clustering.js';
 import { demoteUnreachable } from './posture/reachability-filter.js';
@@ -200,6 +244,9 @@ import { annotateRelevance } from './posture/relevance.js';
 import { sweepRootCauses } from './posture/root-cause-sweep.js';
 import { computeAnalysisTiers, countUnmodeledSinkCandidates } from './posture/coverage-report.js';
 import { annotatePrivacyTaint, emitDpiaArtifact } from './dataflow/privacy-taint.js';
+import { loadPrivacyGovernanceConfig, emitRopaArtifact } from './dataflow/privacy-governance.js';
+import { buildDataInventory, emitDataInventoryArtifact, emitDataFlowGraph } from './dataflow/privacy-inventory.js';
+import { adaptIRForPrivacyTaint } from './privacy/ir-adapter.js';
 import { buildThreatModel as buildAutoThreatModel, persistThreatModel as persistAutoThreatModel } from './posture/threat-model-auto.js';
 import { runApiContractScan } from './posture/api-contract.js';
 import { annotateProvenance } from './sca/sigstore-verify.js';
@@ -213,6 +260,17 @@ import { annotateAttackTaxonomy, summarizeTaxonomy } from './posture/attack-taxo
 import { suppressByPastDecisions } from './posture/triage-memory.js';
 import { suppressByIntent } from './posture/intent-context.js';
 import { annotateGitHistory } from './posture/git-history.js';
+// NOT `annotateProvenance` (sca/sigstore-verify.js's build-attestation
+// annotator) and NOT `annotateFindingProvenance` (posture/provenance.js's
+// AI-code fingerprint annotator). Both are already imported above in this
+// file, so either name here is a duplicate binding — a SyntaxError — and the
+// second is worse still because it also takes a findings array as its first
+// argument, so a wrong import would RUN rather than fail. This one is named
+// for the mechanism that distinguishes it —
+// provenance derived from GIT HISTORY. See provenance/coordinator.js's header.
+import { annotateGitProvenance, PROVENANCE_DEFAULT_TIMEOUT_MS, MAX_PROVIDER_ENRICHMENTS_PER_SCAN } from './posture/provenance/coordinator.js';
+import { updateLifecycle } from './posture/provenance/lifecycle.js';
+import { emptyProvenance, PROVENANCE_STATUS } from './posture/provenance/schema.js';
 import { applyThreatModel } from './posture/threat-model-grounding.js';
 import { annotateCrossRepoSignals } from './posture/pattern-propagation.js';
 import { annotateRiskDollars } from './posture/risk-dollars.js';
@@ -235,7 +293,7 @@ import { annotateAttackPlaybooks } from './posture/attack-playbooks.js';
 // R8: opt-in scan checkpointing/resume for the per-file loop.
 import {
   openCheckpoint, recordFileDone, completedFiles, resumeFindings, closeCheckpoint,
-  computeRunKey, bundleShaForRunKey,
+  computeGlobalKey, globalKeyMeta, invalidatedFiles, bundleShaForRunKey,
 } from './posture/scan-checkpoint.js';
 import { SCANNER_VERSION as _ENGINE_VERSION } from './posture/version.js';
 import { effectiveVersion as _effectiveRulesetVersion } from './posture/ruleset-version.js';
@@ -2311,7 +2369,8 @@ function _brokenMarkerSecurityPredicate(matchText, ctx) {
 // SAST findings here are expected by design — suppress to avoid noise.
 const _INTENTIONAL_VULN_PATH_RE = /(?:^|\/)(?:codefixes|challenge[_\-]?(?:solution|code|fix|answer)|intentional[_\-]?vuln|ctf[_\-]?solution|vulnerable[_\-]?(?:example|sample|code))(?:\/|$)/i;
 
-function scanStructuralVulns(fp, raw) {
+function scanStructuralVulns(fp, raw, _suppOut) {
+  const _supp = _suppOut || _suppressionLog;
   if (_INTENTIONAL_VULN_PATH_RE.test(fp.replace(/\\/g, '/'))) return [];
   // Structural patterns vary: some describe code shapes (eval(), child_process.)
   // and shouldn't match in strings; others ALSO scan string content (e.g.
@@ -2324,7 +2383,7 @@ function scanStructuralVulns(fp, raw) {
   const findings = [];
   const ctx = inferFileContext(fp, raw);
   for (const pat of STRUCTURAL_VULN_PATTERNS) {
-    if (!_ruleAppliesIn(pat, ctx)) { _suppressionLog.push({vuln:pat.vuln,file:fp,line:0,snippet:'',reason:'context-mismatch:'+ctx.kind}); continue; }
+    if (!_ruleAppliesIn(pat, ctx)) { _supp.push({vuln:pat.vuln,file:fp,line:0,snippet:'',reason:'context-mismatch:'+ctx.kind}); continue; }
     if (pat.langScope && !pat.langScope.test(fp)) { continue; }
     const re = new RegExp(pat.regex.source, pat.regex.flags);
     // Default: match against the string-stripped view so rule-library shapes
@@ -2341,7 +2400,7 @@ function scanStructuralVulns(fp, raw) {
       if (typeof pat.predicate === 'function') {
         const verdict = pat.predicate(m[0], { file: fp, line, snippet, lines, raw, cleanedNoise });
         if (verdict && !verdict.fire) {
-          _suppressionLog.push({vuln:pat.vuln, file:fp, line, snippet, reason:'predicate-pass:'+(verdict.reason||'ok')});
+          _supp.push({vuln:pat.vuln, file:fp, line, snippet, reason:'predicate-pass:'+(verdict.reason||'ok')});
           continue;
         }
       }
@@ -2349,7 +2408,7 @@ function scanStructuralVulns(fp, raw) {
       // Used to scope rules like Django DEBUG=True to files that actually
       // import / configure Django (avoid mis-firing on Flask's app.debug).
       if (pat.contextRe && !pat.contextRe.test(raw)) {
-        _suppressionLog.push({vuln:pat.vuln, file:fp, line, snippet, reason:'context-mismatch'});
+        _supp.push({vuln:pat.vuln, file:fp, line, snippet, reason:'context-mismatch'});
         continue;
       }
       // FP-4: severity classifier — return null to suppress, otherwise overrides pat.severity.
@@ -2357,7 +2416,7 @@ function scanStructuralVulns(fp, raw) {
       if (typeof pat.severityFn === 'function') {
         const s = pat.severityFn(m[0], { file: fp, line, snippet, lines });
         if (s === null) {
-          _suppressionLog.push({vuln:pat.vuln, file:fp, line, snippet, reason:'severity-fn:non-security-context'});
+          _supp.push({vuln:pat.vuln, file:fp, line, snippet, reason:'severity-fn:non-security-context'});
           continue;
         }
         effectiveSeverity = s;
@@ -2366,11 +2425,11 @@ function scanStructuralVulns(fp, raw) {
       // hardened code — an SSRF host allow/deny check, or a path
       // basename/containment guard near the sink — is a false positive.
       if (/SSRF/.test(pat.vuln) && _hasSsrfHostGuard({ lines, line })) {
-        _suppressionLog.push({vuln:pat.vuln, file:fp, line, snippet, reason:'ssrf-host-guard'});
+        _supp.push({vuln:pat.vuln, file:fp, line, snippet, reason:'ssrf-host-guard'});
         continue;
       }
       if (/Path Traversal/.test(pat.vuln) && _hasPathGuard({ lines, line })) {
-        _suppressionLog.push({vuln:pat.vuln, file:fp, line, snippet, reason:'path-contained'});
+        _supp.push({vuln:pat.vuln, file:fp, line, snippet, reason:'path-contained'});
         continue;
       }
       const id = `struct:${fp}:${line}:${pat.vuln.replace(/\s/g, '_')}`;
@@ -2578,6 +2637,33 @@ function _resetSuppressions(){ _suppressionLog.length = 0; }
 // so pfr[p] and the aggregates share object identity, exactly as in a normal run.
 function _pfrMetaOnly(ta){ if(!ta||typeof ta!=='object')return {}; const o={}; for(const k of Object.keys(ta)){ if(k==='findings'||k==='sources'||k==='sinks'||k==='sanitizers')continue; o[k]=ta[k]; } return o; }
 function _getSuppressions(){ return [..._suppressionLog]; }
+// Task 11 reentrancy fix: `_suppressionLog` is module-level and unconditionally
+// cleared by `_resetSuppressions()` at the top of every `runFullScan` call.
+// `predicate-replay.js`'s `replayAt` calls `runFullScan` recursively FROM
+// WITHIN an outer, still-running scan's provenance resolution (to replay a
+// finding's predicate at a historical commit) -- before Task 11 wired
+// scan.secrets/scan.logicVulns into real provenance resolution, that recursive
+// call was only ever reachable from scan.findings/SCA origin walks, which this
+// exact fixture (test/fixtures/entropy-fp) never triggered. Wiring secrets in
+// exposed it for the first time: the nested call's `_resetSuppressions()`
+// silently wiped the OUTER scan's suppression log before its own return
+// statement read it via `_getSuppressions()`, so `scan.suppressions` came back
+// empty for anything that happened to walk deep git history.
+//
+// A plain snapshot/restore around ONE `replayAt` call is not sufficient on its
+// own: `coordinator.js` resolves several findings' origins CONCURRENTLY (its
+// own comment: "the scheduler runs these four at a time"), and each finding's
+// resolveOrigin walk can call `replayAt` multiple times sequentially -- so two
+// DIFFERENT findings' replay calls can be in flight at once, interleaved at
+// `runFullScan`'s own internal await points. Two overlapping snapshot/restore
+// pairs racing on the same global array means whichever restores last wins,
+// discarding whatever the other legitimately wrote in between. Exported so
+// predicate-replay.js can snapshot/restore its own call boundary AND serialize
+// that boundary process-wide (see its own comment on the exclusivity queue) --
+// the nested scan's own suppression output is never read by replayAt, so
+// nothing is lost by discarding it.
+function _snapshotSuppressionLog(){ return _suppressionLog.slice(); }
+function _restoreSuppressionLog(saved){ _suppressionLog.length = 0; if (Array.isArray(saved)) _suppressionLog.push(...saved); }
 
 // ── inline suppression pragma ───────────────────────────────────────────────
 //
@@ -3002,7 +3088,8 @@ function _logicPredicateFor(vuln){
   return null;
 }
 
-function scanLogicVulns(fp,raw){
+function scanLogicVulns(fp,raw,_suppOut){
+  const _supp = _suppOut || _suppressionLog;
   // Logic rules generally inspect the surrounding handler block including
   // string-literal route paths and key names, so the comment-stripped (but
   // string-preserving) view is the right default. Rules that explicitly only
@@ -3012,7 +3099,7 @@ function scanLogicVulns(fp,raw){
   const lines=raw.split("\n");const results=[];
   const ctx = inferFileContext(fp, raw);
   for(const pat of LOGIC_PATTERNS){
-    if (!_ruleAppliesIn(pat, ctx)) { _suppressionLog.push({vuln:pat.vuln,file:fp,line:0,snippet:'',reason:'context-mismatch:'+ctx.kind}); continue; }
+    if (!_ruleAppliesIn(pat, ctx)) { _supp.push({vuln:pat.vuln,file:fp,line:0,snippet:'',reason:'context-mismatch:'+ctx.kind}); continue; }
     if (pat.langScope && !pat.langScope.test(fp)) { continue; }
     const re=new RegExp(pat.regex.source,pat.regex.flags);
     const predicate = _logicPredicateFor(pat.vuln);
@@ -3025,7 +3112,7 @@ function scanLogicVulns(fp,raw){
       // FP-2: credential FP filter
       if(pat.vuln==='Hardcoded Secret'||pat.vuln==='Hardcoded Credential Check'){
         const fpCheck=_isFalsePositiveCredential(fp,snippet,m[0]);
-        if(fpCheck.skip){_suppressionLog.push({vuln:pat.vuln,file:fp,line,snippet,reason:fpCheck.reason});continue;}
+        if(fpCheck.skip){_supp.push({vuln:pat.vuln,file:fp,line,snippet,reason:fpCheck.reason});continue;}
         // Stage 4 correctness audit (coverage breadth, secrets): same
         // unredacted-snippet leak found in engine.js's scanEntropySecrets/
         // scanCredentials and sast/secret-concat.js — this is a THIRD,
@@ -3044,7 +3131,7 @@ function scanLogicVulns(fp,raw){
       if (predicate) {
         const verdict = predicate(m[0], {file:fp, line, snippet, lines});
         if (verdict && !verdict.fire) {
-          _suppressionLog.push({vuln:pat.vuln, file:fp, line, snippet, reason:'logic-gate:'+verdict.reason});
+          _supp.push({vuln:pat.vuln, file:fp, line, snippet, reason:'logic-gate:'+verdict.reason});
           continue;
         }
       }
@@ -5834,14 +5921,15 @@ const EXTRA_STRUCTURAL_PATTERNS=[
    fix:"Delete debug routes from production builds. NODE_ENV is unreliable as a security boundary."},
 ];
 
-function scanExtraStructural(fp,raw){
+function scanExtraStructural(fp,raw,_suppOut){
+  const _supp = _suppOut || _suppressionLog;
   const cleaned=stripNoiseAndStrings(raw);
   const cleanedNoise=stripNoise(raw,fp);
   const lines=raw.split('\n');
   const findings=[];
   const ctx = inferFileContext(fp, raw);
   for(const pat of EXTRA_STRUCTURAL_PATTERNS){
-    if (!_ruleAppliesIn(pat, ctx)) { _suppressionLog.push({vuln:pat.vuln,file:fp,line:0,snippet:'',reason:'context-mismatch:'+ctx.kind}); continue; }
+    if (!_ruleAppliesIn(pat, ctx)) { _supp.push({vuln:pat.vuln,file:fp,line:0,snippet:'',reason:'context-mismatch:'+ctx.kind}); continue; }
     if (pat.langScope && !pat.langScope.test(fp)) { continue; }
     const re=new RegExp(pat.regex.source,pat.regex.flags);
     const haystack = pat.readsStringContent ? cleanedNoise : cleaned;
@@ -5851,14 +5939,14 @@ function scanExtraStructural(fp,raw){
       const snippet=lines[line-1]?.trim()||'';
       // contextRe: require a context match across the whole file.
       if (pat.contextRe && !pat.contextRe.test(raw)) {
-        _suppressionLog.push({vuln:pat.vuln, file:fp, line, snippet, reason:'context-mismatch'});
+        _supp.push({vuln:pat.vuln, file:fp, line, snippet, reason:'context-mismatch'});
         continue;
       }
       // Per-pattern predicate gate (mirrors scanStructuralVulns).
       if (typeof pat.predicate === 'function') {
         const verdict = pat.predicate(m[0], { file: fp, line, snippet, lines, raw, cleanedNoise });
         if (verdict && !verdict.fire) {
-          _suppressionLog.push({vuln:pat.vuln, file:fp, line, snippet, reason:'predicate-pass:'+(verdict.reason||'ok')});
+          _supp.push({vuln:pat.vuln, file:fp, line, snippet, reason:'predicate-pass:'+(verdict.reason||'ok')});
           continue;
         }
       }
@@ -5913,7 +6001,8 @@ function _isLikelyNonSecret(v, ctxLine, surroundingLines){
   return null;
 }
 
-function scanEntropySecrets(fp,raw){
+function scanEntropySecrets(fp,raw,_suppOut){
+  const _supp = _suppOut || _suppressionLog;
   if(raw.length>400000)return[]; // skip huge blobs
   const out=[];
   const lines=raw.split("\n");
@@ -5942,7 +6031,7 @@ function scanEntropySecrets(fp,raw){
       // Same redaction concern as the main finding below applies to the
       // suppression log — it's exposed via --include-suppressed, and a
       // heuristic "probably not a real secret" call can be wrong.
-      _suppressionLog.push({vuln:"High-Entropy Credential Candidate",file:fp,line,snippet:ctx.trim().split(v).join(masked),reason:'entropy-'+nonSecretReason});
+      _supp.push({vuln:"High-Entropy Credential Candidate",file:fp,line,snippet:ctx.trim().split(v).join(masked),reason:'entropy-'+nonSecretReason});
       continue;
     }
     // Stage 4 correctness audit (coverage breadth, secrets): `snippet` used
@@ -7055,6 +7144,15 @@ function _osvCacheSet(key,val){try{sessionStorage.setItem('osv_'+key,JSON.string
 // Batched: api.first.org accepts up to ~100 CVEs per request via ?cve=A,B,C…
 // One HTTP round trip per 100 CVEs instead of one per CVE. Cache lookups
 // remain per-CVE so a partial cache-hit still benefits.
+//
+// FR-207: EPSS scores decay in relevance (same note as posture/epss.js's
+// separate implementation) -- track how old the CVE-keyed entries actually
+// USED by this scan are, mirroring _setKevMeta immediately below, so a
+// stale feed is visible on scan.scanHealth rather than silently applied.
+const _EPSS_STALE_AFTER_MS = 7 * 24 * 60 * 60 * 1000;
+let _epssLiveMeta = { source: 'not-loaded', ageDays: null, stale: null, cvesChecked: 0 };
+export function epssLiveMeta() { return { ..._epssLiveMeta }; }
+
 const _EPSS_BATCH = 100;
 async function _fetchEPSSBatch(cveIds){
   if (!cveIds || !cveIds.length) return new Map();
@@ -7069,7 +7167,7 @@ async function _fetchEPSSBatch(cveIds){
       const res = await fetch(url, { headers: { 'User-Agent': 'agentic-security/0.1' } });
       if (!res.ok) {
         // Mark every CVE in the batch as "tried and failed" so we don't refetch this scan.
-        for (const c of batch) _osvCacheSet('epss:'+c, false);
+        for (const c of batch) _osvCacheSet('epss:'+c, { miss: true, ts: Date.now() });
         continue;
       }
       const j = await res.json();
@@ -7080,7 +7178,7 @@ async function _fetchEPSSBatch(cveIds){
         const score = parseFloat(row.epss);
         const percentile = parseFloat(row.percentile);
         if (Number.isFinite(score) && Number.isFinite(percentile)) {
-          const v = { score, percentile };
+          const v = { score, percentile, ts: Date.now() };
           out.set(cve, v);
           _osvCacheSet('epss:'+cve, v);
           seen.add(cve);
@@ -7088,7 +7186,7 @@ async function _fetchEPSSBatch(cveIds){
       }
       // CVEs in the batch that EPSS does not know — cache the negative so we
       // don't retry within this scan run.
-      for (const c of batch) if (!seen.has(c.toUpperCase())) _osvCacheSet('epss:'+c, false);
+      for (const c of batch) if (!seen.has(c.toUpperCase())) _osvCacheSet('epss:'+c, { miss: true, ts: Date.now() });
     } catch { /* network error → caller continues without enrichment */ }
   }
   return out;
@@ -7103,14 +7201,43 @@ async function _enrichWithEPSS(supplyChainResults){
   // Cache lookup pass: keep CVEs we already have, defer the rest to one batched fetch.
   const epssByCve = new Map();
   const uncached = [];
+  // FR-207: age of every entry actually used this scan, cache hit or fresh
+  // fetch — a fresh fetch is age~0, a cache hit carries whatever `ts` it was
+  // written with. A pre-existing on-disk entry from before this field
+  // existed has no `ts` (`|| 0` → maximally stale), matching this
+  // codebase's established "never-dated == already stale" convention
+  // (compliance-policy.js's `_staleness`).
+  const ages = [];
   for (const c of allCves) {
     const hit = _osvCacheGet('epss:'+c);
-    if (hit === null) uncached.push(c);
-    else if (hit) epssByCve.set(c, hit);   // hit === false means "tried, no data" — leave unset
+    if (hit === null) { uncached.push(c); continue; }
+    if (hit === false || hit.miss) continue; // tried, no data — leave unset
+    epssByCve.set(c, hit);
+    ages.push(Date.now() - (hit.ts || 0));
   }
   if (uncached.length) {
     const fetched = await _fetchEPSSBatch(uncached);
-    for (const [cve, v] of fetched) epssByCve.set(cve, v);
+    for (const [cve, v] of fetched) { epssByCve.set(cve, v); ages.push(Date.now() - (v.ts || 0)); }
+  }
+  // Offline mode means "we deliberately have no network access this run" --
+  // mirroring _loadKEVCatalog's own offline handling immediately above,
+  // that is a genuine "we cannot vouch for freshness right now" state
+  // (stale: null), not license to label whatever is on disk stale OR
+  // fresh. This matters in practice: a cache entry written before this
+  // field existed has no `ts` at all, and without the offline carve-out
+  // that would report as "56 years old" (age computed against epoch)
+  // under the exact conditions (no network) where that claim is least
+  // verifiable.
+  if (process.env.AGENTIC_SECURITY_OFFLINE === '1') {
+    _epssLiveMeta = { source: 'offline-skipped', ageDays: null, stale: null, cvesChecked: ages.length };
+  } else if (ages.length) {
+    const oldestMs = Math.max(...ages);
+    _epssLiveMeta = {
+      source: 'cache/live',
+      ageDays: Math.floor(oldestMs / 86400000),
+      stale: oldestMs > _EPSS_STALE_AFTER_MS,
+      cvesChecked: ages.length,
+    };
   }
   for (const r of out) {
     const cve = (r.cveAliases || []).find(a => /^CVE-/.test(a));
@@ -7251,6 +7378,31 @@ function _makePurl(ecosystem,name,version,group){
   return`pkg:${t}/${ns}${encodeURIComponent(name)}${version?'@'+encodeURIComponent(version):''}`;
 }
 
+function _findManifestLine(text, sectionKey, depName) {
+  const lines = text.split('\n');
+  let inSection = false;
+  let depth = 0;
+  const escaped = depName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const nameRe = new RegExp(`"${escaped}"\\s*:`);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!inSection) {
+      if (new RegExp(`"${sectionKey}"\\s*:\\s*\\{`).test(line)) {
+        inSection = true;
+        depth = 1 + (line.match(/\{/g) || []).length - 1 - (line.match(/\}/g) || []).length;
+        if (nameRe.test(line)) return i + 1;
+        if (depth <= 0) inSection = false;
+      }
+      continue;
+    }
+    depth += (line.match(/\{/g) || []).length;
+    depth -= (line.match(/\}/g) || []).length;
+    if (depth <= 0) { inSection = false; continue; }
+    if (nameRe.test(line)) return i + 1;
+  }
+  return null;
+}
+
 function _parsePackageJson(text,filePath){
   const out=[];try{const d=JSON.parse(text);
     for(const[depKey,scope]of[['dependencies','required'],['devDependencies','optional']]){
@@ -7261,7 +7413,8 @@ function _parsePackageJson(text,filePath){
         const group=scoped?`@${parts[0]}`:'';
         const pkgName=scoped?parts[1]:name;
         out.push({name,version:ver,group,scope,purl:_makePurl('npm',pkgName,ver,group),ecosystem:'npm',filePath,
-          isUnpinned:verRange==='*'||verRange==='latest'||verRange===''||verRange==='>=0.0.0'});
+          isUnpinned:verRange==='*'||verRange==='latest'||verRange===''||verRange==='>=0.0.0',
+          line:_findManifestLine(text,depKey,name)});
       }
     }
   }catch(_){}return out;
@@ -7290,12 +7443,13 @@ function _parsePackageLockJson(text,filePath){
 
 function _parseRequirementsTxt(text,filePath){
   const out=[];
-  for(const line of text.split('\n')){
-    const t=line.trim();
+  const lines=text.split('\n');
+  for(let i=0;i<lines.length;i++){
+    const t=lines[i].trim();
     if(!t||t.startsWith('#')||t.startsWith('-'))continue;
     const m=t.match(/^([A-Za-z0-9_.-]+)\s*[=~<>!]+\s*([^\s;#,]*)/);
     if(m)out.push({name:m[1],version:m[2],group:'',scope:'required',
-      purl:_makePurl('pypi',m[1].toLowerCase(),m[2],''),ecosystem:'pypi',filePath,isUnpinned:false});
+      purl:_makePurl('pypi',m[1].toLowerCase(),m[2],''),ecosystem:'pypi',filePath,isUnpinned:false,line:i+1});
   }return out;
 }
 
@@ -8091,6 +8245,15 @@ async function queryOSV(components,allFileContents){
         fixedVersions: vuln.fixedVersions, severity: vuln.severity, cvssVector: vuln.cvssVector,
         hasKnownAttackRef: vuln.hasKnownAttackRef, osvVulnFunctions: vuln.osvVulnFunctions || [], reachable: comp.reachable, scope: comp.scope,
         file: comp.filePath,
+        // `isDirect` is backfilled onto every component just above the queryOSV
+        // call, but was never carried onto the entry materialized from it — so
+        // every consumer asking "is this a direct dependency" got `undefined`.
+        // The transitive-dedup block's `group.find(s => s.isDirect)` has
+        // therefore always fallen through to `group[0]`, picking an arbitrary
+        // member as the primary instead of the direct one, and the provenance
+        // pass's direct-only filter had nothing to filter on. `line` is Task
+        // 12's declaration line, which the SCA provenance evidence node reads.
+        isDirect: comp.isDirect, line: comp.line, depChain: Array.isArray(comp.depChain) ? comp.depChain.map((s) => s.replace(/\/$/, '')) : [],
         // kept for generateRecs() compat
         advisory: `${vid}${cveStr}, ${vuln.description}`,
         range: fixStr ? `< ${fixStr}` : 'see advisory' });
@@ -8268,7 +8431,197 @@ async function queryRegistries(components){
 
 // Node port: takes { fileContents, depFileContents } maps directly instead of a JSZip object.
 // fileContents = code files keyed by relative path; depFileContents = manifest/lockfiles keyed by relative path.
-async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null, resume=undefined, deep=undefined, deepInCi=undefined}, setProgress=()=>{}){_resetSuppressions();_buildProjectIndex(fileContents);await _loadCustomRules(scanRoot);
+  // FR-202 phase 3b (D-0050): a worker importing this module gets a FRESH, unmutated
+  // copy of SOURCE_PATTERNS/SINK_PATTERNS/SANITIZER_PATTERNS/_projectIndex/
+  // _GLOBAL_JAVA_TAINTED_METHODS -- none of the main thread's pre-loop setup carries
+  // across the worker boundary. This reproduces that exact setup (mirroring
+  // runFullScan's own pre-loop sequence) so a long-lived worker can run it ONCE at
+  // startup, then service many _runFileCascade calls with correctly-populated state,
+  // instead of redoing whole-project work per file.
+  export async function _initCascadeWorkerState(fileContents, scanRoot) {
+    _buildProjectIndex(fileContents);
+    try { _GLOBAL_JAVA_TAINTED_METHODS = _buildGlobalJavaTaintedMethodIndex(fileContents); }
+    catch { _GLOBAL_JAVA_TAINTED_METHODS = new Set(); }
+    await _loadCustomRules(scanRoot);
+  }
+
+  // FR-202 phase 3b (D-0050): the shape a preemptively-KILLED worker task leaves
+  // behind. Unlike the existing post-hoc _perFileTimeoutMs check (which fires only
+  // after a slow-but-completed cascade already populated a real delta), a worker
+  // timeout means the file's analysis was terminated mid-execution -- there is no
+  // partial result to salvage, so every field is empty and only the timeout marker
+  // finding (added by the caller, same as the cooperative path) reflects the file.
+  function _emptyCascadeDelta(c) {
+    return {
+      content: c, pfr: { findings: [], sources: [], sinks: [], sanitizers: [] },
+      routes: [], findings: [], sources: [], sinks: [], sanitizers: [],
+      logic: [], secrets: [], ciphersRest: [], ciphersTransit: [], suppressions: [],
+    };
+  }
+
+  // FR-202 phase 3a (D-0049): the per-file detector cascade returns a self-contained
+  // delta instead of mutating the outer accumulator arrays directly, so the same
+  // function body can later run inside a worker (phase 3b) and post its result back
+  // rather than reaching into shared memory it would not have access to.
+  export function _runFileCascade(p, c, scanRoot, _detectorErrors) {
+    const _aR=[],_aF=[],_aSrc=[],_aSink=[],_aSan=[],_aLogic=[],_aSecrets=[],_aCiphersRest=[],_aCiphersTransit=[],_aSupp=[];
+    const cc=_blankCached(c,_commentLangFor(p));_aR.push(...(runDetector(_detectorErrors,p,'scanRoutes',()=>scanRoutes(p,cc))||[]));const ta=performAnalysis(p,c);_aF.push(...ta.findings);_aSrc.push(...ta.sources);_aSink.push(...ta.sinks);_aSan.push(...ta.sanitizers);_aLogic.push(...(runDetector(_detectorErrors,p,'scanLogicVulns',()=>scanLogicVulns(p,cc,_aSupp))||[]));_aSecrets.push(...(runDetector(_detectorErrors,p,'scanCredentials',()=>scanCredentials(p,c))||[]));_aF.push(...(runDetector(_detectorErrors,p,'scanStructuralVulns',()=>scanStructuralVulns(p,cc,_aSupp))||[]));_aF.push(...(runDetector(_detectorErrors,p,'scanExtraStructural',()=>scanExtraStructural(p,cc,_aSupp))||[]));_aF.push(...(runDetector(_detectorErrors,p,'scanAliasedSinks',()=>scanAliasedSinks(p,cc))||[]));_aF.push(...(runDetector(_detectorErrors,p,'scanJavaSAST',()=>scanJavaSAST(p,cc))||[]));_aF.push(...(runDetector(_detectorErrors,p,'scanJavaBenchExtras',()=>scanJavaBenchExtras(p,cc))||[]));_aLogic.push(...(runDetector(_detectorErrors,p,'scanMiddlewareOrdering',()=>scanMiddlewareOrdering(p,cc))||[]));_aLogic.push(...(runDetector(_detectorErrors,p,'scanReDoS',()=>scanReDoS(p,cc))||[]));if(/\.(?:java|cs|kt|py|php|phtml)$/i.test(p)){_aLogic.push(...(runDetector(_detectorErrors,p,'scanRegexReDoS',()=>scanRegexReDoS(p,cc))||[]));}_aLogic.push(...(runDetector(_detectorErrors,p,'scanTodosNearSecurity',()=>scanTodosNearSecurity(p,c))||[]));_aSecrets.push(...(runDetector(_detectorErrors,p,'scanEntropySecrets',()=>scanEntropySecrets(p,c,_aSupp))||[]));const cp=scanCiphers(p,cc);_aCiphersRest.push(...cp.atRest);_aCiphersTransit.push(...cp.inTransit);if(/\.(graphql|gql)$/i.test(p))_aF.push(...(runDetector(_detectorErrors,p,'scanGraphQL',()=>scanGraphQL(p,cc))||[]));_aF.push(...(runDetector(_detectorErrors,p,'scanIaC',()=>scanIaC(p,cc))||[]));_aF.push(...(runDetector(_detectorErrors,p,'scanTerraform',()=>scanTerraform(p,cc))||[]));_aF.push(...(runDetector(_detectorErrors,p,'scanCloudTemplates',()=>scanCloudTemplates(p,c))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanLLM',()=>scanLLM(p,c))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanLLMOwasp',()=>scanLLMOwasp(p,c))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanLlmCost',()=>scanLlmCost(p,c))||[]));
+      _aLogic.push(...(runDetector(_detectorErrors,p,'scanBusinessLogic',()=>scanBusinessLogic(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanPipeline',()=>scanPipeline(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanContainer',()=>scanContainer(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanInstallScripts',()=>scanInstallScripts(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanMCP',()=>scanMCP(p,c))||[]));
+      // PRD F5.2 — rug-pull: a tool whose definition changed AFTER approval.
+      // Every scanMCP rule judges the CURRENT content, so a description that is
+      // innocuous today and hostile tomorrow passes both scans. This compares
+      // against a recorded baseline, which is the only way to see a change.
+      // Wired here rather than left as a tested module: a detector with no call
+      // site is a dark detector, which is the exact class this session keeps
+      // finding.
+      if (/(?:^|[\\/])\.?mcp(?:\.[a-z]+)?\.json$|(?:^|[\\/])\.mcp\.json$/i.test(p)) {
+        try {
+          const _cfg = JSON.parse(c);
+          const _rp = _detectRugPull(scanRoot, _cfg, { file: p });
+          _aF.push(..._rp.findings);
+          // Record on first sight so the NEXT scan has something to compare
+          // against; refresh after reporting so a reviewed change is not
+          // re-reported forever.
+          _saveMcpBaseline(scanRoot, _fingerprintMcp(_cfg));
+        } catch (e) {
+          // Only a malformed config is tolerated here — scanMCP already reports
+          // what it can from one. Anything else is a programmer error and must
+          // not be swallowed: a bare `catch {}` around this block hid a
+          // ReferenceError (`root` vs `scanRoot`) that silently disabled the
+          // whole detector while every unit test still passed.
+          if (!(e instanceof SyntaxError)) throw e;
+        }
+      }
+      _aF.push(...(runDetector(_detectorErrors,p,'scanClaudeSettings',()=>scanClaudeSettings(p,c))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanClaudeMdPromptInjection',()=>scanClaudeMdPromptInjection(p,c))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanClaudeHookInjection',()=>scanClaudeHookInjection(p,c))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanDjangoHardening',()=>scanDjangoHardening(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanDefiDeep',()=>scanDefiDeep(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanSpringbootHardening',()=>scanSpringbootHardening(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanLaravelHardening',()=>scanLaravelHardening(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanSwift',()=>scanSwift(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanDartFlutter',()=>scanDartFlutter(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanWeakRandomness',()=>scanWeakRandomness(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanGraphQLModule',()=>scanGraphQLModule(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanSensitiveDataLogging',()=>scanSensitiveDataLogging(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanComparisonSafety',()=>scanComparisonSafety(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanWeakPasswordHash',()=>scanWeakPasswordHash(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanCachePoisoning',()=>scanCachePoisoning(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanNullByteInjection',()=>scanNullByteInjection(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanLlmTradingAgent',()=>scanLlmTradingAgent(p,c))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanMobileManifest',()=>scanMobileManifest(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanQuarkusHardening',()=>scanQuarkusHardening(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanFastapiHardening',()=>scanFastapiHardening(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanAuthZ',()=>scanAuthZ(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanModelLoad',()=>scanModelLoad(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanPromptTemplate',()=>scanPromptTemplate(p,c))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanXXE',()=>scanXXE(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanJNDI',()=>scanJNDI(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanJavaDeserialization',()=>scanJavaDeserialization(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanJwtExp',()=>scanJwtExp(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanZipSlip',()=>scanZipSlip(p,cc))||[]));_aF.push(...(runDetector(_detectorErrors,p,'scanSiblingGuard',()=>scanSiblingGuard(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanFileUpload',()=>scanFileUpload(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanHostHeader',()=>scanHostHeader(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanPythonSinks',()=>scanPythonSinks(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanCSharp',()=>scanCSharp(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanCpp',()=>scanCpp(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanSolidity',()=>scanSolidity(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanRust',()=>scanRust(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanGoExtended',()=>scanGoExtended(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanDatabaseRLS',()=>scanDatabaseRLS(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanRateLimit',()=>scanRateLimit(p,cc))||[]));_aF.push(...(runDetector(_detectorErrors,p,'scanResourceExhaustion',()=>scanResourceExhaustion(p,cc))||[]));_aF.push(...(runDetector(_detectorErrors,p,'scanRedirectToctou',()=>scanRedirectToctou(p,cc))||[]));_aF.push(...(runDetector(_detectorErrors,p,'scanCodegenSink',()=>scanCodegenSink(p,cc))||[]));_aF.push(...(runDetector(_detectorErrors,p,'scanOwnershipAuthz',()=>scanOwnershipAuthz(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanAuthProvider',()=>scanAuthProvider(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanEnvHygiene',()=>scanEnvHygiene(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanWebhook',()=>scanWebhook(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanClientSide',()=>scanClientSide(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanPromptFirewall',()=>scanPromptFirewall(p,c))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanLlmRedteam',()=>scanLlmRedteam(p,c))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanJulietShape',()=>scanJulietShape(p,c))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanCppDataflow',()=>scanCppDataflow(p,cc))||[]));
+      // Phase 1: new detectors.
+      _aF.push(...(runDetector(_detectorErrors,p,'scanMassAssignment',()=>scanMassAssignment(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanPrototypePollution',()=>scanPrototypePollution(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanCSRF',()=>scanCSRF(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanTOCTOU',()=>scanTOCTOU(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanNoSQLInjection',()=>scanNoSQLInjection(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanLDAPInjection',()=>scanLDAPInjection(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanXPathInjection',()=>scanXPathInjection(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanSSTI',()=>scanSSTI(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanOpenRedirect',()=>scanOpenRedirect(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanWrongContextSanitizer',()=>scanWrongContextSanitizer(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanSanitizerContextMismatch',()=>scanSanitizerContextMismatch(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanFrontendHygiene',()=>scanFrontendHygiene(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanCsvInjection',()=>scanCsvInjection(p,cc))||[]));
+      // R16 — specialist crypto-hygiene classes (constant-time comparison,
+      // secret zeroization). Narrow by design: keyed on the secret-ness of the
+      // identifier, and silent whenever the correct constant-time or
+      // guaranteed-wipe API is already present.
+      _aF.push(...(runDetector(_detectorErrors,p,'scanCryptoSpecialist',()=>scanCryptoSpecialist(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanStoredTaint',()=>scanStoredTaint(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanJavaStructural',()=>scanJavaStructural(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanCsharpStructural',()=>scanCsharpStructural(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanJsFrameworkStructural',()=>scanJsFrameworkStructural(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanPythonStructural',()=>scanPythonStructural(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanGoStructural',()=>scanGoStructural(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanSecretConcat',()=>scanSecretConcat(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanXssReflectedMultilang',()=>scanXssReflectedMultilang(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanCodeInjectionMultilang',()=>scanCodeInjectionMultilang(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanResponseSplitting',()=>scanResponseSplitting(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanStoredPromptInjection',()=>scanStoredPromptInjection(p,c))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanRAGPoisoning',()=>scanRAGPoisoning(p,c))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanAgentToolEscalation',()=>scanAgentToolEscalation(p,c))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanAgentUntrustedFlow',()=>scanAgentUntrustedFlow(p,c))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanEventEntrypoints',()=>scanEventEntrypoints(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanDbTaint',()=>scanDbTaint(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanSSRFCloudMetadata',()=>scanSSRFCloudMetadata(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanMutationXSS',()=>scanMutationXSS(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanKotlin',()=>scanKotlin(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanRuby',()=>scanRuby(p,cc))||[]));_aF.push(...(runDetector(_detectorErrors,p,'scanRubyPathJoin',()=>scanRubyPathJoin(p,cc))||[]));
+      _aF.push(...(runDetector(_detectorErrors,p,'scanPhp',()=>scanPhp(p,cc))||[]));
+      // Integration block: scaffolded SAST scanners. Gated by env var.
+      if (process.env.AGENTIC_SECURITY_NO_INTEGRATION !== '1') {
+        if (process.env.AGENTIC_SECURITY_NO_LLM_APP !== '1') _aF.push(...(runDetector(_detectorErrors,p,'scanLlmApp',()=>scanLlmApp(p,c))||[]));
+        if (process.env.AGENTIC_SECURITY_NO_MOBILE  !== '1') _aF.push(...(runDetector(_detectorErrors,p,'scanMobile',()=>scanMobile(p,cc))||[]));
+        if (process.env.AGENTIC_SECURITY_NO_PQC     !== '1') _aF.push(...(runDetector(_detectorErrors,p,'scanPqc',()=>scanPqc(p,cc))||[]));
+        if (process.env.AGENTIC_SECURITY_NO_WEB3_ADV!== '1') _aF.push(...(runDetector(_detectorErrors,p,'scanWeb3Advanced',()=>scanWeb3Advanced(p,cc))||[]));
+        if (process.env.AGENTIC_SECURITY_NO_DAPP    !== '1') _aF.push(...(runDetector(_detectorErrors,p,'scanDappFrontend',()=>scanDappFrontend(p,cc))||[]));
+        if (process.env.AGENTIC_SECURITY_NO_CLOUD_IAM!== '1') _aF.push(...(runDetector(_detectorErrors,p,'scanCloudIam',()=>scanCloudIam(p,cc))||[]));
+        if (process.env.AGENTIC_SECURITY_NO_K8S_ADM !== '1') _aF.push(...(runDetector(_detectorErrors,p,'scanK8sAdmission',()=>scanK8sAdmission(p,cc))||[]));
+        if (process.env.AGENTIC_SECURITY_NO_CRYPTO_PROTO !== '1') _aF.push(...(runDetector(_detectorErrors,p,'scanCryptoProtocol',()=>scanCryptoProtocol(p,cc))||[]));
+        if (process.env.AGENTIC_SECURITY_NO_ML_SUPPLY    !== '1') _aF.push(...(runDetector(_detectorErrors,p,'scanMlSupplyChain',()=>scanMlSupplyChain(p,cc))||[]));
+      }
+    return {content:c, pfr:ta, routes:_aR, findings:_aF, sources:_aSrc, sinks:_aSink, sanitizers:_aSan, logic:_aLogic, secrets:_aSecrets, ciphersRest:_aCiphersRest, ciphersTransit:_aCiphersTransit, suppressions:_aSupp};
+  }
+
+// `provenance:false` is the RE-ENTRANCY BRAKE, not a feature flag.
+// posture/provenance/predicate-replay.js answers "did this finding's condition
+// hold at commit X" by calling runFullScan back on that commit's blobs. Once
+// runFullScan itself runs the provenance pass, that is an unbounded recursion —
+// scan → provenance → replay → scan → … — which manifests as a scan that never
+// returns and spawns `git` forever, because every level of it is synchronous
+// execFileSync work. The replay's findings are discarded, so it wants no
+// provenance anyway; and it must NOT touch the lifecycle store, whose events
+// would otherwise be written from historical blobs as if they were this scan.
+// Passed explicitly per invocation rather than held in a module-level guard so
+// concurrent scans in one process cannot disable each other's provenance.
+//
+// `completeScan` is a SEPARATE question from `provenance`, and conflating them
+// is what let the fourth instance of this bug through. `provenance:false` says
+// "do not run the pass at all"; `completeScan:false` says "the pass may run,
+// but this file set is a SUBSET of scanRoot, so absence of a finding proves
+// nothing." Only the lifecycle ledger's remediation pass reads it — that is the
+// one place a finding's absence is turned into a positive claim. Defaults true
+// because a direct runFullScan caller supplying no file-subsetting options is
+// scanning everything it was given; runScan.js narrows it for --changed-since
+// and for caller-supplied fileContents.
+async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null, resume=undefined, deep=undefined, deepInCi=undefined, provenance=true, completeScan=true, skipAnnotators=false}, setProgress=()=>{}){_resetSuppressions();_buildProjectIndex(fileContents);await _loadCustomRules(scanRoot);
   // Pre-pass: build cross-file Java tainted-method index so per-file taint
   // analysis can recognize calls to user-input-returning helper methods
   // defined in OTHER files (Juliet's DataflowThruInnerClass / Vector / Stream
@@ -8295,7 +8648,7 @@ function _deterministicFileTimings(timings) {
 
   const _fileTimings = [];
   let _filesSkipped = 0, _filesTimedOut = 0, _filesDenseSkipped = 0;
-  const files=Object.keys(fileContents).filter(f=>(shouldScan(f) || isKubernetesManifest(f, fileContents[f]) || isCloudFormationTemplate(f, fileContents[f]) || isInstructionFile(f)) && !_isPathIgnored(f));const fc={},pfr={};const aR=[],aF=[],aSrc=[],aSink=[],aSan=[],aLogic=[],aSupply=[],aSecrets=[],aCiphersRest=[],aCiphersTransit=[];
+  const files=Object.keys(fileContents).filter(f=>(shouldScan(f) || isKubernetesManifest(f, fileContents[f]) || isCloudFormationTemplate(f, fileContents[f]) || isInstructionFile(f)) && !_isPathIgnored(f));const fc={},pfr={};const aR=[],aF=[],aSrc=[],aSink=[],aSan=[],aLogic=[],aSupply=[],aSecrets=[],aCiphersRest=[],aCiphersTransit=[];const _detectorErrors=[];
   // ---- R8: opt-in per-file checkpointing (AGENTIC_SECURITY_RESUME=1, or
   // runScan({resume:true})). Default OFF, so existing behaviour is untouched.
   // Only this loop is checkpointed; every cross-file pass below re-runs, so
@@ -8303,17 +8656,28 @@ function _deterministicFileTimings(timings) {
   const _ckptEnabled = (resume === undefined ? process.env.AGENTIC_SECURITY_RESUME === '1' : !!resume) && !!scanRoot;
   let _ckpt = null; const _ckptPayloads = new Map(); let _ckptDone = new Set(); let _ckptResumed = 0, _ckptWrites = 0;
   const _ckptAbortAfter = parseInt(process.env.AGENTIC_SECURITY_CHECKPOINT_ABORT_AFTER || '0', 10) || 0;
+  let _ckptInvalidated = [];
   if (_ckptEnabled) {
     try {
-      const _runKey = computeRunKey({
+      const _ckptIdentity = {
         engineVersion: _ENGINE_VERSION,
         rulesetVersion: (_effectiveRulesetVersion(scanRoot) || {}).version,
         bundleSha: bundleShaForRunKey(),
-        fileContents, depFileContents,
+        depFileContents,
+      };
+      // FR-208: the global key covers everything that would affect how EVERY
+      // file is analysed (engine/ruleset/bundle/deps/env); each scanned
+      // file's OWN content is checked per-record inside openCheckpoint
+      // instead, so changing one file no longer discards every other file's
+      // already-completed work — see scan-checkpoint.js's module header.
+      _ckpt = openCheckpoint(scanRoot, {
+        globalKey: computeGlobalKey(_ckptIdentity),
+        meta: globalKeyMeta(_ckptIdentity),
+        fileContents,
       });
-      _ckpt = openCheckpoint(scanRoot, { runKey: _runKey });
       for (const r of resumeFindings(_ckpt)) { if (r && r.findings) _ckptPayloads.set(r.file, r.findings); }
       _ckptDone = completedFiles(_ckpt);
+      _ckptInvalidated = invalidatedFiles(_ckpt);
     } catch (_) { _ckpt = null; }
   }
   // Replay a checkpointed file's ENTIRE contribution, in the same array order
@@ -8360,146 +8724,45 @@ function _deterministicFileTimings(timings) {
     // is what the checkpoint format has to survive. Never set in normal use.
     if (_ckptAbortAfter > 0 && _ckptWrites >= _ckptAbortAfter) process.exit(137);
   };
-  let i=0;for(const p of files){i++;const _ft0=Date.now();setProgress({current:i,total:files.length,file:p.split("/").pop(),phase:"Scanning"});
+  // FR-202 phase 3b (D-0050): opt-in real deadline enforcement for the per-file
+  // cascade via a reused worker pool. Off by default -- the synchronous path above
+  // this loop is completely unchanged when the flag is unset.
+  const _useWorkerCascade = process.env.AGENTIC_SECURITY_WORKER_CASCADE === '1';
+  let _cascadePool = null;
+  if (_useWorkerCascade) {
+    const { createCascadePool } = await import('./pipeline/cascade-worker-pool.js');
+    _cascadePool = createCascadePool({
+      fileContents, scanRoot,
+      modulePath: _resolveEngineModulePathForWorkers(),
+      poolSize: Number(process.env.AGENTIC_SECURITY_WORKER_POOL_SIZE) || 4,
+    });
+  }
+  let i=0;
+  try {
+  for(const p of files){i++;const _ft0=Date.now();setProgress({current:i,total:files.length,file:p.split("/").pop(),phase:"Scanning"});
     if(_ckptDone.has(p)&&_ckptReplay(p))continue;
     const _mk={aR:aR.length,aF:aF.length,aSrc:aSrc.length,aSink:aSink.length,aSan:aSan.length,aLogic:aLogic.length,aSecrets:aSecrets.length,aCR:aCiphersRest.length,aCT:aCiphersTransit.length,sup:_suppressionLog.length};
-    try{const c=fileContents[p];if(!c||c.length>500000){_filesSkipped++;continue;}const _avgLine=c.length/Math.max(c.split('\n').length,1);if(_avgLine>400&&c.length>10000){_filesDenseSkipped++;continue;}const cc=_blankCached(c,_commentLangFor(p));fc[p]=c;aR.push(...scanRoutes(p,cc));const ta=performAnalysis(p,c);pfr[p]=ta;aF.push(...ta.findings);aSrc.push(...ta.sources);aSink.push(...ta.sinks);aSan.push(...ta.sanitizers);aLogic.push(...scanLogicVulns(p,cc));aSecrets.push(...scanCredentials(p,c));aF.push(...scanStructuralVulns(p,cc));aF.push(...scanExtraStructural(p,cc));aF.push(...scanAliasedSinks(p,cc));aF.push(...scanJavaSAST(p,cc));aF.push(...scanJavaBenchExtras(p,cc));aLogic.push(...scanMiddlewareOrdering(p,cc));aLogic.push(...scanReDoS(p,cc));if(/\.(?:java|cs|kt|py|php|phtml)$/i.test(p)){try{aLogic.push(...scanRegexReDoS(p,cc));}catch(_){}}aLogic.push(...scanTodosNearSecurity(p,c));aSecrets.push(...scanEntropySecrets(p,c));const cp=scanCiphers(p,cc);aCiphersRest.push(...cp.atRest);aCiphersTransit.push(...cp.inTransit);if(/\.(graphql|gql)$/i.test(p))aF.push(...scanGraphQL(p,cc));aF.push(...scanIaC(p,cc));aF.push(...scanTerraform(p,cc));aF.push(...scanCloudTemplates(p,c));
-      aF.push(...scanLLM(p,c));
-      aF.push(...scanLLMOwasp(p,c));
-      aF.push(...scanLlmCost(p,c));
-      aLogic.push(...scanBusinessLogic(p,cc));
-      aF.push(...scanPipeline(p,cc));
-      aF.push(...scanContainer(p,cc));
-      aF.push(...scanInstallScripts(p,cc));
-      aF.push(...scanMCP(p,c));
-      // PRD F5.2 — rug-pull: a tool whose definition changed AFTER approval.
-      // Every scanMCP rule judges the CURRENT content, so a description that is
-      // innocuous today and hostile tomorrow passes both scans. This compares
-      // against a recorded baseline, which is the only way to see a change.
-      // Wired here rather than left as a tested module: a detector with no call
-      // site is a dark detector, which is the exact class this session keeps
-      // finding.
-      if (/(?:^|[\\/])\.?mcp(?:\.[a-z]+)?\.json$|(?:^|[\\/])\.mcp\.json$/i.test(p)) {
-        try {
-          const _cfg = JSON.parse(c);
-          const _rp = _detectRugPull(scanRoot, _cfg, { file: p });
-          aF.push(..._rp.findings);
-          // Record on first sight so the NEXT scan has something to compare
-          // against; refresh after reporting so a reviewed change is not
-          // re-reported forever.
-          _saveMcpBaseline(scanRoot, _fingerprintMcp(_cfg));
-        } catch (e) {
-          // Only a malformed config is tolerated here — scanMCP already reports
-          // what it can from one. Anything else is a programmer error and must
-          // not be swallowed: a bare `catch {}` around this block hid a
-          // ReferenceError (`root` vs `scanRoot`) that silently disabled the
-          // whole detector while every unit test still passed.
-          if (!(e instanceof SyntaxError)) throw e;
-        }
-      }
-      aF.push(...scanClaudeSettings(p,c));
-      aF.push(...scanClaudeMdPromptInjection(p,c));
-      aF.push(...scanClaudeHookInjection(p,c));
-      aF.push(...scanDjangoHardening(p,cc));
-      aF.push(...scanDefiDeep(p,cc));
-      aF.push(...scanSpringbootHardening(p,cc));
-      aF.push(...scanLaravelHardening(p,cc));
-      aF.push(...scanSwift(p,cc));
-      aF.push(...scanDartFlutter(p,cc));
-      aF.push(...scanWeakRandomness(p,cc));
-      aF.push(...scanGraphQLModule(p,cc));
-      aF.push(...scanSensitiveDataLogging(p,cc));
-      aF.push(...scanComparisonSafety(p,cc));
-      aF.push(...scanWeakPasswordHash(p,cc));
-      aF.push(...scanCachePoisoning(p,cc));
-      aF.push(...scanNullByteInjection(p,cc));
-      aF.push(...scanLlmTradingAgent(p,c));
-      aF.push(...scanMobileManifest(p,cc));
-      aF.push(...scanQuarkusHardening(p,cc));
-      aF.push(...scanFastapiHardening(p,cc));
-      aF.push(...scanAuthZ(p,cc));
-      aF.push(...scanModelLoad(p,cc));
-      aF.push(...scanPromptTemplate(p,c));
-      aF.push(...scanXXE(p,cc));
-      aF.push(...scanJNDI(p,cc));
-      aF.push(...scanJavaDeserialization(p,cc));
-      aF.push(...scanJwtExp(p,cc));
-      aF.push(...scanZipSlip(p,cc));aF.push(...scanSiblingGuard(p,cc));
-      aF.push(...scanFileUpload(p,cc));
-      aF.push(...scanHostHeader(p,cc));
-      aF.push(...scanPythonSinks(p,cc));
-      aF.push(...scanCSharp(p,cc));
-      aF.push(...scanCpp(p,cc));
-      aF.push(...scanSolidity(p,cc));
-      aF.push(...scanRust(p,cc));
-      aF.push(...scanGoExtended(p,cc));
-      aF.push(...scanDatabaseRLS(p,cc));
-      aF.push(...scanRateLimit(p,cc));aF.push(...scanResourceExhaustion(p,cc));aF.push(...scanRedirectToctou(p,cc));aF.push(...scanCodegenSink(p,cc));aF.push(...scanOwnershipAuthz(p,cc));
-      aF.push(...scanAuthProvider(p,cc));
-      aF.push(...scanEnvHygiene(p,cc));
-      aF.push(...scanWebhook(p,cc));
-      aF.push(...scanClientSide(p,cc));
-      aF.push(...scanPromptFirewall(p,c));
-      aF.push(...scanLlmRedteam(p,c));
-      aF.push(...scanJulietShape(p,c));
-      aF.push(...scanCppDataflow(p,cc));
-      // Phase 1: new detectors.
-      aF.push(...scanMassAssignment(p,cc));
-      aF.push(...scanPrototypePollution(p,cc));
-      aF.push(...scanCSRF(p,cc));
-      aF.push(...scanTOCTOU(p,cc));
-      aF.push(...scanNoSQLInjection(p,cc));
-      aF.push(...scanLDAPInjection(p,cc));
-      aF.push(...scanXPathInjection(p,cc));
-      aF.push(...scanSSTI(p,cc));
-      aF.push(...scanOpenRedirect(p,cc));
-      aF.push(...scanWrongContextSanitizer(p,cc));
-      aF.push(...scanSanitizerContextMismatch(p,cc));
-      aF.push(...scanFrontendHygiene(p,cc));
-      aF.push(...scanCsvInjection(p,cc));
-      // R16 — specialist crypto-hygiene classes (constant-time comparison,
-      // secret zeroization). Narrow by design: keyed on the secret-ness of the
-      // identifier, and silent whenever the correct constant-time or
-      // guaranteed-wipe API is already present.
-      aF.push(...scanCryptoSpecialist(p,cc));
-      aF.push(...scanStoredTaint(p,cc));
-      aF.push(...scanJavaStructural(p,cc));
-      aF.push(...scanCsharpStructural(p,cc));
-      aF.push(...scanJsFrameworkStructural(p,cc));
-      aF.push(...scanPythonStructural(p,cc));
-      aF.push(...scanGoStructural(p,cc));
-      aF.push(...scanSecretConcat(p,cc));
-      aF.push(...scanXssReflectedMultilang(p,cc));
-      aF.push(...scanCodeInjectionMultilang(p,cc));
-      aF.push(...scanResponseSplitting(p,cc));
-      aF.push(...scanStoredPromptInjection(p,c));
-      aF.push(...scanRAGPoisoning(p,c));
-      aF.push(...scanAgentToolEscalation(p,c));
-      aF.push(...scanAgentUntrustedFlow(p,c));
-      aF.push(...scanEventEntrypoints(p,cc));
-      aF.push(...scanDbTaint(p,cc));
-      aF.push(...scanSSRFCloudMetadata(p,cc));
-      aF.push(...scanMutationXSS(p,cc));
-      aF.push(...scanKotlin(p,cc));
-      aF.push(...scanRuby(p,cc));aF.push(...scanRubyPathJoin(p,cc));
-      aF.push(...scanPhp(p,cc));
-      // Integration block: scaffolded SAST scanners. Gated by env var.
-      if (process.env.AGENTIC_SECURITY_NO_INTEGRATION !== '1') {
-        if (process.env.AGENTIC_SECURITY_NO_LLM_APP !== '1') aF.push(...scanLlmApp(p,c));
-        if (process.env.AGENTIC_SECURITY_NO_MOBILE  !== '1') aF.push(...scanMobile(p,cc));
-        if (process.env.AGENTIC_SECURITY_NO_PQC     !== '1') aF.push(...scanPqc(p,cc));
-        if (process.env.AGENTIC_SECURITY_NO_WEB3_ADV!== '1') aF.push(...scanWeb3Advanced(p,cc));
-        if (process.env.AGENTIC_SECURITY_NO_DAPP    !== '1') aF.push(...scanDappFrontend(p,cc));
-        if (process.env.AGENTIC_SECURITY_NO_CLOUD_IAM!== '1') aF.push(...scanCloudIam(p,cc));
-        if (process.env.AGENTIC_SECURITY_NO_K8S_ADM !== '1') aF.push(...scanK8sAdmission(p,cc));
-        if (process.env.AGENTIC_SECURITY_NO_CRYPTO_PROTO !== '1') aF.push(...scanCryptoProtocol(p,cc));
-        if (process.env.AGENTIC_SECURITY_NO_ML_SUPPLY    !== '1') aF.push(...scanMlSupplyChain(p,cc));
+    try{const c=fileContents[p];if(!c||c.length>500000){_filesSkipped++;continue;}const _avgLine=c.length/Math.max(c.split('\n').length,1);if(_avgLine>400&&c.length>10000){_filesDenseSkipped++;continue;}
+      let _delta;
+      if (_cascadePool) {
+        const _res = await _cascadePool.runFile(p, c, scanRoot, _detectorErrors, { timeoutMs: _perFileTimeoutMs });
+        if (_res.ok) { _delta = _res.result; }
+        else if (_res.timedOut) { _delta = _emptyCascadeDelta(c); }
+        else { throw new Error(_res.error); }
+      } else {
+        _delta = _runFileCascade(p,c,scanRoot,_detectorErrors);
       }
+      fc[p]=_delta.content;pfr[p]=_delta.pfr;
+      aR.push(..._delta.routes);aF.push(..._delta.findings);aSrc.push(..._delta.sources);aSink.push(..._delta.sinks);aSan.push(..._delta.sanitizers);aLogic.push(..._delta.logic);aSecrets.push(..._delta.secrets);aCiphersRest.push(..._delta.ciphersRest);aCiphersTransit.push(..._delta.ciphersTransit);_suppressionLog.push(..._delta.suppressions);
       const _ftElapsed=Date.now()-_ft0;
       if(_ftElapsed>_perFileTimeoutMs){aF.push({id:`file-timeout:${p}`,file:p,line:0,vuln:`File analysis exceeded ${_perFileTimeoutMs}ms (${_ftElapsed}ms)`,severity:'info',parser:'ENGINE',confidence:0.5,_timeout:true});_filesTimedOut++;}
       _fileTimings.push({file:p,ms:_ftElapsed});
-      _ckptRecord(p,_mk,_ftElapsed,ta);
-      }catch(_){_fileTimings.push({file:p,ms:Date.now()-_ft0,error:true});}if(i%5===0)await new Promise(r=>setTimeout(r,0));}
+      _ckptRecord(p,_mk,_ftElapsed,_delta.pfr);
+    }catch(_){_fileTimings.push({file:p,ms:Date.now()-_ft0,error:true});}
+    if(i%5===0)await new Promise(r=>setTimeout(r,0));}
+  } finally {
+    if (_cascadePool) await _cascadePool.shutdown();
+  }
   // Deserialization-gadget detector runs once with full-tree context (it needs
   // manifest contents to know which gadget libs are on the classpath).
   try {
@@ -8507,7 +8770,7 @@ function _deterministicFileTimings(timings) {
     if (_gadgets.size) {
       for (const p of files) {
         const c = fc[p]; if (!c) continue;
-        aF.push(...scanDeserializationGadgets(p, c, { gadgets: _gadgets }));
+        aF.push(...(runDetector(_detectorErrors,p,'scanDeserializationGadgets',()=>scanDeserializationGadgets(p, c, { gadgets: _gadgets }))||[]));
       }
     }
   } catch(_) {}
@@ -8650,17 +8913,17 @@ function _deterministicFileTimings(timings) {
   // R19 (PRD §5): cross-route BOLA/BFLA over the aggregated route inventory.
   // Convention deviation is PROJECT-scoped by design: the convention is a
   // property of the codebase, not of one file (see convention-deviation.js).
-  try{aF.push(...scanConventionDeviationProject(fc));}catch(_){}
-  try{aF.push(...scanApiBrokenAuthz(aR));}catch(_){}
+  aF.push(...(runDetector(_detectorErrors,'<project>','scanConventionDeviationProject',()=>scanConventionDeviationProject(fc))||[]));
+  aF.push(...(runDetector(_detectorErrors,'<project>','scanApiBrokenAuthz',()=>scanApiBrokenAuthz(aR))||[]));
   // R22 (PRD §5): cross-service edges inferred from code (client call → matched route).
-  try{aF.push(...scanCrossService(aR,fc));}catch(_){}
+  aF.push(...(runDetector(_detectorErrors,'<project>','scanCrossService',()=>scanCrossService(aR,fc))||[]));
   // R21 (PRD §5): RBAC role-tier consistency over the route inventory.
-  try{aF.push(...scanRbacConsistency(aR,fc));}catch(_){}
+  aF.push(...(runDetector(_detectorErrors,'<project>','scanRbacConsistency',()=>scanRbacConsistency(aR,fc))||[]));
   setProgress({current:i,total:files.length,file:"Reachability + guards...",phase:"Linking"});annotateReachability(aF,aR,callGraph,fc);aF.forEach(f=>detectGuardsForFinding(f,fc));
   setProgress({current:i,total:files.length,file:"Inferring sanitizers...",phase:"Linking"});const learned=inferSanitizers(fc);applyLearnedSanitizers(aF,learned,fc);
   setProgress({current:i,total:files.length,file:"Sanitizer effectiveness...",phase:"Linking"});applySanitizerEffectiveness(aF);
   setProgress({current:i,total:files.length,file:"Attack chains...",phase:"Linking"});const chains=crossFindingChain(aF);aF.push(...chains);
-  setProgress({current:i,total:files.length,file:"Config file cross-ref...",phase:"Linking"});aLogic.push(...scanConfigFiles(fc));
+  setProgress({current:i,total:files.length,file:"Config file cross-ref...",phase:"Linking"});aLogic.push(...(runDetector(_detectorErrors,'<project>','scanConfigFiles',()=>scanConfigFiles(fc))||[]));
   setProgress({current:i,total:files.length,file:"OSV vulnerability database...",phase:"SCA"});
   const allFileContents={...fc, ...depFileContents};
   // PRD F11.4 — malicious install hooks, scanned where package.json actually
@@ -8675,7 +8938,7 @@ function _deterministicFileTimings(timings) {
   // A manifest detector belongs on the manifest path.
   for (const [mp, mc] of Object.entries(depFileContents)) {
     if (!/(?:^|\/)package\.json$/i.test(mp)) continue;
-    try { aF.push(...scanInstallScripts(mp, mc)); } catch (_) { /* never fail a scan on one manifest */ }
+    aF.push(...(runDetector(_detectorErrors,mp,'scanInstallScripts',()=>scanInstallScripts(mp, mc))||[]));
   }
   const components=parseManifests(allFileContents);
   // R8 (PRD §5): OS packages from an extracted container image's package DBs
@@ -8806,8 +9069,8 @@ function _deterministicFileTimings(timings) {
     }
   }
   const annotatedComponents=components.map(c=>{const key=`${c.ecosystem}:${c.name}:${c.version}`;const vulns=vulnsByKey[key]||[];const riKey=c.ecosystem==='maven'&&c.group?`maven:${c.group}/${c.name}`:`${c.ecosystem}:${c.name}`;const ri=registryInfo.get(riKey)||{};const latestVersion=ri.latestVersion||'';const vd=(ri.versions||{})[c.version]||{};const isDeprecated=typeof vd.deprecated==='string'&&vd.deprecated.length>0;const deprecationMessage=isDeprecated?vd.deprecated:'';const isOutdated=!isDeprecated&&typeof vd.outdated==='string'&&vd.outdated.length>0;const outdatedMessage=isOutdated?vd.outdated:'';const license=ri.license||vd.license||'';return{...c,vulns,hasVulns:vulns.length>0,hasAttackPath:attackResult.flagged.has(key),attackPaths:attackResult.pathsByKey.get(key)||[],latestVersion,isDeprecated,deprecationMessage,isOutdated,outdatedMessage,license};});
-  try{aF.push(...scanDbTaintCrossFile(fc));}catch(_){}
-  try{aF.push(...scanStoredPromptInjectionCrossFile(fc));}catch(_){}
+  aF.push(...(runDetector(_detectorErrors,'<project>','scanDbTaintCrossFile',()=>scanDbTaintCrossFile(fc))||[]));
+  aF.push(...(runDetector(_detectorErrors,'<project>','scanStoredPromptInjectionCrossFile',()=>scanStoredPromptInjectionCrossFile(fc))||[]));
   // Roadmap #8 — tree-sitter sinks for long-tail languages (opt-in,
   // AGENTIC_SECURITY_TREE_SITTER=1; degrades to no-op without the optional dep).
   if(process.env.AGENTIC_SECURITY_TREE_SITTER==='1'){try{aF.push(...await scanTreeSitterSinks(fc));}catch(_){}}
@@ -8894,6 +9157,7 @@ function _deterministicFileTimings(timings) {
   const _deepInCiAllowed = deepInCi === true || process.env.AGENTIC_SECURITY_DEEP_IN_CI === '1';
   const _deepEnabled = _deepRequested && (!_inCi || _deepInCiAllowed);
   let _deepCallGraph = null;
+  let _deepFailure = null;
   if (_deepEnabled) {
     const budgetMs = parseInt(process.env.AGENTIC_SECURITY_DEEP_TIMEOUT_MS || '300000', 10);
     const t0 = Date.now();
@@ -8931,7 +9195,10 @@ function _deterministicFileTimings(timings) {
       aF.push(...irFindings);
     } catch (e) {
       // Deep mode is best-effort. A parser blowup in one file shouldn't kill
-      // the scan — fall back to the pattern-only result.
+      // the scan — fall back to the pattern-only result. Recorded (not just
+      // swallowed) so scanHealth (FR-206) can report the downgrade instead of
+      // looking identical to a scan where deep mode simply wasn't requested.
+      _deepFailure = String((e && e.message) || e);
     }
   } else if (_deepRequested && _inCi) {
     // Operator asked for deep but we're in CI — emit a non-blocking notice
@@ -8945,6 +9212,23 @@ function _deterministicFileTimings(timings) {
       confidence: 1.0,
     });
   }
+  // FR-205/FR-206: make the deep-analysis decision explicit in machine
+  // output, not just as an occasional info-severity finding. Covers the case
+  // the finding-based notice above does not: deep mode never explicitly
+  // requested at all (the common default-unset-in-CI case), which previously
+  // produced no signal of any kind that assurance had quietly narrowed.
+  const _deepStatus = {
+    requested: _deepRequested,
+    enabled: _deepEnabled,
+    inCi: _inCi,
+    ciOverrideAllowed: _deepInCiAllowed,
+    reason: _deepEnabled
+      ? null
+      : (_deepRequested
+          ? (_inCi ? 'requested, but running in CI without AGENTIC_SECURITY_DEEP_IN_CI=1' : 'unknown')
+          : (_inCi ? 'not requested (deep analysis defaults to off in CI)' : 'not requested')),
+    failure: _deepFailure,
+  };
   // Java SCA enrichment: use deep-mode IR call graph to improve Java function reachability
   if (_deepCallGraph) {
     try {
@@ -9087,19 +9371,88 @@ function _deterministicFileTimings(timings) {
   // Every catch in this block writes into _annotatorErrors so the operator
   // can tell "didn't run" from "ran cleanly." The array is surfaced as
   // scan.annotatorErrors in the report; an empty array means clean.
+  //
+  // FR-PROV-029 (Finding Provenance PRD): `skipAnnotators` lets a caller skip
+  // this entire ~54-annotator pipeline below. The guard also covers
+  // non-annotator finalization that lives in the same block — entropy-vs-
+  // named secret dedup, orphan classification, supply-chain in-place
+  // filtering, `Object.freeze(finalFindings)`, and closing the resume
+  // checkpoint — so a skipped run leaves all of that undone too; name the
+  // option accordingly if a future caller needs annotators skipped WITHOUT
+  // skipping those steps. predicate-replay.js's `replayAt()` is the only
+  // caller that sets it — it re-runs runFullScan scoped to a historical
+  // commit's blob content purely to recompute `computeStableId()` over the
+  // raw detector output (`scan.findings`/`scan.secrets`); it never reads
+  // anything an annotator sets (verified empirically — see the commit
+  // message). Every binding the pipeline below
+  // populates that the final `return` still references is declared here,
+  // OUTSIDE the guarded block, defaulted to exactly what it was before any
+  // annotator ran. A skipped run returns those fields at their
+  // pre-annotation default instead of throwing a ReferenceError; a normal
+  // (non-skipping) run is byte-for-byte unaffected, since the guarded block
+  // below still assigns the same values to these same bindings — it just no
+  // longer *declares* them, so nothing here changes what a value ends up
+  // being, only where the variable comes into scope.
   let _executionProofSummary = null, _vulnHistory = null;
   let _logicClaims = null;
-  const _annotatorErrors = [];
-  const _runAnnotator = (phase, fn) => {
-    try { return fn(); }
-    catch (e) {
-      _annotatorErrors.push({ phase, err: String((e && e.message) || e) });
-      return undefined;
-    }
-  };
-  _runAnnotator('annotateStableIds', () => annotateStableIds(finalFindings));
-  _runAnnotator("clusterByRootCause", () => { finalFindings = clusterByRootCause(finalFindings); });
-  _runAnnotator("demoteUnreachable", () => {
+  let _annotatorErrors = [];
+  let _v3 = {};
+  let _privacyIrBacked = null;
+  let _privacyTaxonomyVersion = null;
+  let _privacyFramework = null;
+  let _threatModel = null, _apiContractFindings = [], _sbomDiff = null,
+      _complianceReport = null, _exploitBundles = null, _pqcPlan = null,
+      _licenseGraph = null, _attributions = null, _taxonomySummary = null;
+  let _scanMeta = null;
+  let _entrypointInventory = {};
+  let _rootCauseSweep = null;
+  let _proofCoverage = null;
+  let _coverageLedger = null;
+  let _scanHealth = null;
+  // Task 11 (PRD P0 scope): ruleId backfill for scan.secrets / blameable
+  // scan.logicVulns findings MUST run unconditionally, HERE, outside the
+  // `skipAnnotators` guard below -- not just because the live scan needs it,
+  // but because predicate-replay.js's replayAt() recurses into THIS function
+  // with skipAnnotators:true and recomputes computeStableId() directly on
+  // whatever it finds in the nested scan's own scan.secrets/scan.logicVulns.
+  // If the backfill only ran on the live (skipAnnotators:false) call, the
+  // nested replay scan would compute a DIFFERENT stableId (falling back to
+  // the shared f.cwe -- e.g. every secret type collapsing onto "CWE-798")
+  // than the live scan's already-backfilled finding, so replayAt's
+  // `sid === targetStableId` check would NEVER match -- permanently landing
+  // every secrets/logicVulns finding on status:'partial',
+  // reason:'predicate-never-confirmed-in-candidates'. Caught empirically:
+  // test/fixtures/entropy-fp's AWS-key fixture resolved 'partial' instead of
+  // 'complete' until this moved here from inside the (skipAnnotators-gated)
+  // provenance block further down.
+  //
+  // At this point in the function, aSecrets/aLogic hold every BLAMEABLE
+  // producer's output (scanCredentials/scanEntropySecrets;
+  // scanLogicVulns/scanBusinessLogic/scanMiddlewareOrdering/scanReDoS/
+  // scanRegexReDoS/scanTodosNearSecurity/scanConfigFiles) -- the 3 synthetic
+  // producers (license-policy:/deploy-platform:/stack-playbook:) and
+  // logic-claims.js's ingested claims are pushed LATER, inside the
+  // `skipAnnotators` guard below, so they are never present in a nested
+  // replay scan's aLogic and never need this backfill for replay-matching
+  // purposes. The provenance block further down re-applies this same
+  // idempotent backfill to the full, final `blameableLogic` (which by then
+  // includes logic-claims too) before calling annotateGitProvenance on it.
+  const _slugify = (s) => String(s || 'unknown').toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '') || 'unknown';
+  for (const f of aSecrets) { if (!f.ruleId) f.ruleId = `secret:${_slugify(f.vuln)}`; }
+  for (const f of aLogic) { if (!f.ruleId) f.ruleId = `logic:${_slugify(f.vuln)}`; }
+  if (!skipAnnotators) {
+  // FR-106 (assurance-hardening PRD): Promise-aware, explicitly awaited at
+  // every one of its ~51 call sites below (previously a sync `try{return
+  // fn()}` let an async callback's rejection escape as an unhandled
+  // rejection, and every caller fired-and-forgot regardless). Logic lives in
+  // pipeline/annotator-runner.js, fault-injection tested directly there
+  // since this project's own annotators are deliberately built never to
+  // throw (posture/CLAUDE.md's "no throwing" convention) — this closure just
+  // supplies the local _annotatorErrors array.
+  const _runAnnotator = (phase, fn) => runAnnotatorAsync(_annotatorErrors, phase, fn);
+  await _runAnnotator('annotateStableIds', () => annotateStableIds(finalFindings));
+  await _runAnnotator("clusterByRootCause", () => { finalFindings = clusterByRootCause(finalFindings); });
+  await _runAnnotator("demoteUnreachable", () => {
     demoteUnreachable(finalFindings, { routes: aR });
     // `type: 'vulnerable_dep'` findings live in supplyChain, not finalFindings
     // (src/sca/CLAUDE.md) — demoteUnreachable's SCA-tier branch needs this
@@ -9108,14 +9461,14 @@ function _deterministicFileTimings(timings) {
   });
   // Premortem #8: backfill parser/family BEFORE confidence and calibration,
   // because both consume those fields and silently no-op when they're null.
-  _runAnnotator("backfillFindingDefaults", () => { backfillFindingDefaults(finalFindings); });
-  _runAnnotator("annotateConfidence", () => { annotateConfidence(finalFindings); });
+  await _runAnnotator("backfillFindingDefaults", () => { backfillFindingDefaults(finalFindings); });
+  await _runAnnotator("annotateConfidence", () => { annotateConfidence(finalFindings); });
   // Phase-1 next-gen P1.3 (FR-UX-1, FR-UX-2): Brier-calibrated probability +
   // 95% Wilson CI from per-family historical TP/FP. Falls back to null with
   // an explicit `calibration_reason` when N is below the calibration floor.
-  _runAnnotator("annotateCalibratedConfidence", () => { annotateCalibratedConfidence(finalFindings, { scanRoot }); });
+  await _runAnnotator("annotateCalibratedConfidence", () => { annotateCalibratedConfidence(finalFindings, { scanRoot }); });
   const _projectCtx = (() => { try { return detectProjectContext(fc, aR); } catch { return {}; } })();
-  _runAnnotator("annotateExploitability", () => { annotateExploitability(finalFindings, _projectCtx); });
+  await _runAnnotator("annotateExploitability", () => { annotateExploitability(finalFindings, _projectCtx); });
   // Roadmap #6 — proof-gate precision pass. Runs AFTER confidence +
   // exploitability so it can demote their tiers, and BEFORE mitigation /
   // composite-risk so the demotion flows into the canonical ranking. Default
@@ -9155,8 +9508,8 @@ function _deterministicFileTimings(timings) {
         if (f.stableId) unsanitizersOnPath[f.stableId] = undo;
       }
     }
-    _runAnnotator("applySanitizerGate", () => { applySanitizerGate(finalFindings, { sanitizersOnPath, unsanitizersOnPath }); });
-    _runAnnotator("annotateProofGate", () => { annotateProofGate(finalFindings); });
+    await _runAnnotator("applySanitizerGate", () => { applySanitizerGate(finalFindings, { sanitizersOnPath, unsanitizersOnPath }); });
+    await _runAnnotator("annotateProofGate", () => { annotateProofGate(finalFindings); });
   }
   // Addition #1 — default falsification pass. Actively tries to DISPROVE each
   // taint-style finding by locating a context-matched control on the path, and
@@ -9166,29 +9519,45 @@ function _deterministicFileTimings(timings) {
   // default; the LLM tier is only wired when an endpoint is configured. Opt out
   // with AGENTIC_SECURITY_NO_FALSIFICATION=1.
   if (process.env.AGENTIC_SECURITY_NO_FALSIFICATION !== '1') {
-    _runAnnotator("annotateFalsification", () => { annotateFalsification(finalFindings, fc); });
+    await _runAnnotator("annotateFalsification", () => { annotateFalsification(finalFindings, fc); });
   }
   // Addition #5 — capability-based model routing. Stamp each finding with the
   // model tier a cost-sensitive fixer/triager/PoC subagent should be dispatched
   // on for THIS vuln class (crypto/auth/critical → strongest; injection → mid;
   // low-sev hardening → cheapest). Advisory metadata consumed at dispatch time.
-  _runAnnotator("annotateDispatchModel", () => {
+  await _runAnnotator("annotateDispatchModel", () => {
     for (const f of finalFindings) { try { f.dispatchModel = routeModelForFinding(f).model; } catch { /* advisory only */ } }
   });
   // v3 next-gen: production-aware context ingest (Pillar 9). Must run BEFORE
   // the mitigation composite, persona prioritization, and final why-fired
   // record so those see the demotion signals.
-  _runAnnotator("annotateWafMitigation", () => { annotateWafMitigation(finalFindings, scanRoot); });
-  _runAnnotator("annotateAuthMitigation", () => { annotateAuthMitigation(finalFindings, scanRoot); });
-  _runAnnotator("annotateNetworkMitigation", () => { annotateNetworkMitigation(finalFindings, scanRoot); });
-  _runAnnotator("annotateTelemetry", () => { annotateTelemetry(finalFindings, scanRoot); });
-  _runAnnotator("annotateFeatureFlagGating", () => { annotateFeatureFlagGating(finalFindings, fc, { scanRoot }); });
+  await _runAnnotator("annotateWafMitigation", () => { annotateWafMitigation(finalFindings, scanRoot); });
+  await _runAnnotator("annotateAuthMitigation", () => { annotateAuthMitigation(finalFindings, scanRoot); });
+  await _runAnnotator("annotateNetworkMitigation", () => { annotateNetworkMitigation(finalFindings, scanRoot); });
+  await _runAnnotator("annotateTelemetry", () => { annotateTelemetry(finalFindings, scanRoot); });
+  await _runAnnotator("annotateFeatureFlagGating", () => { annotateFeatureFlagGating(finalFindings, fc, { scanRoot }); });
   // v3 next-gen: composite mitigation verdict consumes every prod signal above.
-  _runAnnotator("annotateMitigationComposite", () => { annotateMitigationComposite(finalFindings); });
+  await _runAnnotator("annotateMitigationComposite", () => { annotateMitigationComposite(finalFindings); });
   // Composite risk score (0..100 derived ordinal). Must run AFTER mitigation
   // composite + exploitability + toxicityScore so it sees the final values.
   // Used by agents and UI as the canonical sort key for "which finding first."
-  _runAnnotator("annotateCompositeRisk", () => { annotateCompositeRisk(finalFindings); });
+  await _runAnnotator("annotateCompositeRisk", () => { annotateCompositeRisk(finalFindings); });
+
+  // FR-405 (assurance-hardening PRD): null means "privacy analysis never
+  // ran at all" (AGENTIC_SECURITY_NO_PRIVACY=1, or the annotator threw
+  // before setting this) — treated the same as false by the gate below,
+  // since neither case has real IR-backed evidence to offer. Declared at
+  // function scope (now hoisted above the `skipAnnotators` guard, near
+  // _executionProofSummary et al. — same reasoning: FR-PROV-029), because
+  // the annotatePrivacyTaint closure that assigns to it (inside the
+  // AGENTIC_SECURITY_NO_INTEGRATION block below) runs and exits before that
+  // block closes — a block-scoped `let` inside that if-statement would be
+  // unreachable by the later assessPrivacyFramework call and the final
+  // return, both of which are outside the block.
+  //
+  // FR-402: _privacyTaxonomyVersion (which taxonomy version actually
+  // classified this scan's fields) has the same scoping constraint as
+  // _privacyIrBacked directly above (D-0011) and is hoisted alongside it.
 
   // ── World-class integration block ─────────────────────────────────────
   // Each annotator is opt-in via env var and try/catch wrapped. They run
@@ -9198,46 +9567,89 @@ function _deterministicFileTimings(timings) {
     // Cross-service taint annotation reads .agentic-security/services.yml
     // and bumps severity on cross-service-reachable findings.
     if (process.env.AGENTIC_SECURITY_NO_CROSS_SERVICE !== '1') {
-      _runAnnotator("runCrossServiceTaint", () => { runCrossServiceTaint(scanRoot, finalFindings); });
+      await _runAnnotator("runCrossServiceTaint", () => { runCrossServiceTaint(scanRoot, finalFindings); });
     }
     // Runtime correlation: demotes findings whose paths were unobserved
     // in production eBPF traces (when a trace file is present).
     if (process.env.AGENTIC_SECURITY_NO_RUNTIME_CORRELATION !== '1') {
-      _runAnnotator("annotateRuntimeCorrelation", async () => { await annotateRuntimeCorrelation(scanRoot, finalFindings); });
+      await _runAnnotator("annotateRuntimeCorrelation", async () => { await annotateRuntimeCorrelation(scanRoot, finalFindings); });
     }
     // Triage learning: applies per-(project, family, file-glob) calibration
     // from prior wont-fix / false-positive decisions.
     if (process.env.AGENTIC_SECURITY_NO_TRIAGE_LEARNING !== '1') {
-      _runAnnotator("applyLearnedCalibration", () => { applyLearnedCalibration(scanRoot, finalFindings); });
+      await _runAnnotator("applyLearnedCalibration", () => { applyLearnedCalibration(scanRoot, finalFindings); });
     }
     // Formal verification: CBMC for C/C++, MIRI for Rust. Opt-in via
     // AGENTIC_SECURITY_FORMAL=1 (off by default — requires external tools).
     if (process.env.AGENTIC_SECURITY_FORMAL === '1') {
-      _runAnnotator("annotateFormalVerification", async () => { await annotateFormalVerification(finalFindings, fc, {}); });
+      await _runAnnotator("annotateFormalVerification", async () => { await annotateFormalVerification(finalFindings, fc, {}); });
     }
     // SMT path feasibility: Z3-backed proof of reachability. Opt-in via
     // AGENTIC_SECURITY_SMT_FEASIBILITY=1.
     if (process.env.AGENTIC_SECURITY_SMT_FEASIBILITY === '1') {
-      _runAnnotator("annotatePathFeasibility", async () => { await annotatePathFeasibility(finalFindings, {}); });
+      await _runAnnotator("annotatePathFeasibility", async () => { await annotatePathFeasibility(finalFindings, {}); });
     }
     // Privacy / PII taint: emits pii-exposure findings + DPIA artifact.
+    // FR-405 (assurance-hardening PRD): _privacyIrBacked is declared at
+    // function scope above the AGENTIC_SECURITY_NO_INTEGRATION block, not
+    // here — this closure runs and exits before that block's closing brace,
+    // so a block-scoped declaration would be unreachable from the later
+    // assessPrivacyFramework call and the final return.
     if (process.env.AGENTIC_SECURITY_NO_PRIVACY !== '1') {
-      _runAnnotator("annotatePrivacyTaint", () => {
-        // Build a minimal IR map from fc; the privacy taint module needs
-        // per-file content + a coarse decls/calls list. We construct it
-        // from existing finding sources rather than re-parsing every file.
-        const minimalIR = new Map();
-        for (const [fp, content] of Object.entries(fc || {})) {
-          if (typeof content !== 'string') continue;
-          minimalIR.set(fp, { _content: content, decls: [], calls: [] });
-        }
-        const r = annotatePrivacyTaint(minimalIR);
-        if (r && Array.isArray(r.findings)) finalFindings.push(...r.findings);
+      await _runAnnotator("annotatePrivacyTaint", () => {
+        // FR-401 (assurance-hardening PRD, A-06): decls/calls used to be
+        // hardcoded empty for every file (the actual root cause, per
+        // decisions.md D-0003, was a missing adapter reconciling
+        // privacy-taint.js's flat per-file shape with the real Layer-1 IR's
+        // per-function/CFG shape — not a missing capability in the IR or
+        // taint engine themselves; see privacy/ir-adapter.js).
+        //
+        // Reuse _sharedIR when deep mode already built it (free — no
+        // second parse pass). When deep mode is OFF (the common default
+        // path), do NOT force a fresh IR build here: buildProjectIR parses
+        // every file and is exactly the cost deep mode is opt-in for
+        // (NFR: "no more than 15% ... overhead ... excluding newly enabled
+        // deep analysis"). In that case privacy analysis still runs, but
+        // honestly marked as not IR-backed (irBacked:false below) rather
+        // than silently claiming the same coverage as the deep-mode path —
+        // this is the signal FR-405's "missing capability -> not_assessed,
+        // never satisfied" contract needs to key off, not yet wired into
+        // privacy-framework.js's own bucketing in this cycle (separate,
+        // later FR-405 work).
+        const irBacked = !!(_sharedIR && _sharedIR.perFile);
+        const adaptedIR = irBacked
+          ? adaptIRForPrivacyTaint(_sharedIR.perFile, fc, storedRegistry)
+          : new Map(Object.entries(fc || {})
+              .filter(([, content]) => typeof content === 'string')
+              .map(([fp, content]) => [fp, { _content: content, decls: [], calls: [] }]));
+        // FR-402: pass scanRoot so an operator's .agentic-security/
+        // privacy-taxonomy.json (if any) is actually loaded on a real scan.
+        const r = annotatePrivacyTaint(adaptedIR, { scanRoot });
+        r.irBacked = irBacked;
+        _privacyIrBacked = irBacked;
+        _privacyTaxonomyVersion = r.taxonomyVersion || null;
+        // FR-102 (assurance-hardening PRD): route through the registered-
+        // producer collector rather than a bare push. r is already computed
+        // above (this call also drives the DPIA artifact below), so the
+        // thunk just hands back what's already there.
+        collectProducerResult(finalFindings, _annotatorErrors, 'privacy-taint', () => (r && Array.isArray(r.findings)) ? r.findings : []);
         // Persist the DPIA scaffold for compliance review.
         if (r && r.piiFields) {
           try {
-            const dpia = emitDpiaArtifact(r.piiFields, r.findings || []);
+            // FR-407: governance fields are loaded once and threaded into
+            // both the DPIA (per-class subsection) and the RoPA artifact
+            // (the full register) so an operator only maintains one config
+            // file for both.
+            const governanceConfig = loadPrivacyGovernanceConfig(scanRoot);
+            const dpia = emitDpiaArtifact(r.piiFields, r.findings || [], { policyExemptions: r.policyExemptions || [], governanceConfig });
             _safeWriteState(_statePath(scanRoot, 'dpia.md'), dpia);
+            const ropa = emitRopaArtifact(r.piiFields, governanceConfig);
+            _safeWriteState(_statePath(scanRoot, 'ropa.md'), ropa);
+            // FR-406: code-derived data inventory + flow graph, built from
+            // the SAME findings/exemptions already computed above.
+            const inventory = buildDataInventory(r.piiFields, r.findings || [], r.policyExemptions || []);
+            _safeWriteState(_statePath(scanRoot, 'data-inventory.json'), emitDataInventoryArtifact(inventory));
+            _safeWriteState(_statePath(scanRoot, 'data-flow-graph.md'), emitDataFlowGraph(inventory));
           } catch (_) {}
         }
       });
@@ -9246,80 +9658,80 @@ function _deterministicFileTimings(timings) {
     // ATLAS, D3FEND, kill-chain stage, and CAPEC IDs so downstream SIEM /
     // SOAR systems can correlate with existing detection rules.
     if (process.env.AGENTIC_SECURITY_NO_ATTACK_TAX !== '1') {
-      _runAnnotator("annotateAttackTaxonomy", () => { annotateAttackTaxonomy(finalFindings); });
+      await _runAnnotator("annotateAttackTaxonomy", () => { annotateAttackTaxonomy(finalFindings); });
     }
     // Triage memory — demote findings whose (family, dir) bucket was
     // previously marked wont-fix or false-positive in this project.
     if (process.env.AGENTIC_SECURITY_NO_TRIAGE_MEMORY !== '1') {
-      _runAnnotator("suppressByPastDecisions", () => { suppressByPastDecisions(scanRoot, finalFindings); });
+      await _runAnnotator("suppressByPastDecisions", () => { suppressByPastDecisions(scanRoot, finalFindings); });
     }
     // Intent-aware FP suppression — demote findings on files marked as
     // intentionally vulnerable (sandbox/CTF/tutorial/example/etc.).
     if (process.env.AGENTIC_SECURITY_NO_INTENT_CTX !== '1') {
-      _runAnnotator("suppressByIntent", () => { suppressByIntent(scanRoot, finalFindings); });
+      await _runAnnotator("suppressByIntent", () => { suppressByIntent(scanRoot, finalFindings); });
     }
     // Git history — stamp each finding with introducedBy / introducedIn /
     // originatingPrompt by running `git blame` on the finding's line.
     if (process.env.AGENTIC_SECURITY_NO_GIT_HISTORY !== '1') {
-      _runAnnotator("annotateGitHistory", () => { annotateGitHistory(scanRoot, finalFindings); });
+      await _runAnnotator("annotateGitHistory", () => { annotateGitHistory(scanRoot, finalFindings); });
     }
     // Threat-model grounding — bump severity on crown-jewels, demote
     // out-of-scope, tag compliance regimes, stamp attacker profile.
     if (process.env.AGENTIC_SECURITY_NO_THREAT_MODEL_GROUNDING !== '1') {
-      _runAnnotator("applyThreatModel", () => { applyThreatModel(scanRoot, finalFindings); });
+      await _runAnnotator("applyThreatModel", () => { applyThreatModel(scanRoot, finalFindings); });
     }
     // Cross-repo pattern propagation — surface sibling-repo fixes and
     // triage decisions for the same family from this developer's history.
     if (process.env.AGENTIC_SECURITY_NO_CROSS_REPO !== '1') {
-      _runAnnotator("annotateCrossRepoSignals", () => { annotateCrossRepoSignals(scanRoot, finalFindings); });
+      await _runAnnotator("annotateCrossRepoSignals", () => { annotateCrossRepoSignals(scanRoot, finalFindings); });
     }
     // Risk-in-dollars — combine EPSS + crown-jewel + reachability into an
     // expected-value-of-exploitation USD figure per finding.
     if (process.env.AGENTIC_SECURITY_NO_RISK_DOLLARS !== '1') {
-      _runAnnotator("annotateRiskDollars", () => { annotateRiskDollars(scanRoot, finalFindings); });
+      await _runAnnotator("annotateRiskDollars", () => { annotateRiskDollars(scanRoot, finalFindings); });
     }
     // Time-to-fix — estimate engineering hours per finding.
     if (process.env.AGENTIC_SECURITY_NO_TIME_TO_FIX !== '1') {
-      _runAnnotator("annotateTimeToFix", () => { annotateTimeToFix(scanRoot, finalFindings); });
+      await _runAnnotator("annotateTimeToFix", () => { annotateTimeToFix(scanRoot, finalFindings); });
     }
   }
   // v3 next-gen: crown-jewel mapping (FR-PROD-5) — score each file/finding by
   // business impact. Must run before persona prioritization (which uses it).
-  _runAnnotator("annotateCrownJewelScores", () => { annotateCrownJewelScores(finalFindings, fc); });
+  await _runAnnotator("annotateCrownJewelScores", () => { annotateCrownJewelScores(finalFindings, fc); });
   // v3 next-gen: clone clusters (FR-SEM-8) + emit clone-outlier infos.
-  _runAnnotator("annotateCloneClusters", () => { annotateCloneClusters(finalFindings); });
+  await _runAnnotator("annotateCloneClusters", () => { annotateCloneClusters(finalFindings); });
   try {
     const outliers = findCloneOutliers(finalFindings);
     if (outliers && outliers.length) finalFindings.push(...outliers);
   } catch(_) {}
   // v3 next-gen: AI-generated-code fingerprint (FR-LEARN-10). Property bag tag.
-  _runAnnotator("annotateAiProvenance", () => { annotateAiProvenance(finalFindings, fc); });
+  await _runAnnotator("annotateAiProvenance", () => { annotateAiProvenance(finalFindings, fc); });
   // v3 next-gen: whole-program type narrowing (FR-SEM-10) — heuristic
   // confidence dampener on findings rooted in functions whose callers all
   // pass narrowly-typed values.
-  _runAnnotator("annotateTypeNarrowing", () => { annotateTypeNarrowing(finalFindings, fc); });
+  await _runAnnotator("annotateTypeNarrowing", () => { annotateTypeNarrowing(finalFindings, fc); });
   // v3 next-gen: STRIDE classification (FR-LOGIC-10).
-  _runAnnotator("annotateStrideCategory", () => { annotateStrideCategory(finalFindings); });
+  await _runAnnotator("annotateStrideCategory", () => { annotateStrideCategory(finalFindings); });
   // v3 next-gen: per-attacker-persona score matrix (FR-ADV-2). Must run AFTER
   // crown-jewels + mitigation composite so it sees those signals.
-  _runAnnotator("annotatePersonaScores", () => { annotatePersonaScores(finalFindings); });
+  await _runAnnotator("annotatePersonaScores", () => { annotatePersonaScores(finalFindings); });
   // v3 next-gen: SCA reverse-blast-radius enrichment (FR-ADV-5). Annotates
   // SCA findings (package-name-keyed) — must run against supplyChain, not
   // finalFindings (SAST), which has no package-name field at all.
-  _runAnnotator("annotateScaReverseBlast", () => { annotateScaReverseBlast(supplyChain, fc); });
+  await _runAnnotator("annotateScaReverseBlast", () => { annotateScaReverseBlast(supplyChain, fc); });
   // v3 next-gen: bug-bounty payout prediction (FR-ADV-3). Composes with the
   // mitigation composite — gated/unreachable findings get the bounty scaled
   // down rather than zeroed.
-  _runAnnotator("annotateBountyPrediction", () => { annotateBountyPrediction(finalFindings); });
+  await _runAnnotator("annotateBountyPrediction", () => { annotateBountyPrediction(finalFindings); });
   // v3 next-gen: attack-playbook annotation (FR-ADV-4). Only for high+ findings.
-  _runAnnotator("annotateAttackPlaybooks", () => { annotateAttackPlaybooks(finalFindings); });
+  await _runAnnotator("annotateAttackPlaybooks", () => { annotateAttackPlaybooks(finalFindings); });
   // Phase-1 next-gen P1.1 (FR-VER-2): attach a runnable PoC to each finding
   // when a CWE template covers it. Findings without coverage get f.poc=null.
   // Premortem #12: pass fileContents so PoC param-key inference can re-read
   // the actual handler line when detector snippets are misattributed.
-  _runAnnotator("annotatePocs", () => { annotatePocs(finalFindings, { routes: aR, fileContents: fc }); });
+  await _runAnnotator("annotatePocs", () => { annotatePocs(finalFindings, { routes: aR, fileContents: fc }); });
   // FR-VER-3: regression-test generator (builds on the PoC artifact).
-  _runAnnotator("annotateRegressionTests", () => { annotateRegressionTests(finalFindings); });
+  await _runAnnotator("annotateRegressionTests", () => { annotateRegressionTests(finalFindings); });
   // R2 — execution proof. Synthesizes a SANDBOX-RUNNABLE PoC (the HTTP PoCs
   // above need a live server, so they can never be executed by the prover)
   // and lets R1's sandbox decide the tier. Opt-in via AGENTIC_SECURITY_PROVE=1
@@ -9332,7 +9744,7 @@ function _deterministicFileTimings(timings) {
   // Never a finding and never a severity change: those bugs are fixed, and a
   // historical fix is not evidence of a present defect. Opt-in because it
   // shells out to git over up to 500 commits.
-  _runAnnotator('annotateHistoricalRisk', () => {
+  await _runAnnotator('annotateHistoricalRisk', () => {
     if (process.env.AGENTIC_SECURITY_ARCHAEOLOGY !== '1' || !scanRoot) return;
     _vulnHistory = mineVulnHistory(scanRoot);
     annotateHistoricalRisk(finalFindings, _vulnHistory);
@@ -9346,65 +9758,38 @@ function _deterministicFileTimings(timings) {
   // verifier verdict — verified-exploit (live PoC ran), verified-by-llm,
   // verified-sanitizer-absence, unverified-by-design, or cannot-verify.
   // Fail-closed: any error → cannot-verify, never a silent drop.
-  _runAnnotator("annotateVerifierVerdicts", () => { annotateVerifierVerdicts(finalFindings, { fileContents: fc }); });
+  await _runAnnotator("annotateVerifierVerdicts", () => { annotateVerifierVerdicts(finalFindings, { fileContents: fc }); });
   // Cross-language taint (Sentinel-parity FR-DET-3) — five boundary types:
   // HTTP/REST via OpenAPI, gRPC via .proto, GraphQL via SDL, SQL/ORM
   // round-trip, and IaC → application-code reachability (FR-DET-4).
   const _allXlangFiles = { ...fc, ...depFileContents };
-  try {
-    const xl = scanCrossLangOpenAPI(_allXlangFiles, finalFindings);
-    if (xl && xl.length) finalFindings.push(...xl);
-  } catch(_) {}
-  try {
-    const xl = scanCrossLangGrpc(_allXlangFiles, finalFindings);
-    if (xl && xl.length) finalFindings.push(...xl);
-  } catch(_) {}
-  try {
-    const xl = scanCrossLangGraphql(_allXlangFiles, finalFindings);
-    if (xl && xl.length) finalFindings.push(...xl);
-  } catch(_) {}
-  try {
-    const xl = scanCrossLangOrm(_allXlangFiles, finalFindings);
-    if (xl && xl.length) finalFindings.push(...xl);
-  } catch(_) {}
+  // FR-101/FR-102 (assurance-hardening PRD): each of these 11 producers now
+  // goes through the registered-producer collector (pipeline/producer-
+  // collector.js) instead of a bare try/catch + push — a thrown exception
+  // becomes a diagnostic in _annotatorErrors (previously silently swallowed
+  // by `catch(_) {}` with no trace anywhere) and the collector stamps
+  // producerId provenance on each finding.
+  collectProducerResult(finalFindings, _annotatorErrors, 'cross-lang-openapi', () => scanCrossLangOpenAPI(_allXlangFiles, finalFindings));
+  collectProducerResult(finalFindings, _annotatorErrors, 'cross-lang-grpc', () => scanCrossLangGrpc(_allXlangFiles, finalFindings));
+  collectProducerResult(finalFindings, _annotatorErrors, 'cross-lang-graphql', () => scanCrossLangGraphql(_allXlangFiles, finalFindings));
+  collectProducerResult(finalFindings, _annotatorErrors, 'cross-lang-orm', () => scanCrossLangOrm(_allXlangFiles, finalFindings));
   // Phase-1 next-gen P1.5 (FR-XSAT-4): cross-language taint via Kafka, SQS,
   // RabbitMQ, Redis streams, and Google Pub/Sub topics.
-  try {
-    const xl = scanCrossLangQueues(_allXlangFiles, finalFindings);
-    if (xl && xl.length) finalFindings.push(...xl);
-  } catch(_) {}
-  try {
-    const xl = scanIacReachability(_allXlangFiles, finalFindings);
-    if (xl && xl.length) finalFindings.push(...xl);
-  } catch(_) {}
+  collectProducerResult(finalFindings, _annotatorErrors, 'cross-lang-queues', () => scanCrossLangQueues(_allXlangFiles, finalFindings));
+  collectProducerResult(finalFindings, _annotatorErrors, 'iac-reachability', () => scanIacReachability(_allXlangFiles, finalFindings));
   // Phase-2.5 next-gen: IAM policy reachability (FR-XSAT-7).
-  try {
-    const ia = scanIamPolicies(_allXlangFiles, finalFindings);
-    if (ia && ia.length) finalFindings.push(...ia);
-  } catch(_) {}
+  collectProducerResult(finalFindings, _annotatorErrors, 'iam-policy', () => scanIamPolicies(_allXlangFiles, finalFindings));
   // Phase-2.5 next-gen: container runtime config audit (FR-XSAT-8).
-  try {
-    const cr = scanContainerRuntime(_allXlangFiles);
-    if (cr && cr.length) finalFindings.push(...cr);
-  } catch(_) {}
+  collectProducerResult(finalFindings, _annotatorErrors, 'container-runtime', () => scanContainerRuntime(_allXlangFiles));
   // Phase-4 next-gen: business-logic analysis (FR-LOGIC-1, FR-LOGIC-2, FR-LOGIC-7).
-  try {
-    const bl = scanBusinessLogicV2(_allXlangFiles);
-    if (bl && bl.length) finalFindings.push(...bl);
-  } catch(_) {}
+  collectProducerResult(finalFindings, _annotatorErrors, 'business-logic-v2', () => scanBusinessLogicV2(_allXlangFiles));
   // v3 next-gen: specification-mining drift detector (FR-LOGIC-8). Emits
   // findings for function-name-vs-body mismatches. Low confidence by default;
   // active-learning loop tunes per project.
-  try {
-    const sm = scanSpecificationDrift(_allXlangFiles);
-    if (sm && sm.length) finalFindings.push(...sm);
-  } catch(_) {}
+  collectProducerResult(finalFindings, _annotatorErrors, 'specification-drift', () => scanSpecificationDrift(_allXlangFiles));
   // v3 next-gen: bounded concurrency-bug detector (FR-SEM-9). Heuristic only;
   // catches missed unlocks, fire-and-forget async, and 2-lock deadlock cycles.
-  try {
-    const cc = scanConcurrency(_allXlangFiles);
-    if (cc && cc.length) finalFindings.push(...cc);
-  } catch(_) {}
+  collectProducerResult(finalFindings, _annotatorErrors, 'concurrency', () => scanConcurrency(_allXlangFiles));
   // FR-LOGIC-6: LLM-driven flow narration (template fallback when no LLM endpoint).
   try { await annotateNarration(finalFindings); }
   catch (e) { _annotatorErrors.push({ phase: 'annotateNarration', err: String((e && e.message) || e) }); }
@@ -9671,14 +10056,14 @@ function _deterministicFileTimings(timings) {
   classifyOrphans(aSrc,aSink,finalFindings,fc);
   // v3 next-gen: capture scan-level reports (counterfactual, threat model,
   // trust-boundary diagram, calibration-drift alarms). All best-effort.
-  let _v3 = {};
-  _runAnnotator("_v3.counterfactual", () => { _v3.counterfactual = runCounterfactual(finalFindings, fc); });
-  _runAnnotator("_v3.threatModel", () => { _v3.threatModel = buildThreatModel(finalFindings, fc); });
-  _runAnnotator("_v3.trustBoundaryDiagram", () => { _v3.trustBoundaryDiagram = buildTrustBoundaryDiagram(finalFindings, fc); });
-  _runAnnotator("_v3.calibrationDrift", () => { _v3.calibrationDrift = computeCalibrationDrift(scanRoot); });
+  // (_v3 is hoisted above the `skipAnnotators` guard — FR-PROV-029.)
+  await _runAnnotator("_v3.counterfactual", () => { _v3.counterfactual = runCounterfactual(finalFindings, fc); });
+  await _runAnnotator("_v3.threatModel", () => { _v3.threatModel = buildThreatModel(finalFindings, fc); });
+  await _runAnnotator("_v3.trustBoundaryDiagram", () => { _v3.trustBoundaryDiagram = buildTrustBoundaryDiagram(finalFindings, fc); });
+  await _runAnnotator("_v3.calibrationDrift", () => { _v3.calibrationDrift = computeCalibrationDrift(scanRoot); });
   // v3 next-gen: why-fired provenance is captured LAST so it reflects the
   // final state of each finding after every other annotator has run.
-  _runAnnotator("annotateWhyFired", () => { annotateWhyFired(finalFindings, {}); });
+  await _runAnnotator("annotateWhyFired", () => { annotateWhyFired(finalFindings, {}); });
   // SCA-SAST correlation: link SAST findings to SCA vulnerable packages
   try{for(const f of finalFindings){if(!f.chain||!f.chain.length)continue;const src=f.chain[0]?.label||'';for(const sc of supplyChain){if(sc.type!=='vulnerable_dep')continue;if(src.includes(sc.name)||f.vuln?.toLowerCase().includes(sc.name)){f.scaCorrelation={osvId:sc.osvId,package:sc.name,version:sc.version,confirmed:true};sc.sastConfirmed=true;break;}}}}catch(_){}
   // Multi-sink chain detection: group findings by source variable
@@ -9689,10 +10074,9 @@ function _deterministicFileTimings(timings) {
   // Each is opt-in via env var. They produce machine-readable artifacts
   // (threat-model.json/.md, dpia.md, compliance-evidence.json/.md,
   // sbom-history/<sha>.json, exploit-bundles/) under .agentic-security/.
-  let _privacyFramework = null;
-  let _threatModel = null, _apiContractFindings = [], _sbomDiff = null,
-      _complianceReport = null, _exploitBundles = null, _pqcPlan = null,
-      _licenseGraph = null, _attributions = null, _taxonomySummary = null;
+  // (_privacyFramework/_threatModel/_apiContractFindings/_sbomDiff/
+  // _complianceReport/_exploitBundles/_pqcPlan/_licenseGraph/_attributions/
+  // _taxonomySummary are hoisted above the `skipAnnotators` guard — FR-PROV-029.)
   if (process.env.AGENTIC_SECURITY_NO_INTEGRATION !== '1') {
     // Threat model — STRIDE + entities + attack trees rooted in findings.
     if (process.env.AGENTIC_SECURITY_NO_THREAT_MODEL !== '1') {
@@ -9787,6 +10171,12 @@ function _deterministicFileTimings(timings) {
           // filesScanned feeds the vacuous-satisfaction guard: a clean signal
           // from a run that read no files is not evidence of compliance.
           filesScanned: files.length,
+          // FR-405: feeds the SAME guard, specifically for controls whose
+          // only mapped signal comes from privacy-taint — a non-IR-backed
+          // run (deep mode off, the common default) still emits a "no
+          // findings" pass, which is not real evidence for those controls
+          // even though the scan otherwise examined real files.
+          privacyIrBacked: _privacyIrBacked,
         });
         if (_privacyFramework) persistPrivacyFramework(scanRoot, _privacyFramework);
         if (_privacyFramework && process.env.AGENTIC_SECURITY_PRIVACY_FRAMEWORK === '1') {
@@ -9812,6 +10202,34 @@ function _deterministicFileTimings(timings) {
     }
   }
 
+  // FR-103 (assurance-hardening PRD): canonical enrichment completion pass.
+  // This is the LAST point in the function where a finding could still be
+  // missing stableId/confidence/calibration/exploitability because it was
+  // appended by a late producer (see pipeline/enrichment-completion.js's
+  // header for why this is a gap-filling pass rather than relocating ~19
+  // append sites earlier in this function). Must run after every push site
+  // above and before the freeze immediately below.
+  const _projectCtxForCompletion = typeof _projectCtx !== 'undefined' ? _projectCtx : {};
+  completeEnrichment(finalFindings, { scanRoot, projectCtx: _projectCtxForCompletion });
+
+  // FR-104 (assurance-hardening PRD): freeze the finding collection.
+  // Object.freeze on an array blocks push/pop/splice/length changes (this
+  // module and every caller downstream run under ESM strict mode, so a
+  // violation THROWS a TypeError rather than silently no-op'ing) — no
+  // producer may append after this point. This is a SHALLOW freeze: the
+  // remaining read/annotate calls below (countUnmodeledSinkCandidates,
+  // buildEntrypointInventory, annotateRelevance, sweepRootCauses,
+  // proofCoverage) either only read `finalFindings` or, for annotateRelevance,
+  // legitimately mutate FIELDS on individual finding objects — verified by
+  // reading each function's body (none push/splice/pop/shift/unshift onto
+  // the array they're handed). Field mutation is annotation, not production,
+  // and annotateRelevance running this late is an established, deliberate
+  // part of this codebase's architecture (its own header: "runs after every
+  // finding has been appended... so nothing escapes annotation"). What
+  // freezing forecloses is exactly what FR-104 asks for: no MORE findings
+  // can be added after this point.
+  Object.freeze(finalFindings);
+
   // Coverage-honesty report (#5 + #6): per-language analysis tier (IR-taint vs
   // pattern-only), dense/large/timeout skips, and unmodeled-sink candidates.
   let _analysisTier = null, _unmodeledSinks = null;
@@ -9826,19 +10244,314 @@ function _deterministicFileTimings(timings) {
   // seen when only N-of-those-candidates were actually analyzed.
   // checkpoint.total intentionally keeps files.length — that field means the
   // full candidate set for resume bookkeeping, a different, correct meaning.
-  const _scanMeta={filesScanned:Object.keys(fc).length,filesSkipped:_filesSkipped,filesDenseSkipped:_filesDenseSkipped,filesTimedOut:_filesTimedOut,analysisTier:_analysisTier,unmodeledSinkCandidates:_unmodeledSinks,fileTimings:_deterministicFileTimings(_fileTimings),findingsBySeverity:{critical:finalFindings.filter(f=>f.severity==='critical').length,high:finalFindings.filter(f=>f.severity==='high').length,medium:finalFindings.filter(f=>f.severity==='medium').length,low:finalFindings.filter(f=>f.severity==='low').length,info:finalFindings.filter(f=>f.severity==='info').length},checkpoint:{enabled:!!(_ckpt&&_ckpt.enabled),resumed:_ckptResumed,total:files.length}};
+  _scanMeta={filesScanned:Object.keys(fc).length,filesSkipped:_filesSkipped,filesDenseSkipped:_filesDenseSkipped,filesTimedOut:_filesTimedOut,analysisTier:_analysisTier,unmodeledSinkCandidates:_unmodeledSinks,fileTimings:_deterministicFileTimings(_fileTimings),findingsBySeverity:{critical:finalFindings.filter(f=>f.severity==='critical').length,high:finalFindings.filter(f=>f.severity==='high').length,medium:finalFindings.filter(f=>f.severity==='medium').length,low:finalFindings.filter(f=>f.severity==='low').length,info:finalFindings.filter(f=>f.severity==='info').length},checkpoint:{enabled:!!(_ckpt&&_ckpt.enabled),resumed:_ckptResumed,total:files.length,discarded:!!(_ckpt&&_ckpt.discarded),discardReason:(_ckpt&&_ckpt.discarded)?(_ckpt.reason||null):null,invalidatedFileCount:_ckptInvalidated.length,invalidatedFiles:_ckptInvalidated.slice(0,20),invalidatedFilesTruncated:_ckptInvalidated.length>20}};
   // R8: the scan completed, so the checkpoint has been fully consumed — remove
   // it. Anything that threw before this point leaves it in place to resume from.
   try { closeCheckpoint(_ckpt, { complete: true }); } catch (_) {}
+  // Finding Provenance (M0/M1) — attaches `finding.findingProvenance`.
+  //
+  // Placed HERE, not immediately after the SCA/multi-sink correlation blocks
+  // where the plan first put it, for the same reason `annotateRelevance` below
+  // runs this late: several post-scan artifact emitters between those blocks
+  // and this point still PUSH findings (`runApiContractScan`, `runSbomDiff`,
+  // the cross-language chain passes). Annotating before them would have left
+  // every finding they produce with no `findingProvenance` at all, which is
+  // precisely the "absent field" state the coordinator's terminal-status
+  // guarantee exists to make unreachable. Running after `Object.freeze` above
+  // is safe and is in fact the point: the finding SET can no longer change, and
+  // a shallow freeze still permits annotating FIELDS on the individual finding
+  // objects. This annotator never appends or drops a finding.
+  if (provenance !== false) {
+   // Task 11 (PRD P0 scope): real origin resolution for scan.secrets and
+   // blameable scan.logicVulns findings. Both channels were previously
+   // stamped an unconditional not_available (see the backstop loop below) —
+   // not because computeStableId can't handle them (its ruleId() fallback
+   // chain already tolerates a missing f.ruleId), but because nobody
+   // backfilled a real per-pattern ruleId and nobody called
+   // annotateGitProvenance on these channels at all. scan.secrets findings
+   // set neither ruleId nor family nor parser, and every secret type shares
+   // the same fixed f.cwe ("CWE-798"), so without a per-pattern backfill
+   // every secret in a scan would collide onto ONE stableId.
+   //
+   // scan.logicVulns is not one detector's output — three of its ~9
+   // producers (license-policy:, deploy-platform:, stack-playbook:) use a
+   // FIXED PLACEHOLDER `line` (0 or 1), not a real diffable source location
+   // — they read scanRoot-level files (package.json, vercel.json, ...)
+   // directly rather than from the scanned fileContents. Routing those
+   // through git-blame-style resolution would fabricate a plausible-looking
+   // but meaningless commit attribution (e.g. "package.json line 1" blamed
+   // on whatever commit last touched that line, unrelated to the actual
+   // license/platform/stack finding). They are excluded by id prefix here
+   // and stay on the honest, PERMANENT not_available path in the backstop
+   // loop below — never routed through resolveOrigin. Declared here, OUTSIDE
+   // the _runAnnotator callback below, because the backstop loop (also
+   // outside that callback — see its own comment on why) needs
+   // `blameableLogic`/`syntheticLogic` too.
+   //
+   // `aSecrets`/`aLogic`'s ruleId backfill for the producers that exist by
+   // this point in the function already happened much earlier (right before
+   // the `skipAnnotators` guard opens — see that comment for why it CANNOT
+   // live here alone). `_slugify` is declared there and is in scope here too.
+   // What's re-applied below is only the SAME idempotent backfill
+   // (`if (!f.ruleId)`), now over the full, final `blameableLogic` — which by
+   // this point additionally includes logic-claims.js's late-pushed ingested
+   // claims, the one blameable producer the early pass could not see.
+   const SYNTHETIC_LOGIC_PREFIXES = ['license-policy:', 'deploy-platform:', 'stack-playbook:'];
+   const isSyntheticLogicFinding = (f) => typeof f?.id === 'string'
+     && SYNTHETIC_LOGIC_PREFIXES.some((p) => f.id.startsWith(p));
+   const blameableLogic = aLogic.filter((f) => !isSyntheticLogicFinding(f));
+   const syntheticLogic = aLogic.filter(isSyntheticLogicFinding);
+   for (const f of blameableLogic) {
+     if (!f.ruleId) f.ruleId = `logic:${_slugify(f.vuln)}`;
+   }
+   annotateStableIds(aSecrets);
+   annotateStableIds(blameableLogic);
+   await _runAnnotator("annotateGitProvenance", async () => {
+    // ONE deadline for the whole scan's provenance work, computed here and
+    // threaded into all five annotateGitProvenance calls below. Computed per call
+    // inside the coordinator, the effective scan-level budget was 2× the
+    // configured --provenance-timeout: the SAST pass got a fresh window and
+    // then the SCA pass got another one, so an operator asking for a 30s cap
+    // could wait 60s. The spec describes a single global deadline; this is
+    // where "global" has to be established, because this is the only scope
+    // that sees both passes.
+    const provenanceTimeoutMs = process.env.AGENTIC_SECURITY_PROVENANCE_TIMEOUT_MS
+      ? parseInt(process.env.AGENTIC_SECURITY_PROVENANCE_TIMEOUT_MS, 10) : undefined;
+    // Deterministic mode promises byte-identical SARIF run-to-run
+    // (posture/deterministic.js), and `observedAt` above is already frozen to
+    // honour that. But `findingProvenance.status` (complete/partial/
+    // budget_exhausted/...) is driven by THIS deadline, which was computed
+    // from a real `Date.now()` even under --deterministic — so two runs of
+    // the identical scan could cross a 60s budget at different points under
+    // machine contention (git subprocess calls slowed by CPU/IO pressure) and
+    // land different findings on `budget_exhausted` vs a resolved status,
+    // changing the emitted SARIF between runs. An explicit
+    // --provenance-timeout / AGENTIC_SECURITY_PROVENANCE_TIMEOUT_MS still wins
+    // (an operator asking for a tight budget gets it regardless of mode);
+    // absent that, deterministic mode gets a much larger fixed ceiling so
+    // resolution has room to finish under realistic load instead of a bound
+    // that's routinely crossed — see test/proof-corpus-lib.test.js's
+    // "produces byte-identical SARIF across two runs".
+    const DETERMINISTIC_PROVENANCE_TIMEOUT_MS = 300000; // 5 minutes
+    const provenanceDeadlineAt = Date.now()
+      + (Number.isFinite(provenanceTimeoutMs) && provenanceTimeoutMs > 0
+        ? provenanceTimeoutMs
+        : (isDeterministic() ? DETERMINISTIC_PROVENANCE_TIMEOUT_MS : PROVENANCE_DEFAULT_TIMEOUT_MS));
+    const provenanceCtx = {
+      scanRoot,
+      deadlineAt: provenanceDeadlineAt,
+      // CLI flags that set these land in Task 17; reading the env directly here
+      // mirrors AGENTIC_SECURITY_NO_GIT_HISTORY's existing pattern in this file.
+      disabled: process.env.AGENTIC_SECURITY_NO_PROVENANCE === '1',
+      scanId: process.env.AGENTIC_SECURITY_SCAN_ID || null,
+      // Frozen under --deterministic so SARIF (which now carries
+      // findingProvenance.firstObserved.observedAt — see report/index.js's
+      // toSARIF) stays byte-identical run-to-run, matching the exact
+      // convention posture/deterministic.js's makeDeterministic() already
+      // uses for meta.startedAt. This value predates that guarantee; it was
+      // invisible before findingProvenance reached any output format.
+      observedAt: isDeterministic() ? '1970-01-01T00:00:00.000Z' : new Date().toISOString(),
+      // FR-PROV-028 / "Evidence integrity": the cache key (coordinator.js's
+      // `makeCacheKey`) and `computeDigest`'s `rulesetVersion` binding both
+      // read this field, so it has to be the REAL effective ruleset version,
+      // not an env var operators essentially never set. `_effectiveRulesetVersion`
+      // (posture/ruleset-version.js's `effectiveVersion`) already resolves
+      // env override > pinned file > CURRENT_RULESET_VERSION (== the running
+      // scanner's own package version) — the same helper the checkpoint
+      // identity above (`_ckptIdentity.rulesetVersion`) already calls for an
+      // unrelated purpose. Computed ONCE here and shared via `provenanceCtx`,
+      // same precedent as `deadlineAt` and `providerEnrichments` below: it's
+      // cheap (an env read plus one small JSON file stat/read), but five
+      // recomputations across the five annotateGitProvenance calls buys
+      // nothing and risks a mid-scan pinned-file edit producing five
+      // different answers in one run.
+      rulesetVersion: (_effectiveRulesetVersion(scanRoot) || {}).version || null,
+      since: process.env.AGENTIC_SECURITY_PROVENANCE_SINCE || null,
+      timeoutMs: provenanceTimeoutMs,
+      mode: process.env.AGENTIC_SECURITY_PROVENANCE_MODE || 'standard',
+      // Fix-round item 2: ONE shared provider-enrichment counter for the
+      // whole scan, same precedent as the single `deadlineAt` above. Object
+      // identity (not the primitive value) is what makes the cap survive the
+      // `{ ...provenanceCtx, findingType: ... }` spreads used by four of the
+      // five annotateGitProvenance calls below — see coordinator.js's
+      // `providerEnrichments` comment for why a bare number would not work.
+      providerEnrichments: { remaining: MAX_PROVIDER_ENRICHMENTS_PER_SCAN },
+    };
+    await annotateGitProvenance(finalFindings, provenanceCtx);
+    // Direct dependencies only: a transitive dep's vulnerable version was never
+    // declared in this repository's manifests, so there is no commit here that
+    // introduced it and `resolveDirectSCAOrigin` would have nothing to walk.
+    //
+    // Keyed on `isDirect`, the same field the transitive-dedup block above
+    // uses. The plan's `!s.isTransitive` was a silent no-op: `isTransitive`
+    // exists on dependency COMPONENTS but was never carried onto the
+    // vulnerable_dep entries, so the negation was true for every entry and the
+    // filter excluded nothing. `isDirect` is now propagated at materialization.
+    const directDeps = (supplyChain || []).filter((s) => s && s.type === 'vulnerable_dep' && s.isDirect);
+    // `resolveDirectSCAOrigin`/`scaStableId` key on `filePath`; the vulnerable_dep
+    // entries built above carry the manifest path as `file` (report/index.js
+    // already reads `sc.filePath || sc.file` for the same reason). Backfill the
+    // alias rather than teaching the SCA resolver a second field name — without
+    // it every direct dependency resolves to `not_available: no-manifest-path`.
+    for (const s of directDeps) { if (!s.filePath && s.file) s.filePath = s.file; }
+    await annotateGitProvenance(directDeps, { ...provenanceCtx, findingType: 'sca' });
+    // M3 §3.2: transitive dependencies now get real origin resolution too,
+    // narrowing what was previously an unconditional not_available backstop
+    // to genuinely unresolvable cases (non-npm lockfiles, no candidate
+    // history) — see transitive-sca.js's own scope note.
+    const transitiveDeps = (supplyChain || []).filter((s) => s && s.type === 'vulnerable_dep' && !s.isDirect);
+    for (const s of transitiveDeps) { if (!s.filePath && s.file) s.filePath = s.file; }
+    await annotateGitProvenance(transitiveDeps, { ...provenanceCtx, findingType: 'sca-transitive' });
+    // Task 11 (PRD P0 scope): `aSecrets`/`blameableLogic` already have real
+    // stableIds backfilled above (outside this callback — see that comment).
+    // findingType 'secret'/'logic' is not consumed by any branch in
+    // coordinator.js's resolveOne (only 'sca'/'sca-transitive' select a
+    // different resolution strategy) — both fall through to the plain SAST
+    // path (file+line blame short-circuit, then origin-resolver.js). Passed
+    // anyway for clarity and future debugging; harmless today.
+    await annotateGitProvenance(aSecrets, { ...provenanceCtx, findingType: 'secret' });
+    await annotateGitProvenance(blameableLogic, { ...provenanceCtx, findingType: 'logic' });
+    // FR-PROV-013 — introduce/remediate/reintroduce events. Best-effort by
+    // design: the lifecycle store is a convenience ledger, and a failed write
+    // (read-only tree, lock contention) must never fail a scan, matching how
+    // every other provenance component degrades.
+    //
+    // Gated on `disabled` as well as on the `provenance` parameter, because
+    // those are two different opt-outs and only one of them was being honoured.
+    // updateLifecycle WRITES to disk; an operator who set
+    // AGENTIC_SECURITY_NO_PROVENANCE=1 has said the feature does nothing, and a
+    // disabled feature that still litters `.agentic-security/provenance/` is
+    // not disabled. (annotateGitProvenance handles `disabled` internally by
+    // stamping not_available, which is why it is still called above — every
+    // finding must keep a terminal status even with the feature off.)
+    //
+    // Gated on `scanRoot` too. Every path into updateLifecycle resolves the
+    // store through statePath(scanRoot, …), and statePath falls back to the
+    // PROCESS CWD when scanRoot is null — so a runFullScan called with no
+    // scanRoot (the in-process test/bench harnesses, predicate replay before
+    // its provenance:false brake, any embedder) wrote a lifecycle ledger into
+    // whatever directory the process happened to be in, keyed on that
+    // unrelated run's findings. That is how this repo's own
+    // scanner/.agentic-security/provenance/lifecycle.json accumulated 374
+    // stableIds and 3000+ spurious remediated/reintroduced events. No
+    // scanRoot means no project to keep a ledger for.
+    //
+    // `completeScan` is the other half, and it is a correctness gate rather
+    // than a hygiene one — see runFullScan's parameter comment and
+    // lifecycle.js's applyScan.
+    //
+    // TRUTHY IS NOT ENOUGH — it has to be a real directory. `resolveProjectRoot`
+    // honours a caller-supplied scanRoot only when it exists on disk AND is a
+    // directory; for anything else (a typo'd path, a `/tmp/...` a test never
+    // created, a file rather than a directory) it silently falls back to walking
+    // UP FROM THE PROCESS CWD for a project marker. So `agentic-security scan
+    // ./typo` run from inside a project writes THAT project's lifecycle ledger
+    // from a scan that never looked at it — and since such a scan finds nothing
+    // while still claiming `completeScan`, the remediation pass closes every
+    // open finding the real project had. Same corruption as the null-scanRoot
+    // case above, reached through a different door: found by tracing the writes
+    // that kept reappearing in this repo's own scanner/.agentic-security AFTER
+    // the null guard was added. All three remaining writers were
+    // truthy-but-nonexistent scanRoots.
+    //
+    // Narrow on purpose. Every other state write in such a scan lands in the
+    // same wrong place, which is a wider `state-dir.js` question; the lifecycle
+    // ledger is singled out here because it is the only one that turns the
+    // mistake into a destructive claim about findings it never saw.
+    let scanRootIsRealDir = false;
+    try { scanRootIsRealDir = !!scanRoot && fs.statSync(scanRoot).isDirectory(); } catch { scanRootIsRealDir = false; }
+    if (scanRootIsRealDir && !provenanceCtx.disabled) {
+      try {
+        await updateLifecycle(scanRoot, finalFindings, {
+          scanId: provenanceCtx.scanId, observedAt: provenanceCtx.observedAt,
+          completeScan,
+        });
+      } catch (_) { /* best-effort */ }
+    }
+   });
+   // Structural backstop for the terminal-status guarantee, for BOTH channels.
+   // Deliberately OUTSIDE the _runAnnotator callback above: _runAnnotator
+   // swallows whatever the callback throws, so anything that depends on the
+   // callback reaching its last line is a convention, not a guarantee. If
+   // annotateGitProvenance threw before its per-finding loop began
+   // (getRepoState blowing up on a corrupt repo, say), everything below the
+   // throw is skipped and every finding and supplyChain entry silently carries
+   // no findingProvenance at all — exactly the absent-field state the status
+   // enum exists to make unreachable. Enforced here so it holds structurally.
+   for (const f of finalFindings) {
+     if (f && typeof f === 'object' && !f.findingProvenance) {
+       f.findingProvenance = emptyProvenance(PROVENANCE_STATUS.ERROR, {
+         limitations: ['provenance annotator did not reach this finding'],
+       });
+     }
+   }
+   // The supply-chain half. report/index.js normalizes EVERY supplyChain entry
+   // into an SCA finding — not just the direct vulnerable_dep ones the resolver
+   // can speak to — and pipeline/finding-schema.js requires findingProvenance on
+   // every channel. Three distinct populations reach this loop and they are not
+   // the same statement, so they do not share a limitation string:
+   //
+   //  - transitive vulnerable_deps: resolved by resolveTransitiveSCAOrigin
+   //    above (M3 §3.2) — this branch is now reached only if that annotation
+   //    pass itself failed to stamp the entry.
+   //  - unpinned_dep / no_lockfile and friends: these describe the ABSENCE of a
+   //    declaration, so "which commit introduced this version" is not a question
+   //    that has an answer to defer.
+   //  - anything the annotator failed to reach, as above.
+   //
+   // The first two are honest `not_available` — that is exactly what the status
+   // is for. Only a genuine annotator failure is an `error`, which is why this
+   // loop distinguishes them rather than stamping one status for all three.
+   for (const sc of (supplyChain || [])) {
+     if (!sc || typeof sc !== 'object' || sc.findingProvenance) continue;
+     sc.findingProvenance = emptyProvenance(PROVENANCE_STATUS.NOT_AVAILABLE, {
+       limitations: [sc.type === 'vulnerable_dep'
+         ? 'transitive dependency origin resolution failed for this entry (annotator error)'
+         : `origin resolution does not apply to a ${sc.type || 'non-vulnerability'} supply-chain entry`],
+     });
+   }
+   // The OTHER two channels report/index.js normalizes into findings —
+   // `scan.secrets` and `scan.logicVulns`. The same argument that produced the
+   // supplyChain loop above applies verbatim: pipeline/finding-schema.js makes
+   // `findingProvenance` REQUIRED on every channel, and normalizeFindings emits
+   // a finding for each of these, so leaving them unstamped ships a
+   // schema-incomplete finding whose absent field is indistinguishable from
+   // "escaped annotation" — the exact condition the status enum exists to
+   // remove.
+   //
+   // Task 11 (PRD P0 scope): `aSecrets` and `blameableLogic` now go through
+   // REAL resolution above (real stableIds backfilled, real
+   // annotateGitProvenance calls made), so this loop no longer covers them
+   // wholesale — it is now a defensive catch-all for any entry the real call
+   // somehow didn't reach (same precedent as the supplyChain loop above), plus
+   // `syntheticLogic`, which can NEVER get real resolution by design (see the
+   // classification comment above `SYNTHETIC_LOGIC_PREFIXES`) and stays here
+   // permanently and honestly, not as a deferral.
+   for (const x of (syntheticLogic || [])) {
+     if (!x || typeof x !== 'object' || x.findingProvenance) continue;
+     x.findingProvenance = emptyProvenance(PROVENANCE_STATUS.NOT_AVAILABLE, {
+       limitations: ['this finding describes dependency/config/policy state, not a single source line a commit introduced -- origin resolution does not apply'],
+     });
+   }
+   for (const bucket of [aSecrets, blameableLogic]) {
+     for (const x of (bucket || [])) {
+       if (!x || typeof x !== 'object' || x.findingProvenance) continue;
+       x.findingProvenance = emptyProvenance(PROVENANCE_STATUS.NOT_AVAILABLE, {
+         limitations: ['origin resolution annotator did not reach this finding'],
+       });
+     }
+   }
+  }
   // Addition #2 — attack-surface completeness inventory (entry points → dispositions).
-  let _entrypointInventory = {}; try { _entrypointInventory = buildEntrypointInventory(fc, { routes: aR, findings: finalFindings }); } catch { _entrypointInventory = {}; }
+  // (_entrypointInventory is hoisted above the `skipAnnotators` guard — FR-PROV-029.)
+  try { _entrypointInventory = buildEntrypointInventory(fc, { routes: aR, findings: finalFindings }); } catch { _entrypointInventory = {}; }
   // R9 + R6 — relevance scoping. Runs HERE, after every finding has been
   // appended (multi-sink chains, cross-language chains) and after the
   // entry-point inventory exists, so no finding escapes annotation and the
   // attack surface it is scored against is the complete one. Recall-
   // preserving: never removes a finding, never touches severity, and only
   // asserts `unreachable` on positive evidence (see posture/relevance.js).
-  _runAnnotator("annotateRelevance", () => {
+  await _runAnnotator("annotateRelevance", () => {
     annotateRelevance(finalFindings, {
       fileContents: fc,
       entrypointInventory: _entrypointInventory,
@@ -9848,14 +10561,46 @@ function _deterministicFileTimings(timings) {
   });
   // Addition #3 — root-cause sweep: from confirmed findings, find sibling instances
   // detectors missed, with total-count accounting. Confirmed-only (cheap by default).
-  let _rootCauseSweep = null; try { _rootCauseSweep = sweepRootCauses(finalFindings, fc); } catch { _rootCauseSweep = null; }
+  // (_rootCauseSweep/_proofCoverage/_coverageLedger/_scanHealth are hoisted
+  // above the `skipAnnotators` guard — FR-PROV-029.)
+  try { _rootCauseSweep = sweepRootCauses(finalFindings, fc); } catch { _rootCauseSweep = null; }
   // PRD F7.2: publish what CANNOT be proven alongside what can. A proof RATE
   // computed over the provable subset makes a narrow subset look like strength;
   // the three-bucket split (provable / declined-on-purpose / not-yet-classified)
   // is the honest shape. Measured on the CVE corpus: 19% / 13% / 68%.
-  let _proofCoverage = null;
   try { _proofCoverage = proofCoverage([...finalFindings, ...aLogic]); } catch { _proofCoverage = null; }
-  return{entrypointInventory:_entrypointInventory,rootCauseSweep:_rootCauseSweep,proofCoverage:_proofCoverage,kevCatalog:kevCatalogMeta(),routes:dd(aR,r=>`${r.method}:${r.path}:${r.file}:${r.line}`),findings:finalFindings,sources:aSrc,sinks:aSink,sanitizers:aSan,filesScanned:files.length,crossFileCount:cf.length,logicVulns:aLogic,supplyChain,components:annotatedComponents,secrets:aSecrets,ciphers:{atRest:aCiphersRest,inTransit:aCiphersTransit},pfr,fc,suppressions:_getSuppressions(),_v3,_scanMeta,_engineErrors:{cppDataflowParseErrors:_cppDataflowParseErrors.value},annotatorErrors:_annotatorErrors,executionProof:_executionProofSummary,logicClaims:_logicClaims,vulnHistory:_vulnHistory,threatModel:_threatModel,privacyFramework:_privacyFramework,sbomDiff:_sbomDiff,complianceReport:_complianceReport,exploitBundles:_exploitBundles,pqcPlan:_pqcPlan,licenseGraph:_licenseGraph,attributions:_attributions,attackTaxonomy:_taxonomySummary};}
+  // FR-203: per-file/per-analyzer coverage ledger, computed from exactly
+  // the signals FR-201 (_detectorErrors) and FR-202 (the _timeout:true
+  // marker finding) already produce -- files actually scanned come from
+  // fc's own keys (skipped-for-size/density files were never added to it).
+  const _timedOutFiles = finalFindings.filter(f => f && f._timeout === true).map(f => f.file);
+  _coverageLedger = computeCoverageLedger({ files: Object.keys(fc), detectorErrors: _detectorErrors, timedOutFiles: _timedOutFiles });
+  // FR-206 (assurance-hardening PRD, Milestone 0): additive scan-health
+  // summary, computed from signals the engine already collects.
+  // `analyzers` was `null` (see pipeline/scan-health.js's prior comment)
+  // until FR-203's coverage ledger existed to compute it for real.
+  _scanHealth = computeScanHealth({
+    scanMeta: _scanMeta,
+    annotatorErrors: _annotatorErrors,
+    engineErrors: { cppDataflowParseErrors: _cppDataflowParseErrors.value },
+    deepStatus: _deepStatus,
+    analyzerCoverage: summarizeCoverageForScanHealth(_coverageLedger),
+  });
+  // FR-207: stale vulnerability feeds, calibration data, and compliance
+  // evidence are real assurance gaps, not just findings the feed omits --
+  // surfaced the same way every other scan-health condition is, so
+  // --assurance strict (FR-204) can fail on them. Custom-rule-pack
+  // freshness is the one leg NOT computed here: that mechanism only runs
+  // in bin/agentic-security.js, after this scan object already exists (see
+  // applyFreshness's own header comment in pipeline/scan-health.js).
+  _scanHealth = applyFreshness(_scanHealth, {
+    kev: kevCatalogMeta(),
+    epss: epssLiveMeta(),
+    calibration: calibrationFreshness(),
+    compliance: _complianceReport ? { stale: _complianceReport.summary?.stale || 0 } : null,
+  });
+  } // end if (!skipAnnotators) — FR-PROV-029
+  return{entrypointInventory:_entrypointInventory,rootCauseSweep:_rootCauseSweep,proofCoverage:_proofCoverage,kevCatalog:kevCatalogMeta(),routes:dd(aR,r=>`${r.method}:${r.path}:${r.file}:${r.line}`),findings:finalFindings,sources:aSrc,sinks:aSink,sanitizers:aSan,filesScanned:files.length,crossFileCount:cf.length,logicVulns:aLogic,supplyChain,components:annotatedComponents,secrets:aSecrets,ciphers:{atRest:aCiphersRest,inTransit:aCiphersTransit},pfr,fc,suppressions:_getSuppressions(),_v3,_scanMeta,_engineErrors:{cppDataflowParseErrors:_cppDataflowParseErrors.value},annotatorErrors:_annotatorErrors,detectorErrors:_detectorErrors,executionProof:_executionProofSummary,logicClaims:_logicClaims,vulnHistory:_vulnHistory,threatModel:_threatModel,privacyFramework:_privacyFramework,privacyIrBacked:_privacyIrBacked,privacyTaxonomyVersion:_privacyTaxonomyVersion,sbomDiff:_sbomDiff,complianceReport:_complianceReport,exploitBundles:_exploitBundles,pqcPlan:_pqcPlan,licenseGraph:_licenseGraph,attributions:_attributions,attackTaxonomy:_taxonomySummary,scanHealth:_scanHealth,coverageLedger:_coverageLedger};}
 
 // Post-aggregation classification: every source becomes "unsafe"|"safe"; every sink becomes "confirmed"|"safe".
 // Orphans (no finding linkage) are bucketed by file-local heuristic so the UI shows binary states only.
@@ -10322,6 +11067,7 @@ export {
   classifyOrphans, classifyField, classifyEndpoint, shouldScan,
   _isFalsePositiveCredential, _detectSafeSinkShape,
   _loadCustomRules, _isCustomSuppressed, _isPathIgnored,
+  _snapshotSuppressionLog, _restoreSuppressionLog,
   scanIaC, IAC_PATTERNS, _isIaCFile, isCloudFormationTemplate,
   payloadsForFinding, buildProofObligation,
   DATA_CLASSES, SOURCE_PATTERNS, SINK_PATTERNS, SANITIZER_PATTERNS,