@hublo/sentinel 1.5.0-alpha.2 → 1.5.0-alpha.20

package/dist/{chunk-AHA7LGGA.js → chunk-ZN32JGFP.js}

@@ -53,19 +53,26 @@ import {
   selfCommand,
   splitToolArgs,
   walk
-} from "./chunk-E3MYVYEZ.js";
+} from "./chunk-KLEXJFJ6.js";
 import {
   DEFAULT_MAX_DIAGNOSTICS,
+  WORKSPACE_ROOT_MARKER,
   findWorkspaceRoot,
   moduleName,
   readOwnPackage,
   readProjectPackageJson
-} from "./chunk-KMKQDGI6.js";
+} from "./chunk-YQRDKWSH.js";
 import {
   REPORT_DIR,
+  SCRIPTS,
+  SHAPES,
+  TARGET,
+  defaults,
   defineStaticAnalysis,
-  isPlainObject
-} from "./chunk-GJGZRXM3.js";
+  extensionsOf,
+  isPlainObject,
+  overridableSettings
+} from "./chunk-AYEOGJQR.js";
 import {
   parseJsonc
 } from "./chunk-QXFCZON7.js";
@@ -178,10 +185,10 @@ import { join, relative } from "node:path";
 var DEPRECATED_NX_BUILDER = "@nx/webpack:webpack";
 var TRANSLATABLE_WEBPACK_CONFIG = "tools/webpack-configs/update.webpack.config.js";
 var readProjectJson = (cwd) => {
-  const path = join(cwd, "project.json");
-  if (!existsSync(path)) return void 0;
+  const path2 = join(cwd, "project.json");
+  if (!existsSync(path2)) return void 0;
   try {
-    return JSON.parse(readFileSync(path, "utf8"));
+    return JSON.parse(readFileSync(path2, "utf8"));
   } catch {
     return void 0;
   }
@@ -1124,10 +1131,10 @@ function buildStamp(cwd) {
     return Date.now();
   }
 }
-function writtenSince(path, startedAt) {
-  if (!existsSync5(path)) return false;
+function writtenSince(path2, startedAt) {
+  if (!existsSync5(path2)) return false;
   try {
-    return statSync(path).mtimeMs >= startedAt;
+    return statSync(path2).mtimeMs >= startedAt;
   } catch {
     return true;
   }
@@ -1414,11 +1421,11 @@ function toModulePattern(pattern) {
 }
 function inheritedIgnorePatterns(workspaceRoot) {
   if (!workspaceRoot) return [];
-  const path = join8(workspaceRoot, ROOT_IGNORE_FILE);
-  if (!existsSync6(path)) return [];
+  const path2 = join8(workspaceRoot, ROOT_IGNORE_FILE);
+  if (!existsSync6(path2)) return [];
   let contents;
   try {
-    contents = readFileSync6(path, "utf8");
+    contents = readFileSync6(path2, "utf8");
   } catch {
     return [];
   }
@@ -1948,9 +1955,9 @@ function readFailure(output) {
   const line = (detail ?? lines.find((entry) => entry !== "") ?? "").replace(/^x\s*/, "");
   return line.split(/:\s*Failed to parse config/i)[0] ?? line;
 }
-function fingerprint(path) {
+function fingerprint(path2) {
   try {
-    const stat = statSync2(path);
+    const stat = statSync2(path2);
     return `${stat.size}:${stat.mtimeMs}`;
   } catch {
     return void 0;
@@ -3770,11 +3777,11 @@ function downgradedRulesFor(preset) {
 import { existsSync as existsSync9, readFileSync as readFileSync9 } from "node:fs";
 import { isAbsolute, join as join12, resolve as resolve2 } from "node:path";
 function ruleCount(cwd, specifier) {
-  const path = isAbsolute(specifier) ? specifier : resolve2(cwd, specifier);
-  if (!existsSync9(path)) return void 0;
+  const path2 = isAbsolute(specifier) ? specifier : resolve2(cwd, specifier);
+  if (!existsSync9(path2)) return void 0;
   try {
     const parsed = parseJsonc(
-      readFileSync9(path, "utf8"),
+      readFileSync9(path2, "utf8"),
       specifier
     );
     return Object.keys(parsed.rules ?? {}).length;
@@ -3870,7 +3877,7 @@ function readRootEslintIgnores(root) {
   return { patterns: patterns.filter((pattern) => pattern.startsWith("**/")), unresolved };
 }
 function readEslintIgnores(cwd) {
-  const config = ESLINT_CONFIG_FILES.map((name) => join13(cwd, name)).find((path) => existsSync10(path));
+  const config = ESLINT_CONFIG_FILES.map((name) => join13(cwd, name)).find((path2) => existsSync10(path2));
   if (!config) return { patterns: [], unresolved: [] };
   let source;
   try {
@@ -4146,12 +4153,12 @@ function plan2(context) {
   const ignores = readEslintIgnores(context.cwd);
   const rootIgnores = readRootEslintIgnores(findWorkspaceRoot(context.cwd));
   const bare = (pattern) => pattern.replace(/^\*\*\//, "").replace(/\/\*\*$/, "");
-  const defaults = new Set(DEFAULT_IGNORE_PATTERNS.map(bare));
+  const defaults2 = new Set(DEFAULT_IGNORE_PATTERNS.map(bare));
   const moduleOwn = [
     ...committedIgnorePatterns(context.cwd),
     ...ignores.patterns,
     ...rootIgnores.patterns
-  ].filter((pattern) => !defaults.has(bare(pattern)));
+  ].filter((pattern) => !defaults2.has(bare(pattern)));
   const carried = [.../* @__PURE__ */ new Set([...DEFAULT_IGNORE_PATTERNS, ...moduleOwn])];
   const stub = {
     extends: extendsWithPreset(committedExtends(context.cwd), variant),
@@ -4751,9 +4758,19 @@ function registerLint() {
 }
 
 // src/roles/static-analysis/adapters/jscpd/jscpd.adapter.ts
-import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync14, mkdirSync, readFileSync as readFileSync14, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join19 } from "node:path";
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { existsSync as existsSync16, mkdirSync as mkdirSync2, readFileSync as readFileSync17, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join22 } from "node:path";
+import { globSync as globSync4 } from "tinyglobby";
+
+// src/roles/static-analysis/complexity/scan.ts
+import { readFileSync as readFileSync14 } from "node:fs";
+import { globSync } from "tinyglobby";
+
+// src/roles/static-analysis/adapters/jscpd/tool-config.ts
+import { existsSync as existsSync14, mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join18 } from "node:path";
 
 // src/roles/static-analysis/configs/resolve.ts
 import { existsSync as existsSync13 } from "node:fs";
@@ -4761,12 +4778,12 @@ import { join as join17 } from "node:path";
 import { pathToFileURL } from "node:url";
 var STATIC_CONFIG_FILE = "static-analysis.config.mjs";
 async function loadStaticConfig(cwd) {
-  const path = join17(cwd, STATIC_CONFIG_FILE);
-  if (!existsSync13(path)) {
+  const path2 = join17(cwd, STATIC_CONFIG_FILE);
+  if (!existsSync13(path2)) {
     return { config: defineStaticAnalysis(), from: null, unreadable: null };
   }
   try {
-    const loaded = await import(pathToFileURL(path).href);
+    const loaded = await import(pathToFileURL(path2).href);
     return { config: adopt(loaded.default), from: STATIC_CONFIG_FILE, unreadable: null };
   } catch (error) {
     return {
@@ -4784,21 +4801,789 @@ function adopt(exported) {
   return defineStaticAnalysis(exported);
 }
 
+// src/roles/static-analysis/adapters/jscpd/tool-config.ts
+var OWN_ARTEFACTS = [`**/${STATIC_CONFIG_FILE}`, `**/${REPORT_DIR}/**`];
+function testGlobs(config) {
+  const relative5 = config.duplication.tests;
+  return {
+    ignore: relative5.map((glob) => `**/${glob}`),
+    // A one-item brace group is avoided rather than trusted: nothing guarantees `{x}` expands.
+    pattern: relative5.length === 1 ? `**/${relative5[0]}` : `**/{${relative5.join(",")}}`
+  };
+}
+function exclusions(config, scope = "tests") {
+  const tests = scope === "product" ? testGlobs(config).ignore : [];
+  return [.../* @__PURE__ */ new Set([...config.ignore, ...OWN_ARTEFACTS, ...tests])];
+}
+function measuredRoots(cwd) {
+  return existsSync14(join18(cwd, "src")) ? ["src"] : ["."];
+}
+function fileSettings(config, scope, extraEntries = []) {
+  return {
+    // The detection window. Stated rather than defaulted, because it decides what is invisible.
+    minTokens: config.duplication.minTokens,
+    minLines: config.duplication.minLines,
+    // `format` is jscpd's name for what we call `languages`. Naming `typescript` alone would
+    // leave out `.tsx`, which is a separate language to it: 300 files of 523 on front/console.
+    format: config.languages,
+    ignore: exclusions(config, scope),
+    // A scan that analyses nothing otherwise exits 0 with only a warning, which reads as a pass.
+    failOnEmpty: true,
+    // The dead-code engine keeps its own section, and its own `minLines`: jscpd's documentation is
+    // explicit that the top-level one is about clones and is never carried into a dead-code run.
+    deadCode: {
+      // ⛔ The module's declared patterns PLUS the files another module imports. Seeding the walk
+      // rather than replacing it keeps what it does well, transitivity: a file reachable only
+      // through a dead one stays dead. Without these seeds a library has no entry point at all, so
+      // the walk reports "the module does not import itself", true of every library: 87 files on
+      // `libs/nest/auth` against 12 that nothing anywhere imports. See `workspace/consumers.ts`.
+      entry: [...config.entry, ...extraEntries],
+      minConfidence: config.deadCode.minConfidence,
+      categories: config.deadCode.categories
+    },
+    // The escape hatch, last so it wins, and empty unless a module asked for it.
+    ...config.tools.jscpd
+  };
+}
+function duplicationRun(config, paths, scope) {
+  const dir = mkdtempSync(join18(tmpdir(), "sentinel-static-"));
+  const configPath = join18(dir, "jscpd.json");
+  writeFileSync3(configPath, `${JSON.stringify(fileSettings(config, scope), null, 2)}
+`, "utf8");
+  const args = [
+    "--config",
+    configPath,
+    // The test pass SELECTS its files; the product pass excludes them through `ignore` above. A
+    // flag and not a config key, because `--pattern` is the only documented way in and it takes
+    // exactly one glob, braces expanded. Verified: 478 product files + 87 test files = the 565 of
+    // a blended scan on `apps/front/console`.
+    ...scope === "tests" ? ["--pattern", testGlobs(config).pattern] : [],
+    // Always json, and only json, whatever shape the caller asked for. The three shapes are
+    // rendered by this role from the figures, not by the tool: one report lives under
+    // `static-analysis`, assembled from several passes, so a per-pass console table from the tool
+    // would be a fourth voice saying the same numbers differently. `--output` below is jscpd's
+    // output DIRECTORY, not our `--output` shape.
+    "--reporters",
+    "json",
+    "--output",
+    dir,
+    "--no-tips",
+    ...paths
+  ];
+  return { args, rawReportDir: dir, dispose: () => rmSync3(dir, { force: true, recursive: true }) };
+}
+function deadCodeRun(config, paths, extraEntries = []) {
+  const dir = mkdtempSync(join18(tmpdir(), "sentinel-static-"));
+  const configPath = join18(dir, "jscpd.json");
+  writeFileSync3(
+    configPath,
+    `${JSON.stringify(fileSettings(config, "dead-code", extraEntries), null, 2)}
+`,
+    "utf8"
+  );
+  return {
+    args: [
+      "--config",
+      configPath,
+      "--dead-code",
+      "--reporters",
+      "json",
+      "--output",
+      dir,
+      "--no-tips",
+      ...paths
+    ],
+    rawReportDir: dir,
+    dispose: () => rmSync3(dir, { force: true, recursive: true })
+  };
+}
+var RAW_REPORT = {
+  duplication: "jscpd-report.json",
+  "dead-code": "basta-report.json"
+};
+
+// src/roles/static-analysis/complexity/cyclomatic.ts
+import { parseSync as parseSync2 } from "oxc-parser";
+var FUNCTION_NODES = /* @__PURE__ */ new Set([
+  "FunctionDeclaration",
+  "FunctionExpression",
+  "ArrowFunctionExpression"
+]);
+var DECISION_NODES = /* @__PURE__ */ new Set([
+  "IfStatement",
+  "ForStatement",
+  "ForInStatement",
+  "ForOfStatement",
+  "WhileStatement",
+  "DoWhileStatement",
+  "CatchClause",
+  "ConditionalExpression"
+]);
+var DECISION_OPERATORS = /* @__PURE__ */ new Set(["&&", "||", "??"]);
+var DECISION_ASSIGNMENTS = /* @__PURE__ */ new Set(["&&=", "||=", "??="]);
+function walk2(node, visit, stopAt) {
+  if (!node || typeof node !== "object") return;
+  if (Array.isArray(node)) {
+    for (const child of node) walk2(child, visit, stopAt);
+    return;
+  }
+  const current = node;
+  if (typeof current.type === "string") {
+    if (stopAt(current)) return;
+    visit(current);
+  }
+  for (const [field, value] of Object.entries(current)) {
+    if (field === "type" || field === "start" || field === "end") continue;
+    walk2(value, visit, stopAt);
+  }
+}
+function complexityOf(fn) {
+  let count = 1;
+  for (const parameter of Array.isArray(fn.params) ? fn.params : []) {
+    walk2(
+      parameter,
+      (node) => {
+        if (node.type === "AssignmentPattern") count += 1;
+      },
+      (node) => FUNCTION_NODES.has(node.type ?? "")
+    );
+  }
+  const body = fn.body ?? fn;
+  let root = true;
+  walk2(
+    body,
+    (node) => {
+      if (DECISION_NODES.has(node.type ?? "")) count += 1;
+      if (node.type === "AssignmentPattern") count += 1;
+      if (node.type === "SwitchCase" && node.test !== null && node.test !== void 0) count += 1;
+      if (node.type === "LogicalExpression" && DECISION_OPERATORS.has(String(node.operator ?? ""))) {
+        count += 1;
+      }
+      if (node.type === "AssignmentExpression" && DECISION_ASSIGNMENTS.has(String(node.operator ?? ""))) {
+        count += 1;
+      }
+      if ((node.type === "MemberExpression" || node.type === "CallExpression") && node.optional === true) {
+        count += 1;
+      }
+    },
+    (node) => {
+      if (root) {
+        root = false;
+        return false;
+      }
+      return FUNCTION_NODES.has(node.type ?? "");
+    }
+  );
+  return count;
+}
+function nameOf(fn, parent) {
+  const own = fn.id?.name;
+  if (own) return own;
+  const key = parent?.id?.name ?? parent?.key?.name;
+  if (key) return key;
+  return "(anonymous)";
+}
+function lineAt(source, offset) {
+  if (offset === void 0) return 1;
+  let line = 1;
+  for (let index = 0; index < offset && index < source.length; index += 1) {
+    if (source[index] === "\n") line += 1;
+  }
+  return line;
+}
+function complexityOfFile(path2, source) {
+  const parsed = parseSync2(path2, source);
+  if (parsed.errors.length > 0) return [];
+  const found = [];
+  const parents = /* @__PURE__ */ new Map();
+  walk2(
+    parsed.program,
+    (node) => {
+      for (const value of Object.values(node)) {
+        if (value && typeof value === "object" && !Array.isArray(value)) {
+          parents.set(value, node);
+        }
+      }
+      if (!FUNCTION_NODES.has(node.type ?? "")) return;
+      found.push({
+        name: nameOf(node, parents.get(node)),
+        line: lineAt(source, node.start),
+        complexity: complexityOf(node)
+      });
+    },
+    () => false
+  );
+  return found;
+}
+
+// src/roles/static-analysis/complexity/scan.ts
+var RISK_BANDS = [
+  { metric: "complexityModerate", from: 11, to: 20, label: "moderate risk" },
+  { metric: "complexityHigh", from: 21, to: 50, label: "high risk" },
+  { metric: "complexityUntestable", from: 51, to: Infinity, label: "untestable" }
+];
+var MCCABE_REFERENCE = RISK_BANDS[0].from;
+function productFiles(cwd, config) {
+  const extensions = extensionsOf(config.languages).map((extension) => extension.slice(1)).join(",");
+  return globSync(
+    measuredRoots(cwd).map(
+      (root) => root === "." ? `**/*.{${extensions}}` : `${root}/**/*.{${extensions}}`
+    ),
+    {
+      cwd,
+      ignore: exclusions(config, "product"),
+      dot: false
+    }
+  );
+}
+function scanComplexity(cwd, config) {
+  const files = productFiles(cwd, config);
+  const all2 = [];
+  for (const path2 of files) {
+    let source;
+    try {
+      source = readFileSync14(`${cwd}/${path2}`, "utf8");
+    } catch {
+      continue;
+    }
+    for (const fn of complexityOfFile(path2, source)) all2.push({ ...fn, path: path2 });
+  }
+  all2.sort((left, right) => right.complexity - left.complexity);
+  const bands = {};
+  for (const band of RISK_BANDS) {
+    bands[band.metric] = all2.filter(
+      (fn) => fn.complexity >= band.from && fn.complexity <= band.to
+    ).length;
+  }
+  return {
+    files: files.length,
+    functions: all2.length,
+    max: all2[0]?.complexity ?? 0,
+    complex: all2.filter((fn) => fn.complexity >= MCCABE_REFERENCE),
+    bands
+  };
+}
+
+// src/roles/static-analysis/coverage.ts
+import path from "node:path";
+import { globSync as globSync2 } from "tinyglobby";
+var UNREADABLE_EXTENSIONS = [".svelte", ".vue", ".astro"];
+function hasUnreadableCode(coverage) {
+  return coverage.unread > 0;
+}
+function coverageOf(cwd, config) {
+  const ignore = exclusions(config, "product");
+  const readable = extensionsOf(config.languages).map((extension) => extension.slice(1)).join(",");
+  const roots = measuredRoots(cwd);
+  const under = (extensions) => roots.map((root) => root === "." ? `**/*.{${extensions}}` : `${root}/**/*.{${extensions}}`);
+  const read = readable ? globSync2(under(readable), { cwd, ignore, dot: false }).length : 0;
+  const unreadable = UNREADABLE_EXTENSIONS.map((extension) => extension.slice(1)).join(",");
+  const found = globSync2(under(unreadable), { cwd, ignore, dot: false });
+  const total = read + found.length;
+  return {
+    read,
+    unread: found.length,
+    share: total === 0 ? 0 : found.length / total,
+    extensions: [...new Set(found.map((file) => path.extname(file)))].sort()
+  };
+}
+function unreadableNote(coverage) {
+  const percent = Math.round(coverage.share * 100);
+  const kinds = coverage.extensions.join(", ");
+  return `${coverage.unread} product file(s) in ${kinds} cannot be parsed, ${percent}% of this module: no graph and no dead-code figure is reported, because a file the role cannot open still imports the files it imports`;
+}
+
+// src/roles/static-analysis/graph/picture.ts
+import forceAtlas2 from "graphology-layout-forceatlas2";
+import circular from "graphology-layout/circular.js";
+import renderSvg from "graphology-svg";
+var ITERATIONS = 300;
+var LABELLED = 10;
+var BLANK = " ";
+var SIZE = { width: 1600, height: 1200, margin: 30 };
+function hueOf(community) {
+  return `hsl(${community * 137 % 360} 65% 52%)`;
+}
+function writeGraphPicture(graph, communities, path2) {
+  const drawn = graph.copy();
+  circular.assign(drawn);
+  forceAtlas2.assign(drawn, { iterations: ITERATIONS, settings: forceAtlas2.inferSettings(drawn) });
+  const named = new Set(
+    drawn.nodes().sort((left, right) => drawn.degree(right) - drawn.degree(left) || left.localeCompare(right)).slice(0, LABELLED)
+  );
+  drawn.forEachNode((node) => {
+    drawn.setNodeAttribute(node, "size", 2 + Math.sqrt(drawn.degree(node)));
+    drawn.setNodeAttribute(node, "color", hueOf(communities[node] ?? 0));
+    drawn.setNodeAttribute(node, "label", named.has(node) ? node.split("/").pop() ?? node : BLANK);
+  });
+  return new Promise((resolve5) => {
+    renderSvg(drawn, path2, SIZE, () => resolve5());
+  });
+}
+
+// src/roles/static-analysis/graph/scan.ts
+import Graph from "graphology";
+import louvain from "graphology-communities-louvain";
+import { stronglyConnectedComponents } from "graphology-components";
+import { degreeCentrality } from "graphology-metrics/centrality/degree.js";
+import { density } from "graphology-metrics/graph/density.js";
+
+// src/roles/static-analysis/graph/imports.ts
+import { readFileSync as readFileSync15 } from "node:fs";
+import { dirname, join as join19 } from "node:path";
+import { parseSync as parseSync3 } from "oxc-parser";
+import { globSync as globSync3 } from "tinyglobby";
+var EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
+var TS_BEHIND_JS = {
+  ".js": [".ts", ".tsx"],
+  ".mjs": [".mts"],
+  ".cjs": [".cts"]
+};
+function specifiersOf(program) {
+  const found = [];
+  const walk3 = (node) => {
+    if (!node || typeof node !== "object") return;
+    if (Array.isArray(node)) {
+      for (const child of node) walk3(child);
+      return;
+    }
+    const current = node;
+    const source = current.source?.value;
+    switch (current.type) {
+      // `import x from './a'`, and the two re-export forms, which are imports that also publish.
+      case "ImportDeclaration":
+      case "ExportNamedDeclaration":
+      case "ExportAllDeclaration":
+        if (typeof source === "string") found.push(source);
+        break;
+      // `import('./a')`, the lazy route and the split bundle.
+      case "ImportExpression":
+        if (typeof source === "string") found.push(source);
+        break;
+      case "CallExpression": {
+        const argument = current.arguments?.[0]?.value;
+        if (current.callee?.name === "require" && typeof argument === "string") found.push(argument);
+        break;
+      }
+      default:
+        break;
+    }
+    for (const [field, value] of Object.entries(current)) {
+      if (field === "type" || field === "start" || field === "end") continue;
+      walk3(value);
+    }
+  };
+  walk3(program);
+  return found;
+}
+function resolveSpecifier(from, specifier, known) {
+  if (!specifier.startsWith(".")) return void 0;
+  const base = join19(dirname(from), specifier);
+  if (known.has(base)) return base;
+  for (const extension of EXTENSIONS) {
+    if (known.has(base + extension)) return base + extension;
+  }
+  const written = EXTENSIONS.find((extension) => base.endsWith(extension));
+  for (const extension of TS_BEHIND_JS[written ?? ""] ?? []) {
+    const swapped = base.slice(0, -(written ?? "").length) + extension;
+    if (known.has(swapped)) return swapped;
+  }
+  for (const extension of EXTENSIONS) {
+    const index = join19(base, `index${extension}`);
+    if (known.has(index)) return index;
+  }
+  return void 0;
+}
+function buildImportGraph(cwd, config) {
+  const extensions = extensionsOf(config.languages).map((extension) => extension.slice(1)).join(",");
+  const files = globSync3(
+    measuredRoots(cwd).map(
+      (root) => root === "." ? `**/*.{${extensions}}` : `${root}/**/*.{${extensions}}`
+    ),
+    {
+      cwd,
+      ignore: exclusions(config, "product"),
+      dot: false
+    }
+  );
+  const known = new Set(files);
+  const tree = {};
+  for (const file of files) {
+    tree[file] = [];
+    let parsed;
+    try {
+      parsed = parseSync3(file, readFileSync15(join19(cwd, file), "utf8"));
+    } catch {
+      continue;
+    }
+    if (parsed.errors.length > 0) continue;
+    for (const specifier of specifiersOf(parsed.program)) {
+      const target = resolveSpecifier(file, specifier, known);
+      if (target && target !== file && !tree[file].includes(target)) tree[file].push(target);
+    }
+  }
+  return tree;
+}
+
+// src/roles/static-analysis/graph/scan.ts
+var MOST_IMPORTED_LISTED = 10;
+function seeded() {
+  let state = 42;
+  return () => {
+    state = (state * 1664525 + 1013904223) % 4294967296;
+    return state / 4294967296;
+  };
+}
+function toGraph(tree) {
+  const graph = new Graph({ type: "directed", allowSelfLoops: false });
+  for (const file of Object.keys(tree)) if (!graph.hasNode(file)) graph.addNode(file);
+  for (const [from, targets2] of Object.entries(tree)) {
+    for (const to of targets2) {
+      if (!graph.hasNode(to)) graph.addNode(to);
+      if (from !== to && !graph.hasDirectedEdge(from, to)) graph.addDirectedEdge(from, to);
+    }
+  }
+  return graph;
+}
+function scanGraph(cwd, config) {
+  const graph = toGraph(buildImportGraph(cwd, config));
+  const cycles = stronglyConnectedComponents(graph).filter((component) => component.length > 1).map((files) => ({ files })).sort((left, right) => right.files.length - left.files.length);
+  const partition = graph.size > 0 ? louvain.detailed(graph, { resolution: config.graph.resolution, rng: seeded() }) : { count: graph.order, modularity: void 0, communities: {} };
+  const centrality = degreeCentrality(graph);
+  const mostImported = graph.nodes().map((path2) => {
+    const afferent = graph.inDegree(path2);
+    const efferent = graph.outDegree(path2);
+    return {
+      path: path2,
+      importedBy: afferent,
+      dependsOn: efferent,
+      // Both zero cannot reach here, the filter below drops them, but the guard stays: the
+      // formula is the only place in this pass that divides.
+      instability: afferent + efferent === 0 ? 1 : efferent / (afferent + efferent),
+      centrality: centrality[path2] ?? 0
+    };
+  }).filter((file) => file.importedBy > 0).sort(
+    (left, right) => right.importedBy - left.importedBy || left.path.localeCompare(right.path)
+  ).slice(0, MOST_IMPORTED_LISTED);
+  return {
+    files: graph.order,
+    edges: graph.size,
+    density: graph.order > 1 ? density(graph) : 0,
+    cycles,
+    filesInCycles: cycles.reduce((total, cycle) => total + cycle.files.length, 0),
+    communities: partition.count,
+    modularity: partition.modularity,
+    mostImported,
+    graph,
+    communityOf: partition.communities
+  };
+}
+
+// src/roles/static-analysis/maintainability/size-rules.ts
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join20 } from "node:path";
+var PUBLISHED_THRESHOLDS = {
+  complexity: 20,
+  "max-depth": 4,
+  "max-lines": 300,
+  "max-lines-per-function": 50,
+  "max-statements": 10,
+  "max-params": 3,
+  "max-nested-callbacks": 10,
+  "max-classes-per-file": 1
+};
+var CATEGORIES = [
+  "correctness",
+  "suspicious",
+  "pedantic",
+  "perf",
+  "style",
+  "restriction",
+  "nursery"
+];
+function sizeRulesConfig() {
+  return {
+    plugins: [],
+    categories: Object.fromEntries(CATEGORIES.map((category) => [category, "off"])),
+    // ⛔ `warn` and not `error`, for the reason `tool-config.ts` gives about jscpd's `threshold`:
+    // at `error` oxlint exits 1 as soon as one file breaches, which is indistinguishable from the
+    // binary failing to run. Measured on `libs/nest/auth`, same config otherwise: `error` exits 1,
+    // `warn` exits 0, and both report the same 18 diagnostics. So the tool measures, this role
+    // judges, and a non-zero exit means the tool failed.
+    rules: Object.fromEntries(
+      Object.entries(PUBLISHED_THRESHOLDS).map(([rule, threshold]) => [rule, ["warn", threshold]])
+    )
+  };
+}
+function sizeRulesRun(paths, ignore) {
+  const dir = mkdtempSync2(join20(tmpdir2(), "sentinel-size-"));
+  const configPath = join20(dir, "oxlintrc.json");
+  writeFileSync4(configPath, `${JSON.stringify(sizeRulesConfig(), null, 2)}
+`, "utf8");
+  return {
+    // `--format json` because the console shape is rendered by this role from the figures: a
+    // per-pass table from the tool would be a second voice saying the same numbers differently.
+    // The exclusions are the SAME list the duplication product pass is given, so "the module's
+    // code" means one thing across the whole report.
+    args: [
+      "-c",
+      configPath,
+      ...ignore.flatMap((pattern) => ["--ignore-pattern", pattern]),
+      "--format",
+      "json",
+      ...paths
+    ],
+    dispose: () => rmSync4(dir, { force: true, recursive: true })
+  };
+}
+function ruleOf(code) {
+  return /\(([^)]+)\)\s*$/.exec(code)?.[1];
+}
+function valueOf(message) {
+  return Number(/\((\d+)\)/.exec(message)?.[1] ?? 0);
+}
+function breachesOf(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { breaches: [], diagnostics: 0, files: 0 };
+  }
+  const diagnostics = parsed.diagnostics ?? [];
+  const worst = /* @__PURE__ */ new Map();
+  for (const diagnostic of diagnostics) {
+    const rule = ruleOf(diagnostic.code ?? "");
+    const file = diagnostic.filename;
+    if (!rule || !file || !(rule in PUBLISHED_THRESHOLDS)) continue;
+    const value = valueOf(diagnostic.message ?? "");
+    const line = diagnostic.labels?.[0]?.span?.line ?? 0;
+    const key = `${file}\0${rule}`;
+    const seen = worst.get(key);
+    if (!seen || value > seen.value) worst.set(key, { file, rule, value, line });
+  }
+  return {
+    breaches: [...worst.values()],
+    diagnostics: diagnostics.length,
+    files: parsed.number_of_files ?? 0
+  };
+}
+function scanSizeRules(cwd, roots, ignore, binary, spawn) {
+  if (!binary) return void 0;
+  const run = sizeRulesRun(roots, ignore);
+  try {
+    const result = spawn(binary, run.args, cwd);
+    if (result.status !== 0) return void 0;
+    return breachesOf(result.stdout);
+  } finally {
+    run.dispose();
+  }
+}
+
 // src/roles/static-analysis/help/metrics.ts
 var metricsHelp = {
   duplicatedLinesPercent: {
     label: "Duplicated lines",
-    what: "The share of lines jscpd found in at least one clone, over the lines it scanned.",
-    read: "Higher is worse. It is computed per module, so two modules compare directly; the repository-wide figure is not the average of theirs, because modules differ in size.",
-    caveat: "A clone is not automatically a defect. Two screens that genuinely do the same thing are supposed to look alike, and extracting them can couple two features that have no reason to change together. The usual reading is the Rule of Three: a second occurrence is tolerable, a third is the signal to refactor. This share cannot apply that rule for you, because it counts lines, not how many times one fragment occurs.",
+    what: "The share of lines jscpd found in at least one clone, over the lines of the files it was able to scan.",
+    read: "Higher is worse. It is computed per module, so two modules compare directly as long as they measured with the same settings, which is what the settings printed under the figures are for; the repository-wide figure is not the average of theirs, because modules differ in size.",
+    caveat: "A clone is not automatically a defect. Two screens that genuinely do the same thing are supposed to look alike, and extracting them can couple two features that have no reason to change together. The usual reading is the Rule of Three: a second occurrence is tolerable, a third is the signal to refactor. This share cannot apply that rule for you, because it counts lines, not how many times one fragment occurs. The denominator is also narrower than the module: a file shorter than the detection window cannot contain a clone, so the tool leaves it out of both counts, which on one front app is 31 files of 596, or 5%.",
     source: "jscpd, over the token stream rather than the text: for JavaScript and TypeScript the tokens come from the oxc parser, which emits neither whitespace nor comments, so reindenting a block is not a clone and `--mode` measured identical on all three values. Rule of Three: Fowler, Refactoring, crediting Don Roberts."
   },
+  complexityMax: {
+    label: "Complexity, worst function",
+    what: "McCabe's number for the single hardest function of the module's product code.",
+    read: "One number for the module, and the only one of the pair that names a place to go: the function itself is in the list below. Read it against the two published references, 10 and 30, rather than against another module, because a module of 200 functions and one of 2 000 are not comparable on a maximum.",
+    caveat: "It says nothing about how MANY functions are hard, which is what the count beside it is for, and nothing about whether the hardest one is wrong: a parser or a state machine legitimately branches. It is also not what the linter refuses. The `nest` lint preset already fails a build at 30 per function, and the five other presets carry no complexity rule at all, so this figure is the only visibility a React or a tooling module has today.",
+    source: "Computed over the oxc tree by this role, because no tool we have gives it per function: jscpd sums it per FILE, verified on fixtures where ten trivial functions score the same as one function of 10, and escomplex fails to parse 32.6% of one nest service. The counting rule is the common one, ESLint's set of decision points, held against values computed by hand in `tests/static-analysis-cyclomatic.test.ts`."
+  },
+  complexityModerate: {
+    label: "Complexity 11-20, moderate risk",
+    what: "How many functions sit in McCabe's second band, out of how many were measured.",
+    read: "The ordinary band to find something in. A function here is readable and worth a second look when it changes often, not a defect.",
+    caveat: 'A band is a statement about testing effort, not about correctness: McCabe proposed them as the number of independent paths a test suite would have to cover. A parser or a state machine legitimately sits here. \u26D4 Nothing in this role fails on a band, and the line this repository actually refuses is elsewhere: `complexity: ["error", 30]` per function in the `nest` lint preset, which sits inside the NEXT band, and the five other presets carry no complexity rule at all.',
+    source: "McCabe, \"A Complexity Measure\", IEEE TSE SE-2(4), 1976, for the count and for the bands, as published by SonarSource and summarised by Sourcegraph. The counting rule is this role's own, over the oxc tree, and it was held against oxlint's own `complexity` rule on this package, its threshold lowered to 1 so that it reports every function it can: 839 functions over 181 files, 839 identical values, not one disagreement. Compared per FILE as a multiset of values rather than by function name, because oxlint writes six shapes of message and matching on the name silently drops four of them. The 182nd file is `plugins/hublo.js`, which oxlint declines to lint because it is git-ignored, so its 8 functions are unverified rather than contested."
+  },
+  complexityHigh: {
+    label: "Complexity 21-50, high risk",
+    what: "How many functions sit in McCabe's third band.",
+    read: "The band worth acting on, and the one the `nest` lint preset cuts through at 30. A function here needs either a split or a very good reason, and the list below names each one with its line.",
+    caveat: "Same reserve as the band below: it measures paths, not defects. What makes this band different is that it brackets the only complexity line this repository enforces, so a function at 25 is high risk by the published scale and perfectly acceptable to the build, while one at 35 fails a nest build and passes everywhere else.",
+    source: "McCabe, \"A Complexity Measure\", IEEE TSE SE-2(4), 1976, for the count and for the bands, as published by SonarSource and summarised by Sourcegraph. The counting rule is this role's own, over the oxc tree, and it was held against oxlint's own `complexity` rule on this package, its threshold lowered to 1 so that it reports every function it can: 839 functions over 181 files, 839 identical values, not one disagreement. Compared per FILE as a multiset of values rather than by function name, because oxlint writes six shapes of message and matching on the name silently drops four of them. The 182nd file is `plugins/hublo.js`, which oxlint declines to lint because it is git-ignored, so its 8 functions are unverified rather than contested."
+  },
+  complexityUntestable: {
+    label: "Complexity over 50, untestable",
+    what: "How many functions sit in McCabe's top band, the one he called untestable.",
+    read: "Read it as a count of places no test suite can cover exhaustively, and expect it to be zero. Any value here is the first thing to look at in the module.",
+    caveat: "The word is McCabe's and it is about path coverage, not about whether the function works: a 60-path function can be correct and well tested in practice. What it does say is that nobody can enumerate its behaviour, which is what makes a change to it expensive.",
+    source: "McCabe, \"A Complexity Measure\", IEEE TSE SE-2(4), 1976, for the count and for the bands, as published by SonarSource and summarised by Sourcegraph. The counting rule is this role's own, over the oxc tree, and it was held against oxlint's own `complexity` rule on this package, its threshold lowered to 1 so that it reports every function it can: 839 functions over 181 files, 839 identical values, not one disagreement. Compared per FILE as a multiset of values rather than by function name, because oxlint writes six shapes of message and matching on the name silently drops four of them. The 182nd file is `plugins/hublo.js`, which oxlint declines to lint because it is git-ignored, so its 8 functions are unverified rather than contested."
+  },
+  entryPoints: {
+    label: "Entry points",
+    what: "How many files the reachability walk started from, against how many it scanned.",
+    read: "Read it FIRST, before the dead-code share below, because it says whether that share can mean anything. The further it is from the file count, the more the walk had to prove; when the two are equal, nothing could have been found unreachable.",
+    caveat: "\u26A0\uFE0F Two sources feed it, and they answer different questions. The module DECLARES what runs: a framework bootstrap, a lambda handler, the patterns this role ships. And the workspace says what other modules IMPORT from here, which is the only answer a library has, since its consumers live outside and nothing inside it runs. Measured on `libs/nest/auth`, 57 of 137: a handful declared, the rest imported from the 47 projects that depend on it. A count close to the file count is neither good nor bad, it means this pass had little to decide; a count of zero on a library used to mean the walk had nothing to start from, and the share below was then unreadable rather than clean.",
+    source: "jscpd's dead-code statistics, `entryPoints` against `files`. The seeds are the module's own manifest, about fifty framework conventions, the patterns this role declares, and the files another module imports, which come from the workspace index in `workspace/consumers.ts`. The report does not list WHICH files they are, only how many."
+  },
+  deadLinesPercent: {
+    label: "Unreachable lines",
+    what: "The share of scanned lines the reachability walk never reached from an entry point.",
+    read: "Higher is worse, and only once the entry-point count above says the question was decidable. Read it next to the four counts below rather than alone: one number covering files, exports, symbols and imports hides four different kinds of work.",
+    caveat: "Unreachable here means unreachable WITHIN this module, and that is a measured limitation rather than a theoretical one. A library is consumed from outside the scan, so its files look unreachable: on a sample of 12 files reported dead, 9 of `libs/front/components` and 7 of `libs/nest/auth` are cited elsewhere in the repository, one of them in 356 files. Test, fixture and story files are also outside the reachability graph, verified on a fixture, so a file reached only by a story is reported unreachable; it is true of the product and false of the repository, and `libs/front/components` has one such file of 915 lines.",
+    source: "jscpd's dead-code engine, `deadLines` over `totalLines`. The library figures were measured per module with the workspace's own path aliases, and the story case was isolated on a four-file fixture where the only importer was a `.stories.tsx`."
+  },
+  unusedFiles: {
+    label: "Unreachable files",
+    what: "Files no entry point reaches, each with a confidence the tool assigns.",
+    read: "The most actionable of the four, and the one to start from: a whole file nothing reaches is a decision, not a cleanup. Open the ones with the highest confidence first.",
+    caveat: "Three classes hide in this count and only one of them is a deletion, so read the reason the tool gives before acting: a file nothing reaches at all, a file only a spec or a story reaches, which is alive and breaks if removed, and an entry point of a framework this role has not declared. The tool labels the second itself as `used-only-by-tests`, and that is not a corner: measured over 1 231 findings on this repository, 659 of them carry it, 53.5%. A finding with no reason given is the one to open first.",
+    source: "jscpd dead-code findings of category `unused-file`, with the engine's own `reasons` and `message` carried through. The 53.5% was counted over every dead-code report produced on this repository; the third class was separated by hand on `apps/front/console`, where three of five findings were its TanStack bootstrap."
+  },
+  unusedExports: {
+    label: "Unused exports",
+    what: "Exported names nothing in this module imports.",
+    read: "Low on an application, where an export with no local consumer is usually a leftover. On a library it says almost nothing, for the reason the share above gives.",
+    caveat: "Exports of a file the tool treats as an entry point are NOT counted, deliberately: the tool's own words are that they are usually a public API. So this number is about internal exports, and a module whose every file is an entry point reports zero of them whatever its state.",
+    source: "jscpd dead-code findings of category `unused-export`."
+  },
+  unusedSymbols: {
+    label: "Unused symbols",
+    what: "Declared names, not exported, that nothing in their own file uses.",
+    read: "A local cleanup rather than a design signal, and usually a small count.",
+    caveat: "The tool scores every finding and names what lowered the score, a file calling `eval`, an unrecognised decorator, a name that appears inside a string literal. Measured on sentinel itself, a confidence floor of 60 yields 22 symbols, 90 yields none, so this count moves with that floor and is printed with it.",
+    source: "jscpd dead-code findings of category `unused-symbol`, above the confidence floor."
+  },
+  unusedImports: {
+    label: "Unused imports",
+    what: "Imported names the importing file never uses.",
+    read: "Mostly a lint concern, and it is here because for front applications the linter is not asking. Treat a high count as a lint gap rather than as dead code.",
+    caveat: "\u26A0\uFE0F 85% of these findings, measured over every module scanned on this pass, are `import React from 'react'`, which the modern JSX transform makes unnecessary and the classic one requires, so whether it is removable depends on the module's `jsx` setting and not on this count. Worse for acting on it line by line: `import React, { useState } from 'react'` is reported with the name `React`, and deleting the line takes `useState` with it. It overlaps `typescript/no-unused-vars`, which this repository's `nest`, `react-lib`, `svelte` and `tools` lint presets enable and its `react` preset turns off, which is the only reason the figure is not redundant for front applications.",
+    source: "jscpd dead-code findings of category `unused-import`; the 85% and the preset states were measured on this repository's lint presets and the day's scans."
+  },
+  duplicatedLinesPercentTests: {
+    label: "Duplicated lines (tests)",
+    what: "The same share, measured over this module's test files alone.",
+    read: "Read it DIFFERENTLY from the figure above rather than as a worse version of it. Repetition in a spec is often deliberate: a test that spells out its own setup can be read on its own, and factoring that setup into a helper is what makes a failing test hard to diagnose. The figure is here because its size is a fact about the specs, not because it is a debt to pay down.",
+    caveat: "It says nothing about whether the tests are good, and a high value is not automatically a problem: the two common causes are a deliberately explicit setup, which is a defensible style, and a suite copied file by file as the module grew, which is not, and this number cannot tell them apart. The split is also why it exists at all: measured across 8 modules of the three families, 71% of all duplicated lines are between two test files, so a single blended figure was mostly this one wearing the name of the module.",
+    source: "Same tool and same detection window as the figure above, over the files matching this role's test glob, which is printed under the figures. The 71% was measured on apps/front/console, host-admin, hr-management, libs/front/components, libs/front/shared, apps/nest/microservices/contract, apps/nest/microservices/agency and libs/nest/auth."
+  },
+  clonesTests: {
+    label: "Clones (tests)",
+    what: "How many duplicated fragments the test pass reported.",
+    read: "A count, with the same reserves as the product one above.",
+    caveat: "Everything the product clone count does not say applies here unchanged. One more thing is specific to the split: the two passes partition the files, so a fragment shared between a test and a product file has a partner in NEITHER pass and is counted in neither number. Measured on the same 8 modules, that is 42 entries of 5117, 0.8%, and 650 lines.",
+    source: "jscpd report statistics for the test pass. The partition and its loss were verified on apps/front/console: 478 product files plus 87 test files are the 565 of a blended scan, and 32 plus 40 are its 72 entries."
+  },
   clones: {
     label: "Clones",
     what: "How many duplicated fragments jscpd reported, each entry linking two places that match.",
     read: "A count, so it grows with the size of the module. Read it next to the duplicated-line share rather than on its own, and treat it as the number of places to go and look at.",
     caveat: "Not a count of duplicated places, and the gap is measured, not theoretical: five identical files produce four entries, all of them naming one file in common, so n copies give n-1 entries, neither n nor the n(n-1)/2 pairs. Worse for reading occurrences, jscpd keeps only the longest match per pair of files, so when a third file shares just part of a block, that block is reported under two different fragments and its real number of occurrences cannot be recovered from the report. Size is invisible too: one clone of sixty lines and one of six both count as one.",
     source: "jscpd report statistics. Counting behaviour measured on fixtures with jscpd 5.4.0; the shared file is not the same one across major versions, so only the count is relied on."
+  },
+  cycles: {
+    label: "Import cycles",
+    what: "Groups of files that import each other in a circle, directly or through other files.",
+    read: "Expect zero, and read any value as a count of places to go and break one edge. The figure beside it is how many FILES are caught, which is the size of the problem: one group of forty is a different afternoon from twenty groups of two.",
+    caveat: "A cycle is reported, not judged, and some are harmless in practice: a type-only import is erased at build time and two files that merely reference each other's types will never deadlock. What the measurement cannot tell you is which kind yours is, because it does not read the `type` keyword. It also reports GROUPS and not paths, so a group of six files may contain a dozen distinct circles; breaking one of them does not necessarily break the group, which is exactly why the group is the unit.",
+    source: "Tarjan's strongly connected components, via graphology-components. Held against madge's own `circular()` on five modules of the three families: the set of files caught was identical every time (2, 110, 11, 13 and 2), and only the count differed, because madge enumerates paths where this groups them."
+  },
+  importEdges: {
+    label: "Imports between files",
+    what: "How many times one of the module's own files imports another of them.",
+    read: "Read it against the file count beside it rather than on its own: roughly two to three edges per file is what the modules measured here sit at. It is the size of the graph every other figure on this block is computed over.",
+    caveat: "Module-local on purpose, so it says nothing about what the module pulls from the rest of the workspace: a front app importing three hundred components from `libs/` shows none of that here. Tests are outside the graph too, specs and the support beside them, so a file every spec imports does not look busy because of them: measured on `apps/front/host-admin`, 113 helpers in a `testing/` or `test/` directory or named `*.msw.ts` were counted as product code until the role's glob learnt those conventions, and each was showing up as a community of its own. Generated code is out as well: on `apps/front/console`, excluding `routeTree.gen.ts` removes 20 edges and the module's only cycle, which is TanStack's own and which nobody can fix by hand.",
+    source: "Built from the oxc parse of every file the role scans, resolving relative specifiers only. The resolution was held against madge, which follows the workspace path aliases, over five modules with the same exclusions on both sides: 16 052 edges, no code edge missed and none invented, the 28 differences all imports of files outside the scanned languages."
+  },
+  graphDensity: {
+    label: "Density",
+    what: "The share of all the edges that could exist between these files that actually do.",
+    read: "Between 0 and 1, and near 0 in real code. It is a shape, not a score: it tells you whether the module is a web or a tree.",
+    caveat: "\u26D4 Do NOT compare it between modules of different sizes, and the reason is arithmetic rather than opinion: the denominator grows with the SQUARE of the file count, so a module gets a lower density by growing, not by improving. Measured here: `libs/nest/auth` 0.0216 at 101 files and `apps/front/host-admin` 0.0005 at 4 380, which says almost nothing about either. What it is good for is one module watched over time at a stable size.",
+    source: "graphology-metrics, graph density, the standard definition for a directed graph."
+  },
+  communities: {
+    label: "Communities",
+    what: "How many clusters of files the partition found, where a cluster is a set of files much more connected to each other than to the rest.",
+    read: "Read it against the module's own directories, which is the grouping the team wrote by hand. Expect it to be HIGHER: the partition refines the folders rather than reproducing them, measured at 24 communities for 16 domains on a nest service and 208 for 20 modules on the largest front app. Held against the directories over five modules, each community sits inside one directory 58% to 85% of the time, and each directory splits across several communities, so the agreement is a refinement and not a match.",
+    caveat: "The count depends on a setting, `graph.resolution`, which the report prints: changing it changes the answer, and graphology warns in its own documentation that it is finicky to tweak. The role ships the published value of 1 rather than one chosen to make the partition look right. The algorithm is also greedy, so this is one good partition, not the best one. \u26A0\uFE0F And a community holding two directories is NOT a statement that they depend on each other: a file both of them import pulls them together on its own. Measured on `apps/nest/microservices/recruitment`, one community holds 79 files of `candidate-management` and 64 of `application-management` with 4 edges between the two halves, because 12 shared enums sit between them, one of which is imported 58 times. \u26A0\uFE0F A community of ONE file means the module's own code neither imports it nor is imported by it, which is a strong signal and not a verdict. Measured on `apps/front/host-admin`: 53 such files, of which 37 have no reference anywhere and are dead, 10 are routes the framework loads by convention, and 5 are test helpers whose naming this role does not recognise. \u26D4 Read it WITH the dead-code figures rather than against them: this pass sees a file as a node, so it can only say that nothing reaches it, while the dead-code pass looks inside the files and reports an unused export or an unused symbol in a file that is otherwise very much alive. Two scales, not two answers to one question.",
+    source: "Louvain, via graphology-communities-louvain, with the role's own random seed so the figure reproduces. Blondel, Guillaume, Lambiotte and Lefebvre, 2008."
+  },
+  modularity: {
+    label: "Modularity (Q)",
+    what: "The quality of the ASSIGNMENT of files to communities: how much more densely connected the files inside a community are than the same files would be in a random network. Both halves of the words a team already uses are in that sentence, which is why the figure is worth having: dense inside is cohesion, the degree to which the elements of a part belong together, and sparse between is what makes a part independent enough to be given an interface.",
+    read: "Between -1 and 1. It judges the partition, not the code, and that is what makes it architectural: Louvain already maximised it, so a low value does not mean a poor partition was picked, it means no good one exists and the module does not decompose along its imports. A high value says the opposite, that a modular model is there to be read, and the drawing is where to read it. The five modules measured here sit between 0.58 and 0.84.",
+    caveat: "\u26A0\uFE0F Do not read the fourth decimal. Louvain is greedy, so Q is the value of ONE local optimum: measured over 20 runs with the library's own randomness, `console` produced 16 different values and `recruitment` spanned 0.0357. The role pins its seed, which makes the figure reproducible but not exact, so a change smaller than a hundredth between two runs of two different versions means nothing. A high Q also does not mean the clusters are the right ones: it says they are separable, not that they match any boundary a team cares about. Read as cohesion it is a practical one: files that interact are a population that lives together, the way Louvain was meant to divide a social network, so it catches technical and functional coupling alike. What it will not give you is a place to go, because it is one average over the whole module. The communities themselves are, and the drawing is there for that.",
+    source: "Newman-Girvan modularity, via graphology-metrics, which states in its own source that it stays true to Newman's original definition. Q is the measure; Louvain is the algorithm that maximises it. The wording of what it quantifies, the quality of an assignment of nodes to communities, is Neo4j's graph data science documentation."
+  },
+  mostImported: {
+    label: "Most imported files",
+    what: "The files the rest of the module leans on, with the three coupling figures for each: how many files import it (`Ca`), how many it imports (`Ce`), and Martin's instability `I = Ce / (Ca + Ce)`.",
+    read: "Context, not a defect list: every module has a most-imported file and a type definition used everywhere is doing its job. Read the three together, because that is what Martin made them for: a file many others depend on should itself depend on little, so a high `Ca` next to an `I` near 1 is the row to open. A change there reaches every dependent, and it is itself exposed to everything it pulls. Measured across five modules of the three families, this repository mostly satisfies that rule already: of the 50 most-imported files, 46 sit at `I` of 0.06 or less, and the two highest are 0.23 and 0.29.",
+    caveat: "\u26D4 Martin defined `Ca`, `Ce` and `I` for a COMPONENT, something released and versioned as a unit, not for a file. Reading them per file is a transposition, the same one `code-health-meter` makes, and what it costs is that a file is not independently releasable: splitting one in two changes every figure without changing anything about the design. The module's OWN instability is not here either, and cannot be: this graph stops at the module's edge on purpose, so the imports that would give the module its `Ce` are outside it. \u26A0\uFE0F And if you compare the counts with another tool, note the unit. `Ca` here is raw. graphology's degree centrality, in the last column, is NORMALISED by the file count, and the two disagree in direction: `libs/nest/auth`'s busiest file is imported 18 times and scores 0.18, `apps/front/host-admin`'s is imported 122 times and scores 0.028. There is no threshold on any of the four and the role proposes none. \u26A0\uFE0F The list is ranked by `Ca` alone, so in principle a file with a middling `Ca` and an `I` near 1, which is the shape Martin warns about, could sit below the cut. Measured on 6 214 imported files across five modules: not one has `Ca` of 10 or more together with `I` of 0.5 or more, so the ranking hides nothing today. That is a fact about this repository on the day it was measured, not a property of the ranking.",
+    source: 'In- and out-degree of the module import graph, with graphology\'s degree centrality beside them. `Ca`, `Ce` and `I`: Robert C. Martin, "OO Design Quality Metrics", 1994. \u26D4 `A` and `D` from the same paper are deliberately absent: abstractness measured 0.013 on the front and 0.010 on nest, so `D = |A + I - 1|` collapses to `|I - 1|`, which is instability said twice.'
+  },
+  complexity: {
+    label: "Files with a complex function",
+    what: "Files holding at least one function whose cyclomatic complexity passes 20.",
+    read: "Count of files, so it is comparable between modules only against their file count, which the unit carries. It is the same measure as the band rows above, seen per file rather than per function. A file is counted once per indicator, however many times the rule fires inside it. Measured on `libs/nest/auth`, counting diagnostics instead would have inflated the total by 1.8x, and by 2.8x at lower thresholds, because `max-nested-callbacks` reports once per level.",
+    caveat: "It does not say which function, nor whether branching is wrong there: a parser legitimately branches. \u26D4 This is a GAUGE and not the line your lint refuses at. It runs oxlint with its own config in a temporary directory, at the threshold the rule publishes, and never reads the module's `.oxlintrc.json`. So it answers the same question the same way in every module, including the 146 of 198 that have not adopted lint, and it WILL disagree with a green build: the `nest` preset refuses `complexity` at 30 while this reports above 20.",
+    source: "oxlint complexity, at ESLint's published default of 20. The exclusions are the same list the duplication product pass is given, passed as `--ignore-pattern`: the `ignorePatterns` key in oxlint's config is accepted and silently ignored, which had this gauge measuring the test suite until the file counts were compared, 137 against 111 on `libs/nest/auth`."
+  },
+  "max-depth": {
+    label: "Files with deep nesting",
+    what: "Files holding a block nested more than four levels deep.",
+    read: "The rarest of the indicators, 0.6 firings per 100 files across the repository, so one occurrence is worth opening rather than filtering. A file is counted once per indicator, however many times the rule fires inside it. Measured on `libs/nest/auth`, counting diagnostics instead would have inflated the total by 1.8x, and by 2.8x at lower thresholds, because `max-nested-callbacks` reports once per level.",
+    caveat: "Depth is not complexity: four flat `if`s in a row never trip it, and one `if` inside three loops does.",
+    source: "oxlint max-depth, at ESLint's published default of 4. The exclusions are the same list the duplication product pass is given, passed as `--ignore-pattern`: the `ignorePatterns` key in oxlint's config is accepted and silently ignored, which had this gauge measuring the test suite until the file counts were compared, 137 against 111 on `libs/nest/auth`."
+  },
+  "max-lines": {
+    label: "Files over 300 lines",
+    what: "Files longer than 300 lines, blank lines and comments included.",
+    read: "A size signal and nothing else. Read it beside the duplication figure: a long file that duplicates nothing is a different problem from a long file that repeats itself. A file is counted once per indicator, however many times the rule fires inside it. Measured on `libs/nest/auth`, counting diagnostics instead would have inflated the total by 1.8x, and by 2.8x at lower thresholds, because `max-nested-callbacks` reports once per level.",
+    caveat: "Length is not a defect. A generated file, a long constant table or a barrel is long by nature, which is why this is reported and never failed on.",
+    source: "oxlint max-lines, at ESLint's published default of 300. The exclusions are the same list the duplication product pass is given, passed as `--ignore-pattern`: the `ignorePatterns` key in oxlint's config is accepted and silently ignored, which had this gauge measuring the test suite until the file counts were compared, 137 against 111 on `libs/nest/auth`."
+  },
+  "max-lines-per-function": {
+    label: "Files with a long function",
+    what: "Files holding at least one function longer than 50 lines.",
+    read: "\u26A0\uFE0F A DESCRIPTOR, not part of the maintainability figure. It fires on 46.9 files per 100 across the repository, so it would fire on nearly every pull request. A file is counted once per indicator, however many times the rule fires inside it. Measured on `libs/nest/auth`, counting diagnostics instead would have inflated the total by 1.8x, and by 2.8x at lower thresholds, because `max-nested-callbacks` reports once per level.",
+    caveat: "What is excluded from the figure is the SCORE, not the reading: the count stays here precisely because it is frequent, and a module far from 46.9 is saying something.",
+    source: "oxlint max-lines-per-function, at ESLint's published default of 50. The exclusions are the same list the duplication product pass is given, passed as `--ignore-pattern`: the `ignorePatterns` key in oxlint's config is accepted and silently ignored, which had this gauge measuring the test suite until the file counts were compared, 137 against 111 on `libs/nest/auth`."
+  },
+  "max-statements": {
+    label: "Files with a long function body",
+    what: "Files holding at least one function of more than ten statements.",
+    read: "\u26A0\uFE0F A DESCRIPTOR, not part of the maintainability figure, for the same reason as the row above: 42.9 firings per 100 files. A file is counted once per indicator, however many times the rule fires inside it. Measured on `libs/nest/auth`, counting diagnostics instead would have inflated the total by 1.8x, and by 2.8x at lower thresholds, because `max-nested-callbacks` reports once per level.",
+    caveat: "It counts statements and not work: ten calls in a row trip it where one dense expression does not.",
+    source: "oxlint max-statements, at ESLint's published default of 10. The exclusions are the same list the duplication product pass is given, passed as `--ignore-pattern`: the `ignorePatterns` key in oxlint's config is accepted and silently ignored, which had this gauge measuring the test suite until the file counts were compared, 137 against 111 on `libs/nest/auth`."
+  },
+  "max-params": {
+    label: "Files with a wide signature",
+    what: "Files holding at least one function taking more than three parameters.",
+    read: "The most frequent of the scored indicators, 9.6 per 100 files. A wide signature is usually an object waiting to be named. A file is counted once per indicator, however many times the rule fires inside it. Measured on `libs/nest/auth`, counting diagnostics instead would have inflated the total by 1.8x, and by 2.8x at lower thresholds, because `max-nested-callbacks` reports once per level.",
+    caveat: "A destructured object parameter counts as one, so the figure does not see a function taking fifteen fields in one bag.",
+    source: "oxlint max-params, at ESLint's published default of 3. The exclusions are the same list the duplication product pass is given, passed as `--ignore-pattern`: the `ignorePatterns` key in oxlint's config is accepted and silently ignored, which had this gauge measuring the test suite until the file counts were compared, 137 against 111 on `libs/nest/auth`."
+  },
+  "max-nested-callbacks": {
+    label: "Files with nested callbacks",
+    what: "Files holding callbacks nested more than ten deep.",
+    read: "Zero everywhere measured so far. Kept because a non-zero value is then unambiguous. A file is counted once per indicator, however many times the rule fires inside it. Measured on `libs/nest/auth`, counting diagnostics instead would have inflated the total by 1.8x, and by 2.8x at lower thresholds, because `max-nested-callbacks` reports once per level.",
+    caveat: "It counts callbacks and not promise chains or awaits, so modern asynchronous code can be deeply sequential without ever tripping it.",
+    source: "oxlint max-nested-callbacks, at ESLint's published default of 10. The exclusions are the same list the duplication product pass is given, passed as `--ignore-pattern`: the `ignorePatterns` key in oxlint's config is accepted and silently ignored, which had this gauge measuring the test suite until the file counts were compared, 137 against 111 on `libs/nest/auth`."
+  },
+  "max-classes-per-file": {
+    label: "Files with several classes",
+    what: "Files declaring more than one class.",
+    read: "1.8 per 100 files. On a nest service it usually means a DTO file, which is a convention rather than a defect. A file is counted once per indicator, however many times the rule fires inside it. Measured on `libs/nest/auth`, counting diagnostics instead would have inflated the total by 1.8x, and by 2.8x at lower thresholds, because `max-nested-callbacks` reports once per level.",
+    caveat: "It says nothing about the size of the classes, and a file with one 800-line class never appears here.",
+    source: "oxlint max-classes-per-file, at ESLint's published default of 1. The exclusions are the same list the duplication product pass is given, passed as `--ignore-pattern`: the `ignorePatterns` key in oxlint's config is accepted and silently ignored, which had this gauge measuring the test suite until the file counts were compared, 137 against 111 on `libs/nest/auth`."
+  },
+  usedOnlyByTests: {
+    label: "Used only by tests",
+    what: "Files of this module that no production code imports, but another module's test files do.",
+    read: "A third state between alive and dead, and the only one of the three that names a design question rather than a defect: a production module shipping something only the suites consume. Zero is the ordinary value.",
+    caveat: "It says nothing about whether that is wrong. A test factory deliberately published by a library belongs here and is doing its job. What it refuses to do is call those files dead, which is what a walk that ignores tests does: measured on `libs/nest/auth`, 11 live files are imported only from a test, `auth.module.ts` among them, and 47 projects depend on that module. \u26A0\uFE0F It sees FILES, so an export used only by specs inside a file that production also imports is invisible here.",
+    source: "The workspace index in `workspace/consumers.ts`: one scan of the tracked files, specifiers resolved against the tsconfig aliases, an importer classified as a test by the same conventions the duplication pass uses. Measured on this repository: 278 such files in all, 39 of them in `libs/front/components`."
   }
 };
 function helpFor(key) {
@@ -4806,175 +5591,619 @@ function helpFor(key) {
 }
 
 // src/roles/static-analysis/report.ts
-function hasFinding(report) {
-  return report.rows.some((row) => row.over);
+function secondSide(finding) {
+  if (!finding.other) return "";
+  const file = (at) => at.split(":")[0] ?? at;
+  const sameFile = file(finding.other) === file(finding.path);
+  const label = sameFile ? "and line" : "and";
+  const shownSide = sameFile ? finding.other.split(":")[1] ?? finding.other : finding.other;
+  return ` <span class="unit">${label}</span> <code>${escape(shownSide)}</code>`;
+}
+var HTML_GROUP_LIMIT = 50;
+function figure(row) {
+  return row.unit === "%" && typeof row.value === "number" ? row.value.toFixed(2) : String(row.value);
+}
+function caveatsOf(report) {
+  const keys = [...report.rows.map((row) => row.metric), ...report.findings.map((f) => f.metric)];
+  const seen = /* @__PURE__ */ new Set();
+  const found = [];
+  for (const key of keys) {
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const help = helpFor(key);
+    if (help) found.push(help);
+  }
+  return found;
 }
 function renderConsole(report) {
   const lines = [];
   const width = (pick) => Math.max(...report.rows.map((row) => pick(row).length));
   const label = (row) => helpFor(row.metric)?.label ?? row.metric;
-  const value = (row) => `${row.value} ${row.unit}`;
-  const limit = (row) => row.threshold === null ? "no threshold" : `max ${row.threshold}${row.moved ? " (module)" : ""}`;
+  const value = (row) => `${figure(row)} ${row.unit}`.trim();
   const labelWidth = width(label);
   const valueWidth = width(value);
   lines.push(`sentinel static-analysis: ${report.module}`);
   for (const row of report.rows) {
-    lines.push(
-      `  ${row.over ? "!" : " "} ${label(row).padEnd(labelWidth)}  ${value(row).padStart(valueWidth)}  ${limit(row)}`
-    );
+    lines.push(`    ${label(row).padEnd(labelWidth)}  ${value(row).padStart(valueWidth)}`);
+  }
+  for (const note of report.notes) lines.push(`    (${note})`);
+  if (report.settings.length > 0) {
+    const keyWidth = Math.max(...report.settings.map((setting) => setting.key.length));
+    lines.push("", "  measured with");
+    for (const setting of report.settings) {
+      lines.push(
+        `    ${setting.key.padEnd(keyWidth)}  ${setting.value}${setting.moved ? "  (module)" : ""}`
+      );
+    }
+    if (report.settings.some((setting) => setting.moved)) {
+      lines.push(`    (module) = overridden in ${report.module}'s static-analysis.config.mjs`);
+    }
   }
   if (report.byLanguage && Object.keys(report.byLanguage).length > 0) {
-    lines.push("", "  per language, where a clone was found");
+    lines.push("", "  per language, where a clone was found in the product code");
     for (const [language, stats] of Object.entries(report.byLanguage)) {
       lines.push(
         `    ${language.padEnd(12)} ${stats.percentage.toFixed(2)}% (${stats.duplicatedLines} lines over ${stats.files} files)`
       );
     }
-    lines.push("    a language with no clone is not listed");
+    lines.push("    a language is absent when no file of it was long enough to scan");
   }
-  const caveats = report.rows.map((row) => ({ row, help: helpFor(row.metric) })).filter(
-    (entry) => Boolean(entry.help)
-  );
+  if (report.findings.length > 0) {
+    lines.push(
+      "",
+      `  ${report.findings.length} place(s) to look, listed by \`${SCRIPTS.json}\` and \`${SCRIPTS.html}\``
+    );
+  }
+  const caveats = caveatsOf(report);
   if (caveats.length > 0) {
     lines.push("", "  what these numbers do not say");
-    for (const { row, help } of caveats) {
+    for (const help of caveats) {
       lines.push(`    ${help.label}: ${help.caveat}`, `      source: ${help.source}`);
-      void row;
     }
   }
   return `${lines.join("\n")}
 `;
 }
 function renderJson(report) {
-  const rows = report.rows.map((row) => ({ ...row, help: helpFor(row.metric) ?? null }));
+  const rows = report.rows.map((row) => {
+    const help = helpFor(row.metric);
+    return { ...row, help: help ? { label: help.label, caveat: help.caveat } : null };
+  });
   return `${JSON.stringify({ ...report, rows }, null, 2)}
 `;
 }
+function prose(text) {
+  return escape(text).replace(/`([^`]+)`/g, "<code>$1</code>");
+}
 function escape(text) {
   return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 }
 function renderHtml(report) {
   const rows = report.rows.map((row) => {
     const help = helpFor(row.metric);
-    return `      <tr class="${row.over ? "over" : ""}">
+    return `      <tr>
         <th scope="row">${escape(help?.label ?? row.metric)}</th>
-        <td class="num">${escape(String(row.value))} <span class="unit">${escape(row.unit)}</span></td>
-        <td class="num">${row.threshold === null ? '<span class="unit">none</span>' : escape(String(row.threshold))}${row.moved ? ' <span class="moved">module</span>' : ""}</td>
-        <td class="caveat">${escape(help?.caveat ?? "")}</td>
+        <td class="num">${escape(figure(row))} <span class="unit">${escape(row.unit)}</span></td>
       </tr>`;
   }).join("\n");
+  const reserves = caveatsOf(report).map(
+    (help) => `    <details>
+      <summary>${escape(help.label)}<span class="what">${prose(help.what)}</span></summary>
+      <p class="read"><b>How to read it.</b> ${prose(help.read)}</p>
+      <p><b>What it does not say.</b> ${prose(help.caveat)}</p>
+      <p class="source">Source: ${prose(help.source)}</p>
+    </details>`
+  ).join("\n");
+  const settings = report.settings.map(
+    (setting) => `      <tr>
+        <th scope="row"><code>${escape(setting.key)}</code></th>
+        <td class="num">${escape(setting.value)}</td>
+        <td>${setting.moved ? '<span class="moved">overridden here</span>' : ""}</td>
+      </tr>`
+  ).join("\n");
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding of report.findings) {
+    const bucket = groups.get(finding.metric) ?? [];
+    bucket.push(finding);
+    groups.set(finding.metric, bucket);
+  }
+  const columnsFor = (metric, all2) => {
+    const has = (pick) => all2.some((f) => pick(f) !== void 0);
+    const isComplexity = metric.startsWith("complexity");
+    return [
+      { header: "File", cell: (f) => `<code>${escape(f.path)}</code>${secondSide(f)}` },
+      ...has((f) => f.name) ? [
+        {
+          header: isComplexity ? "Function" : "Name",
+          cell: (f) => f.name ? `<code>${escape(f.name)}</code>` : ""
+        }
+      ] : [],
+      ...has((f) => f.value) ? [
+        {
+          // Martin's own names, because a reader holding this against another tool needs the
+          // word, and `Ca` alone would be unreadable to one who does not.
+          header: isComplexity ? "Complexity" : has((f) => f.dependsOn) ? "Imported by (Ca)" : "Value",
+          cell: (f) => `<span class="num">${f.value ?? ""}</span>`
+        }
+      ] : [],
+      ...has((f) => f.dependsOn) ? [
+        {
+          header: "Depends on (Ce)",
+          cell: (f) => `<span class="num">${f.dependsOn ?? ""}</span>`
+        },
+        {
+          header: "Instability (I)",
+          cell: (f) => `<span class="num">${f.instability === void 0 ? "" : f.instability.toFixed(2)}</span>`
+        },
+        {
+          header: "Centrality",
+          cell: (f) => `<span class="num">${f.centrality === void 0 ? "" : f.centrality.toFixed(4)}</span>`
+        }
+      ] : [],
+      // "Length" and not "Lines": the number is how many lines the finding COVERS, and the cell
+      // beside it already carries line numbers.
+      ...has((f) => f.lines) ? [{ header: "Length", cell: (f) => `<span class="num">${f.lines ?? ""}</span>` }] : [],
+      ...has((f) => f.confidence) ? [
+        {
+          header: "Confidence",
+          cell: (f) => `<span class="num">${f.confidence ?? ""}</span>`
+        }
+      ] : [],
+      ...has((f) => f.reason) ? [
+        {
+          header: "Why the tool is unsure",
+          cell: (f) => f.reason ? `<span class="reason">${escape(f.reason)}</span>` : ""
+        }
+      ] : []
+    ];
+  };
+  const findings = [...groups.entries()].map(([metric, all2]) => {
+    const label = helpFor(metric)?.label ?? metric;
+    const weight = (finding) => finding.value ?? finding.lines ?? 0;
+    const sorted = [...all2].sort((left, right) => weight(right) - weight(left));
+    const listed = sorted.slice(0, HTML_GROUP_LIMIT);
+    const rest = sorted.length - listed.length;
+    const columns = columnsFor(metric, all2);
+    const head = columns.map((column) => `<th scope="col">${column.header}</th>`).join("");
+    const rows2 = listed.map((finding) => {
+      const cells = columns.map((column) => `        <td>${column.cell(finding)}</td>`).join("\n");
+      const code = finding.excerpt ? `
+      <tr class="excerpt">
+        <td colspan="${columns.length}">
+          <details>
+            <summary>${finding.lines ?? ""} duplicated lines</summary>
+            <pre><code>${escape(finding.excerpt)}</code></pre>
+          </details>
+        </td>
+      </tr>` : "";
+      return `      <tr>
+${cells}
+      </tr>${code}`;
+    }).join("\n");
+    return `
+  <h2>${escape(label)} &middot; where to look</h2>
+  <section>
+    <table class="places">
+      <thead>
+        <tr>${head}</tr>
+      </thead>
+      <tbody>
+${rows2}
+      </tbody>
+    </table>
+${rest > 0 ? `    <p class="sub">The ${HTML_GROUP_LIMIT} longest are listed; ${rest} more are in <code>${SCRIPTS.json}</code>.</p>` : ""}
+  </section>`;
+  }).join("\n");
   return `<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
 <title>Static analysis: ${escape(report.module)}</title>
 <style>
-  :root { color-scheme: light dark; --ink: #1a1a1a; --bg: #fdfdfc; --rule: #e2e0da; --warn: #9a3412; --dim: #6b6b6b; }
-  @media (prefers-color-scheme: dark) {
-    :root { --ink: #e8e6e1; --bg: #1b1b1a; --rule: #35332e; --warn: #fb923c; --dim: #9b9892; }
-  }
-  body { margin: 0; padding: 2rem 1rem; background: var(--bg); color: var(--ink);
-         font: 15px/1.55 ui-sans-serif, system-ui, sans-serif; }
-  main { max-width: 60rem; margin: 0 auto; }
-  h1 { font-size: 1.25rem; margin: 0 0 0.25rem; }
-  p.sub { color: var(--dim); margin: 0 0 1.5rem; }
+  /*
+   * The Hublo palette, token by token, read from "libs/front/theme/src/branding/definitions/hublo"
+   * rather than approximated: "commonColors.ts" holds the values and "colorTokens.ts" the semantic
+   * names used in the comments below.
+   *
+   * \u26D4 One theme, and that is a decision rather than an omission: the charter has no dark palette,
+   * zero occurrences of "prefers-color-scheme" in the whole theme package, so a dark variant here
+   * would be charter this page invented. Every colour is painted explicitly instead, so the page
+   * holds on whatever ground opens it.
+   */
+  :root {
+    color-scheme: light;
+    --page: #f5f8fd;      /* neutral5,  background.page-header */
+    --surface: #ffffff;   /* neutral0,  background.surface */
+    --ink: #131415;       /* neutral35, text.primary */
+    --ink-soft: #5e6972;  /* neutral30, text.secondary */
+    --label: #72808e;     /* neutral25, text.label-default */
+    --rule: #ced7e0;      /* neutral15, border.page-header */
+    --brand: #3a4392;     /* blue15,    text.brand */
+    --brand-bg: #e5ecff;  /* blue0,     background.brand */
+    --moved: #c83c3c;     /* red15,     text.destructive */
+  }
+  /*
+   * The brand faces first, then Inter, then the system. They are loaded at runtime from a branding
+   * artefact in the applications, so they cannot be embedded here without an external request, and
+   * an external request is the one thing this page must not make. A viewer who has them sees them.
+   */
+  body {
+    margin: 0;
+    padding: 2.5rem 1rem 4rem;
+    background: var(--page);
+    color: var(--ink);
+    font: 15px/1.6 'Brand Sans', Inter, ui-sans-serif, system-ui, sans-serif;
+  }
+  main { max-width: 64rem; margin: 0 auto; }
+  header { border-left: 3px solid var(--brand); padding-left: 0.9rem; margin-bottom: 2rem; }
+  h1 { font-size: 1.3rem; font-weight: 600; margin: 0 0 0.2rem; letter-spacing: -0.01em; }
+  h2 {
+    font-size: 0.74rem; text-transform: uppercase; letter-spacing: 0.08em;
+    color: var(--label); margin: 2.5rem 0 0.6rem; font-weight: 600;
+  }
+  p.sub { color: var(--ink-soft); margin: 0; font-size: 0.9rem; }
+  section {
+    background: var(--surface); border: 1px solid var(--rule); border-radius: 10px;
+    padding: 0.25rem 1.1rem; overflow-x: auto;
+  }
   table { width: 100%; border-collapse: collapse; }
-  th, td { text-align: left; padding: 0.6rem 0.75rem; border-bottom: 1px solid var(--rule);
-           vertical-align: top; }
-  thead th { font-size: 0.78rem; text-transform: uppercase; letter-spacing: 0.06em; color: var(--dim); }
-  td.num { font-variant-numeric: tabular-nums; white-space: nowrap; }
-  .unit, .moved { color: var(--dim); font-size: 0.85em; }
-  .caveat { color: var(--dim); font-size: 0.9em; }
-  tr.over th, tr.over td.num { color: var(--warn); font-weight: 600; }
+  th, td { text-align: left; padding: 0.7rem 0.6rem; border-bottom: 1px solid var(--rule); vertical-align: top; }
+  tr:last-child th, tr:last-child td { border-bottom: 0; }
+  thead th { font-size: 0.72rem; text-transform: uppercase; letter-spacing: 0.07em; color: var(--label); font-weight: 600; }
+  tbody th { font-weight: 500; white-space: nowrap; }
+  td.num { font-variant-numeric: tabular-nums; white-space: nowrap; font-weight: 500; }
+  /*
+   * Which column absorbs the slack, per table. One global rule on the shared class got this
+   * wrong in all three at once: the figures read well and the settings table clipped its origin
+   * column while the findings table crushed its file paths into three lines.
+   */
+  table.figures td.num { width: 100%; }
+  /*
+   * The settings table does NOT force its value column wide. One of its values is the test glob,
+   * long enough to push the table past the card, and the origin column then slid out of view and
+   * was clipped: "overridden in this mo". Long values wrap instead, and the origin stays readable.
+   */
+  table.settings td.num { white-space: normal; overflow-wrap: anywhere; }
+  table.settings td:last-child { text-align: right; white-space: nowrap; }
+  table.places td:first-child { width: 100%; }
+  table.places td { white-space: nowrap; }
+  table.places td:first-child { white-space: normal; }
+  .num { font-variant-numeric: tabular-nums; }
+  td.read { color: var(--ink-soft); font-size: 0.88rem; }
+  tbody th { color: var(--ink); }
+  code { font: 0.86em ui-monospace, SFMono-Regular, Menlo, monospace; color: var(--ink-soft); }
+  .unit { color: var(--label); font-size: 0.82em; font-weight: 400; }
+  .reason {
+    font: 0.74rem ui-monospace, SFMono-Regular, Menlo, monospace;
+    background: var(--brand-bg); color: var(--brand);
+    padding: 0.1rem 0.4rem; border-radius: 4px; white-space: nowrap;
+  }
+  .moved {
+    color: var(--moved); font-size: 0.78rem; font-weight: 500;
+    white-space: nowrap;
+  }
+  /* The graph. The svg carries a viewBox, so dropping its fixed width lets it fill the column. */
+  .picture svg { width: 100%; height: auto; display: block; }
+  .picture p.read { margin: 0 0 0.8rem; padding: 0 0.6rem; color: var(--ink-soft); font-size: 0.88rem; max-width: 52rem; }
+
+  /* The collapsed reserves. Closed by default: the figures are what the page opens on. */
+  details { border-bottom: 1px solid var(--rule); }
+  details:last-of-type { border-bottom: 0; }
+  summary {
+    cursor: pointer; padding: 0.7rem 0.6rem; font-size: 0.9rem; font-weight: 500;
+    display: flex; flex-wrap: wrap; gap: 0.5rem; align-items: baseline;
+  }
+  /*
+   * The chevron is drawn, not inherited: "display: flex" on a summary removes the native marker,
+   * and a collapsed block with no affordance is a block nobody opens.
+   */
+  summary { list-style: none; }
+  summary::-webkit-details-marker { display: none; }
+  summary::before {
+    content: ''; flex: none; width: 0.38rem; height: 0.38rem; margin: 0.3rem 0.1rem 0 0;
+    border-right: 1.5px solid var(--label); border-bottom: 1.5px solid var(--label);
+    transform: rotate(-45deg); transition: transform 0.15s ease;
+  }
+  details[open] summary::before { transform: rotate(45deg); border-color: var(--brand); }
+  @media (prefers-reduced-motion: reduce) { summary::before { transition: none; } }
+  summary:hover { color: var(--brand); }
+  /* One line, truncated: the summary is a hint, the body is the text. Opening it shows all. */
+  summary .what {
+    color: var(--label); font-size: 0.82rem; font-weight: 400;
+    flex: 1 1 18rem; min-width: 0;
+    white-space: nowrap; overflow: hidden; text-overflow: ellipsis;
+  }
+  details[open] summary .what { white-space: normal; overflow: visible; }
+  details[open] summary { color: var(--brand); }
+  details p.read { color: var(--ink-soft); }
+  details p b { color: var(--ink); font-weight: 600; }
+  details p { margin: 0 0 0.7rem; padding: 0 0.6rem; color: var(--ink-soft); font-size: 0.88rem; max-width: 52rem; }
+  details p.source { color: var(--label); font-size: 0.8rem; }
+  /* The duplicated code, under the row that located it. */
+  tr.excerpt td { padding: 0 0.6rem 0.4rem; border-bottom: 1px solid var(--rule); }
+  tr.excerpt details { border: 0; }
+  tr.excerpt summary { padding: 0.35rem 0; font-size: 0.8rem; color: var(--label); font-weight: 400; }
+  tr.excerpt summary:hover { color: var(--brand); }
+  tr.excerpt pre {
+    margin: 0 0 0.5rem; padding: 0.7rem 0.9rem; background: var(--page);
+    border: 1px solid var(--rule); border-radius: 6px; overflow-x: auto;
+    font: 0.8rem/1.5 ui-monospace, SFMono-Regular, Menlo, monospace; white-space: pre;
+  }
+  tr.excerpt pre code { color: var(--ink); font-size: 1em; }
+  footer { color: var(--label); font-size: 0.78rem; margin-top: 2.5rem; }
+  @media (max-width: 40rem) {
+    section { padding: 0.25rem 0.6rem; }
+    summary .what { display: none; }
+  }
 </style>
 </head>
 <body>
 <main>
-  <h1>Static analysis: ${escape(report.module)}</h1>
-  <p class="sub">Passes: ${escape(report.passes.join(", "))}</p>
-  <table>
-    <thead>
-      <tr><th scope="col">Metric</th><th scope="col">Value</th><th scope="col">Threshold</th><th scope="col">What it does not say</th></tr>
-    </thead>
-    <tbody>
+  <header>
+    <h1>${escape(report.module)}</h1>
+    <p class="sub">Static analysis, ${escape(report.passes.join(" / "))}</p>
+  </header>
+
+  <h2>Measured</h2>
+  <section>
+    <table class="figures">
+      <thead>
+        <tr><th scope="col">Metric</th><th scope="col">Value</th></tr>
+      </thead>
+      <tbody>
 ${rows}
-    </tbody>
-  </table>
+      </tbody>
+    </table>
+  </section>
+${report.notes.length > 0 ? `
+  <h2>Not measured</h2>
+  <section>
+    <table><tbody>
+${report.notes.map((note) => `      <tr><td class="read">${escape(note)}</td></tr>`).join("\n")}
+    </tbody></table>
+  </section>
+` : ""}
+${report.picture ? `
+  <h2>Shape</h2>
+  <section class="picture">
+    <p class="read">One dot per file, sized by how many imports touch it, coloured by the community it landed in. It shows the SHAPE: how many lobes, whether they are joined, where everything converges. The names are in the tables below.</p>
+${report.picture}
+  </section>
+` : ""}
+  <h2>What these numbers do not say</h2>
+  <section>
+${reserves}
+  </section>
+
+  <h2>Measured with</h2>
+  <section>
+    <table class="settings">
+      <thead>
+        <tr><th scope="col">Setting</th><th scope="col">Value</th><th scope="col">Origin</th></tr>
+      </thead>
+      <tbody>
+${settings}
+      </tbody>
+    </table>
+  </section>
+${findings}
+  <footer>sentinel static-analysis</footer>
 </main>
 </body>
 </html>
 `;
 }
 
-// src/roles/static-analysis/adapters/jscpd/config.ts
-import { mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
-import { tmpdir } from "node:os";
-import { join as join18 } from "node:path";
-function fileSettings(config) {
-  return {
-    // The detection window. Stated rather than defaulted, because it decides what is invisible.
-    minTokens: config.duplication.minTokens,
-    minLines: config.duplication.minLines,
-    // `format` is jscpd's name for what we call `languages`. Naming `typescript` alone would
-    // leave out `.tsx`, which is a separate language to it: 300 files of 523 on front/console.
-    format: config.languages,
-    ignore: config.ignore,
-    // A scan that analyses nothing otherwise exits 0 with only a warning, which reads as a pass.
-    failOnEmpty: true,
-    // The dead-code engine keeps its own section, and its own `minLines`: jscpd's documentation is
-    // explicit that the top-level one is about clones and is never carried into a dead-code run.
-    deadCode: {
-      entry: config.entry,
-      minConfidence: config.deadCode.minConfidence,
-      categories: config.deadCode.categories
-    },
-    // The escape hatch, last so it wins, and empty unless a module asked for it.
-    ...config.tools.jscpd
+// src/roles/static-analysis/workspace/consumers.ts
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { existsSync as existsSync15, mkdirSync, readFileSync as readFileSync16, statSync as statSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname2, join as join21, relative as relative4, resolve as resolve3, sep } from "node:path";
+var CACHE_DIR = join21("node_modules", ".cache", "sentinel");
+var CACHE_FILE = "consumer-index.json";
+var SHAPE = 3;
+var EXTENSIONS2 = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
+function workspaceRootFrom(cwd) {
+  let dir = resolve3(cwd);
+  for (; ; ) {
+    if (existsSync15(join21(dir, WORKSPACE_ROOT_MARKER))) return dir;
+    const parent = dirname2(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function aliasTable(workspaceRoot) {
+  const file = join21(workspaceRoot, "tsconfig.base.json");
+  if (!existsSync15(file)) return /* @__PURE__ */ new Map();
+  let paths;
+  try {
+    const parsed = JSON.parse(readFileSync16(file, "utf8"));
+    paths = parsed.compilerOptions?.paths ?? {};
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+  const table = /* @__PURE__ */ new Map();
+  for (const [alias, targets2] of Object.entries(paths)) {
+    if (alias === "apps/*" || alias === "libs/*") continue;
+    table.set(
+      alias,
+      targets2.map((target) => target.replace(/^\.\//, ""))
+    );
+  }
+  return table;
+}
+function resolveSpecifier2(specifier, table, workspaceRoot) {
+  const isFile = (candidate) => {
+    try {
+      return statSync4(join21(workspaceRoot, candidate)).isFile();
+    } catch {
+      return false;
+    }
   };
+  const exists = (candidate) => {
+    if (isFile(candidate)) return candidate;
+    for (const extension of EXTENSIONS2) {
+      if (isFile(candidate + extension)) return candidate + extension;
+    }
+    for (const extension of EXTENSIONS2) {
+      const index = `${candidate}/index${extension}`;
+      if (isFile(index)) return index;
+    }
+    return void 0;
+  };
+  const exact = table.get(specifier);
+  if (exact) {
+    for (const target of exact) {
+      const hit = exists(target);
+      if (hit) return hit;
+    }
+  }
+  for (const [alias, targets2] of table) {
+    if (!alias.endsWith("/*")) continue;
+    const prefix = alias.slice(0, -1);
+    if (!specifier.startsWith(prefix)) continue;
+    const rest = specifier.slice(prefix.length);
+    for (const target of targets2) {
+      if (!target.endsWith("/*")) continue;
+      const hit = exists(target.slice(0, -1) + rest);
+      if (hit) return hit;
+    }
+  }
+  return void 0;
 }
-function duplicationRun(config, reportDir, paths) {
-  const dir = mkdtempSync(join18(tmpdir(), "sentinel-static-"));
-  const configPath = join18(dir, "jscpd.json");
-  writeFileSync3(configPath, `${JSON.stringify(fileSettings(config), null, 2)}
-`, "utf8");
-  const args = [
-    "--config",
-    configPath,
-    // Always json, and only json, whatever shape the caller asked for. The three shapes are
-    // rendered by this role from the figures, not by the tool: one report lives under
-    // `static-analysis`, assembled from several passes, so a per-pass console table from the tool
-    // would be a fourth voice saying the same numbers differently. `--output` below is jscpd's
-    // output DIRECTORY, not our `--output` shape.
-    "--reporters",
-    "json",
-    "--output",
-    reportDir,
-    "--no-tips",
-    ...paths
-  ];
-  return { args, dispose: () => rmSync3(dir, { force: true, recursive: true }) };
+function isTestFile(path2) {
+  return /\.(test|spec|steps|e2e-spec|integration-spec|stories)\.[cm]?[jt]sx?$|(^|\/)(tests|__tests__|test|testing|stubs|__mocks__|mocks)\//.test(
+    path2
+  );
+}
+function moduleOf(path2, roots) {
+  let best;
+  for (const root of roots) {
+    if ((path2 === root || path2.startsWith(`${root}/`)) && (!best || root.length > best.length)) {
+      best = root;
+    }
+  }
+  return best;
+}
+function buildConsumerIndex(workspaceRoot, moduleRoots) {
+  const table = aliasTable(workspaceRoot);
+  const imported = /* @__PURE__ */ new Set();
+  const testOnly = /* @__PURE__ */ new Set();
+  if (table.size === 0) return { imported, testOnly, builtFrom: "no alias table" };
+  const result = spawnSync5(
+    "git",
+    ["grep", "-I", "-n", "-o", "-E", "@[A-Za-z0-9_-]+/[A-Za-z0-9_./-]+", "--", "*.ts", "*.tsx"],
+    { cwd: workspaceRoot, encoding: "utf8", maxBuffer: 512 * 1024 * 1024 }
+  );
+  if (result.error || result.status !== 0 && result.status !== 1) {
+    return { imported, testOnly, builtFrom: "git grep failed" };
+  }
+  const fromProduct = /* @__PURE__ */ new Map();
+  const seen = /* @__PURE__ */ new Map();
+  for (const line of (result.stdout ?? "").split("\n")) {
+    if (!line) continue;
+    const first = line.indexOf(":");
+    const second = line.indexOf(":", first + 1);
+    if (first < 0 || second < 0) continue;
+    const importer = line.slice(0, first).split(sep).join("/");
+    const specifier = line.slice(second + 1);
+    if (!seen.has(specifier)) seen.set(specifier, resolveSpecifier2(specifier, table, workspaceRoot));
+    const target = seen.get(specifier);
+    if (!target) continue;
+    if (moduleOf(importer, moduleRoots) === moduleOf(target, moduleRoots)) continue;
+    imported.add(target);
+    const product = !isTestFile(importer);
+    fromProduct.set(target, (fromProduct.get(target) ?? false) || product);
+  }
+  for (const [target, product] of fromProduct) if (!product) testOnly.add(target);
+  return { imported, testOnly, builtFrom: `git grep over ${seen.size} distinct specifiers` };
+}
+function cacheKey(workspaceRoot) {
+  const run = (args) => {
+    const out = spawnSync5("git", args, { cwd: workspaceRoot, encoding: "utf8" });
+    return out.error || out.status !== 0 ? void 0 : out.stdout ?? "";
+  };
+  const head = run(["rev-parse", "HEAD"]);
+  const dirty = run(["status", "--porcelain=v1", "--untracked-files=no"]);
+  if (head === void 0 || dirty === void 0) return void 0;
+  return `${SHAPE}:${head.trim()}:${hash(dirty)}`;
+}
+function hash(text) {
+  let value = 5381;
+  for (let index = 0; index < text.length; index += 1) {
+    value = (value << 5) + value + text.charCodeAt(index) >>> 0;
+  }
+  return value.toString(36);
+}
+function consumerIndex(workspaceRoot, moduleRoots) {
+  const key = cacheKey(workspaceRoot);
+  const file = join21(workspaceRoot, CACHE_DIR, CACHE_FILE);
+  if (key && existsSync15(file)) {
+    try {
+      const cached = JSON.parse(readFileSync16(file, "utf8"));
+      if (cached.key === key) {
+        return {
+          imported: new Set(cached.imported),
+          testOnly: new Set(cached.testOnly),
+          builtFrom: `${cached.builtFrom}, from cache`
+        };
+      }
+    } catch {
+    }
+  }
+  const index = buildConsumerIndex(workspaceRoot, moduleRoots());
+  if (key) {
+    try {
+      mkdirSync(join21(workspaceRoot, CACHE_DIR), { recursive: true });
+      const payload = {
+        key,
+        imported: [...index.imported],
+        testOnly: [...index.testOnly],
+        builtFrom: index.builtFrom
+      };
+      writeFileSync5(file, JSON.stringify(payload), "utf8");
+    } catch {
+    }
+  }
+  return index;
+}
+function outsideView(index, workspaceRoot, moduleRoot) {
+  const prefix = relative4(workspaceRoot, moduleRoot).split(sep).join("/");
+  const within = (path2) => prefix === "" ? path2 : path2.startsWith(`${prefix}/`) ? path2.slice(prefix.length + 1) : void 0;
+  const imported = /* @__PURE__ */ new Set();
+  const testOnly = /* @__PURE__ */ new Set();
+  for (const path2 of index.imported) {
+    const local = within(path2);
+    if (local) imported.add(local);
+  }
+  for (const path2 of index.testOnly) {
+    const local = within(path2);
+    if (local) testOnly.add(local);
+  }
+  return { imported, testOnly };
 }
 
-// src/roles/static-analysis/adapters/jscpd/resolve.ts
+// src/roles/static-analysis/adapters/jscpd/resolve-binary.ts
 function resolveJscpd(cwd) {
   return resolveBin(cwd, "jscpd") ?? binFromOwnInstall("jscpd", "jscpd");
 }
 
 // src/roles/static-analysis/adapters/jscpd/jscpd.adapter.ts
-var EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".css", ".scss"];
-var SCRIPT = "static-analysis";
-var SHAPES = ["console", "json", "html"];
+var EXTENSIONS3 = extensionsOf(defaults.languages);
 var scripts = () => ({
-  [SCRIPT]: `sentinel --run --${SCRIPT}`,
-  [`${SCRIPT}:json`]: `sentinel --run --${SCRIPT} --output json`,
-  [`${SCRIPT}:html`]: `sentinel --run --${SCRIPT} --output html`
+  [SCRIPTS.console]: `sentinel --run --${TARGET}`,
+  [SCRIPTS.json]: `sentinel --run --${TARGET} --output json`,
+  [SCRIPTS.html]: `sentinel --run --${TARGET} --output html`
 });
 var targets = () => ({
-  [SCRIPT]: { cache: true, inputs: ["default", `{projectRoot}/${STATIC_CONFIG_FILE}`] },
-  [`${SCRIPT}:json`]: { cache: false },
-  [`${SCRIPT}:html`]: { cache: false }
+  [TARGET]: { cache: true, inputs: ["default", `{projectRoot}/${STATIC_CONFIG_FILE}`] }
 });
-var CONFIG_STUB = `import { defineStaticAnalysis } from '@hublo/sentinel/static-analysis'
+function configStub() {
+  const rows = overridableSettings();
+  const pad = Math.max(...rows.map((row) => row.key.length));
+  const show = (row) => `  //   ${row.key.padEnd(pad)}  ${row.value}`;
+  const movable = rows.filter((row) => row.where === "overrides").map(show);
+  const refused = rows.filter((row) => row.where === "refused").map((row) => `  //   ${row.key}: ${row.note}`);
+  return `import { defineStaticAnalysis } from '@hublo/sentinel/static-analysis'
 
 export default defineStaticAnalysis({
   root: import.meta.dirname,
@@ -4986,39 +6215,73 @@ export default defineStaticAnalysis({
   // Named product journeys, as { 'the name product uses': ['src/some/path/**'] }. Paths are
   // relative to this module, because one run measures one module.
   journeys: {},
+
+  // ---------------------------------------------------------------------------------------------
+  // What this module can move, with the role's value today. A setting you leave out keeps that
+  // value; a setting you write REPLACES it, including inside a list. Anything you set is printed
+  // under "measured with" in the report and marked \`(module)\`, because two modules measured with
+  // different settings can no longer be compared.
+  //
+${movable.join("\n")}
+  //
+  // A list shown as a count is not copyable, and replacing one means writing back what you keep,
+  // so read the values in full with:
+  //
+  //   pnpm exec sentinel --inspect --${TARGET} --json
+  //
+${refused.join("\n")}
+  //
+  // overrides: {
+  //   duplication: { minTokens: 100 },
+  // },
 })
 `;
+}
+function configValue(config, path2) {
+  return path2.split(".").reduce(
+    (node, key) => node && typeof node === "object" ? node[key] : void 0,
+    config
+  );
+}
 var JscpdAdapter = class extends BaseAdapter {
-  target = "static-analysis";
+  target = TARGET;
   runner = "jscpd";
   /** Every preset: duplication, dead code and complexity are not stack-specific. */
   appliesTo(_preset) {
     return true;
   }
   plan(context) {
-    if (!hasSourceFiles(context.cwd, EXTENSIONS)) {
+    if (!hasSourceFiles(context.cwd, EXTENSIONS3)) {
       return {
         operations: [],
-        skipped: `no file ${this.runner} can read (looked for ${EXTENSIONS.join(", ")}).`
+        skipped: `no file ${this.runner} can read (looked for ${EXTENSIONS3.join(", ")}).`
       };
     }
     return {
       operations: [
         // `write` and not `merge-json`: this file is code, and the engine's in-place merge is for
         // JSON. A re-init therefore RESTORES the stub, so an existing one is left alone below.
-        ...existsSync14(join19(context.cwd, STATIC_CONFIG_FILE)) ? [] : [{ kind: "write", path: STATIC_CONFIG_FILE, contents: CONFIG_STUB }],
+        ...existsSync16(join22(context.cwd, STATIC_CONFIG_FILE)) ? [] : [{ kind: "write", path: STATIC_CONFIG_FILE, contents: configStub() }],
         manifestOperation(context.cwd, scripts()),
-        ...nxTargetOperations({ cwd: context.cwd, targets: targets() }),
-        // The reports are build output. Without this every adopting module grows an untracked
-        // directory nobody can explain, which is exactly what the format role's `lint/` did.
-        { kind: "ensure-lines", path: ".gitignore", lines: [`/${REPORT_DIR}/`] }
+        ...nxTargetOperations({ cwd: context.cwd, targets: targets() })
+        // The report directory is ignored ONCE at the workspace root, by `--init`'s workspace prep,
+        // and not here: a per-module rule creates a `.gitignore` in modules that had none and
+        // repeats the same line in every adopting module.
       ],
       notes: [
-        `added the three \`${SCRIPT}\` scripts and ${STATIC_CONFIG_FILE}; declare this module's entry points and journeys there, everything else comes from the role`
+        `added the three \`${TARGET}\` scripts and ${STATIC_CONFIG_FILE}; declare this module's entry points and journeys there, everything else comes from the role`
       ]
     };
   }
-  async run(ctx) {
+  /**
+   * Measure, and emit only when asked to.
+   *
+   * `--run` prints and may write a file; `--report` answers a machine and must do neither, which is
+   * the only difference between the two verbs here. Shared rather than duplicated because the
+   * measurement is where every reserve lives: two copies would drift, and the one that drifted
+   * would be the one nobody reads.
+   */
+  async measure(ctx, emitting) {
     const shape = ctx.output ?? "console";
     if (!SHAPES.includes(shape)) {
       process.stderr.write(
@@ -5027,9 +6290,9 @@ var JscpdAdapter = class extends BaseAdapter {
       );
       return { ok: false, code: 1 };
     }
-    if (!hasSourceFiles(ctx.cwd, EXTENSIONS)) {
+    if (!hasSourceFiles(ctx.cwd, EXTENSIONS3)) {
       process.stderr.write(
-        `sentinel static-analysis(jscpd): no file to measure in this module (looked for ${EXTENSIONS.join(", ")}).
+        `sentinel static-analysis(jscpd): no file to measure in this module (looked for ${EXTENSIONS3.join(", ")}).
 `
       );
       return { ok: true, code: 0 };
@@ -5057,38 +6320,117 @@ var JscpdAdapter = class extends BaseAdapter {
       return { ok: false, code: 1 };
     }
     const { paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, { valueFlags: ["-c", "--config"] });
-    const reportDir = join19(ctx.cwd, REPORT_DIR);
-    mkdirSync(reportDir, { recursive: true });
-    const { args, dispose } = duplicationRun(config, reportDir, paths.length > 0 ? paths : ["."]);
-    try {
-      const result = spawnSync5(jscpd, args, { cwd: ctx.cwd, encoding: "utf8" });
-      if (result.error) {
-        process.stderr.write(
-          `sentinel static-analysis(jscpd): could not run jscpd (${result.error.message})
+    const scanned = paths.length > 0 ? paths : measuredRoots(ctx.cwd);
+    const coverage = coverageOf(ctx.cwd, config);
+    const unreadableCode = hasUnreadableCode(coverage);
+    const product = runDuplication(jscpd, config, scanned, "product", ctx.cwd);
+    if (product.kind === "failed") return { ok: false, code: product.code };
+    if (product.kind === "empty") {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): nothing left to measure in this module once the exclusions applied, so no figure is reported (a figure of 0% would be a different claim).
 `
-        );
-        return { ok: false, code: 1 };
-      }
-      if (result.status !== 0) {
-        process.stderr.write(
-          `sentinel static-analysis(jscpd): jscpd exited ${result.status}
-${result.stderr ?? ""}`
-        );
-        return { ok: false, code: result.status ?? 1 };
-      }
-      const report = buildReport(ctx, reportDir, config);
-      if (!report) {
-        process.stderr.write(
-          `sentinel static-analysis(jscpd): jscpd wrote no report in ${REPORT_DIR}
+      );
+      return { ok: true, code: 0 };
+    }
+    const tests = runDuplication(jscpd, config, scanned, "tests", ctx.cwd);
+    if (tests.kind === "failed") return { ok: false, code: tests.code };
+    const outside = outsideOf(ctx.cwd);
+    const dead = runDeadCode(jscpd, config, paths.length > 0 ? paths : ["."], ctx.cwd, [
+      ...outside.imported
+    ]);
+    if (dead.kind === "failed") return { ok: false, code: dead.code };
+    if (dead.kind === "no-entry-point" && !unreadableCode) {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): no entry point found in this module, so nothing could be reached and no dead-code figure is reported (${dead.files} file(s) scanned). Declare what runs here in \`entry\` inside ${STATIC_CONFIG_FILE}: a lambda handler, a framework bootstrap, a script. A figure of 100% would describe the walk, not the code.
 `
-        );
-        return { ok: false, code: 1 };
-      }
-      emit(report, shape, reportDir);
-      return { ok: true, code: 0, metrics: metricsOf(report) };
-    } finally {
-      dispose();
+      );
     }
+    const complexity = scanComplexity(ctx.cwd, config);
+    const graph = scanGraph(ctx.cwd, config);
+    const size = scanSizeRules(
+      ctx.cwd,
+      scanned,
+      exclusions(config, "product"),
+      resolveOxlint(ctx.cwd),
+      (bin, args, cwd) => {
+        const result = spawnSync6(bin, args, { cwd, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+        return { status: result.error ? 1 : result.status, stdout: result.stdout ?? "" };
+      }
+    );
+    const report = assembleReport(
+      ctx,
+      config,
+      product,
+      tests,
+      dead,
+      complexity,
+      graph,
+      coverage,
+      size,
+      outside
+    );
+    if (emitting) await emit(report, shape, ctx.cwd, graph, coverage);
+    return { ok: true, code: 0, metrics: metricsOf(report) };
+  }
+  /** `--run`: measure and show it. */
+  async run(ctx) {
+    return this.measure(ctx, true);
+  }
+  /**
+   * `--inspect`: the settings that apply here, IN FULL.
+   *
+   * It exists because of the other half of documenting an override. The config stub lists what a
+   * module can move, but a list it summarises as "19 patterns" cannot be copied from, and
+   * `overrides` REPLACES a list rather than extending it: a developer who wants one more exclusion
+   * has to write the current ones back, so they need to read them. This is where.
+   *
+   * ⚠️ `--run` answers a narrower question, on purpose. The report prints the settings its FIGURES
+   * came from, which is what makes two modules comparable; this prints everything that applies,
+   * including what no pass has used yet. The two are not interchangeable.
+   */
+  async inspect(ctx) {
+    const { config, from, unreadable } = await loadStaticConfig(ctx.cwd);
+    const roleValue = (path2) => path2.split(".").reduce(
+      (node, key) => node && typeof node === "object" ? node[key] : void 0,
+      defaults
+    );
+    return {
+      runner: this.runner,
+      configFile: from,
+      ...unreadable ? { unreadable } : {},
+      reportDir: REPORT_DIR,
+      // The resolved values, not the role's: what this module measures with.
+      settings: {
+        entry: config.entry,
+        ignore: config.ignore,
+        languages: config.languages,
+        journeys: config.journeys,
+        duplication: config.duplication,
+        deadCode: config.deadCode
+      },
+      // What this module moved, with the role's value beside it, so the difference is readable
+      // without opening the package.
+      overrides: config.moved.map((path2) => ({
+        setting: path2,
+        module: roleValue(path2) === void 0 ? "set" : JSON.stringify(configValue(config, path2)),
+        role: JSON.stringify(roleValue(path2))
+      })),
+      // What the two passes will actually do with the globs, which is where a mistaken override
+      // shows up first: a product pass excluding nothing, or a test pass selecting nothing.
+      passes: {
+        product: { excludes: exclusions(config, "product").length },
+        tests: { excludes: exclusions(config, "tests").length, selects: config.duplication.tests }
+      }
+    };
+  }
+  /**
+   * `--report`: the same figures, for a machine.
+   *
+   * It writes nothing and prints nothing: the caller is the `--json` envelope or the CI comment,
+   * and a role that also printed its table would make the same numbers arrive twice in two shapes.
+   */
+  async report(ctx) {
+    return this.measure(ctx, false);
   }
   /**
    * Adoption, from the COMMITTED manifest only, so a workspace-wide sweep stays cheap and needs no
@@ -5098,7 +6440,7 @@ ${result.stderr ?? ""}`
     const declared = moduleScripts(ctx.cwd);
     const missing = Object.keys(scripts()).filter((name) => !(name in declared));
     const adopted = missing.length < Object.keys(scripts()).length;
-    const hasConfig = existsSync14(join19(ctx.cwd, STATIC_CONFIG_FILE));
+    const hasConfig = existsSync16(join22(ctx.cwd, STATIC_CONFIG_FILE));
     return {
       adopted,
       preset: adopted ? ctx.preset : null,
@@ -5110,41 +6452,332 @@ ${result.stderr ?? ""}`
     };
   }
 };
-function buildReport(ctx, reportDir, config) {
-  const path = join19(reportDir, "jscpd-report.json");
-  if (!existsSync14(path)) return void 0;
-  let parsed;
+function analysedNothing(stderr) {
+  return typeof stderr === "string" && stderr.includes("--fail-on-empty");
+}
+function measuredWith(config) {
+  const moved = (key) => config.moved.some((path2) => path2 === key || path2.startsWith(`${key}.`));
+  const row = (key, value) => ({ key, value, moved: moved(key) });
+  return [
+    row("duplication.minTokens", String(config.duplication.minTokens)),
+    row("duplication.minLines", String(config.duplication.minLines)),
+    row("duplication.kinds", config.duplication.kinds.join(", ")),
+    row("languages", `${config.languages.length}: ${config.languages.join(", ")}`),
+    // The count the SCAN received, not the module's list: the role unions its own artefacts in,
+    // and printing 20 while measuring with 22 is the kind of small lie that costs an afternoon.
+    // The product pass, which is the one the headline figure comes from.
+    row("ignore", `${exclusions(config, "product").length} patterns`),
+    row("duplication.tests", config.duplication.tests.join("  ")),
+    // The dead-code pass's own two, and the reason they are in the same block: a reader comparing
+    // two modules' unreachable share needs the confidence floor as much as the detection window.
+    row("deadCode.minConfidence", String(config.deadCode.minConfidence)),
+    row("deadCode.categories", config.deadCode.categories.join(", ")),
+    row("entry", `${config.entry.length} patterns`),
+    // ⛔ Always printed, even when no size row appears, because this is the line that tells a
+    // reader why a breach can sit beside a green lint. The thresholds are not a module setting and
+    // never appear as `(module)`: a gauge whose scale moves per module compares nothing.
+    row(
+      "size indicators",
+      `${Object.entries(PUBLISHED_THRESHOLDS).map(([rule, threshold]) => `${rule} ${threshold}`).join(", ")} (published defaults, oxlint run outside the module)`
+    ),
+    // ⚠️ The graph pass's one knob, and it has to be here: it changes both the community count and
+    // `Q`, so the two figures are meaningless without it. The seed is NOT printed beside it,
+    // because it is not a setting: see `graph/scan.ts` for why the role owns it.
+    row("graph.resolution", String(config.graph.resolution)),
+    // Not a setting a module can move: it is McCabe's own published figure, and the row says so
+    // rather than letting a reader take it for one of ours.
+    {
+      key: "complexity bands",
+      value: RISK_BANDS.map(
+        (band) => `${band.from}${band.to === Infinity ? "+" : `-${band.to}`}`
+      ).join(" / "),
+      moved: false
+    }
+  ];
+}
+function runTool(jscpd, args, cwd, pass) {
+  const result = spawnSync6(jscpd, args, { cwd, encoding: "utf8" });
+  if (result.error) {
+    process.stderr.write(
+      `sentinel static-analysis(jscpd): could not run the ${pass} pass (${result.error.message})
+`
+    );
+    return { kind: "failed", code: 1 };
+  }
+  if (result.status !== 0) {
+    if (analysedNothing(result.stderr)) return { kind: "empty" };
+    process.stderr.write(
+      `sentinel static-analysis(jscpd): the ${pass} pass exited ${result.status}
+${result.stderr ?? ""}`
+    );
+    return { kind: "failed", code: result.status ?? 1 };
+  }
+  return { kind: "ran" };
+}
+function runDeadCode(jscpd, config, paths, cwd, extraEntries = []) {
+  const { args, rawReportDir, dispose } = deadCodeRun(config, paths, extraEntries);
+  try {
+    const ran = runTool(jscpd, args, cwd, "dead-code");
+    if (ran.kind !== "ran") return ran;
+    const path2 = join22(rawReportDir, RAW_REPORT["dead-code"]);
+    if (!existsSync16(path2)) {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): the dead-code pass wrote no ${RAW_REPORT["dead-code"]}
+`
+      );
+      return { kind: "failed", code: 1 };
+    }
+    const parsed = safeParseDeadCode(readFileSync17(path2, "utf8"));
+    const statistics = parsed?.statistics;
+    if (!statistics) {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): the dead-code report has no readable figures
+`
+      );
+      return { kind: "failed", code: 1 };
+    }
+    if ((statistics.entryPoints ?? 0) === 0) {
+      return { kind: "no-entry-point", files: statistics.files ?? 0 };
+    }
+    const byCategory = {};
+    for (const finding of parsed?.findings ?? []) {
+      const category = finding.category ?? "unknown";
+      byCategory[category] = (byCategory[category] ?? 0) + 1;
+    }
+    return { kind: "figures", statistics, byCategory, findings: parsed?.findings ?? [] };
+  } finally {
+    dispose();
+  }
+}
+function runDuplication(jscpd, config, paths, scope, cwd) {
+  const { args, rawReportDir, dispose } = duplicationRun(config, paths, scope);
+  try {
+    const ran = runTool(jscpd, args, cwd, scope);
+    if (ran.kind !== "ran") return ran;
+    const path2 = join22(rawReportDir, RAW_REPORT.duplication);
+    const parsed = existsSync16(path2) ? safeParse(readFileSync17(path2, "utf8")) : void 0;
+    const total = parsed?.statistics?.total;
+    if (!total) {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): the ${scope} pass wrote no readable report
+`
+      );
+      return { kind: "failed", code: 1 };
+    }
+    return {
+      kind: "figures",
+      total,
+      formats: parsed?.statistics?.formats ?? {},
+      duplicates: parsed?.duplicates ?? []
+    };
+  } finally {
+    dispose();
+  }
+}
+function safeParse(text) {
   try {
-    parsed = JSON.parse(readFileSync14(path, "utf8"));
+    return JSON.parse(text);
   } catch {
     return void 0;
   }
-  const total = parsed.statistics?.total;
-  if (!total) return void 0;
-  const limit = config.thresholds.duplicatedLinesPercent;
-  const moved = config.moved.includes("thresholds.duplicatedLinesPercent");
-  const percent = Number((total.percentage ?? 0).toFixed(2));
-  const rows = [
-    {
-      metric: "duplicatedLinesPercent",
-      value: percent,
-      unit: "%",
-      threshold: limit,
-      over: percent > limit,
-      moved
-    },
-    {
-      metric: "clones",
-      value: total.clones ?? 0,
-      unit: "entries",
-      threshold: null,
-      over: false,
-      moved: false
+}
+function safeParseDeadCode(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+function placesToLook(product, tests, dead, complexity, graph) {
+  const at = (side) => `${side?.name ?? "(unknown)"}${side?.start === void 0 ? "" : `:${side.start}`}`;
+  const clones = (outcome, metric) => outcome.kind === "figures" ? outcome.duplicates.map((entry) => ({
+    metric,
+    path: at(entry.firstFile),
+    other: at(entry.secondFile),
+    ...entry.lines === void 0 ? {} : { lines: entry.lines },
+    ...entry.fragment ? { excerpt: entry.fragment } : {}
+  })) : [];
+  const deadMetric = {
+    "unused-file": "unusedFiles",
+    "unused-export": "unusedExports",
+    "unused-symbol": "unusedSymbols",
+    "unused-import": "unusedImports"
+  };
+  return [
+    ...clones(product, "clones"),
+    ...clones(tests, "clonesTests"),
+    // Each one under the band it falls in, so it sits beside the caveat that applies to it.
+    ...complexity.complex.map((fn) => ({
+      metric: RISK_BANDS.find((band) => fn.complexity >= band.from && fn.complexity <= band.to)?.metric ?? "complexityMax",
+      path: `${fn.path}:${fn.line}`,
+      name: fn.name,
+      value: fn.complexity
+    })),
+    ...dead.kind === "figures" ? dead.findings.map((finding) => ({
+      metric: deadMetric[finding.category ?? ""] ?? "deadLinesPercent",
+      path: finding.path ?? "(unknown)",
+      ...finding.name ? { name: finding.name } : {},
+      ...finding.lines === void 0 ? {} : { lines: finding.lines },
+      ...finding.confidence === void 0 ? {} : { confidence: finding.confidence },
+      ...finding.reasons?.length ? { reason: finding.reasons.join(", ") } : {},
+      ...finding.message ? { message: finding.message } : {}
+    })) : [],
+    // One finding per GROUP of mutually importing files, not per cycle path: see `graph/scan.ts`.
+    // The first file names the finding and the rest go in `other`, which is the shape the report
+    // already renders for a clone's two sides.
+    ...graph.cycles.map((cycle) => ({
+      metric: "cycles",
+      path: cycle.files[0] ?? "(unknown)",
+      other: cycle.files.slice(1).join(", "),
+      value: cycle.files.length
+    })),
+    // ⛔ Context, not defects. Every module has a most-imported file, and nothing here says the
+    // count is too high: the caveat on the metric says so in the reader's own words.
+    ...graph.mostImported.map((file) => ({
+      metric: "mostImported",
+      path: file.path,
+      value: file.importedBy,
+      dependsOn: file.dependsOn,
+      instability: Number(file.instability.toFixed(2)),
+      centrality: Number(file.centrality.toFixed(4))
+    }))
+  ];
+}
+function outsideOf(cwd) {
+  const empty = { imported: /* @__PURE__ */ new Set(), testOnly: /* @__PURE__ */ new Set() };
+  const root = workspaceRootFrom(cwd);
+  if (!root) return empty;
+  try {
+    return outsideView(
+      consumerIndex(root, () => moduleRootsOf(root)),
+      root,
+      cwd
+    );
+  } catch {
+    return empty;
+  }
+}
+function moduleRootsOf(workspaceRoot) {
+  const roots = [];
+  for (const area of ["apps", "libs"]) {
+    const base = join22(workspaceRoot, area);
+    if (!existsSync16(base)) continue;
+    for (const entry of globSync4([`${area}/**/package.json`, `${area}/**/project.json`], {
+      cwd: workspaceRoot,
+      ignore: ["**/node_modules/**"],
+      dot: false
+    })) {
+      const root = entry.split("/").slice(0, -1).join("/");
+      if (root) roots.push(root);
     }
+  }
+  return [...new Set(roots)];
+}
+function assembleReport(ctx, config, product, tests, dead, complexity, graph, coverage, size, outside) {
+  const unreadable = hasUnreadableCode(coverage);
+  const share = (total) => Number((total.percentage ?? 0).toFixed(2));
+  const rows = [
+    { metric: "duplicatedLinesPercent", value: share(product.total), unit: "%" },
+    { metric: "clones", value: product.total.clones ?? 0, unit: "entries" }
   ];
-  const formats = parsed.statistics?.formats ?? {};
+  const notes = [];
+  if (tests.kind !== "figures") {
+    notes.push("no test file to measure, so no test duplication figure is reported");
+  }
+  if (dead.kind === "no-entry-point" && !unreadable) {
+    notes.push(
+      `no entry point found, so nothing could be reached and no dead-code figure is reported (${dead.files} file(s) scanned): declare what RUNS here in \`entry\``
+    );
+  }
+  if (dead.kind === "empty" && !unreadable) {
+    notes.push("the dead-code pass had nothing left to analyse, so no figure is reported");
+  }
+  if (tests.kind === "figures") {
+    rows.push(
+      { metric: "duplicatedLinesPercentTests", value: share(tests.total), unit: "%" },
+      { metric: "clonesTests", value: tests.total.clones ?? 0, unit: "entries" }
+    );
+  }
+  if (unreadable) {
+    notes.push(unreadableNote(coverage));
+  }
+  if (dead.kind === "figures" && !unreadable) {
+    const stats = dead.statistics;
+    rows.push(
+      {
+        metric: "entryPoints",
+        value: stats.entryPoints ?? 0,
+        unit: `of ${stats.files ?? 0} files`
+      },
+      { metric: "deadLinesPercent", value: share(stats), unit: "%" },
+      { metric: "unusedFiles", value: dead.byCategory["unused-file"] ?? 0, unit: "files" },
+      { metric: "unusedExports", value: dead.byCategory["unused-export"] ?? 0, unit: "exports" },
+      { metric: "unusedSymbols", value: dead.byCategory["unused-symbol"] ?? 0, unit: "symbols" },
+      { metric: "unusedImports", value: dead.byCategory["unused-import"] ?? 0, unit: "imports" }
+    );
+  }
+  if (outside.testOnly.size > 0 && !unreadable) {
+    rows.push({ metric: "usedOnlyByTests", value: outside.testOnly.size, unit: "files" });
+  }
+  if (complexity.functions > 0) {
+    rows.push({ metric: "complexityMax", value: complexity.max, unit: "max per function" });
+    for (const band of RISK_BANDS) {
+      const count = complexity.bands[band.metric] ?? 0;
+      if (count === 0) continue;
+      rows.push({
+        metric: band.metric,
+        value: count,
+        unit: `of ${complexity.functions} functions`
+      });
+    }
+  } else {
+    notes.push("no function to measure, so no complexity figure is reported");
+  }
+  if (graph.files > 1 && !unreadable) {
+    rows.push(
+      { metric: "importEdges", value: graph.edges, unit: `between ${graph.files} files` },
+      {
+        metric: "graphDensity",
+        value: Number(graph.density.toFixed(4)),
+        unit: "of the possible edges"
+      },
+      {
+        metric: "cycles",
+        // ⛔ Zero is the expected value here, so the unit has to read correctly at zero as well as
+        // at one, which `1 groups, 2 files` did not. The file count only means something when
+        // there is a group, so it is absent when there is none.
+        value: graph.cycles.length,
+        unit: graph.cycles.length === 0 ? "none" : `${graph.cycles.length === 1 ? "group" : "groups"}, ${graph.filesInCycles} files`
+      },
+      { metric: "communities", value: graph.communities, unit: `of ${graph.files} files` }
+    );
+    if (graph.modularity === void 0) {
+      notes.push("no import between the files, so no modularity is reported");
+    } else {
+      rows.push({ metric: "modularity", value: Number(graph.modularity.toFixed(4)), unit: "" });
+    }
+  } else if (!unreadable) {
+    notes.push("fewer than two files, so no graph figure is reported");
+  }
+  if (size) {
+    const counts = /* @__PURE__ */ new Map();
+    for (const breach of size.breaches) counts.set(breach.rule, (counts.get(breach.rule) ?? 0) + 1);
+    for (const [rule, threshold] of Object.entries(PUBLISHED_THRESHOLDS)) {
+      const count = counts.get(rule) ?? 0;
+      if (count === 0) continue;
+      rows.push({
+        metric: rule,
+        value: count,
+        // The threshold travels WITH the figure: the same count means two different things at two
+        // thresholds, and this gauge's thresholds are not the ones a module's lint enforces.
+        unit: `files over ${threshold}, of ${size.files}`
+      });
+    }
+  } else {
+    notes.push("oxlint could not be run, so no size indicator is reported");
+  }
   const byLanguage = Object.fromEntries(
-    Object.entries(formats).map(([language, stats]) => [
+    Object.entries(product.formats).map(([language, stats]) => [
       language,
       {
         files: stats.sources ?? 0,
@@ -5153,26 +6786,59 @@ function buildReport(ctx, reportDir, config) {
       }
     ])
   );
-  return { module: ctx.module, passes: ["duplication"], rows, byLanguage };
+  return {
+    module: ctx.module,
+    passes: [
+      "duplication",
+      ...tests.kind === "figures" ? ["duplication (tests)"] : [],
+      ...dead.kind === "figures" ? ["dead code"] : [],
+      ...complexity.functions > 0 ? ["complexity"] : [],
+      ...graph.files > 1 ? ["graph"] : []
+    ],
+    rows,
+    notes,
+    settings: measuredWith(config),
+    findings: placesToLook(product, tests, dead, complexity, graph),
+    byLanguage
+  };
 }
-function emit(report, shape, reportDir) {
+async function emit(report, shape, cwd, graph, coverage) {
   if (shape === "console") {
     process.stdout.write(renderConsole(report));
     return;
   }
+  mkdirSync2(join22(cwd, REPORT_DIR), { recursive: true });
+  const written = [];
+  if (shape === "html" && graph.files > 1 && !hasUnreadableCode(coverage)) {
+    const picture = `${TARGET}-graph.svg`;
+    const path2 = join22(cwd, REPORT_DIR, picture);
+    await writeGraphPicture(graph.graph, graph.communityOf, path2);
+    written.push(`${REPORT_DIR}/${picture}`);
+    report.picture = inlineable(readFileSync17(path2, "utf8"));
+  }
   const name = shape === "json" ? "static-analysis.json" : "static-analysis.html";
   const body = shape === "json" ? renderJson(report) : renderHtml(report);
-  const path = join19(reportDir, name);
-  writeFileSync4(path, body, "utf8");
+  writeFileSync6(join22(cwd, REPORT_DIR, name), body, "utf8");
+  written.unshift(`${REPORT_DIR}/${name}`);
   process.stdout.write(`${renderConsole(report)}
-  written: ${REPORT_DIR}/${name}
+  written: ${written.join(", ")}
 `);
 }
+function inlineable(svg) {
+  return svg.replace(/^<\?xml[^>]*\?>\s*/, "").replace(/^(<svg)\s+width="[^"]*"\s+height="[^"]*"/, "$1");
+}
 function metricsOf(report) {
   return {
     passes: report.passes,
-    finding: hasFinding(report),
+    // Carried for the same reason they are printed: a consumer reading an absent figure needs to
+    // know whether it is clean or unmeasurable.
+    notes: report.notes,
     ...Object.fromEntries(report.rows.map((row) => [row.metric, row.value])),
+    // Carried into `--json` and the CI comment for the same reason the console prints them: a
+    // figure whose settings are unknown cannot be compared with the next module's.
+    settings: Object.fromEntries(
+      report.settings.map((s) => [s.key, { value: s.value, moved: s.moved }])
+    ),
     byLanguage: report.byLanguage
   };
 }
@@ -5190,10 +6856,10 @@ function registerTest() {
 }
 
 // src/roles/typescript/adapters/tsc/tsc.adapter.ts
-import { spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync16 } from "node:fs";
+import { spawnSync as spawnSync7 } from "node:child_process";
+import { existsSync as existsSync17, readFileSync as readFileSync19 } from "node:fs";
 import { createRequire } from "node:module";
-import { join as join21 } from "node:path";
+import { join as join24 } from "node:path";
 
 // src/roles/typescript/presets/nest.json
 var nest_default2 = {
@@ -5373,13 +7039,13 @@ function readTsconfigAdoption(cwd) {
     // Drift is measured against what the preset SETS, not against the allowlist alone: see
     // `presetOwnedKeys`. Without this a module overriding the workspace base reads as
     // non-conformant forever, since re-running `--init` would not (and should not) fix it.
-    presetOwns: (path) => presetCompilerOptionKeys(path.slice(path.lastIndexOf("/") + 1)) ?? []
+    presetOwns: (path2) => presetCompilerOptionKeys(path2.slice(path2.lastIndexOf("/") + 1)) ?? []
   });
 }
 
 // src/roles/typescript/adapters/tsc/plan.ts
-import { readFileSync as readFileSync15 } from "node:fs";
-import { join as join20 } from "node:path";
+import { readFileSync as readFileSync18 } from "node:fs";
+import { join as join23 } from "node:path";
 
 // src/roles/typescript/typecheck-script.ts
 var SENTINEL_TYPECHECK_COMMAND = "sentinel --run --typescript";
@@ -5472,7 +7138,7 @@ function planAdoption(context) {
     };
   }
   const existing = parseJsonc(
-    readFileSync15(join20(context.cwd, target.path), "utf8"),
+    readFileSync18(join23(context.cwd, target.path), "utf8"),
     target.path
   );
   const extendsChain = composeExtends(existing.extends, preset);
@@ -5610,7 +7276,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let chain;
     try {
       const parsed = parseJsonc(
-        readFileSync16(join21(cwd, target.path), "utf8"),
+        readFileSync19(join24(cwd, target.path), "utf8"),
         target.path
       );
       chain = parsed.extends;
@@ -5623,7 +7289,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     );
     if (preset === void 0) return void 0;
     try {
-      createRequire(join21(cwd, "noop.js")).resolve(preset);
+      createRequire(join24(cwd, "noop.js")).resolve(preset);
       return void 0;
     } catch {
       return preset;
@@ -5664,7 +7330,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
       return { ok: false, code: 1 };
     }
     if (options.length > 0) return this.runWithOptions(ctx, tsc, config);
-    const result = spawnSync6(tsc, ["-b", config], { cwd: ctx.cwd, stdio: "inherit" });
+    const result = spawnSync7(tsc, ["-b", config], { cwd: ctx.cwd, stdio: "inherit" });
     if (result.error) {
       process.stderr.write(
         `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -5699,7 +7365,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let worst = 0;
     for (const project of this.referencedProjects(ctx.cwd, config)) {
       const args = ["-p", project, "--noEmit", "--composite", "false", ...ctx.toolArgs ?? []];
-      const result = spawnSync6(tsc, args, { cwd: ctx.cwd, stdio: "inherit" });
+      const result = spawnSync7(tsc, args, { cwd: ctx.cwd, stdio: "inherit" });
       if (result.error) {
         process.stderr.write(
           `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -5719,10 +7385,10 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
   referencedProjects(cwd, config) {
     try {
       const parsed = parseJsonc(
-        readFileSync16(join21(cwd, config), "utf8"),
+        readFileSync19(join24(cwd, config), "utf8"),
         config
       );
-      const referenced = (parsed.references ?? []).map((reference) => reference.path).filter((path) => typeof path === "string" && path.length > 0);
+      const referenced = (parsed.references ?? []).map((reference) => reference.path).filter((path2) => typeof path2 === "string" && path2.length > 0);
       return referenced.length > 0 ? referenced : [config];
     } catch {
       return [config];
@@ -5735,7 +7401,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * check.
    */
   typecheckTarget(cwd) {
-    if (existsSync15(join21(cwd, "tsconfig.json"))) return "tsconfig.json";
+    if (existsSync17(join24(cwd, "tsconfig.json"))) return "tsconfig.json";
     const target = resolveTsconfigTarget(cwd);
     return target.reason === "none" ? null : target.path;
   }
@@ -5788,7 +7454,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
       return { ok: true, code: 0, metrics: _TscAdapter.NOTHING_TO_REPORT };
     }
     const tsc = resolveBin(ctx.cwd, "tsc") ?? "tsc";
-    const result = spawnSync6(tsc, ["-b", config], { cwd: ctx.cwd, encoding: "utf8" });
+    const result = spawnSync7(tsc, ["-b", config], { cwd: ctx.cwd, encoding: "utf8" });
     if (result.error) {
       process.stderr.write(
         `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -5831,7 +7497,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * errors in the output mean the rule must be on.
    */
   noImplicitAnyEnabled(cwd, tsc, config, mainOutput) {
-    const shown = spawnSync6(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
+    const shown = spawnSync7(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
     if (shown.status === 0 && shown.stdout) {
       try {
         const co = parseJsonc(
@@ -5941,31 +7607,31 @@ function replaceLines(current, replacements) {
 }
 
 // src/core/apply-plan.ts
-import { existsSync as existsSync16, readFileSync as readFileSync17, renameSync, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "node:fs";
-import { resolve as resolve3, sep } from "node:path";
+import { existsSync as existsSync18, readFileSync as readFileSync20, renameSync, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "node:fs";
+import { resolve as resolve4, sep as sep2 } from "node:path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
 function resolveWithinRoot(cwd, relativePath) {
-  const root = resolve3(cwd);
-  const absolutePath = resolve3(root, relativePath);
-  if (absolutePath !== root && !absolutePath.startsWith(root + sep)) {
+  const root = resolve4(cwd);
+  const absolutePath = resolve4(root, relativePath);
+  if (absolutePath !== root && !absolutePath.startsWith(root + sep2)) {
     throw new Error(`Refusing to write outside the module root: "${relativePath}".`);
   }
   return absolutePath;
 }
 function readIfExists(absolutePath) {
-  return existsSync16(absolutePath) ? readFileSync17(absolutePath, "utf8") : void 0;
+  return existsSync18(absolutePath) ? readFileSync20(absolutePath, "utf8") : void 0;
 }
 function* leaves(value, prefix = []) {
   for (const [key, keyValue] of Object.entries(value)) {
-    const path = [...prefix, key];
-    if (isPlainObject(keyValue)) yield* leaves(keyValue, path);
-    else yield [path, keyValue];
+    const path2 = [...prefix, key];
+    if (isPlainObject(keyValue)) yield* leaves(keyValue, path2);
+    else yield [path2, keyValue];
   }
 }
 function mergeJsonc(current, value) {
   let text = current.trim().length > 0 ? current : "{}\n";
-  for (const [path, leaf] of leaves(value)) {
-    const edits = modify(text, path, leaf, {
+  for (const [path2, leaf] of leaves(value)) {
+    const edits = modify(text, path2, leaf, {
       formattingOptions: { insertSpaces: true, tabSize: 2 }
     });
     text = applyEdits(text, edits);
@@ -5974,10 +7640,10 @@ function mergeJsonc(current, value) {
 }
 function removeJsoncKeys(current, keys) {
   let text = current.trim().length > 0 ? current : "{}\n";
-  for (const path of keys) {
+  for (const path2 of keys) {
     const root = parseTree(text);
-    if (!root || !findNodeAtLocation(root, path)) continue;
-    const edits = modify(text, path, void 0, {
+    if (!root || !findNodeAtLocation(root, path2)) continue;
+    const edits = modify(text, path2, void 0, {
       formattingOptions: { insertSpaces: true, tabSize: 2 }
     });
     text = applyEdits(text, edits);
@@ -5991,14 +7657,14 @@ function sameJson(left, right) {
     return false;
   }
 }
-function assertParseable(path, current) {
+function assertParseable(path2, current) {
   if (current.trim().length === 0) return;
   try {
-    parseJsonc(current, path);
+    parseJsonc(current, path2);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     throw new Error(
-      `${path} does not parse, so sentinel will not edit it: ${reason}. Nothing was written. Fix the file and re-run.`,
+      `${path2} does not parse, so sentinel will not edit it: ${reason}. Nothing was written. Fix the file and re-run.`,
       { cause: error }
     );
   }
@@ -6055,14 +7721,14 @@ function preparePlan(cwd, plan3) {
 }
 function writeFileAtomic(absolutePath, contents) {
   const tempPath = `${absolutePath}.sentinel-${process.pid}.tmp`;
-  writeFileSync5(tempPath, contents);
+  writeFileSync7(tempPath, contents);
   renameSync(tempPath, absolutePath);
 }
 function applyPlan(cwd, plan3) {
   const changed = preparePlan(cwd, plan3).filter((file) => file.before !== file.after);
   for (const file of changed) {
     if (file.deleted) {
-      rmSync4(file.absolutePath, { force: true });
+      rmSync5(file.absolutePath, { force: true });
       continue;
     }
     writeFileAtomic(file.absolutePath, file.after);
@@ -6071,8 +7737,8 @@ function applyPlan(cwd, plan3) {
 }
 
 // src/core/config/preset-evidence.ts
-import { existsSync as existsSync17, readdirSync as readdirSync3, readFileSync as readFileSync18 } from "node:fs";
-import { join as join22 } from "node:path";
+import { existsSync as existsSync19, readdirSync as readdirSync3, readFileSync as readFileSync21 } from "node:fs";
+import { join as join25 } from "node:path";
 var PATH_SIGNALS = [
   {
     preset: "nest",
@@ -6106,12 +7772,12 @@ function sourceImports(cwd, pattern) {
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (!NOT_SCANNED.has(entry.name)) stack.push(join22(dir, entry.name));
+        if (!NOT_SCANNED.has(entry.name)) stack.push(join25(dir, entry.name));
         continue;
       }
       if (!SOURCE_FILE.test(entry.name)) continue;
       try {
-        if (pattern.test(readFileSync18(join22(dir, entry.name), "utf8"))) return true;
+        if (pattern.test(readFileSync21(join25(dir, entry.name), "utf8"))) return true;
       } catch {
         continue;
       }
@@ -6120,12 +7786,12 @@ function sourceImports(cwd, pattern) {
   return false;
 }
 function dependencyNames(cwd) {
-  const path = join22(cwd, "package.json");
-  if (!existsSync17(path)) return [];
+  const path2 = join25(cwd, "package.json");
+  if (!existsSync19(path2)) return [];
   try {
     const manifest = parseJsonc(
-      readFileSync18(path, "utf8"),
-      path
+      readFileSync21(path2, "utf8"),
+      path2
     );
     return [
       ...Object.keys(manifest.dependencies ?? {}),
@@ -6147,7 +7813,7 @@ function reactTsconfigEvidence(cwd) {
   }
   for (const name of entries) {
     try {
-      const config = parseJsonc(readFileSync18(join22(cwd, name), "utf8"), name);
+      const config = parseJsonc(readFileSync21(join25(cwd, name), "utf8"), name);
       if (config.compilerOptions?.jsx !== void 0) return 'its tsconfig sets "jsx"';
       const extended = Array.isArray(config.extends) ? config.extends : config.extends === void 0 ? [] : [config.extends];
       if (extended.some((entry) => entry === REACT_TYPESCRIPT_PRESET)) {
@@ -6217,8 +7883,8 @@ function previewPlan(opts, plan3) {
         {
           dryRun: true,
           notes: plan3.notes ?? [],
-          files: changed.map(({ path, before, after, deleted }) => ({
-            path,
+          files: changed.map(({ path: path2, before, after, deleted }) => ({
+            path: path2,
             action: deleted ? "delete" : before.length === 0 ? "create" : "update",
             before,
             after
@@ -6237,10 +7903,10 @@ function previewPlan(opts, plan3) {
     process.stderr.write("  nothing to change\n");
     return 0;
   }
-  for (const { path, before, after, deleted } of changed) {
+  for (const { path: path2, before, after, deleted } of changed) {
     const action = deleted ? "delete" : before.length === 0 ? "create" : "update";
     process.stdout.write(`
-  ${action} ${path}
+  ${action} ${path2}
 `);
     for (const line of diffLines(before, after)) process.stdout.write(`    ${line}
 `);