@hublo/sentinel 1.5.0-alpha.3 → 1.5.0-alpha.31

package/dist/{chunk-IHRYFU2R.js → chunk-PWHE527G.js}

@@ -52,20 +52,29 @@ import {
   rewriteToolchainImports,
   selfCommand,
   splitToolArgs,
-  walk
-} from "./chunk-E3MYVYEZ.js";
+  walk,
+  writtenFileFormatter
+} from "./chunk-ZFNBW6S3.js";
 import {
   DEFAULT_MAX_DIAGNOSTICS,
+  WORKSPACE_ROOT_MARKER,
   findWorkspaceRoot,
   moduleName,
+  ownPackageDir,
   readOwnPackage,
   readProjectPackageJson
-} from "./chunk-KMKQDGI6.js";
+} from "./chunk-IL5PPLXE.js";
 import {
   REPORT_DIR,
+  SCRIPTS,
+  SHAPES,
+  TARGET,
+  defaults,
   defineStaticAnalysis,
-  isPlainObject
-} from "./chunk-DVKTH3RY.js";
+  extensionsOf,
+  isPlainObject,
+  overridableSettings
+} from "./chunk-GCHCLR7P.js";
 import {
   parseJsonc
 } from "./chunk-QXFCZON7.js";
@@ -178,10 +187,10 @@ import { join, relative } from "node:path";
 var DEPRECATED_NX_BUILDER = "@nx/webpack:webpack";
 var TRANSLATABLE_WEBPACK_CONFIG = "tools/webpack-configs/update.webpack.config.js";
 var readProjectJson = (cwd) => {
-  const path = join(cwd, "project.json");
-  if (!existsSync(path)) return void 0;
+  const path2 = join(cwd, "project.json");
+  if (!existsSync(path2)) return void 0;
   try {
-    return JSON.parse(readFileSync(path, "utf8"));
+    return JSON.parse(readFileSync(path2, "utf8"));
   } catch {
     return void 0;
   }
@@ -786,26 +795,26 @@ function buildScripts(cwd) {
   }
   return scripts2;
 }
-function plan(context) {
-  const manifest = readProjectPackageJson(context.cwd);
-  const unmet = unmetRequirements(context.preset, {
+function plan(context2) {
+  const manifest = readProjectPackageJson(context2.cwd);
+  const unmet = unmetRequirements(context2.preset, {
     ...manifest.dependencies,
     ...manifest.devDependencies
   });
   if (unmet.length > 0) {
-    return { operations: [], skipped: describeUnmet(context.preset, unmet) };
+    return { operations: [], skipped: describeUnmet(context2.preset, unmet) };
   }
-  const declaredPreset2 = declaredBuildPreset(context.cwd);
-  const configFile = buildConfigFile(context.cwd);
+  const declaredPreset2 = declaredBuildPreset(context2.cwd);
+  const configFile = buildConfigFile(context2.cwd);
   if (declaredPreset2 === void 0 && configFile !== void 0) {
     return {
       operations: [],
       skipped: `this module has a Vite config, but it builds neither a React app (no @vitejs/plugin-react or @tanstack/react-start) nor a Nest service (no ${BUILD_PRESET_SPECIFIERS.nest}). Those are the two families this role serves.`
     };
   }
-  const webpackTarget = webpackBuildTarget(context.cwd);
-  if (declaredBuildPreset(context.cwd) === "nest" || webpackTarget !== void 0) {
-    return planNestService(context, webpackTarget);
+  const webpackTarget = webpackBuildTarget(context2.cwd);
+  if (declaredBuildPreset(context2.cwd) === "nest" || webpackTarget !== void 0) {
+    return planNestService(context2, webpackTarget);
   }
   if (configFile === void 0) {
     return {
@@ -813,14 +822,14 @@ function plan(context) {
       skipped: `no Vite config in this module, so there is nothing to point at sentinel. This role moves an existing config's imports; it does not introduce a bundler. If this module builds another way (38 services here build through \`@nx/webpack\`), the build role does not apply to it.`
     };
   }
-  return planReactApp(context, configFile);
+  return planReactApp(context2, configFile);
 }
-function planReactApp(context, configFile) {
+function planReactApp(context2, configFile) {
   const notes = [];
   const operations = [];
-  const esm = esmReadiness(configFile, readProjectPackageJson(context.cwd).type);
+  const esm = esmReadiness(configFile, readProjectPackageJson(context2.cwd).type);
   if (esm.kind === "blocked") return { operations: [], skipped: esm.why };
-  const rewrite = rewriteBuildImports(readConfigSource(context.cwd, configFile), configFile);
+  const rewrite = rewriteBuildImports(readConfigSource(context2.cwd, configFile), configFile);
   if (rewrite.kind === "blocked") {
     return {
       operations: [],
@@ -831,7 +840,7 @@ function planReactApp(context, configFile) {
     operations.push({ kind: "write", path: configFile, contents: rewrite.source });
   }
   for (const name of COMPANION_CONFIG_FILES) {
-    const source = readConfigSource(context.cwd, name);
+    const source = readConfigSource(context2.cwd, name);
     if (source === "") continue;
     const companion = rewriteBuildImports(source, name);
     if (companion.kind === "rewritten") {
@@ -848,28 +857,28 @@ function planReactApp(context, configFile) {
       `${configFile} now imports ${rewrite.moved.join(", ")} from \`${BUILD_PRESET_SPECIFIER}\`. Only the import lines changed: every attribute, alias and path is untouched, so this build produces what it produced before.`
     );
   }
-  const scripts2 = buildScripts(context.cwd);
-  operations.push(manifestOperation(context.cwd, scripts2));
+  const scripts2 = buildScripts(context2.cwd);
+  operations.push(manifestOperation(context2.cwd, scripts2));
   operations.push(
     ...nxTargetOperations({
-      cwd: context.cwd,
+      cwd: context2.cwd,
       targets: buildTarget({
-        moduleName: adoptedPackageName(context.cwd),
+        moduleName: adoptedPackageName(context2.cwd),
         outputs: candidateOutputs()
       })
     })
   );
-  const dev = devTargetOperations(context.cwd, scripts2[DEV_SCRIPT_NAME]);
+  const dev = devTargetOperations(context2.cwd, scripts2[DEV_SCRIPT_NAME]);
   operations.push(...dev.operations);
   if (dev.note !== void 0) notes.push(dev.note);
-  const owned = ownedBuildDependencies(context.cwd);
+  const owned = ownedBuildDependencies(context2.cwd);
   if (owned.length > 0) {
     operations.push({ kind: "remove-json-keys", path: "package.json", keys: owned });
     notes.push(
       `removed ${owned.map(([, name]) => name).join(", ")} from this module: sentinel owns them now, and two copies of Vite in one build give the plugins a different Vite than the one running them.`
     );
   }
-  const formatted = readFormatAdoption(context.cwd).adopted;
+  const formatted = readFormatAdoption(context2.cwd).adopted;
   notes.push(
     formatted ? `run \`sentinel --run --format --fix\` on this module: adoption rewrote ${configFile}, and a rewritten import can be longer than your formatter wraps at.` : `this module is formatted by the workspace, not by sentinel, so format ${configFile} with whatever owns it before committing: a rewritten import can be longer than that formatter wraps at, and the check would fail on a file nobody typed.`
   );
@@ -878,8 +887,8 @@ function planReactApp(context, configFile) {
   );
   return { operations, notes };
 }
-function planNestService(context, webpackTarget) {
-  const outputs = webpackTarget === void 0 ? nestOutputsFromConfig(context.cwd) : nestBuildOutputs(webpackTarget);
+function planNestService(context2, webpackTarget) {
+  const outputs = webpackTarget === void 0 ? nestOutputsFromConfig(context2.cwd) : nestBuildOutputs(webpackTarget);
   if (outputs === void 0) {
     return {
       operations: [],
@@ -887,22 +896,22 @@ function planNestService(context, webpackTarget) {
     };
   }
   const metadata = [
-    manifestOperation(context.cwd, { [BUILD_SCRIPT_NAME]: SENTINEL_BUILD_COMMAND }),
+    manifestOperation(context2.cwd, { [BUILD_SCRIPT_NAME]: SENTINEL_BUILD_COMMAND }),
     ...nxTargetOperations({
-      cwd: context.cwd,
+      cwd: context2.cwd,
       targets: buildTarget({
-        moduleName: adoptedPackageName(context.cwd),
+        moduleName: adoptedPackageName(context2.cwd),
         configFiles: [NEST_CONFIG_FILE],
         outputs
       })
     })
   ];
   if (webpackTarget === void 0) return { operations: metadata };
-  const refusal = refusalFor(context.cwd, webpackTarget);
+  const refusal = refusalFor(context2.cwd, webpackTarget);
   if (refusal !== void 0) return { operations: [], blocked: refusal };
   const dropped = Object.keys(webpackTarget.configurations ?? {});
   return {
-    operations: [...nestAdoptionOperations(context.cwd, webpackTarget), ...metadata],
+    operations: [...nestAdoptionOperations(context2.cwd, webpackTarget), ...metadata],
     notes: [
       `wrote ${NEST_CONFIG_FILE} and pointed the nx build target at sentinel. The target stays \`nx:run-commands\` with \`forwardAllArgs: false\`, so the image's \`--generatePackageJson\` still works and the Dockerfile needs no change.`,
       ...dropped.length > 0 ? [
@@ -984,8 +993,8 @@ var ViteRoleAdapter = class extends BaseAdapter {
    * other leaves the module half-migrated in a way nothing reports. The operations are
    * idempotent, so `--init --build` and `--init --dev` are interchangeable rather than additive.
    */
-  plan(context) {
-    return plan(context);
+  plan(context2) {
+    return plan(context2);
   }
   async status(ctx) {
     const { adopted, preset, conformant, drift, unreadable } = readBuildAdoption(ctx.cwd);
@@ -1064,14 +1073,14 @@ var ViteDevAdapter = class extends ViteRoleAdapter {
    * so a developer could believe the dev server had been adopted on its own. Refusing was the
    * wrong correction, it added friction to a command that already produced the right result.
    */
-  plan(context) {
-    if (declaredBuildPreset(context.cwd) === "nest" || webpackBuildTarget(context.cwd)) {
+  plan(context2) {
+    if (declaredBuildPreset(context2.cwd) === "nest" || webpackBuildTarget(context2.cwd)) {
       return {
         operations: [],
         skipped: `a Nest service has no dev server, so --dev has nothing to adopt here. Its build is \`sentinel --init --build\`, and it runs as a Node process afterwards.`
       };
     }
-    const planned = super.plan(context);
+    const planned = super.plan(context2);
     if (planned.operations.length === 0) return planned;
     return {
       ...planned,
@@ -1117,17 +1126,17 @@ function buildStamp(cwd) {
   const marker = join6(cwd, `.sentinel-build-stamp-${process.pid}`);
   try {
     writeFileSync(marker, "");
-    const stamp = statSync(marker).mtimeMs;
+    const stamp2 = statSync(marker).mtimeMs;
     rmSync(marker, { force: true });
-    return stamp;
+    return stamp2;
   } catch {
     return Date.now();
   }
 }
-function writtenSince(path, startedAt) {
-  if (!existsSync5(path)) return false;
+function writtenSince(path2, startedAt) {
+  if (!existsSync5(path2)) return false;
   try {
-    return statSync(path).mtimeMs >= startedAt;
+    return statSync(path2).mtimeMs >= startedAt;
   } catch {
     return true;
   }
@@ -1414,11 +1423,11 @@ function toModulePattern(pattern) {
 }
 function inheritedIgnorePatterns(workspaceRoot) {
   if (!workspaceRoot) return [];
-  const path = join8(workspaceRoot, ROOT_IGNORE_FILE);
-  if (!existsSync6(path)) return [];
+  const path2 = join8(workspaceRoot, ROOT_IGNORE_FILE);
+  if (!existsSync6(path2)) return [];
   let contents;
   try {
-    contents = readFileSync6(path, "utf8");
+    contents = readFileSync6(path2, "utf8");
   } catch {
     return [];
   }
@@ -1565,25 +1574,25 @@ var OxfmtAdapter = class extends BaseAdapter {
     const declared = readFormatAdoption(cwd).preset;
     return declared !== null && PRESET_NAMES.includes(declared) ? declared : void 0;
   }
-  plan(context) {
-    if (!hasSourceFiles(context.cwd, FORMATTABLE_EXTENSIONS)) {
+  plan(context2) {
+    if (!hasSourceFiles(context2.cwd, FORMATTABLE_EXTENSIONS)) {
       return {
         operations: [],
         skipped: `no file oxfmt can read here, so there is nothing to format.`
       };
     }
     const own = readOwnPackage();
-    const presetName = formatPresetName(context.preset);
+    const presetName = formatPresetName(context2.preset);
     const preset = formatPresetFor(presetName);
-    const existing = readFormatAdoption(context.cwd);
-    const prettier = readPrettierSettings(context.cwd);
+    const existing = readFormatAdoption(context2.cwd);
+    const prettier = readPrettierSettings(context2.cwd);
     const local = existing.adopted ? { ...existing.local } : { ...prettier.options };
     for (const [key, value] of Object.entries(local)) {
       if (ALWAYS_LOCAL_KEYS.includes(key)) continue;
       if (key in preset && JSON.stringify(preset[key]) === JSON.stringify(value)) delete local[key];
     }
     const localKeys = Object.keys(local).filter((key) => !ALWAYS_LOCAL_KEYS.includes(key)).sort();
-    const inherited = inheritedIgnorePatterns(findWorkspaceRoot(context.cwd));
+    const inherited = inheritedIgnorePatterns(findWorkspaceRoot(context2.cwd));
     const declaredIgnores = Array.isArray(local.ignorePatterns) ? local.ignorePatterns.filter((v) => typeof v === "string") : [];
     const ignorePatterns = [
       .../* @__PURE__ */ new Set([...declaredIgnores, ...inherited, ...FORMAT_DEFAULT_IGNORES])
@@ -1604,17 +1613,17 @@ var OxfmtAdapter = class extends BaseAdapter {
       // Written pre-formatted (2-space, trailing newline): oxfmt formats JSON too, and until
       // the format pass runs this file is the one config nothing has formatted yet.
       { kind: "write", path: FORMAT_CONFIG_FILE, contents: JSON.stringify(config, null, 2) + "\n" },
-      manifestOperation(context.cwd, this.formatScripts(context.cwd))
+      manifestOperation(context2.cwd, this.formatScripts(context2.cwd))
     ];
     const prettierConfigs = PRETTIER_CONFIG_FILES.filter(
-      (name) => existsSync8(join10(context.cwd, name))
+      (name) => existsSync8(join10(context2.cwd, name))
     );
     for (const name of prettierConfigs) operations.push({ kind: "delete", path: name });
-    const removableDeps = this.modulePrettierDependencies(context.cwd);
+    const removableDeps = this.modulePrettierDependencies(context2.cwd);
     if (removableDeps.length > 0) {
       operations.push({ kind: "remove-json-keys", path: "package.json", keys: removableDeps });
     }
-    operations.push(...nxTargetOperations({ cwd: context.cwd, targets: formatTargets() }));
+    operations.push(...nxTargetOperations({ cwd: context2.cwd, targets: formatTargets() }));
     const notes = [
       `materialized the ${presetName} format preset into ${FORMAT_CONFIG_FILE} (${own.name}@${own.version}). oxfmt has no \`extends\`, so the values live here; \`sentinel --status --format\` reports modules left behind by a preset change`
     ];
@@ -1646,8 +1655,8 @@ var OxfmtAdapter = class extends BaseAdapter {
         `removed the prettier devDependenc(ies) this module declared (${removableDeps.map(([, name]) => name).join(", ")}); the ROOT is untouched`
       );
     }
-    const script = this.formatScripts(context.cwd)[FORMAT_SCRIPT_NAME] ?? "";
-    if (keepsOtherCommands2(script, selfCommand(context.cwd, "--run --format"))) {
+    const script = this.formatScripts(context2.cwd)[FORMAT_SCRIPT_NAME] ?? "";
+    if (keepsOtherCommands2(script, selfCommand(context2.cwd, "--run --format"))) {
       notes.push(
         `kept the rest of the format script (\`${script}\`): only the prettier part is sentinel's`
       );
@@ -1948,9 +1957,9 @@ function readFailure(output) {
   const line = (detail ?? lines.find((entry) => entry !== "") ?? "").replace(/^x\s*/, "");
   return line.split(/:\s*Failed to parse config/i)[0] ?? line;
 }
-function fingerprint(path) {
+function fingerprint(path2) {
   try {
-    const stat = statSync2(path);
+    const stat = statSync2(path2);
     return `${stat.size}:${stat.mtimeMs}`;
   } catch {
     return void 0;
@@ -2799,6 +2808,7 @@ var react_default = {
       reason: "the house rule finds 3 real violations; they are fixed as their own change rather than inside a linter swap, so the rule ships visible-but-off and can be switched on once they are"
     },
     "hublo/no-regex-lookbehind": "error",
+    "hublo/require-reload-document": "error",
     "jest/expect-expect": {
       severity: "off",
       reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
@@ -3285,7 +3295,7 @@ var react_default = {
   uncovered: {
     "import/order": "import ordering is FORMATTING, and the format role owns it: oxfmt's `sortImports` reproduces exactly these groups (builtin, external, internal, parent/index, sibling, alphabetical, blank line between) and sorts a file completely in ONE pass, because it rewrites the whole import block. A lint fixer cannot: it emits text edits over overlapping ranges, so this rule needed several runs to finish (five imports took four passes, measured) and sentinel deliberately runs autofix once. Enforced by `pnpm run format`, not by the linter, which is also why `eslint-plugin-import` is no longer hosted at all: its only other rule, no-duplicates, is native in oxlint.",
     "no-octal": "no oxlint equivalent",
-    "no-restricted-syntax": "no oxlint equivalent as configuration, so the AST selectors this repo used are shipped as real rules in the local `hublo` plugin instead, which this tier hosts (`../plugins/hublo.js`). Two are hosted today: the eight palette selectors as `hublo/no-palette-common`, and the lookbehind selector as `hublo/no-regex-lookbehind`. Any selector NOT in that plugin is not enforced here; propose it and it joins the plugin rather than a per-module copy.",
+    "no-restricted-syntax": "no oxlint equivalent as configuration, so the AST selectors this repo used are shipped as real rules in the local `hublo` plugin instead, which this tier hosts (`../plugins/hublo.js`). Three are hosted today: the eight palette selectors as `hublo/no-palette-common`, the lookbehind selector as `hublo/no-regex-lookbehind`, and the TanStack Router one as `hublo/require-reload-document`, carried here from an ESLint selector in the monorepo (PR #22043) because ADR 0042 makes this the layer that outlives it. App tier only: measured on main, `libs/front` calls `redirect(` nowhere, while host-admin does in 93 files and console in 2. Any selector NOT in that plugin is not enforced here; propose it and it joins the plugin rather than a per-module copy.",
     semi: "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between."
   }
 };
@@ -3770,11 +3780,11 @@ function downgradedRulesFor(preset) {
 import { existsSync as existsSync9, readFileSync as readFileSync9 } from "node:fs";
 import { isAbsolute, join as join12, resolve as resolve2 } from "node:path";
 function ruleCount(cwd, specifier) {
-  const path = isAbsolute(specifier) ? specifier : resolve2(cwd, specifier);
-  if (!existsSync9(path)) return void 0;
+  const path2 = isAbsolute(specifier) ? specifier : resolve2(cwd, specifier);
+  if (!existsSync9(path2)) return void 0;
   try {
     const parsed = parseJsonc(
-      readFileSync9(path, "utf8"),
+      readFileSync9(path2, "utf8"),
       specifier
     );
     return Object.keys(parsed.rules ?? {}).length;
@@ -3870,7 +3880,7 @@ function readRootEslintIgnores(root) {
   return { patterns: patterns.filter((pattern) => pattern.startsWith("**/")), unresolved };
 }
 function readEslintIgnores(cwd) {
-  const config = ESLINT_CONFIG_FILES.map((name) => join13(cwd, name)).find((path) => existsSync10(path));
+  const config = ESLINT_CONFIG_FILES.map((name) => join13(cwd, name)).find((path2) => existsSync10(path2));
   if (!config) return { patterns: [], unresolved: [] };
   let source;
   try {
@@ -4120,48 +4130,48 @@ function summariseByPlugin(rules) {
   }
   return [...counts.entries()].sort((left, right) => right[1] - left[1]).map(([plugin, count]) => `${count} ${plugin}`).join(", ");
 }
-function plan2(context) {
-  if (!hasLintPreset(context.preset)) {
+function plan2(context2) {
+  if (!hasLintPreset(context2.preset)) {
     return {
       operations: [],
-      skipped: `sentinel does not ship a lint preset named "${context.preset}" yet (shipped: ${LINT_PRESETS.join(", ")}). Nothing was written; the module keeps its current linter and the other roles adopt normally.`
+      skipped: `sentinel does not ship a lint preset named "${context2.preset}" yet (shipped: ${LINT_PRESETS.join(", ")}). Nothing was written; the module keeps its current linter and the other roles adopt normally.`
     };
   }
-  const current = presetOfVariant(presetNameFromPath(readLintAdoption(context.cwd).preset));
-  if (current !== void 0 && current !== context.preset) {
+  const current = presetOfVariant(presetNameFromPath(readLintAdoption(context2.cwd).preset));
+  if (current !== void 0 && current !== context2.preset) {
     return {
       operations: [],
-      blocked: `this module is already adopted as "${current}", and --preset says "${context.preset}". Nothing was written. If the change is deliberate, delete ${LINT_CONFIG_FILE} and re-run; otherwise re-run with --preset ${current}.`
+      blocked: `this module is already adopted as "${current}", and --preset says "${context2.preset}". Nothing was written. If the change is deliberate, delete ${LINT_CONFIG_FILE} and re-run; otherwise re-run with --preset ${current}.`
     };
   }
-  if (!hasSourceFiles(context.cwd, LINTABLE_EXTENSIONS)) {
+  if (!hasSourceFiles(context2.cwd, LINTABLE_EXTENSIONS)) {
     return {
       operations: [],
       skipped: `no file oxlint can read (looked for ${LINTABLE_EXTENSIONS.join(", ")}), so there is nothing to lint here. Other roles may still apply: the formatter reads markdown, YAML, HTML and CSS too.`
     };
   }
-  const variant = presetVariant(context.preset, context.cwd);
+  const variant = presetVariant(context2.preset, context2.cwd);
   const disabled = disabledRulesFor(variant);
   const own = readOwnPackage();
-  const ignores = readEslintIgnores(context.cwd);
-  const rootIgnores = readRootEslintIgnores(findWorkspaceRoot(context.cwd));
+  const ignores = readEslintIgnores(context2.cwd);
+  const rootIgnores = readRootEslintIgnores(findWorkspaceRoot(context2.cwd));
   const bare = (pattern) => pattern.replace(/^\*\*\//, "").replace(/\/\*\*$/, "");
-  const defaults = new Set(DEFAULT_IGNORE_PATTERNS.map(bare));
+  const defaults2 = new Set(DEFAULT_IGNORE_PATTERNS.map(bare));
   const moduleOwn = [
-    ...committedIgnorePatterns(context.cwd),
+    ...committedIgnorePatterns(context2.cwd),
     ...ignores.patterns,
     ...rootIgnores.patterns
-  ].filter((pattern) => !defaults.has(bare(pattern)));
+  ].filter((pattern) => !defaults2.has(bare(pattern)));
   const carried = [.../* @__PURE__ */ new Set([...DEFAULT_IGNORE_PATTERNS, ...moduleOwn])];
   const stub = {
-    extends: extendsWithPreset(committedExtends(context.cwd), variant),
+    extends: extendsWithPreset(committedExtends(context2.cwd), variant),
     ...carried.length > 0 ? { ignorePatterns: carried } : {}
   };
   const operations = [
     { kind: "write", path: LINT_CONFIG_FILE, contents: JSON.stringify(stub, null, 2) + "\n" },
-    manifestOperation(context.cwd, lintScripts(context.cwd))
+    manifestOperation(context2.cwd, lintScripts(context2.cwd))
   ];
-  const removableDeps = moduleEslintDependencies(context.cwd);
+  const removableDeps = moduleEslintDependencies(context2.cwd);
   if (removableDeps.length > 0) {
     operations.push({
       kind: "remove-json-keys",
@@ -4169,16 +4179,16 @@ function plan2(context) {
       keys: removableDeps
     });
   }
-  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync11(join15(context.cwd, name)));
+  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync11(join15(context2.cwd, name)));
   for (const name of eslintConfigs) operations.push({ kind: "delete", path: name });
   operations.push(
     ...nxTargetOperations({
-      cwd: context.cwd,
+      cwd: context2.cwd,
       targets: { [LINT_SCRIPT_NAME]: lintTarget() }
     })
   );
   const renames = findSuppressionRenames(
-    context.cwd,
+    context2.cwd,
     renamedPrefixes(lintPresetFor(variant).jsPlugins, lintPresetFor(variant).renames)
   );
   const deleting = new Set(eslintConfigs);
@@ -4228,7 +4238,7 @@ function plan2(context) {
       `renamed ${rewritten.length} suppression comment(s) whose plugin oxlint registers under a different name (${[...new Set(rewritten.map((entry) => entry.rule))].join(", ")}); left alone they would stop suppressing anything, silently`
     );
   }
-  const script = lintScripts(context.cwd)[LINT_SCRIPT_NAME] ?? "";
+  const script = lintScripts(context2.cwd)[LINT_SCRIPT_NAME] ?? "";
   if (keepsOtherCommands3(script)) {
     const stillPrettier = /(^|[\s/])prettier(\s|$)/.test(script);
     notes.push(
@@ -4348,8 +4358,8 @@ var OxlintAdapter = class extends BaseAdapter {
    * linter are two different jobs, and keeping them in one file is what grew it past 800
    * lines. The adapter stays the contract with the engine.
    */
-  plan(context) {
-    return plan2(context);
+  plan(context2) {
+    return plan2(context2);
   }
   declaredPreset(cwd) {
     return presetOfVariant(presetNameFromPath(readLintAdoption(cwd).preset));
@@ -4751,22 +4761,277 @@ function registerLint() {
 }
 
 // src/roles/static-analysis/adapters/jscpd/jscpd.adapter.ts
-import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync14, mkdirSync, readFileSync as readFileSync14, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join19 } from "node:path";
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { existsSync as existsSync18, mkdirSync as mkdirSync2, readFileSync as readFileSync20, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join25 } from "node:path";
+import { globSync as globSync6 } from "tinyglobby";
 
-// src/roles/static-analysis/configs/resolve.ts
-import { existsSync as existsSync13 } from "node:fs";
-import { join as join17 } from "node:path";
+// src/roles/static-analysis/bundle/scan.ts
+import { existsSync as existsSync14, readFileSync as readFileSync15 } from "node:fs";
+import { basename, join as join18 } from "node:path";
 import { pathToFileURL } from "node:url";
+import { gzipSync } from "node:zlib";
+import { globSync as globSync2 } from "tinyglobby";
+
+// src/roles/static-analysis/bundle/budgets.ts
+var TRANSFER_REFERENCES = {
+  /**
+   * The engineering budget, with its conditions: "aim for a JS budget of < 170KB
+   * minified/compressed", for "getting interactive in under five seconds on a slow 3G connection
+   * on a median mobile device". It answers "are we good".
+   */
+  budgetKb: 170,
+  /**
+   * HTTP Archive's `bytesJs`, "the sum of transfer size kilobytes of all external scripts
+   * requested by the page". It answers "are we normal", which is a different question, and the two
+   * routinely disagree: all three of our fronts are below this and above the budget.
+   */
+  webMedianKb: 747.5
+};
+var PARSED_BUDGET_KB = 717;
+var PER_SCRIPT_KB = 100;
+var BANDS = { near: 0.7, exceed: 1 };
+function bandFor(valueKb, referenceKb) {
+  const ratio = valueKb / referenceKb;
+  if (ratio > BANDS.exceed) return "exceed";
+  if (ratio >= BANDS.near) return "near";
+  return "ok";
+}
+
+// src/roles/static-analysis/bundle/find-build.ts
+import { existsSync as existsSync13, readFileSync as readFileSync14, statSync as statSync4 } from "node:fs";
+import { join as join17 } from "node:path";
+import { globSync } from "tinyglobby";
+var MANIFEST_GLOB = "server/_tanstack-start-manifest*.mjs";
+function candidateDirs(cwd) {
+  const declared = readProjectPackageJson(cwd).nx?.targets?.build?.["outputs"];
+  const fromDeclaration = Array.isArray(declared) ? declared.filter((token) => typeof token === "string").map((token) => join17(cwd, token.replace(/^\{projectRoot\}\//, ""))) : [];
+  return [...fromDeclaration, join17(cwd, ".output"), join17(cwd, "dist"), join17(cwd, "build")];
+}
+function findBuildOutput(cwd) {
+  const lookedIn = [];
+  for (const dir of candidateDirs(cwd)) {
+    lookedIn.push(dir);
+    if (!existsSync13(dir)) continue;
+    const found = globSync(MANIFEST_GLOB, { cwd: dir, absolute: true, dot: false });
+    if (found.length === 0) continue;
+    const manifestPath = found[0];
+    const publicDir = join17(dir, "public");
+    if (!existsSync13(publicDir)) continue;
+    return { manifestPath, publicDir, ...dateOf(dir, manifestPath) };
+  }
+  const pkg = readProjectPackageJson(cwd);
+  const builds = typeof pkg.scripts?.["build"] === "string" || pkg.nx?.targets?.["build"] !== void 0;
+  const declaresOutputs = Array.isArray(pkg.nx?.targets?.["build"]?.["outputs"]);
+  return {
+    reason: builds ? `no bundle figure: this module declares a build and wrote no entry manifest, so ${declaresOutputs ? "build it before measuring" : "declare that build's outputs on its nx target the way apps/front/career does"}. A build target with no declared \`outputs\` is still cached, and on a cache hit nx reports the task successful, restores no file and leaves the directory empty, so every job that reads the build sees nothing. Measured on this monorepo: 5 of the 48 projects with a build target are in that state.` : "no bundle figure: this module declares no build, so it writes no entry manifest and there is nothing to measure here. A component library and a back-end service are in that case by construction, and no action follows.",
+    lookedIn
+  };
+}
+function dateOf(dir, manifestPath) {
+  const record = join17(dir, "nitro.json");
+  if (existsSync13(record)) {
+    try {
+      const parsed = JSON.parse(readFileSync14(record, "utf8"));
+      if (typeof parsed.date === "string") {
+        const date = new Date(parsed.date);
+        if (!Number.isNaN(date.getTime())) return { builtAt: date, builtAtFrom: "build record" };
+      }
+    } catch {
+    }
+  }
+  return { builtAt: statSync4(manifestPath).mtime, builtAtFrom: "file timestamp" };
+}
+function isBuildOutput(found) {
+  return "manifestPath" in found;
+}
+
+// src/roles/static-analysis/bundle/scan.ts
+var KIND_BY_EXTENSION = [
+  [/\.(?:js|mjs|cjs)$/, "js"],
+  [/\.css$/, "css"],
+  [/\.(?:png|jpe?g|gif|svg|webp|avif)$/, "img"],
+  [/\.(?:woff2?|ttf|otf|eot)$/, "font"]
+];
+function kindOf(path2) {
+  for (const [pattern, kind] of KIND_BY_EXTENSION) if (pattern.test(path2)) return kind;
+  return "other";
+}
+function resolveAnnounced(publicDir, announced) {
+  const direct = join18(publicDir, announced);
+  if (existsSync14(direct)) return direct;
+  const stripped = join18(publicDir, announced.replace(/^\/[^/]+\//, "/"));
+  return existsSync14(stripped) ? stripped : void 0;
+}
+function emptyWeight() {
+  return { transfer: 0, parsed: 0, files: 0 };
+}
+function add(into, bytes) {
+  into.transfer += bytes.transfer;
+  into.parsed += bytes.parsed;
+  into.files += 1;
+}
+function groupOf(fileName) {
+  return fileName.replace(/-[A-Za-z0-9_-]+\.(?:js|mjs|cjs)$/, "");
+}
+async function scanBundle(cwd) {
+  const found = findBuildOutput(cwd);
+  if (!isBuildOutput(found)) return { notMeasured: found, unresolved: [] };
+  const manifest = await loadManifest(found.manifestPath);
+  if (manifest === void 0) {
+    return {
+      notMeasured: {
+        reason: "the entry manifest was found but could not be read, so no figure is produced rather than a partial one.",
+        lookedIn: [found.manifestPath]
+      },
+      unresolved: []
+    };
+  }
+  const routes = manifest.routes ?? {};
+  const unresolved = [];
+  const measured = /* @__PURE__ */ new Map();
+  const sizeOf = (announced) => {
+    if (!measured.has(announced)) {
+      const path2 = resolveAnnounced(found.publicDir, announced);
+      if (path2 === void 0) {
+        unresolved.push(announced);
+        measured.set(announced, void 0);
+      } else {
+        const buffer = readFileSync15(path2);
+        measured.set(announced, {
+          parsed: buffer.length,
+          transfer: gzipSync(buffer, { level: 9 }).length
+        });
+      }
+    }
+    return measured.get(announced);
+  };
+  const referencesOf = (ids) => {
+    const out = /* @__PURE__ */ new Set();
+    for (const id of ids) {
+      for (const preload of routes[id]?.preloads ?? []) out.add(preload);
+      for (const asset of routes[id]?.assets ?? []) {
+        const href = asset?.attrs?.href;
+        if (href !== void 0) out.add(href);
+      }
+    }
+    return out;
+  };
+  const weigh = (set) => {
+    const by = {};
+    for (const announced of set) {
+      const size = sizeOf(announced);
+      if (size === void 0) continue;
+      const kind = kindOf(announced);
+      add(by[kind] ??= emptyWeight(), size);
+    }
+    return by;
+  };
+  const initialLoad = weigh(referencesOf(["__root__"]));
+  const everyReference = referencesOf(Object.keys(routes));
+  const entrySet = weigh(everyReference);
+  const js = initialLoad.js ?? emptyWeight();
+  const verdict = {
+    transferVsBudget: bandFor(js.transfer / 1024, TRANSFER_REFERENCES.budgetKb),
+    transferVsWebMedian: bandFor(js.transfer / 1024, TRANSFER_REFERENCES.webMedianKb),
+    parsedVsBudget: bandFor(js.parsed / 1024, PARSED_BUDGET_KB)
+  };
+  return {
+    initialLoad,
+    entrySet,
+    dynamic: scanDynamicLayer(found.publicDir, everyReference),
+    heaviest: heaviestPerKind(everyReference, sizeOf),
+    verdict,
+    conditions: { builtAt: found.builtAt, builtAtFrom: found.builtAtFrom, brandKnown: false },
+    unresolved
+  };
+}
+async function loadManifest(path2) {
+  try {
+    const loaded = await import(pathToFileURL(path2).href);
+    if (typeof loaded.tsrStartManifest !== "function") return void 0;
+    const produced = loaded.tsrStartManifest();
+    return produced !== null && typeof produced === "object" ? produced : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function heaviestPerKind(references, sizeOf) {
+  const best = /* @__PURE__ */ new Map();
+  for (const announced of references) {
+    const size = sizeOf(announced);
+    if (size === void 0) continue;
+    const kind = kindOf(announced);
+    const current = best.get(kind);
+    if (current !== void 0 && current.weight.parsed >= size.parsed) continue;
+    best.set(kind, {
+      name: basename(announced),
+      kind,
+      weight: { ...size, files: 1 },
+      band: bandFor(size.parsed / 1024, PER_SCRIPT_KB)
+    });
+  }
+  return [...best.values()].sort((a, b) => b.weight.parsed - a.weight.parsed);
+}
+function scanDynamicLayer(publicDir, references) {
+  const referenced = new Set([...references].map((announced) => basename(announced)));
+  const groups = /* @__PURE__ */ new Map();
+  const all2 = emptyWeight();
+  for (const path2 of globSync2("assets/*.{js,mjs,cjs}", {
+    cwd: publicDir,
+    absolute: true,
+    dot: false
+  })) {
+    const name = basename(path2);
+    if (referenced.has(name)) continue;
+    const buffer = readFileSync15(path2);
+    const size = { parsed: buffer.length, transfer: gzipSync(buffer, { level: 9 }).length };
+    add(all2, size);
+    const group = groupOf(name);
+    groups.set(group, [...groups.get(group) ?? [], size]);
+  }
+  const upperBound = emptyWeight();
+  const lowerBound = emptyWeight();
+  for (const variants of groups.values()) {
+    add(upperBound, {
+      transfer: Math.max(...variants.map((v) => v.transfer)),
+      parsed: Math.max(...variants.map((v) => v.parsed))
+    });
+    add(lowerBound, {
+      transfer: Math.min(...variants.map((v) => v.transfer)),
+      parsed: Math.min(...variants.map((v) => v.parsed))
+    });
+  }
+  return {
+    all: all2,
+    upperBound,
+    lowerBound,
+    groups: groups.size,
+    groupsWithVariants: [...groups.values()].filter((v) => v.length > 1).length
+  };
+}
+
+// src/roles/static-analysis/complexity/scan.ts
+import { readFileSync as readFileSync16 } from "node:fs";
+import { globSync as globSync3 } from "tinyglobby";
+
+// src/roles/static-analysis/adapters/jscpd/tool-config.ts
+import { existsSync as existsSync16, mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join20 } from "node:path";
+
+// src/roles/static-analysis/configs/resolve.ts
+import { existsSync as existsSync15 } from "node:fs";
+import { join as join19 } from "node:path";
+import { pathToFileURL as pathToFileURL2 } from "node:url";
 var STATIC_CONFIG_FILE = "static-analysis.config.mjs";
 async function loadStaticConfig(cwd) {
-  const path = join17(cwd, STATIC_CONFIG_FILE);
-  if (!existsSync13(path)) {
+  const path2 = join19(cwd, STATIC_CONFIG_FILE);
+  if (!existsSync15(path2)) {
     return { config: defineStaticAnalysis(), from: null, unreadable: null };
   }
   try {
-    const loaded = await import(pathToFileURL(path).href);
+    const loaded = await import(pathToFileURL2(path2).href);
     return { config: adopt(loaded.default), from: STATIC_CONFIG_FILE, unreadable: null };
   } catch (error) {
     return {
@@ -4784,197 +5049,2463 @@ function adopt(exported) {
   return defineStaticAnalysis(exported);
 }
 
+// src/roles/static-analysis/adapters/jscpd/tool-config.ts
+var OWN_ARTEFACTS = [`**/${STATIC_CONFIG_FILE}`, `**/${REPORT_DIR}/**`];
+function testGlobs(config) {
+  const relative5 = config.duplication.tests;
+  return {
+    ignore: relative5.map((glob) => `**/${glob}`),
+    // A one-item brace group is avoided rather than trusted: nothing guarantees `{x}` expands.
+    pattern: relative5.length === 1 ? `**/${relative5[0]}` : `**/{${relative5.join(",")}}`
+  };
+}
+function exclusions(config, scope = "tests") {
+  const tests = scope === "product" ? testGlobs(config).ignore : [];
+  return [.../* @__PURE__ */ new Set([...config.ignore, ...OWN_ARTEFACTS, ...tests])];
+}
+function measuredRoots(cwd) {
+  return existsSync16(join20(cwd, "src")) ? ["src"] : ["."];
+}
+function fileSettings(config, scope, extraEntries = []) {
+  return {
+    // The detection window. Stated rather than defaulted, because it decides what is invisible.
+    minTokens: config.duplication.minTokens,
+    minLines: config.duplication.minLines,
+    // `format` is jscpd's name for what we call `languages`. Naming `typescript` alone would
+    // leave out `.tsx`, which is a separate language to it: 300 files of 523 on front/console.
+    format: config.languages,
+    ignore: exclusions(config, scope),
+    // A scan that analyses nothing otherwise exits 0 with only a warning, which reads as a pass.
+    failOnEmpty: true,
+    // The dead-code engine keeps its own section, and its own `minLines`: jscpd's documentation is
+    // explicit that the top-level one is about clones and is never carried into a dead-code run.
+    deadCode: {
+      // ⛔ The module's declared patterns PLUS the files another module imports. Seeding the walk
+      // rather than replacing it keeps what it does well, transitivity: a file reachable only
+      // through a dead one stays dead. Without these seeds a library has no entry point at all, so
+      // the walk reports "the module does not import itself", true of every library: 87 files on
+      // `libs/nest/auth` against 12 that nothing anywhere imports. See `workspace/consumers.ts`.
+      entry: [...config.entry, ...extraEntries],
+      minConfidence: config.deadCode.minConfidence,
+      categories: config.deadCode.categories
+    },
+    // The escape hatch, last so it wins, and empty unless a module asked for it.
+    ...config.tools.jscpd
+  };
+}
+function duplicationRun(config, paths, scope) {
+  const dir = mkdtempSync(join20(tmpdir(), "sentinel-static-"));
+  const configPath = join20(dir, "jscpd.json");
+  writeFileSync3(configPath, `${JSON.stringify(fileSettings(config, scope), null, 2)}
+`, "utf8");
+  const args = [
+    "--config",
+    configPath,
+    // The test pass SELECTS its files; the product pass excludes them through `ignore` above. A
+    // flag and not a config key, because `--pattern` is the only documented way in and it takes
+    // exactly one glob, braces expanded. Verified: 478 product files + 87 test files = the 565 of
+    // a blended scan on `apps/front/console`.
+    ...scope === "tests" ? ["--pattern", testGlobs(config).pattern] : [],
+    // Always json, and only json, whatever shape the caller asked for. The four shapes are
+    // rendered by this role from the figures, not by the tool: one report lives under
+    // `static-analysis`, assembled from several passes, so a per-pass console table from the tool
+    // would be a fourth voice saying the same numbers differently. `--output` below is jscpd's
+    // output DIRECTORY, not our `--output` shape.
+    "--reporters",
+    "json",
+    "--output",
+    dir,
+    "--no-tips",
+    ...paths
+  ];
+  return { args, rawReportDir: dir, dispose: () => rmSync3(dir, { force: true, recursive: true }) };
+}
+function deadCodeRun(config, paths, extraEntries = []) {
+  const dir = mkdtempSync(join20(tmpdir(), "sentinel-static-"));
+  const configPath = join20(dir, "jscpd.json");
+  writeFileSync3(
+    configPath,
+    `${JSON.stringify(fileSettings(config, "dead-code", extraEntries), null, 2)}
+`,
+    "utf8"
+  );
+  return {
+    args: [
+      "--config",
+      configPath,
+      "--dead-code",
+      "--reporters",
+      "json",
+      "--output",
+      dir,
+      "--no-tips",
+      ...paths
+    ],
+    rawReportDir: dir,
+    dispose: () => rmSync3(dir, { force: true, recursive: true })
+  };
+}
+var RAW_REPORT = {
+  duplication: "jscpd-report.json",
+  "dead-code": "basta-report.json"
+};
+
+// src/roles/static-analysis/complexity/cyclomatic.ts
+import { parseSync as parseSync2 } from "oxc-parser";
+var FUNCTION_NODES = /* @__PURE__ */ new Set([
+  "FunctionDeclaration",
+  "FunctionExpression",
+  "ArrowFunctionExpression"
+]);
+var DECISION_NODES = /* @__PURE__ */ new Set([
+  "IfStatement",
+  "ForStatement",
+  "ForInStatement",
+  "ForOfStatement",
+  "WhileStatement",
+  "DoWhileStatement",
+  "CatchClause",
+  "ConditionalExpression"
+]);
+var DECISION_OPERATORS = /* @__PURE__ */ new Set(["&&", "||", "??"]);
+var DECISION_ASSIGNMENTS = /* @__PURE__ */ new Set(["&&=", "||=", "??="]);
+function walk2(node, visit, stopAt) {
+  if (!node || typeof node !== "object") return;
+  if (Array.isArray(node)) {
+    for (const child of node) walk2(child, visit, stopAt);
+    return;
+  }
+  const current = node;
+  if (typeof current.type === "string") {
+    if (stopAt(current)) return;
+    visit(current);
+  }
+  for (const [field, value] of Object.entries(current)) {
+    if (field === "type" || field === "start" || field === "end") continue;
+    walk2(value, visit, stopAt);
+  }
+}
+function complexityOf(fn) {
+  let count = 1;
+  for (const parameter of Array.isArray(fn.params) ? fn.params : []) {
+    walk2(
+      parameter,
+      (node) => {
+        if (node.type === "AssignmentPattern") count += 1;
+      },
+      (node) => FUNCTION_NODES.has(node.type ?? "")
+    );
+  }
+  const body = fn.body ?? fn;
+  let root = true;
+  walk2(
+    body,
+    (node) => {
+      if (DECISION_NODES.has(node.type ?? "")) count += 1;
+      if (node.type === "AssignmentPattern") count += 1;
+      if (node.type === "SwitchCase" && node.test !== null && node.test !== void 0) count += 1;
+      if (node.type === "LogicalExpression" && DECISION_OPERATORS.has(String(node.operator ?? ""))) {
+        count += 1;
+      }
+      if (node.type === "AssignmentExpression" && DECISION_ASSIGNMENTS.has(String(node.operator ?? ""))) {
+        count += 1;
+      }
+      if ((node.type === "MemberExpression" || node.type === "CallExpression") && node.optional === true) {
+        count += 1;
+      }
+    },
+    (node) => {
+      if (root) {
+        root = false;
+        return false;
+      }
+      return FUNCTION_NODES.has(node.type ?? "");
+    }
+  );
+  return count;
+}
+function nameOf(fn, parent) {
+  const own = fn.id?.name;
+  if (own) return own;
+  const key = parent?.id?.name ?? parent?.key?.name;
+  if (key) return key;
+  return "(anonymous)";
+}
+function lineAt(source, offset) {
+  if (offset === void 0) return 1;
+  let line = 1;
+  for (let index = 0; index < offset && index < source.length; index += 1) {
+    if (source[index] === "\n") line += 1;
+  }
+  return line;
+}
+function complexityOfFile(path2, source) {
+  const parsed = parseSync2(path2, source);
+  if (parsed.errors.length > 0) return [];
+  const found = [];
+  const parents = /* @__PURE__ */ new Map();
+  walk2(
+    parsed.program,
+    (node) => {
+      for (const value of Object.values(node)) {
+        if (value && typeof value === "object" && !Array.isArray(value)) {
+          parents.set(value, node);
+        }
+      }
+      if (!FUNCTION_NODES.has(node.type ?? "")) return;
+      found.push({
+        name: nameOf(node, parents.get(node)),
+        line: lineAt(source, node.start),
+        complexity: complexityOf(node)
+      });
+    },
+    () => false
+  );
+  return found;
+}
+
+// src/roles/static-analysis/complexity/scan.ts
+var RISK_BANDS = [
+  { metric: "complexityModerate", from: 11, to: 20, label: "moderate risk" },
+  { metric: "complexityHigh", from: 21, to: 50, label: "high risk" },
+  { metric: "complexityUntestable", from: 51, to: Infinity, label: "untestable" }
+];
+var MCCABE_REFERENCE = RISK_BANDS[0].from;
+function productFiles(cwd, config) {
+  const extensions = extensionsOf(config.languages).map((extension) => extension.slice(1)).join(",");
+  return globSync3(
+    measuredRoots(cwd).map(
+      (root) => root === "." ? `**/*.{${extensions}}` : `${root}/**/*.{${extensions}}`
+    ),
+    {
+      cwd,
+      ignore: exclusions(config, "product"),
+      dot: false
+    }
+  );
+}
+function scanComplexity(cwd, config) {
+  const files = productFiles(cwd, config);
+  const all2 = [];
+  for (const path2 of files) {
+    let source;
+    try {
+      source = readFileSync16(`${cwd}/${path2}`, "utf8");
+    } catch {
+      continue;
+    }
+    for (const fn of complexityOfFile(path2, source)) all2.push({ ...fn, path: path2 });
+  }
+  all2.sort((left, right) => right.complexity - left.complexity);
+  const bands = {};
+  for (const band of RISK_BANDS) {
+    bands[band.metric] = all2.filter(
+      (fn) => fn.complexity >= band.from && fn.complexity <= band.to
+    ).length;
+  }
+  return {
+    files: files.length,
+    functions: all2.length,
+    max: all2[0]?.complexity ?? 0,
+    complex: all2.filter((fn) => fn.complexity >= MCCABE_REFERENCE),
+    bands
+  };
+}
+
+// src/roles/static-analysis/coverage.ts
+import path from "node:path";
+import { globSync as globSync4 } from "tinyglobby";
+var UNREADABLE_EXTENSIONS = [".svelte", ".vue", ".astro"];
+function hasUnreadableCode(coverage) {
+  return coverage.unread > 0;
+}
+function coverageOf(cwd, config) {
+  const ignore = exclusions(config, "product");
+  const readable = extensionsOf(config.languages).map((extension) => extension.slice(1)).join(",");
+  const roots = measuredRoots(cwd);
+  const under = (extensions) => roots.map((root) => root === "." ? `**/*.{${extensions}}` : `${root}/**/*.{${extensions}}`);
+  const read = readable ? globSync4(under(readable), { cwd, ignore, dot: false }).length : 0;
+  const unreadable = UNREADABLE_EXTENSIONS.map((extension) => extension.slice(1)).join(",");
+  const found = globSync4(under(unreadable), { cwd, ignore, dot: false });
+  const total = read + found.length;
+  return {
+    read,
+    unread: found.length,
+    share: total === 0 ? 0 : found.length / total,
+    extensions: [...new Set(found.map((file) => path.extname(file)))].sort()
+  };
+}
+function unreadableNote(coverage) {
+  const percent = Math.round(coverage.share * 100);
+  const kinds = coverage.extensions.join(", ");
+  return `${coverage.unread} product file(s) in ${kinds} cannot be parsed, ${percent}% of this module: no graph and no dead-code figure is reported, because a file the role cannot open still imports the files it imports`;
+}
+
+// src/roles/static-analysis/excerpt.ts
+import { readFileSync as readFileSync17 } from "node:fs";
+import { join as join22 } from "node:path";
+
+// src/roles/static-analysis/help/bundle.ts
+var WEB_DEV_TREE_SHAKING = "https://web.dev/articles/reduce-javascript-payloads-with-tree-shaking";
+var WEB_DEV_SCRIPT_EVALUATION = "https://web.dev/articles/script-evaluation-and-long-tasks";
+var V8_COST_2019 = "https://v8.dev/blog/cost-of-javascript-2019";
+var PATTERNS_SPLITTING = "https://www.patterns.dev/vanilla/bundle-splitting/";
+var TWO_COSTS = 'Compression changes what crosses the network and nothing about what the engine reads: "900 KB of decompressed JavaScript is still 900 KB to the parser and compiler, even though it may be roughly 300 KB when compressed."';
+var BANDS2 = "The word beside the figure is its band: `ok` below 70% of the reference, `near` from 70% to 100%, `exceed` above it. `near` exists because a figure that crosses a line without warning crosses it in a release nobody was watching.";
+var actionable = {
+  bundleInitialTransfer: {
+    label: "Initial load, transfer",
+    what: "The gzipped weight of the JavaScript the entry pulls, which is what crosses the network on a first visit.",
+    read: "Higher is worse, against two references that both measure transfer: 170 KB, the budget for getting interactive in five seconds on a slow 3G connection on a median mobile device, and 747.5 KB, the median page on the web. Sitting below the median and above the budget at the same time is an ordinary position, and both readings are true: the first says we are normal, the second says we are not yet good. " + BANDS2,
+    caveat: `It says nothing about the cost of RUNNING the code. ${TWO_COSTS} The row below is that other cost, and the ratio between the two is not a constant: it varies with the content of each chunk, so neither figure can be derived from the other. This is also not what a returning visitor pays, because the HTTP cache and the engine's own code cache change that picture entirely.`,
+    source: 'The 170 KB budget and its conditions are published together, as is its decompressed equivalent. The median is HTTP Archive\u2019s `bytesJs`, defined there as "the sum of transfer size kilobytes of all external scripts requested by the page", which is why it may only be compared to a compressed figure. gzip rather than brotli deliberately: the build precompresses nothing, so this role compresses for itself, and gzip is the conservative bound because it is always larger than brotli. If the edge serves brotli we are lighter than reported, which is the acceptable direction to be wrong in.',
+    links: [
+      { label: "Why compression does not help the parser", url: WEB_DEV_TREE_SHAKING },
+      { label: "HTTP Archive, page weight", url: "https://httparchive.org/reports/page-weight" },
+      { label: "Bundle splitting", url: PATTERNS_SPLITTING }
+    ],
+    fix: "Split by route, so one screen stops shipping what the others need. Then defer whatever the first interaction does not use."
+  },
+  bundleInitialParsed: {
+    label: "Initial load, to parse",
+    what: "The same files, decompressed: the size the engine actually reads, parses and compiles.",
+    read: "Higher is worse, against 717 KB, published as the decompressed equivalent of the same mobile budget. Read it beside the transfer row rather than instead of it: a chunk of mostly repetitive code compresses well and still costs the engine every byte. " + BANDS2,
+    caveat: "\u26D4 A byte count is not a duration, and this is deliberately not converted into one: no primary source publishes an engine parse throughput, so any millisecond figure derived from kilobytes would be invented. What IS published is per-device, for 1 MB decompressed: 280 ms on a high-end phone, 1781 ms on a median one, 6010 ms on a sub-$100 one. It also says nothing about which of these bytes are USED. A function that is never called is preparsed rather than fully parsed, so dead code costs less than live code, not nothing, and no static measurement can tell which is which.",
+    source: `${TWO_COSTS} Stated by the platform documentation rather than inferred. \u26A0\uFE0F One correction worth carrying: the engine team retired "parse is the dominant cost" in 2019, stating that "the dominant costs of processing scripts are now download and CPU execution time". The widely quoted per-device parse figures predate that, which is why this row is presented as weight rather than as time.`,
+    links: [
+      { label: "The decompressed figure is the one that matters", url: WEB_DEV_TREE_SHAKING },
+      {
+        label: "What the engine does with code it may never run",
+        url: "https://v8.dev/blog/preparser"
+      },
+      { label: "Where the cost actually sits, measured", url: V8_COST_2019 }
+    ],
+    fix: "Ship less code. Drop a polyfill the supported browsers no longer need, or replace a big library with the platform. Splitting moves these bytes, it does not remove them."
+  },
+  bundleHeaviestAsset: {
+    label: "Heaviest single asset",
+    what: "The largest file an ENTRY REFERENCES, of its type, decompressed. \u26D4 Not the largest file emitted: a chunk loaded lazily is referenced by no entry, so it never appears here however heavy it is. Measured on `apps/front/console`, the heaviest unreferenced chunk is 233 KB, 2.3 times the per-script reference; it is inside the dynamic layer figure instead.",
+    read: "Higher is worse, against 100 KB for one script, which the platform documentation calls a good target, and against the engine team\u2019s own advice to split a bundle once it passes roughly 50 to 100 kB. " + BANDS2,
+    caveat: "A large chunk is not automatically a defect. A third-party chunk every entry shares is legitimately big, and splitting it further has a cost of its own, which is the file-count row. It says nothing about whether those bytes are used, and nothing about whether this asset is on the critical path: an asset pulled by one rare screen and an asset pulled by all of them have the same weight here and not the same importance.",
+    source: "The 100 KB per-script target is published by the platform documentation on script evaluation; the 50 to 100 kB splitting advice is the engine team\u2019s, stated with HTTP/2 multiplexing assumed.",
+    links: [
+      { label: "Script evaluation and long tasks", url: WEB_DEV_SCRIPT_EVALUATION },
+      { label: "Bundle splitting", url: PATTERNS_SPLITTING },
+      {
+        label: "Vite build options, including manualChunks",
+        url: "https://vite.dev/config/build-options"
+      }
+    ],
+    fix: "Separate library code from your own with `manualChunks`, then split by route. \u26A0\uFE0F Neither is configured on any front here today."
+  },
+  bundleDynamicLayer: {
+    label: "Dynamic layer, one variant per group",
+    what: "The weight of the files the build emits that no entry references statically, counted once per group rather than once per variant.",
+    read: "A **ceiling**, not an average, and the pair of bounds is the point: the upper figure takes the heaviest variant of every group, the lower one the lightest, so the gap between them is the spread between variants. Read the upper bound as what reaching every group in one variant would cost, which no single session does.",
+    caveat: "\u26D4 It is not additive with the initial load and it is not a total either. A reader pays a SUBSET: one variant, and only the groups the screens they visit actually need. The role cannot say which subset, because that depends on navigation, and attributing a dynamically imported file to the screen that pulls it is not something the entry manifest records. \u26A0\uFE0F Counting every variant instead, which is what reading the output directory gives, overstates this by the number of variants, and ignoring the layer understates the application by more than half on two of the fronts measured here.",
+    source: "The role\u2019s own pass: every emitted script the entry manifest does not reference, grouped by filename stem so variants of one group collapse, then bounded. Confirmed to be translation chunks by reading them, one group per namespace and one variant per locale. \u26A0\uFE0F The grouping is a filename convention, so it is evidence rather than proof: a future bundler naming scheme would need the grouping re-checked, and the file count beside the figure is what makes a wrong grouping visible.",
+    links: [
+      {
+        label: "Import on visibility",
+        url: "https://www.patterns.dev/vanilla/import-on-visibility/"
+      },
+      {
+        label: "Import on interaction",
+        url: "https://www.patterns.dev/vanilla/import-on-interaction/"
+      },
+      {
+        label: "Why the decompressed figure is the one the engine pays",
+        url: WEB_DEV_TREE_SHAKING
+      }
+    ],
+    fix: "Load a group only on the screen that needs it. Many small groups cost a reader far less than the same bytes in a few large ones."
+  }
+};
+var context = {
+  bundleInitialFiles: {
+    label: "Initial load, files",
+    what: "How many separate JAVASCRIPT files the entry pulls. \u26A0\uFE0F Stylesheets, fonts and images are not in it, and this page carries no figure for them.",
+    read: "A direction rather than a target, and it sits between two opposite costs: too few means one large file that cannot be cached or replaced independently, too many means the browser spends longer discovering what the page needs.",
+    caveat: '\u26D4 There is no threshold here and none is invented. The only published statement is a direction: a front that halved its bundles reported that "too many chunks would result in the browser spending significantly more time in discovering all the modules needed for the page", despite HTTP/2 multiplexing. So read this as context for the two weights, never as a verdict on its own.',
+    fix: "Nothing to do. There is no target here: too few files means one big one that cannot be cached alone, too many means a slower start.",
+    source: 'The direction is reported by a file-sharing front\u2019s own engineering write-up of a bundler migration, which also measured a 33% reduction in bundle sizes against only "modest" improvements in its own perceived-load metric. The count itself comes from the entry manifest.',
+    links: [
+      {
+        label: "A bundler migration, measured and reported honestly",
+        url: "https://dropbox.tech/frontend/how-we-reduced-the-size-of-our-javascript-bundles-by-33-percent"
+      },
+      { label: "Bundle splitting", url: PATTERNS_SPLITTING }
+    ]
+  },
+  bundleEntrySet: {
+    label: "Referenced by the entries",
+    what: "The JAVASCRIPT weight of everything some entry references statically, across all entries. \u26A0\uFE0F Stylesheets, fonts and images are outside it.",
+    read: "\u26D4 Not a user cost: nobody downloads all of it. Read it as code-splitting health. A large figure beside a small initial load is splitting doing its job; a figure close to the initial load means one entry is carrying the whole application.",
+    caveat: '\u26A0\uFE0F This is deliberately NOT called "total emitted", because it is not the total: the build writes files no entry references, and on one front measured here that gap was 1326 files against 10 referenced. The dynamic layer above is that gap. Comparing this figure to a page-weight budget is the other trap, because a budget describes one page load and this describes an application. And summing the output directory would be worse than either: the server bundle and the per-brand assets live there, and no page load fetches them.',
+    fix: "Nothing to do. It is everything the entries can reach, which nobody downloads at once. It sets the ceiling for the figures above it.",
+    source: "This role\u2019s own count over the bundler\u2019s entry manifest, which is the only artefact that states which emitted files an entry references."
+  }
+};
+var bundleHelp = { ...actionable, ...context };
+
 // src/roles/static-analysis/help/metrics.ts
 var metricsHelp = {
   duplicatedLinesPercent: {
     label: "Duplicated lines",
-    what: "The share of lines jscpd found in at least one clone, over the lines it scanned.",
-    read: "Higher is worse. It is computed per module, so two modules compare directly; the repository-wide figure is not the average of theirs, because modules differ in size.",
-    caveat: "A clone is not automatically a defect. Two screens that genuinely do the same thing are supposed to look alike, and extracting them can couple two features that have no reason to change together. The usual reading is the Rule of Three: a second occurrence is tolerable, a third is the signal to refactor. This share cannot apply that rule for you, because it counts lines, not how many times one fragment occurs.",
+    what: "The share of lines jscpd found in at least one clone, over the lines of the files it was able to scan.",
+    read: "Higher is worse. It is computed per module, so two modules compare directly as long as they measured with the same settings, which is what the settings printed under the figures are for; the repository-wide figure is not the average of theirs, because modules differ in size.",
+    caveat: "A clone is not automatically a defect. Two screens that genuinely do the same thing are supposed to look alike, and extracting them can couple two features that have no reason to change together. The usual reading is the Rule of Three: a second occurrence is tolerable, a third is the signal to refactor. This share cannot apply that rule for you, because it counts lines, not how many times one fragment occurs. The denominator is also narrower than the module: a file shorter than the detection window cannot contain a clone, so the tool leaves it out of both counts, which on one front app is 31 files of 596, or 5%.",
+    fix: "Extract the shared code once, where both copies can see it. \u26A0\uFE0F Open the list below by length first: one long pair costs more than ten short ones.",
     source: "jscpd, over the token stream rather than the text: for JavaScript and TypeScript the tokens come from the oxc parser, which emits neither whitespace nor comments, so reindenting a block is not a clone and `--mode` measured identical on all three values. Rule of Three: Fowler, Refactoring, crediting Don Roberts."
   },
+  complexityMax: {
+    label: "Complexity, worst function",
+    what: "McCabe's number for the single hardest function of the module's product code.",
+    read: "One number for the module, and the only one of the pair that names a place to go: the function itself is in the list below. Read it against the two published references, 10 and 30, rather than against another module, because a module of 200 functions and one of 2 000 are not comparable on a maximum.",
+    caveat: "It says nothing about how MANY functions are hard, which is what the count beside it is for, and nothing about whether the hardest one is wrong: a parser or a state machine legitimately branches. It is also not what the linter refuses. The `nest` lint preset already fails a build at 30 per function, and the five other presets carry no complexity rule at all, so this figure is the only thing a LINT RUN tells those modules. \u26A0\uFE0F It is not their only visibility here: the size gauge runs in every module whatever its preset, so the same page carries a complexity count per file and a cognitive-complexity one below this row.",
+    fix: "Split this function. Each early return and each block you could name is a place to cut. It is one function, so the work is bounded.",
+    source: "Computed over the oxc tree by this role, because no tool we have gives it per function: jscpd sums it per FILE, verified on fixtures where ten trivial functions score the same as one function of 10, and escomplex fails to parse 32.6% of one nest service. The counting rule is the common one, ESLint's set of decision points, held against values computed by hand in `tests/static-analysis-cyclomatic.test.ts`."
+  },
+  complexityModerate: {
+    label: "Complexity 11-20, moderate risk",
+    what: "How many functions sit in McCabe's second band, out of how many were measured.",
+    read: "The ordinary band to find something in. A function here is readable and worth a second look when it changes often, not a defect.",
+    caveat: 'A band is a statement about testing effort, not about correctness: McCabe proposed them as the number of independent paths a test suite would have to cover. A parser or a state machine legitimately sits here. \u26D4 Nothing in this role fails on a band, and the line this repository actually refuses is elsewhere: `complexity: ["error", 30]` per function in the `nest` lint preset, which sits inside the NEXT band, and the five other presets carry no complexity rule at all.',
+    fix: "Nothing to do. This is the healthy middle. It is here to give the two bands below a denominator.",
+    source: "McCabe, \"A Complexity Measure\", IEEE TSE SE-2(4), 1976, for the count and for the bands, as published by SonarSource and summarised by Sourcegraph. The counting rule is this role's own, over the oxc tree, and it was held against oxlint's own `complexity` rule on this package, its threshold lowered to 1 so that it reports every function it can: 839 functions over 181 files, 839 identical values, not one disagreement. Compared per FILE as a multiset of values rather than by function name, because oxlint writes six shapes of message and matching on the name silently drops four of them. The 182nd file is `plugins/hublo.js`, which oxlint declines to lint because it is git-ignored, so its 8 functions are unverified rather than contested."
+  },
+  complexityHigh: {
+    label: "Complexity 21-50, high risk",
+    what: "How many functions sit in McCabe's third band.",
+    read: "The band worth acting on, and the one the `nest` lint preset cuts through at 30. A function here needs either a split or a very good reason, and the list below names each one with its line.",
+    caveat: "Same reserve as the band below: it measures paths, not defects. What makes this band different is that it brackets the only complexity line this repository enforces, so a function at 25 is high risk by the published scale and perfectly acceptable to the build, while one at 35 fails a nest build and passes everywhere else.",
+    fix: "Plan a split rather than waiting for the next change. At this size nobody tidies a function while passing through, so it only gets worse.",
+    source: "McCabe, \"A Complexity Measure\", IEEE TSE SE-2(4), 1976, for the count and for the bands, as published by SonarSource and summarised by Sourcegraph. The counting rule is this role's own, over the oxc tree, and it was held against oxlint's own `complexity` rule on this package, its threshold lowered to 1 so that it reports every function it can: 839 functions over 181 files, 839 identical values, not one disagreement. Compared per FILE as a multiset of values rather than by function name, because oxlint writes six shapes of message and matching on the name silently drops four of them. The 182nd file is `plugins/hublo.js`, which oxlint declines to lint because it is git-ignored, so its 8 functions are unverified rather than contested."
+  },
+  complexityUntestable: {
+    label: "Complexity over 50, untestable",
+    what: "How many functions sit in McCabe's top band, the one he called untestable.",
+    read: "Read it as a count of places no test suite can cover exhaustively, and expect it to be zero. Any value here is the first thing to look at in the module.",
+    caveat: "The word is McCabe's and it is about path coverage, not about whether the function works: a 60-path function can be correct and well tested in practice. What it does say is that nobody can enumerate its behaviour, which is what makes a change to it expensive.",
+    fix: "Treat this file as blocked for changes until the function is split. A test suite cannot cover this many branches, so a change here cannot be verified.",
+    source: "McCabe, \"A Complexity Measure\", IEEE TSE SE-2(4), 1976, for the count and for the bands, as published by SonarSource and summarised by Sourcegraph. The counting rule is this role's own, over the oxc tree, and it was held against oxlint's own `complexity` rule on this package, its threshold lowered to 1 so that it reports every function it can: 839 functions over 181 files, 839 identical values, not one disagreement. Compared per FILE as a multiset of values rather than by function name, because oxlint writes six shapes of message and matching on the name silently drops four of them. The 182nd file is `plugins/hublo.js`, which oxlint declines to lint because it is git-ignored, so its 8 functions are unverified rather than contested."
+  },
+  entryPoints: {
+    label: "Entry points",
+    what: "How many files the reachability walk started from, against how many it scanned.",
+    read: "Read it FIRST, before the dead-code share below, because it says whether that share can mean anything. The further it is from the file count, the more the walk had to prove; when the two are equal, nothing could have been found unreachable.",
+    caveat: "\u26A0\uFE0F Two sources feed it, and they answer different questions. The module DECLARES what runs: a framework bootstrap, a lambda handler, the patterns this role ships. And the workspace says what other modules IMPORT from here, which is the only answer a library has, since its consumers live outside and nothing inside it runs. Measured on `libs/nest/auth`, 57 of 137: a handful declared, the rest imported from the 47 projects that depend on it. A count close to the file count is neither good nor bad, it means this pass had little to decide; a count of zero on a library used to mean the walk had nothing to start from, and the share below was then unreadable rather than clean.",
+    fix: "Nothing to do. It tells you whether the dead-code figures below can mean anything: the further this sits from the file count, the more the walk proved.",
+    source: "jscpd's dead-code statistics, `entryPoints` against `files`. The seeds are the module's own manifest, about fifty framework conventions, the patterns this role declares, and the files another module imports, which come from the workspace index in `workspace/consumers.ts`. The report does not list WHICH files they are, only how many."
+  },
+  deadLinesPercent: {
+    label: "Unreachable lines",
+    what: "The share of scanned lines the reachability walk never reached from an entry point, with the number of files that are unreachable IN FULL beside it. \u26A0\uFE0F The second number does not contain the first: dead lines also come from exports and symbols that are dead inside files the walk does reach, so 0 unreachable files and a non-zero share is a normal reading, not a contradiction.",
+    read: "\u26D4 Read the two denominators together or the figure misleads, and that is measured rather than feared. On `apps/nest/microservices/agency` the line share is 60.21%, which reads as a rotten module or a broken tool; neither is true. 490 of its 504 files are reachable, and ONE unreachable file, a seed data table, holds 52 210 lines, 59.3% of the module by itself. A large line share over a small file share means a generated or seed file, not code anyone writes. Higher is worse, and only once the entry-point count above says the question was decidable. Read it next to the four counts below rather than alone: one number covering files, exports, symbols and imports hides four different kinds of work.",
+    caveat: "\u26D4 This used to warn that a library's files look unreachable because its consumers live outside the scan. That is no longer how the walk starts: it is SEEDED with what other modules import from here, so a library has real entry points. Measured on `libs/front/components`, 473 entry points over 950 files and 8 unreachable files, against the 87 the unseeded walk reported. A finding here now means imported by nobody, anywhere in the workspace, so read it as real rather than as an artefact of the boundary. \u26A0\uFE0F Test, fixture and story files are also outside the reachability graph, verified on a fixture, so a file reached only by a story is reported unreachable; it is true of the product and false of the repository, and `libs/front/components` has one such file of 915 lines.",
+    fix: "Nothing from this number alone. It says how much; the rows under it say where. Start there.",
+    source: "jscpd's dead-code engine, `deadLines` over `totalLines`. The library figures were measured per module with the workspace's own path aliases, and the story case was isolated on a four-file fixture where the only importer was a `.stories.tsx`."
+  },
+  unusedFiles: {
+    label: "Unreachable files",
+    what: "Files of this module that nothing reaches: not its own code, not another module, not a spec.",
+    read: "A candidate for deletion, and the only one of the dead-code rows that names whole files. Zero is the ordinary value for an application whose entry points are declared.",
+    caveat: "\u26A0\uFE0F Two classes remain in it and only one is a deletion: a file nothing reaches at all, and an entry point of a framework this role has not been told about, which is a missing declaration rather than dead code. A THIRD class used to sit here and no longer does: a file reached only by a spec, which the tool labels `used-only-by-tests` itself, is now counted on its own row instead. Measured on `libs/nest/auth`, that moved 5 files out of 20, and the figure now agrees with the reason printed beside each finding instead of contradicting it.",
+    fix: "Delete the file, or import it where it belongs. \u26A0\uFE0F Read the reason beside each one first: some are kept alive by a framework that loads them by name.",
+    source: "jscpd's dead-code walk, category `unused-file`, minus the findings it labels `used-only-by-tests`. The walk starts from the module's declared entry points PLUS the files another module imports, which come from the workspace index: without those seeds a library has no starting point at all and reports 87 unreachable files where 12 are, measured on `libs/nest/auth`."
+  },
+  unusedExports: {
+    label: "Unused exports",
+    what: "Exported names nothing in this module imports.",
+    read: "Low on an application, where an export with no local consumer is usually a leftover. On a library it says almost nothing, for the reason the share above gives.",
+    caveat: "Exports of a file the tool treats as an entry point are NOT counted, deliberately: the tool's own words are that they are usually a public API. So this number is about internal exports, and a module whose every file is an entry point reports zero of them whatever its state.",
+    fix: "Remove the `export` keyword, not the code. Most of these are internal helpers that were exported only so a test could reach them.",
+    source: "jscpd dead-code findings of category `unused-export`."
+  },
+  unusedSymbols: {
+    label: "Unused symbols",
+    what: "Declared names, not exported, that nothing in their own file uses.",
+    read: "A local cleanup rather than a design signal, and usually a small count.",
+    caveat: "The tool scores every finding and names what lowered the score, a file calling `eval`, an unrecognised decorator, a name that appears inside a string literal. Measured on sentinel itself, a confidence floor of 60 yields 22 symbols, 90 yields none, so this count moves with that floor and is printed with it.",
+    fix: "Delete it. Nothing names this symbol, and unlike a file it cannot be reached by a string at runtime.",
+    source: "jscpd dead-code findings of category `unused-symbol`, above the confidence floor."
+  },
+  unusedImports: {
+    label: "Unused imports",
+    what: "Imported names the importing file never uses.",
+    read: "Mostly a lint concern, and it is here because for front applications the linter is not asking. Treat a high count as a lint gap rather than as dead code.",
+    caveat: "\u26A0\uFE0F 85% of these findings, measured over every module scanned on this pass, are `import React from 'react'`, which the modern JSX transform makes unnecessary and the classic one requires, so whether it is removable depends on the module's `jsx` setting and not on this count. Worse for acting on it line by line: `import React, { useState } from 'react'` is reported with the name `React`, and deleting the line takes `useState` with it. It overlaps `typescript/no-unused-vars`, which this repository's `nest`, `react-lib`, `svelte` and `tools` lint presets enable and its `react` preset turns off, which is the only reason the figure is not redundant for front applications.",
+    fix: "Delete the import. The lint role does this for you once the module adopts it, so a number here on an adopted module is a bug worth reporting.",
+    source: "jscpd dead-code findings of category `unused-import`; the 85% and the preset states were measured on this repository's lint presets and the day's scans."
+  },
+  duplicatedLinesPercentTests: {
+    label: "Duplicated lines (tests)",
+    what: "The same share, measured over this module's test files alone.",
+    read: "Read it DIFFERENTLY from the figure above rather than as a worse version of it. Repetition in a spec is often deliberate: a test that spells out its own setup can be read on its own, and factoring that setup into a helper is what makes a failing test hard to diagnose. The figure is here because its size is a fact about the specs, not because it is a debt to pay down.",
+    caveat: "It says nothing about whether the tests are good, and a high value is not automatically a problem: the two common causes are a deliberately explicit setup, which is a defensible style, and a suite copied file by file as the module grew, which is not, and this number cannot tell them apart. The split is also why it exists at all: measured across 8 modules of the three families, 71% of all duplicated lines are between two test files, so a single blended figure was mostly this one wearing the name of the module.",
+    fix: "Probably nothing. A test that reads top to bottom is worth more than one sharing a builder with thirty others. Act only when the same setup drifts between suites.",
+    source: "Same tool and same detection window as the figure above, over the files matching this role's test glob, which is printed under the figures. The 71% was measured on apps/front/console, host-admin, hr-management, libs/front/components, libs/front/shared, apps/nest/microservices/contract, apps/nest/microservices/agency and libs/nest/auth."
+  },
+  clonesTests: {
+    label: "Clones (tests)",
+    what: "How many duplicated fragments the test pass reported.",
+    read: "A count, with the same reserves as the product one above.",
+    caveat: "Everything the product clone count does not say applies here unchanged. One more thing is specific to the split: the two passes partition the files, so a fragment shared between a test and a product file has a partner in NEITHER pass and is counted in neither number. Measured on the same 8 modules, that is 42 entries of 5117, 0.8%, and 650 lines.",
+    fix: "Start with pairs whose two sides are in different suites. Those drift apart without anyone noticing, because nobody runs both at once.",
+    source: "jscpd report statistics for the test pass. The partition and its loss were verified on apps/front/console: 478 product files plus 87 test files are the 565 of a blended scan, and 32 plus 40 are its 72 entries."
+  },
   clones: {
     label: "Clones",
     what: "How many duplicated fragments jscpd reported, each entry linking two places that match.",
     read: "A count, so it grows with the size of the module. Read it next to the duplicated-line share rather than on its own, and treat it as the number of places to go and look at.",
     caveat: "Not a count of duplicated places, and the gap is measured, not theoretical: five identical files produce four entries, all of them naming one file in common, so n copies give n-1 entries, neither n nor the n(n-1)/2 pairs. Worse for reading occurrences, jscpd keeps only the longest match per pair of files, so when a third file shares just part of a block, that block is reported under two different fragments and its real number of occurrences cannot be recovered from the report. Size is invisible too: one clone of sixty lines and one of six both count as one.",
+    fix: "Start with the longest pairs. A pair inside one folder is usually one extraction. A pair across two features is a shared idea nobody has named yet.",
     source: "jscpd report statistics. Counting behaviour measured on fixtures with jscpd 5.4.0; the shared file is not the same one across major versions, so only the count is relied on."
-  }
+  },
+  cycles: {
+    label: "Import cycles",
+    what: "Groups of files that import each other in a circle, directly or through other files.",
+    read: "Expect zero, and read any value as a count of places to go and break one edge. The figure beside it is how many FILES are caught, which is the size of the problem: one group of forty is a different afternoon from twenty groups of two.",
+    caveat: "A group here survives the build, which is a narrowing of what this figure used to report. The edges a build erases are left out: `import type`, `export type`, and an import whose every binding is an inline `type` one. That matters more than it sounds, because over this monorepo they are **100 of 120 groups, 83.3%**, and the files caught in one fall from 327 to 55, so the old figure pointed at five phantom tangles for every real one. A phantom is not nothing, it is a circle in the TYPES, and it still means two files that cannot be understood apart; it just cannot deadlock, because `tsc` and every bundler delete the import that closes it. The erased count is printed beside the figure so a bigger number from madge or from an older report is explained rather than mysterious. It also reports GROUPS and not paths, so a group of six files may contain a dozen distinct circles, and breaking one of them does not necessarily break the group, which is exactly why the group is the unit.",
+    fix: "Break one import per group. \u26A0\uFE0F Pick the one pointing the wrong way, not the easiest one: cutting any other edge usually leaves the tangle in place.",
+    source: "Tarjan's strongly connected components, via graphology-components, run over the value edges. Held against madge's own `circular()` on five modules of the three families BEFORE the type edges were dropped: the set of files caught was identical every time (2, 110, 11, 13 and 2), and only the count differed, because madge enumerates paths where this groups them. madge does not read the `type` keyword either, so it now reports the larger figure, and the difference is the count printed beside ours. The kind of an edge is read at two levels of the oxc tree, the declaration's `importKind` and each binding's own, because they disagree: in `import type { A }` the declaration is a type one while the binding inside it says value."
+  },
+  importEdges: {
+    label: "Imports between files",
+    what: "How many times one of the module's own files imports another of them.",
+    read: "Read it against the file count beside it rather than on its own: roughly two to three edges per file is what the modules measured here sit at. It is the size of the graph every other figure on this block is computed over.",
+    caveat: "Module-local on purpose, so it says nothing about what the module pulls from the rest of the workspace: a front app importing three hundred components from `libs/` shows none of that here. Tests are outside the graph too, specs and the support beside them, so a file every spec imports does not look busy because of them: measured on `apps/front/host-admin`, 113 helpers in a `testing/` or `test/` directory or named `*.msw.ts` were counted as product code until the role's glob learnt those conventions, and each was showing up as a community of its own. Generated code is out as well: on `apps/front/console`, excluding `routeTree.gen.ts` removes 20 edges and the module's only cycle, which is TanStack's own and which nobody can fix by hand.",
+    fix: "Nothing to do. It is the size of the graph every other figure on this panel is computed over.",
+    source: "Built from the oxc parse of every file the role scans, resolving relative specifiers only. The resolution was held against madge, which follows the workspace path aliases, over five modules with the same exclusions on both sides: 16 052 edges, no code edge missed and none invented, the 28 differences all imports of files outside the scanned languages."
+  },
+  graphDensity: {
+    label: "Density",
+    what: "The share of all the edges that could exist between these files that actually do.",
+    read: "Between 0 and 1, and near 0 in real code. It is a shape, not a score: it tells you whether the module is a web or a tree.",
+    caveat: "\u26D4 Do NOT compare it between modules of different sizes, and the reason is arithmetic rather than opinion: the denominator grows with the SQUARE of the file count, so a module gets a lower density by growing, not by improving. Measured here: `libs/nest/auth` 0.0216 at 101 files and `apps/front/host-admin` 0.0005 at 4 380, which says almost nothing about either. What it is good for is one module watched over time at a stable size.",
+    fix: "Nothing to do. It is a shape, not a score: it says whether the module is a web or a tree. \u26A0\uFE0F Only compare it to itself over time, never between modules.",
+    source: "graphology-metrics, graph density, the standard definition for a directed graph."
+  },
+  communities: {
+    label: "Communities",
+    what: "How many clusters of files the partition found, where a cluster is a set of files much more connected to each other than to the rest.",
+    read: "Read it against the module's own directories, which is the grouping the team wrote by hand. Expect it to be HIGHER: the partition refines the folders rather than reproducing them, measured at 24 communities for 16 domains on a nest service, and 89 for 10 modules on the largest front app. Held against the directories over five modules, each community sits inside one directory 58% to 85% of the time, and each directory splits across several communities, so the agreement is a refinement and not a match.",
+    caveat: "The count depends on a setting, `graph.resolution`, which the report prints: changing it changes the answer, and graphology warns in its own documentation that it is finicky to tweak. The role ships the published value of 1 rather than one chosen to make the partition look right. The algorithm is also greedy, so this is one good partition, not the best one. \u26A0\uFE0F And a community holding two directories is NOT a statement that they depend on each other: a file both of them import pulls them together on its own. Measured on `apps/nest/microservices/recruitment`, one community holds 79 files of `candidate-management` and 64 of `application-management` with 4 edges between the two halves, because 12 shared enums sit between them, one of which is imported 58 times. \u26A0\uFE0F A community of ONE file means the module's own code neither imports it nor is imported by it, which is a strong signal and not a verdict. Measured on `apps/front/host-admin`: 53 such files, of which 37 have no reference anywhere and are dead, 10 are routes the framework loads by convention, and 5 are test helpers whose naming this role does not recognise. \u26D4 Read it WITH the dead-code figures rather than against them: this pass sees a file as a node, so it can only say that nothing reaches it, while the dead-code pass looks inside the files and reports an unused export or an unused symbol in a file that is otherwise very much alive. Two scales, not two answers to one question.",
+    fix: "Nothing to do. It is a grouping to compare with your own folders. \u26A0\uFE0F A community of one file is worth a look: nothing in the module imports it, and nothing it imports.",
+    source: "Louvain, via graphology-communities-louvain, with the role's own random seed so the figure reproduces. Blondel, Guillaume, Lambiotte and Lefebvre, 2008."
+  },
+  modularity: {
+    label: "Modularity (Q)",
+    what: "The quality of the ASSIGNMENT of files to communities: how much more densely connected the files inside a community are than the same files would be in a random network. Both halves of the words a team already uses are in that sentence, which is why the figure is worth having: dense inside is cohesion, the degree to which the elements of a part belong together, and sparse between is what makes a part independent enough to be given an interface.",
+    read: "Between -1 and 1. It judges the partition, not the code, and that is what makes it architectural: Louvain already maximised it, so a low value does not mean a poor partition was picked, it means no good one exists and the module does not decompose along its imports. A high value says the opposite, that a modular model is there to be read, and the drawing is where to read it. The five modules measured here sit between 0.58 and 0.84.",
+    caveat: "\u26A0\uFE0F Do not read the fourth decimal. Louvain is greedy, so Q is the value of ONE local optimum: measured over 20 runs with the library's own randomness, `console` produced 16 different values and `recruitment` spanned 0.0357. The role pins its seed, which makes the figure reproducible but not exact, so a change smaller than a hundredth between two runs of two different versions means nothing. A high Q also does not mean the clusters are the right ones: it says they are separable, not that they match any boundary a team cares about. Read as cohesion it is a practical one: files that interact are a population that lives together, the way Louvain was meant to divide a social network, so it catches technical and functional coupling alike. What it will not give you is a place to go, because it is one average over the whole module. The communities themselves are, and the drawing is there for that.",
+    fix: "Nothing to do. It judges the grouping, not the code. A high value means a clear structure is there to read, and the drawing is where to read it.",
+    source: "Newman-Girvan modularity, via graphology-metrics, which states in its own source that it stays true to Newman's original definition. Q is the measure; Louvain is the algorithm that maximises it. The wording of what it quantifies, the quality of an assignment of nodes to communities, is Neo4j's graph data science documentation."
+  },
+  mostImported: {
+    label: "Most imported files",
+    what: "The files the rest of the module leans on, with the three coupling figures for each: how many files import it (`Ca`), how many it imports (`Ce`), and Martin's instability `I = Ce / (Ca + Ce)`.",
+    read: "Context, not a defect list: every module has a most-imported file and a type definition used everywhere is doing its job. Read the three together, because that is what Martin made them for: a file many others depend on should itself depend on little, so a high `Ca` next to an `I` near 1 is the row to open. A change there reaches every dependent, and it is itself exposed to everything it pulls. Measured across the modules benched so far, this repository mostly satisfies that rule already: 23 of 30 most-imported rows sit at `I` of 0.06 or less, and the highest is 0.24. \u26A0\uFE0F Those are the figures of one bench on one day, not a property of the ranking.",
+    caveat: "\u26D4 Martin defined `Ca`, `Ce` and `I` for a COMPONENT, something released and versioned as a unit, not for a file. Reading them per file is a transposition, the same one `code-health-meter` makes, and what it costs is that a file is not independently releasable: splitting one in two changes every figure without changing anything about the design. The module's OWN instability is not here either, and cannot be: this graph stops at the module's edge on purpose, so the imports that would give the module its `Ce` are outside it. \u26A0\uFE0F And if you compare the counts with another tool, note the unit. `Ca` here is raw. graphology's degree centrality, in the last column, is NORMALISED by the file count, and the two disagree in direction: `libs/nest/auth`'s busiest file is imported 18 times and scores 0.18, `apps/front/host-admin`'s is imported 122 times and scores 0.028. There is no threshold on any of the four and the role proposes none. \u26A0\uFE0F The list is ranked by `Ca` alone, so in principle a file with a middling `Ca` and an `I` near 1, which is the shape Martin warns about, could sit below the cut. Measured on 6 214 imported files across five modules: not one has `Ca` of 10 or more together with `I` of 0.5 or more, so the ranking hides nothing today. That is a fact about this repository on the day it was measured, not a property of the ranking.",
+    fix: "Nothing to do. Every module has a most-imported file, and a type used everywhere is doing its job. Read it as context for the figures around it.",
+    source: 'In- and out-degree of the module import graph, with graphology\'s degree centrality beside them. `Ca`, `Ce` and `I`: Robert C. Martin, "OO Design Quality Metrics", 1994. \u26D4 `A` and `D` from the same paper are deliberately absent: abstractness measured 0.013 on the front and 0.010 on nest, so `D = |A + I - 1|` collapses to `|I - 1|`, which is instability said twice.'
+  },
+  complexity: {
+    label: "Files with a complex function",
+    what: "Files holding at least one function whose cyclomatic complexity passes 10.",
+    read: "499 files of 8 083 across the repository, 6.2 per 100, fourth of the eight. Count of files, so it is comparable between modules only against their file count, which the unit carries. It is the same measure as the band rows above, seen per file rather than per function. A file is counted once per indicator, however many times the rule fires inside it. Measured on `libs/nest/auth`, counting diagnostics instead would have inflated the total by 1.8x, and by 2.8x at lower thresholds, because `max-nested-callbacks` reports once per level.",
+    caveat: "It does not say which function, nor whether branching is wrong there: a parser legitimately branches. \u26D4 This is a GAUGE and not the line your lint refuses at. It runs oxlint with its own config in a temporary directory, at a threshold fixed once for every module, and never reads the module's `.oxlintrc.json`. So it answers the same question the same way in every module, including the 146 of 198 that have not adopted lint, and it WILL disagree with a green build: the `nest` preset refuses `complexity` at 30 while this reports above 10.",
+    fix: "Split the functions this points at. This row counts FILES, so it tells you how much work there is, not how bad any single case is.",
+    source: "oxlint complexity, above 10. The threshold comes from McCabe 1976, which puts the limit at 10, and from our own p90 at 11: the one indicator where two independent references agree within a unit. 94.8% of our functions already sit in the 1-10 band. The rule for every one of the eight is `min(research, our p90, the rule's default)`, and a vendor default alone is not a reference: at 50, max-lines-per-function flagged 21.3% of our files and carried 77% of the union of all eight. The exclusions are the same list the duplication product pass is given, passed as `--ignore-pattern`: the `ignorePatterns` key in oxlint's config is accepted and silently ignored, which had this gauge measuring the test suite until the file counts were compared, 137 against 111 on `libs/nest/auth`."
+  },
+  "max-depth": {
+    label: "Files with deep nesting",
+    what: "Files holding a block nested more than three levels deep.",
+    read: "The rarest of the eight with `max-nested-callbacks`, 8 files of 8 083 across the repository, 0.1 per 100, so one occurrence is worth opening rather than filtering. A file is counted once per indicator, however many times the rule fires inside it. Measured on `libs/nest/auth`, counting diagnostics instead would have inflated the total by 1.8x, and by 2.8x at lower thresholds, because `max-nested-callbacks` reports once per level.",
+    caveat: "Depth is not complexity: four flat `if`s in a row never trip it, and one `if` inside three loops does.",
+    fix: "Move the guard conditions to the top and return early. Depth is not complexity: four `if`s in a row are fine, one inside three loops is not.",
+    source: "oxlint max-depth, above 3. The threshold is IfSQ SP-2, which says few people can understand nesting of conditional statements beyond 3 levels, and our p90 agrees at 3. The rule for every one of the eight is `min(research, our p90, the rule's default)`, and a vendor default alone is not a reference: at 50, max-lines-per-function flagged 21.3% of our files and carried 77% of the union of all eight. The exclusions are the same list the duplication product pass is given, passed as `--ignore-pattern`: the `ignorePatterns` key in oxlint's config is accepted and silently ignored, which had this gauge measuring the test suite until the file counts were compared, 137 against 111 on `libs/nest/auth`."
+  },
+  "max-lines": {
+    label: "Long files",
+    what: "Files longer than 150 lines, blank lines and comments included.",
+    read: "864 files of 8 083 across the repository, 10.7 per 100, the second most frequent of the eight. A size signal and nothing else. Read it beside the duplication figure: a long file that duplicates nothing is a different problem from a long file that repeats itself. A file is counted once per indicator, however many times the rule fires inside it. Measured on `libs/nest/auth`, counting diagnostics instead would have inflated the total by 1.8x, and by 2.8x at lower thresholds, because `max-nested-callbacks` reports once per level.",
+    caveat: "Length is not a defect. A generated file, a long constant table or a barrel is long by nature, which is why this is reported and never failed on.",
+    fix: "Nothing from this row alone. Long is not bad: a generated file or a constants table is long by nature. Read it beside the other size rows.",
+    source: "oxlint max-lines, above 150. The threshold is our p90 of 157 rounded down, because no research anywhere sets a FILE's length: IfSQ's three citations (500, 100-150, 143) are all about routines. The rule for every one of the eight is `min(research, our p90, the rule's default)`, and a vendor default alone is not a reference: at 50, max-lines-per-function flagged 21.3% of our files and carried 77% of the union of all eight. The exclusions are the same list the duplication product pass is given, passed as `--ignore-pattern`: the `ignorePatterns` key in oxlint's config is accepted and silently ignored, which had this gauge measuring the test suite until the file counts were compared, 137 against 111 on `libs/nest/auth`."
+  },
+  "max-lines-per-function": {
+    label: "Files with a long function",
+    what: "Files holding at least one function longer than 109 lines.",
+    read: "630 files of 8 083 across the repository, 7.8 per 100, the third most frequent of the eight. \u26D4 It used to be held out of the report as a mere descriptor, on a measured break of a factor 4.5; that break was an artefact of a threshold of 50, where this one rule alone flagged 21.3% of all files and carried 77% of what the eight reported together. At 109 there is no break left and every indicator counts. A file is counted once per indicator, however many times the rule fires inside it. Measured on `libs/nest/auth`, counting diagnostics instead would have inflated the total by 1.8x, and by 2.8x at lower thresholds, because `max-nested-callbacks` reports once per level.",
+    caveat: "Length is a signal and not a defect: a long function can be a flat list of fields. Read it beside the statement count, which is the other half of the same question, and which it does NOT duplicate: measured here, 255 long functions breach no statement count and 699 dense ones are not long.",
+    fix: "Give the blocks names. A long function is usually several short ones waiting for a signature, and each comment announcing a section marks one.",
+    source: "oxlint max-lines-per-function, above 109. The threshold is our p90. IfSQ SP-1 says 150, citing IBM on routines over 500 lines, and is discarded here for being more permissive than our own code. The rule for every one of the eight is `min(research, our p90, the rule's default)`, and a vendor default alone is not a reference: at 50, max-lines-per-function flagged 21.3% of our files and carried 77% of the union of all eight. The exclusions are the same list the duplication product pass is given, passed as `--ignore-pattern`: the `ignorePatterns` key in oxlint's config is accepted and silently ignored, which had this gauge measuring the test suite until the file counts were compared, 137 against 111 on `libs/nest/auth`."
+  },
+  "max-statements": {
+    label: "Files with a long function body",
+    what: "Files holding at least one function of more than ten statements.",
+    read: "The most frequent of the eight: 891 files of 8 083, 11.0 per 100, against 10.7 for the next. It was held out of the report as a descriptor on a break that no longer exists; see the row above. A file is counted once per indicator, however many times the rule fires inside it. Measured on `libs/nest/auth`, counting diagnostics instead would have inflated the total by 1.8x, and by 2.8x at lower thresholds, because `max-nested-callbacks` reports once per level.",
+    caveat: "It counts statements and not work: ten calls in a row trip it where one dense expression does not.",
+    fix: "Same answer as the row above: name the blocks. This counts statements where that one counts lines, so a file high here is dense rather than long.",
+    source: "oxlint max-statements, above 10. The threshold is the rule's own default, kept because our p90 of 15 is the looser of the two; it is not redundant with the line count, 699 functions breach it without being long and 255 are long without breaching it. The rule for every one of the eight is `min(research, our p90, the rule's default)`, and a vendor default alone is not a reference: at 50, max-lines-per-function flagged 21.3% of our files and carried 77% of the union of all eight. The exclusions are the same list the duplication product pass is given, passed as `--ignore-pattern`: the `ignorePatterns` key in oxlint's config is accepted and silently ignored, which had this gauge measuring the test suite until the file counts were compared, 137 against 111 on `libs/nest/auth`."
+  },
+  "max-params": {
+    label: "Files with a wide signature",
+    what: "Files holding at least one function taking more than three parameters.",
+    read: "373 files of 8 083, 4.6 per 100, fifth of the eight. A wide signature is usually an object waiting to be named. A file is counted once per indicator, however many times the rule fires inside it. Measured on `libs/nest/auth`, counting diagnostics instead would have inflated the total by 1.8x, and by 2.8x at lower thresholds, because `max-nested-callbacks` reports once per level.",
+    caveat: "A destructured object parameter counts as one, so the figure does not see a function taking fifteen fields in one bag.",
+    fix: "Group the arguments into the object the call site already builds. A wide signature forces every caller to remember an order, and that order breaks quietly.",
+    source: "oxlint max-params, above 3. The threshold is the rule\u2019s own default, kept because our p90 of 4 is looser; beyond three parameters the fix is an object or currying, so this is a design boundary rather than a dial. The rule for every one of the eight is `min(research, our p90, the rule's default)`, and a vendor default alone is not a reference: at 50, max-lines-per-function flagged 21.3% of our files and carried 77% of the union of all eight. The exclusions are the same list the duplication product pass is given, passed as `--ignore-pattern`: the `ignorePatterns` key in oxlint's config is accepted and silently ignored, which had this gauge measuring the test suite until the file counts were compared, 137 against 111 on `libs/nest/auth`."
+  },
+  "max-nested-callbacks": {
+    label: "Files with nested callbacks",
+    what: "Files holding callbacks nested more than three deep.",
+    read: '9 files of 8 083 across the repository, 0.1 per 100, the joint rarest with `max-depth`. \u26A0\uFE0F It read "zero everywhere measured so far" while the threshold sat at 10 and the deepest chain in the repository is 4, so it reported nothing for as long as it shipped; at 3 it finds those 9. A non-zero value is unambiguous. A file is counted once per indicator, however many times the rule fires inside it. Measured on `libs/nest/auth`, counting diagnostics instead would have inflated the total by 1.8x, and by 2.8x at lower thresholds, because `max-nested-callbacks` reports once per level.',
+    caveat: "It counts callbacks and not promise chains or awaits, so modern asynchronous code can be deeply sequential without ever tripping it.",
+    fix: "Flatten it with `async`/`await`, or give the inner callback a name. Nesting like this is rarely a choice; it is what a chain looks like before anyone revisits it.",
+    source: "oxlint max-nested-callbacks, above 3. The threshold is IfSQ SP-2 again, same nesting family, and our p90 agrees at 3. It sat at 10 while the deepest chain in the repository is 4, so it reported 0 files for as long as it shipped. The rule for every one of the eight is `min(research, our p90, the rule's default)`, and a vendor default alone is not a reference: at 50, max-lines-per-function flagged 21.3% of our files and carried 77% of the union of all eight. The exclusions are the same list the duplication product pass is given, passed as `--ignore-pattern`: the `ignorePatterns` key in oxlint's config is accepted and silently ignored, which had this gauge measuring the test suite until the file counts were compared, 137 against 111 on `libs/nest/auth`."
+  },
+  "max-classes-per-file": {
+    label: "Files with several classes",
+    what: "Files declaring more than one class.",
+    read: "161 files of 8 083, 2.0 per 100. On a nest service it usually means a DTO file, which is a convention rather than a defect. A file is counted once per indicator, however many times the rule fires inside it. Measured on `libs/nest/auth`, counting diagnostics instead would have inflated the total by 1.8x, and by 2.8x at lower thresholds, because `max-nested-callbacks` reports once per level.",
+    caveat: "It says nothing about the size of the classes, and a file with one 800-line class never appears here.",
+    fix: "Split the file, one class each. \u26A0\uFE0F Unless the second class exists only to serve the first, which this rule cannot tell apart.",
+    source: "oxlint max-classes-per-file, above 1. The threshold is the rule's floor, there is no stricter value to pick. The rule for every one of the eight is `min(research, our p90, the rule's default)`, and a vendor default alone is not a reference: at 50, max-lines-per-function flagged 21.3% of our files and carried 77% of the union of all eight. The exclusions are the same list the duplication product pass is given, passed as `--ignore-pattern`: the `ignorePatterns` key in oxlint's config is accepted and silently ignored, which had this gauge measuring the test suite until the file counts were compared, 137 against 111 on `libs/nest/auth`."
+  },
+  "cognitive-complexity": {
+    label: "Files hard to follow",
+    what: "Files holding at least one function whose cognitive complexity passes 7.",
+    read: "The other complexity figure, and it answers a different question from McCabe's: not how many paths a test suite must cover, but how much a reader has to hold in their head. The two disagree on purpose. A flat `switch` with twelve cases is cyclomatically 13 and cognitively 1, because nothing is nested and nothing surprises; three `if`s inside each other are cyclomatically 4 and cognitively 6, because each level is charged for the levels above it. When a file is high here and low there, the code is tangled rather than merely branchy, and that is the one this role would act on first.",
+    caveat: "\u26A0\uFE0F In JavaScript and TypeScript, sequences of `||` and `??` do NOT increment, deliberately: in this language they are overwhelmingly default-value shorthand rather than control flow, and SonarSource made that exclusion universal in SonarQube 10.8. So a long chain of fallbacks scores zero here while `&&` chains are charged. \u26D4 And it is a GAUGE, not the line your lint refuses at: no preset in this repository enforces cognitive complexity at all today.",
+    fix: "Split what this points at, and trust it over the complexity rows when they disagree. It counts what a reader has to hold in their head.",
+    source: "Sonar's own `cognitive-complexity` rule from `eslint-plugin-sonarjs`, loaded into oxlint through `plugins/sonar-cognitive.js` and run in the same invocation as the size rules. It is USED and never copied: that package ships under the Sonar Source-Available License and sentinel is MIT. The algorithm is Campbell 2018 and its author works at SonarSource, so their implementation is the specification's own house rather than one reading of it; verified against Campbell's published example, which scores 7 in both. The threshold is 7, from `min(research, our p90, the rule's default)`: Sonar publishes 15 for S3776 and that is a vendor default rather than a research value, since one of their own engineers has said publicly that no formula supports it, while our p90 over the files the rule touches is 7. It reports 342 of 8 083 files on the bench, 4.2 per 100."
+  },
+  usedOnlyByTests: {
+    label: "Used only by tests",
+    what: "Files of this module that no production code imports, but another module's test files do.",
+    read: "A third state between alive and dead, and the only one of the three that names a design question rather than a defect: a production module shipping something only the suites consume. Zero is the ordinary value.",
+    caveat: "It says nothing about whether that is wrong. A test factory deliberately published by a library belongs here and is doing its job. What it refuses to do is call those files dead, which is what a walk that ignores tests does: measured on `libs/nest/auth`, 11 live files are imported only from a test, `auth.module.ts` among them, and 47 projects depend on that module. \u26A0\uFE0F It sees FILES, so an export used only by specs inside a file that production also imports is invisible here.",
+    fix: "Decide file by file. Test helpers move to a test folder. Product code that only a test calls is a design question: ask why it was written.",
+    source: "The workspace index in `workspace/consumers.ts`: one scan of the tracked files, specifiers resolved against the tsconfig aliases, an importer classified as a test by the same conventions the duplication pass uses. Measured on this repository: 278 such files in all, 39 of them in `libs/front/components`."
+  },
+  measuredFiles: {
+    label: "Files the gauge read",
+    what: "How many product files the size indicators were measured over.",
+    read: "The denominator of every size row BELOW it: the gauge prints its population first, then the counts it divides. None of them compares between modules without it: three breaches over 50 files and three over 3 000 are not the same module.",
+    caveat: "It is the gauge\u2019s population and not the module\u2019s: `src` only, tests, mocks and generated files excluded, which is the same list every other pass is given. So it is smaller than what `ls` would count, deliberately, and it will differ from the duplication pass\u2019s own file count, which drops files shorter than the detection window.",
+    fix: "Nothing to do. It is the denominator of every size row below. Three breaches in 50 files and three in 3 000 are not the same module.",
+    source: "oxlint's `number_of_files` for the run this role drives, with the role's product exclusions passed as `--ignore-pattern`. \u26A0\uFE0F It is NOT always the graph pass's population, and the earlier version of this line said it was, on the strength of one nest library that happens to have no stylesheet: there the two read the same 99 files. The graph counts a `.css` or `.scss` file as a node; oxlint does not lint one, so the gauge reads fewer. Measured over the four front applications, that accounts for the gap exactly: career 64 against 63, console 504 against 503, front-legacy 1510 against 1509, host-admin 4537 against 4536, one stylesheet each. \u26A0\uFE0F There is a SECOND cause and it is louder: oxlint skips what `.gitignore` covers, and the graph does not. On `apps/cloud/interop` the two read 69 and 100, because a bare unanchored `staffea` on line 225 of the repository\u2019s `.gitignore` shadows 34 files that git still tracks. So a large gap here is worth opening: it means a directory of real source is invisible to every tool that honours `.gitignore`."
+  },
+  // The bundle family lives in its own file: it is the only one whose entries carry a way to act,
+  // and keeping it here would have pushed this file past the point where anyone reads it whole.
+  ...bundleHelp
 };
 function helpFor(key) {
   return metricsHelp[key];
 }
 
+// src/roles/static-analysis/maintainability/size-rules.ts
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join21 } from "node:path";
+var GAUGE_THRESHOLDS = {
+  // McCabe 1976 says 10, our p90 says 11. The only indicator where two independent candidates agree
+  // within one unit, and 94.8% of our functions already sit in the 1-10 band SEI calls low risk.
+  complexity: 10,
+  // IfSQ SP-2, "few people can understand nesting to more than 3 levels". Our p90 agrees at 3.
+  "max-depth": 3,
+  // No research anywhere for a FILE's length: IfSQ's three citations (500, 100-150, 143) are all
+  // about routines. So our p90 of 157, rounded down.
+  "max-lines": 150,
+  // Our p90. IfSQ SP-1 says 150 and is discarded for being more permissive than our own code.
+  "max-lines-per-function": 109,
+  // No research. Our p90 is 15, the rule's default is 10, so the default stays as the stricter one.
+  "max-statements": 10,
+  // No research, and none needed: beyond three parameters the fix is an object or currying, so this
+  // is a design boundary and not a dial. Our p90 of 4 is the looser candidate and loses.
+  "max-params": 3,
+  // Same nesting family as `max-depth`, no citation of its own. Our p90 agrees at 3.
+  "max-nested-callbacks": 3,
+  // 1 is the rule's floor, there is no stricter value to pick.
+  "max-classes-per-file": 1,
+  // Cognitive complexity, Campbell 2018, measured by Sonar's own rule, loaded
+  // through `plugins/sonar-cognitive.js`.
+  // Sonar publishes 15 for S3776, and that is a vendor default rather than a research value: one of
+  // their own engineers has said publicly that no formula supports it. Our p90 is 7, so 7 wins, and
+  // it reports 342 of 8 083 files, 4.2%, which sits inside the band the eight above occupy.
+  "cognitive-complexity": 7
+};
+var COGNITIVE = "cognitive-complexity";
+var cognitivePlugin = () => join21(ownPackageDir(), "plugins", "sonar-cognitive.js");
+var CATEGORIES = [
+  "correctness",
+  "suspicious",
+  "pedantic",
+  "perf",
+  "style",
+  "restriction",
+  "nursery"
+];
+function sizeRulesConfig() {
+  return {
+    plugins: [],
+    categories: Object.fromEntries(CATEGORIES.map((category) => [category, "off"])),
+    // Sonar's cognitive complexity, in the SAME run as the eight above rather than a second
+    // invocation: the parse is the expensive part and it is already paid here. Measured over the
+    // whole bench, 8 083 files, the rule adds 2.4 s to a pass that was going to read them anyway.
+    jsPlugins: [cognitivePlugin()],
+    // ⛔ `warn` and not `error`, for the reason `tool-config.ts` gives about jscpd's `threshold`:
+    // at `error` oxlint exits 1 as soon as one file breaches, which is indistinguishable from the
+    // binary failing to run. Measured on `libs/nest/auth`, same config otherwise: `error` exits 1,
+    // `warn` exits 0, and both report the same 18 diagnostics. So the tool measures, this role
+    // judges, and a non-zero exit means the tool failed.
+    rules: Object.fromEntries(
+      Object.entries(GAUGE_THRESHOLDS).map(([rule, threshold]) => [
+        rule === COGNITIVE ? `sonar/${rule}` : rule,
+        ["warn", threshold]
+      ])
+    )
+  };
+}
+function sizeRulesRun(paths, ignore) {
+  const dir = mkdtempSync2(join21(tmpdir2(), "sentinel-size-"));
+  const configPath = join21(dir, "oxlintrc.json");
+  writeFileSync4(configPath, `${JSON.stringify(sizeRulesConfig(), null, 2)}
+`, "utf8");
+  return {
+    // `--format json` because the console shape is rendered by this role from the figures: a
+    // per-pass table from the tool would be a second voice saying the same numbers differently.
+    // The exclusions are the SAME list the duplication product pass is given, so "the module's
+    // code" means one thing across the whole report.
+    args: [
+      "-c",
+      configPath,
+      ...ignore.flatMap((pattern) => ["--ignore-pattern", pattern]),
+      "--format",
+      "json",
+      ...paths
+    ],
+    dispose: () => rmSync4(dir, { force: true, recursive: true })
+  };
+}
+function ruleOf(code) {
+  return /\(([^)]+)\)\s*$/.exec(code)?.[1];
+}
+function valueOf(message) {
+  const match = /\((\d+)\)/.exec(message) ?? /complexity of (\d+)/.exec(message) ?? // Sonar's own wording, a third shape again: "reduce its Cognitive Complexity from 7 to the 0
+  // allowed". It parenthesises nothing, and the `0` after it is the threshold, not the value.
+  /Complexity from (\d+) to/.exec(message);
+  return Number(match?.[1] ?? 0);
+}
+function breachesOf(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { breaches: [], diagnostics: 0, files: 0 };
+  }
+  const diagnostics = parsed.diagnostics ?? [];
+  const worst = /* @__PURE__ */ new Map();
+  for (const diagnostic of diagnostics) {
+    const rule = ruleOf(diagnostic.code ?? "");
+    const file = diagnostic.filename;
+    if (!rule || !file || !(rule in GAUGE_THRESHOLDS)) continue;
+    const value = valueOf(diagnostic.message ?? "");
+    const line = diagnostic.labels?.[0]?.span?.line ?? 0;
+    const key = `${file}\0${rule}`;
+    const seen = worst.get(key);
+    if (!seen || value > seen.value) worst.set(key, { file, rule, value, line });
+  }
+  return {
+    breaches: [...worst.values()],
+    diagnostics: diagnostics.length,
+    files: parsed.number_of_files ?? 0
+  };
+}
+function scanSizeRules(cwd, roots, ignore, binary, spawn) {
+  if (!binary) return void 0;
+  const run = sizeRulesRun(roots, ignore);
+  try {
+    const result = spawn(binary, run.args, cwd);
+    if (result.status !== 0) return void 0;
+    return breachesOf(result.stdout);
+  } finally {
+    run.dispose();
+  }
+}
+
 // src/roles/static-analysis/report.ts
-function hasFinding(report) {
-  return report.rows.some((row) => row.over);
+var FAMILIES = [
+  {
+    label: "Duplication",
+    headline: "duplicatedLinesPercent",
+    metrics: ["duplicatedLinesPercent", "clones", "duplicatedLinesPercentTests", "clonesTests"]
+  },
+  {
+    label: "Dead code",
+    // Not `entryPoints`, which is the walk's starting condition rather than a result.
+    headline: "deadLinesPercent",
+    metrics: [
+      "entryPoints",
+      "deadLinesPercent",
+      "unusedFiles",
+      "unusedExports",
+      "unusedSymbols",
+      "unusedImports",
+      "usedOnlyByTests"
+    ]
+  },
+  {
+    label: "Complexity",
+    headline: "complexityMax",
+    metrics: ["complexityMax", "complexityModerate", "complexityHigh", "complexityUntestable"]
+  },
+  {
+    label: "Structure",
+    // ⚠️ Not `importEdges`, which is a size and not a signal: a big module has many edges and that
+    // says nothing. A cycle is the one figure in this family a reviewer acts on.
+    headline: "cycles",
+    metrics: ["importEdges", "graphDensity", "cycles", "communities", "modularity", "mostImported"]
+  },
+  {
+    label: "Size",
+    // ⛔ The denominator, and that is the honest choice rather than a weakness. The family is nine
+    // rules with nine counts and no one of them leads: picking one would rank them, which is a
+    // judgement this role does not make. The count of places beside it says the size of the job.
+    headline: "measuredFiles",
+    metrics: ["measuredFiles", ...Object.keys(GAUGE_THRESHOLDS)]
+  },
+  {
+    label: "Bundle",
+    headline: "bundleInitialTransfer",
+    metrics: [
+      "bundleInitialTransfer",
+      "bundleInitialParsed",
+      "bundleInitialFiles",
+      "bundleHeaviestAsset",
+      "bundleDynamicLayer",
+      "bundleEntrySet"
+    ]
+  }
+];
+function familyOf(metric) {
+  return FAMILIES.find((family) => family.metrics.includes(metric))?.label;
+}
+var CLAIMED_METRICS = FAMILIES.flatMap((family) => family.metrics);
+function byFamily(rows) {
+  const grouped2 = FAMILIES.map((family) => ({
+    label: family.label,
+    rows: rows.filter((row) => family.metrics.includes(row.metric))
+  })).filter((family) => family.rows.length > 0);
+  const orphans = rows.filter((row) => familyOf(row.metric) === void 0);
+  return orphans.length > 0 ? [...grouped2, { label: "Other", rows: orphans }] : grouped2;
+}
+function figureBlock(row, places = "") {
+  const help = helpFor(row.metric);
+  const label = help?.label ?? row.metric;
+  const VERDICT = { ok: "ok", near: "near", exceed: "exceeds" };
+  const mark = row.status === void 0 ? "" : `<span class="mark s-${row.status}">${escape(VERDICT[row.status] ?? row.status)}</span>`;
+  const dot = "";
+  const detail = help === void 0 ? "" : helpDetails(help, row.status === void 0);
+  const unit = row.unit === "" ? "" : `${row.unit.startsWith("%") ? "" : " "}<span class="unit">${escape(row.unit)}</span>`;
+  const action = help?.fix === void 0 ? "" : `
+        <p class="fix"><b>What to do.</b> ${prose(help.fix)}</p>`;
+  return `      <div class="figure">
+        <div class="head">
+          <span class="name">${dot}${escape(label)}</span>
+          <span class="val">${escape(figure(row))}${mark}${unit}</span>
+        </div>${action}
+${detail}
+${places}
+      </div>`;
+}
+function helpDetails(help, withoutReference) {
+  const links = (help.links ?? []).length === 0 ? "" : `<p class="links">${(help.links ?? []).map(
+    (link) => `<a href="${escape(link.url)}" target="_blank" rel="noreferrer">${escape(link.label)}</a>`
+  ).join(" \xB7 ")}</p>`;
+  const noReference = withoutReference ? `<p class="noref">No published reference exists for this figure, so it carries no verdict. It is reported as measured.</p>` : "";
+  return `        <details>
+          <summary>how this is measured, and what it does not say</summary>
+          <p class="what">${prose(help.what)}</p>
+          <p class="read"><b>How to read it.</b> ${prose(help.read)}</p>
+          ${noReference}
+          <p><b>What it does not say.</b> ${prose(help.caveat)}</p>
+          ${links}
+          <p class="source">Source: ${prose(help.source)}</p>
+        </details>`;
+}
+function secondSide(finding) {
+  if (!finding.other) return "";
+  const file = (at) => at.split(":")[0] ?? at;
+  const sameFile = file(finding.other) === file(finding.path);
+  const label = sameFile ? "and line" : "and";
+  const shownSide = sameFile ? finding.other.split(":")[1] ?? finding.other : finding.other;
+  return ` <span class="unit">${label}</span> <code>${escape(shownSide)}</code>`;
+}
+var HTML_GROUP_LIMIT = 50;
+function listedByMetric(findings) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding of findings) {
+    const bucket = groups.get(finding.metric) ?? [];
+    bucket.push(finding);
+    groups.set(finding.metric, bucket);
+  }
+  const weight = (finding) => finding.value ?? finding.lines ?? 0;
+  return new Map(
+    [...groups.entries()].map(([metric, all2]) => {
+      const sorted = [...all2].sort((left, right) => weight(right) - weight(left));
+      return [
+        metric,
+        {
+          listed: sorted.slice(0, HTML_GROUP_LIMIT),
+          rest: Math.max(0, sorted.length - HTML_GROUP_LIMIT)
+        }
+      ];
+    })
+  );
+}
+function figure(row) {
+  if (row.unit === "%" && typeof row.value === "number") return row.value.toFixed(2);
+  return typeof row.value === "number" ? grouped(row.value) : String(row.value);
+}
+function caveatsOf(report) {
+  const keys = [...report.rows.map((row) => row.metric), ...report.findings.map((f) => f.metric)];
+  const seen = /* @__PURE__ */ new Set();
+  const found = [];
+  for (const key of keys) {
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const help = helpFor(key);
+    if (help) found.push(help);
+  }
+  return found;
 }
 function renderConsole(report) {
   const lines = [];
   const width = (pick) => Math.max(...report.rows.map((row) => pick(row).length));
   const label = (row) => helpFor(row.metric)?.label ?? row.metric;
-  const value = (row) => `${row.value} ${row.unit}`;
-  const limit = (row) => row.threshold === null ? "no threshold" : `max ${row.threshold}${row.moved ? " (module)" : ""}`;
+  const value = (row) => `${figure(row)} ${row.unit}`.trim();
   const labelWidth = width(label);
   const valueWidth = width(value);
   lines.push(`sentinel static-analysis: ${report.module}`);
-  for (const row of report.rows) {
-    lines.push(
-      `  ${row.over ? "!" : " "} ${label(row).padEnd(labelWidth)}  ${value(row).padStart(valueWidth)}  ${limit(row)}`
-    );
+  for (const family of byFamily(report.rows)) {
+    lines.push("", `  ${family.label.toLowerCase()}`);
+    for (const row of family.rows) {
+      lines.push(`    ${label(row).padEnd(labelWidth)}  ${value(row).padStart(valueWidth)}`);
+    }
+  }
+  for (const note of report.notes) lines.push(`    (${note})`);
+  if (report.settings.length > 0) {
+    const keyWidth = Math.max(...report.settings.map((setting) => setting.key.length));
+    lines.push("", "  measured with");
+    for (const setting of report.settings) {
+      lines.push(
+        `    ${setting.key.padEnd(keyWidth)}  ${setting.value}${setting.moved ? "  (module)" : ""}`
+      );
+    }
+    if (report.settings.some((setting) => setting.moved)) {
+      lines.push(`    (module) = overridden in ${report.module}'s static-analysis.config.mjs`);
+    }
   }
   if (report.byLanguage && Object.keys(report.byLanguage).length > 0) {
-    lines.push("", "  per language, where a clone was found");
+    lines.push("", "  per language, where a clone was found in the product code");
     for (const [language, stats] of Object.entries(report.byLanguage)) {
       lines.push(
         `    ${language.padEnd(12)} ${stats.percentage.toFixed(2)}% (${stats.duplicatedLines} lines over ${stats.files} files)`
       );
     }
-    lines.push("    a language with no clone is not listed");
+    lines.push("    a language is absent when no file of it was long enough to scan");
   }
-  const caveats = report.rows.map((row) => ({ row, help: helpFor(row.metric) })).filter(
-    (entry) => Boolean(entry.help)
-  );
+  if (report.findings.length > 0) {
+    lines.push(
+      "",
+      `  ${report.findings.length} place(s) to look, listed by \`${SCRIPTS.json}\` and \`${SCRIPTS.html}\``
+    );
+  }
+  const caveats = caveatsOf(report);
   if (caveats.length > 0) {
     lines.push("", "  what these numbers do not say");
-    for (const { row, help } of caveats) {
+    for (const help of caveats) {
       lines.push(`    ${help.label}: ${help.caveat}`, `      source: ${help.source}`);
-      void row;
+      if (help.fix !== void 0) lines.push(`      what to do: ${help.fix}`);
+      for (const link of help.links ?? []) lines.push(`      ${link.label}: ${link.url}`);
+    }
+  }
+  return `${lines.join("\n")}
+`;
+}
+var JSON_SCHEMA_VERSION = 1;
+function renderJson(report) {
+  const rows = report.rows.map((row) => {
+    const help = helpFor(row.metric);
+    return { ...row, help: help ? { label: help.label, caveat: help.caveat } : null };
+  });
+  const findings = (report.findings ?? []).map(({ excerpt: _excerpt, ...rest }) => rest);
+  const envelope = {
+    schemaVersion: JSON_SCHEMA_VERSION,
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    commit: report.commit ?? null,
+    ...report,
+    rows,
+    findings
+  };
+  return `${JSON.stringify(envelope, null, 2)}
+`;
+}
+function renderMarkdown(report) {
+  const version = report.settings.find((setting) => setting.key === "sentinel")?.value;
+  const places = /* @__PURE__ */ new Map();
+  for (const finding of report.findings) {
+    places.set(finding.metric, (places.get(finding.metric) ?? 0) + 1);
+  }
+  const figureLine = (row) => {
+    const help = helpFor(row.metric);
+    const label = help?.label ?? row.metric;
+    const VERDICT = { ok: "ok", near: "near", exceed: "exceeds" };
+    const mark = row.status === void 0 ? "" : ` **${VERDICT[row.status] ?? row.status}**`;
+    const unit = row.unit === "" ? "" : `${row.unit.startsWith("%") ? "" : " "}${row.unit}`;
+    const count = places.get(row.metric) ?? 0;
+    const found = count === 0 ? "" : ` \xB7 ${count} ${count === 1 ? "place" : "places"}`;
+    const line = `**${label}** \xB7 ${figure(row)}${mark}${unit}${found}`;
+    return help?.fix === void 0 ? [line, ""] : [line, `> **What to do.** ${help.fix}`, ""];
+  };
+  const byLabel = byFamily(report.rows);
+  const families = [
+    ...byLabel.filter((family) => family.label === "Bundle"),
+    ...byLabel.filter((family) => family.label !== "Bundle")
+  ].flatMap((family) => [`##### ${family.label}`, "", ...family.rows.flatMap(figureLine)]);
+  const notes = report.notes.length === 0 ? [] : ["", ...report.notes.map((note) => `- ${note.split(". ")[0] ?? note}`)];
+  return [
+    `#### \`${report.module}\``,
+    "",
+    summaryText(report),
+    ...notes,
+    "",
+    ...families,
+    "> Measured on this branch and **not compared with `main`**. No figure here refuses anything.",
+    "> **ok**, **near** or **exceeds** is where a figure sits against a PUBLISHED reference; a",
+    "> figure with no verdict has none, which is a decision and not a gap. A file breaching several",
+    "> rules counts once per rule. The code behind every place, and the drawing of the import",
+    "> graph, are in the `static-analysis.html` the artifact carries.",
+    // ⭐ The version that produced these numbers, because the thresholds a module cannot override
+    // live in the tool: nine gauge limits, the complexity bands, the bundle budgets. Two recaps
+    // from two versions are not comparable, and without this nothing on the comment would say so.
+    ...version === void 0 ? [] : [`> Measured by sentinel ${version}.`],
+    ""
+  ].join("\n");
+}
+function prose(text) {
+  return escape(text).replace(/`([^`]+)`/g, "<code>$1</code>");
+}
+function escape(text) {
+  return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+function ruleChip(metric) {
+  const threshold = GAUGE_THRESHOLDS[metric];
+  return threshold === void 0 ? "" : ` <span class="chip"><code>${escape(metric)}</code> &gt; ${threshold}</span>`;
+}
+function measureOf(finding) {
+  const metric = finding.metric;
+  const number = (value, unit = "") => `<span class="pmeas">${grouped(value)}${unit === "" ? "" : `<span class="unit">${escape(unit)}</span>`}</span>`;
+  if (finding.value !== void 0) {
+    if (GAUGE_THRESHOLDS[metric] !== void 0) return number(finding.value);
+    if (metric.startsWith("complexity")) return number(finding.value, "complexity");
+    if (finding.dependsOn !== void 0) return number(finding.value, "imported by");
+    if (metric === "cycles") return number(finding.value, "files in the cycle");
+    return number(finding.value);
+  }
+  return finding.lines === void 0 ? "" : number(finding.lines, "lines");
+}
+function metaOf(finding) {
+  const pairs = [];
+  const add2 = (label, value) => {
+    pairs.push(`<span class="pair"><span class="k">${escape(label)}</span>${value}</span>`);
+  };
+  if (finding.name) {
+    add2(
+      finding.metric.startsWith("complexity") ? "function" : "name",
+      `<code>${escape(finding.name)}</code>`
+    );
+  }
+  if (finding.dependsOn !== void 0) add2("depends on", String(finding.dependsOn));
+  if (finding.instability !== void 0) add2("instability", finding.instability.toFixed(2));
+  if (finding.centrality !== void 0) add2("centrality", finding.centrality.toFixed(4));
+  if (finding.lines !== void 0 && finding.value !== void 0)
+    add2("length", `${finding.lines} lines`);
+  if (finding.confidence !== void 0) add2("confidence", `${finding.confidence}%`);
+  if (finding.reason) add2("unsure", `<span class="reason">${escape(finding.reason)}</span>`);
+  return pairs.length === 0 ? "" : `          <div class="pmeta">${pairs.join("")}</div>
+`;
+}
+function codeSummary(finding) {
+  const count = finding.excerpt === void 0 ? 0 : finding.excerpt.split("\n").length;
+  if (finding.metric === "clones" || finding.metric === "clonesTests") {
+    return `${finding.lines ?? count} duplicated lines`;
+  }
+  if (finding.excerptFirstLine === 1) return `the first ${count} lines`;
+  return `${count} lines from ${finding.excerptFirstLine ?? "?"}`;
+}
+function codeBlock(finding) {
+  if (finding.excerpt === void 0) return "";
+  const first = finding.excerptFirstLine;
+  const body = first === void 0 ? escape(finding.excerpt) : finding.excerpt.split("\n").map((line, offset) => `<span class="n">${first + offset}</span>${escape(line)}`).join("\n");
+  return `          <details class="pcode">
+            <summary>${escape(codeSummary(finding))}</summary>
+            <pre class="code">${body}</pre>
+          </details>
+`;
+}
+function placeCard(finding) {
+  return `        <div class="pcard">
+          <div class="phead">
+            <code class="path">${escape(finding.path)}</code>${secondSide(finding)}
+            <span class="pright">${measureOf(finding)}${ruleChip(finding.metric)}</span>
+          </div>
+${metaOf(finding)}${codeBlock(finding)}        </div>`;
+}
+function placesFor(group) {
+  const total = group.listed.length + group.rest;
+  const capped = group.rest > 0 ? ` <span class="capped">${HTML_GROUP_LIMIT} largest listed</span>` : "";
+  return `        <details class="place">
+          <summary>where to look <span class="count">${grouped(total)} ${total === 1 ? "place" : "places"}</span>${capped}</summary>
+          <div class="cards">
+${group.listed.map((finding) => placeCard(finding)).join("\n")}
+          </div>
+${group.rest > 0 ? `          <p class="sub">The other ${group.rest} are not on this page. <code>${SCRIPTS.json}</code> writes all of them, from the same run as this one.</p>` : ""}
+        </details>`;
+}
+function tabRules(count) {
+  return Array.from(
+    { length: count },
+    (_, index) => `  #tab-${index}:checked ~ nav.tabs label[for="tab-${index}"] { color: var(--ink); background: var(--bg); border-color: var(--rule); font-weight: 600; }
+  #tab-${index}:checked ~ section.panel[data-tab="${index}"] { display: block; }`
+  ).join("\n");
+}
+function kindOf2(metric) {
+  return KIND_LABELS[metric] ?? helpFor(metric)?.label ?? metric;
+}
+var KIND_LABELS = {
+  complexityUntestable: "Complexity 51+",
+  complexityHigh: "Complexity 21-50",
+  complexityModerate: "Complexity 11-20",
+  complexityMax: "Worst function",
+  cycles: "Import cycle",
+  unusedFiles: "Unreachable file",
+  unusedExports: "Unused export",
+  unusedSymbols: "Unused symbol",
+  usedOnlyByTests: "Used only by tests",
+  clones: "Clone",
+  clonesTests: "Clone in tests",
+  mostImported: "Most imported",
+  complexity: "Complex function",
+  "cognitive-complexity": "Hard to follow",
+  "max-lines": "Long file",
+  "max-lines-per-function": "Long function",
+  "max-statements": "Long body",
+  "max-params": "Wide signature",
+  "max-nested-callbacks": "Nested callbacks",
+  "max-depth": "Deep nesting",
+  "max-classes-per-file": "Several classes"
+};
+var KIND_UNITS = {
+  complexityUntestable: "McCabe",
+  complexityHigh: "McCabe",
+  complexityModerate: "McCabe",
+  complexityMax: "McCabe",
+  complexity: "McCabe",
+  "cognitive-complexity": "cognitive",
+  "max-lines": "lines",
+  "max-lines-per-function": "lines",
+  "max-statements": "statements",
+  "max-params": "params",
+  "max-nested-callbacks": "deep",
+  "max-depth": "deep",
+  "max-classes-per-file": "classes",
+  clones: "lines",
+  clonesTests: "lines",
+  cycles: "files",
+  mostImported: "imported by"
+};
+function findingRow(finding) {
+  const path2 = finding.path;
+  const cut = path2.lastIndexOf("/");
+  const dir = cut === -1 ? "" : path2.slice(0, cut + 1);
+  const file = cut === -1 ? path2 : path2.slice(cut + 1);
+  const measure = finding.value ?? finding.lines;
+  const unit = KIND_UNITS[finding.metric];
+  const haystack = [path2, finding.name, finding.other].filter(Boolean).join(" ").toLowerCase();
+  return `          <tr data-kind="${escape(kindOf2(finding.metric))}" data-find="${escape(haystack)}">
+            <td><span class="kind">${escape(kindOf2(finding.metric))}</span></td>
+            <td class="where"><span class="dir">${escape(dir)}</span><b>${escape(file)}</b>${finding.name === void 0 ? "" : `<span class="sym">${escape(finding.name)}</span>`}${finding.other === void 0 ? "" : `<span class="sym">&#8596; ${escape(finding.other)}</span>`}</td>
+            <td class="meas">${measure === void 0 ? "" : `<b>${escape(typeof measure === "number" ? grouped(measure) : String(measure))}</b>${unit === void 0 ? "" : `<span>${escape(unit)}</span>`}`}</td>
+          </tr>`;
+}
+function findingsPanel(report) {
+  const findings = report.findings ?? [];
+  if (findings.length === 0) {
+    return `      <p class="read">This run produced no finding to list.</p>`;
+  }
+  const counts = /* @__PURE__ */ new Map();
+  for (const finding of findings) counts.set(finding.metric, (counts.get(finding.metric) ?? 0) + 1);
+  const chips = [...counts.entries()].map(
+    ([metric, count]) => `<button type="button" class="fchip" data-kind="${escape(kindOf2(metric))}">${escape(kindOf2(metric))} <span>${grouped(count)}</span></button>`
+  ).join("\n        ");
+  return `      <div class="ftools">
+        <input type="search" id="ffilter" placeholder="Filter by path, function or symbol&hellip;"
+          aria-label="Filter the findings" autocomplete="off">
+        <kbd aria-hidden="true">/</kbd>
+      </div>
+      <div class="fchips">
+        <button type="button" class="fchip on" data-kind="">All <span>${grouped(findings.length)}</span></button>
+        ${chips}
+      </div>
+      <p class="fcount" id="fcount" hidden>${grouped(findings.length)} of ${grouped(findings.length)} shown</p>
+      <p class="panel-note"><b>This list is complete.</b> Every one of the ${grouped(findings.length)} findings
+        this run produced is in the page, worst first within each kind, while a figure&rsquo;s own card on
+        Overview shows only its largest. The code of a clone or a long function stays on that card, where
+        the context is; this list is here to find a file.</p>
+      <table class="findings" id="ftable">
+        <thead>
+          <tr><th scope="col">Kind</th><th scope="col">Where</th><th scope="col" class="meas">Measure</th></tr>
+        </thead>
+        <tbody>
+${findings.map((finding) => findingRow(finding)).join("\n")}
+        </tbody>
+      </table>`;
+}
+function grouped(count) {
+  if (!Number.isInteger(count)) return String(count);
+  return String(count).replace(/\B(?=(\d{3})+(?!\d))/g, "\u202F");
+}
+function summaryParts(report, bold) {
+  const withReference = report.rows.filter((row) => row.status !== void 0);
+  const above = withReference.filter((row) => row.status === "exceed").length;
+  const findings = report.findings ?? [];
+  const inTests = findings.filter((finding) => finding.metric === "clonesTests").length;
+  const inProduct = findings.length - inTests;
+  return [
+    withReference.length === 0 ? "No figure here has a published reference" : `${bold(`${above} of ${withReference.length}`)} figures with a published reference are above it`,
+    `${bold(grouped(inProduct))} places in product code`,
+    ...inTests === 0 ? [] : [`${bold(grouped(inTests))} clones in tests`]
+  ];
+}
+function summaryLine(report) {
+  return summaryParts(report, (text) => `<b>${text}</b>`).join(" &middot; ");
+}
+function summaryText(report) {
+  return summaryParts(report, (text) => `**${text}**`).join(" \xB7 ");
+}
+function populationsLine(report) {
+  const of = (metric) => {
+    const unit = report.rows.find((row) => row.metric === metric)?.unit;
+    const found = /(\d[\d\u202f ]*) files/.exec(unit ?? "")?.[1];
+    return found === void 0 ? void 0 : grouped(Number(found.replace(/[\u202f ]/g, "")));
+  };
+  const gauge = report.rows.find((row) => row.metric === "measuredFiles")?.value;
+  const graph = of("importEdges") ?? of("communities");
+  const walk3 = of("entryPoints") ?? of("deadLinesPercent");
+  const parts = [
+    gauge === void 0 ? void 0 : `the size gauge ${grouped(Number(gauge))} files`,
+    graph === void 0 ? void 0 : `the import graph ${graph}`,
+    walk3 === void 0 ? void 0 : `the dead-code walk ${walk3}, which follows the specs too`
+  ].filter(Boolean);
+  return parts.length < 2 ? "" : `      <p class="pops">Three passes read three populations: ${parts.join(", ")}.</p>`;
+}
+var FINDINGS_SCRIPT = `
+  (function () {
+    var table = document.getElementById('ftable')
+    var box = document.getElementById('ffilter')
+    var count = document.getElementById('fcount')
+    if (!table || !box || !count) return
+    var rows = [].slice.call(table.tBodies[0].rows)
+    var chips = [].slice.call(document.querySelectorAll('.fchip'))
+    var kind = ''
+    function apply() {
+      var text = box.value.trim().toLowerCase()
+      var shown = 0
+      for (var i = 0; i < rows.length; i++) {
+        var row = rows[i]
+        var ok =
+          (kind === '' || row.getAttribute('data-kind') === kind) &&
+          (text === '' || row.getAttribute('data-find').indexOf(text) !== -1)
+        row.classList.toggle('hidden', !ok)
+        if (ok) shown++
+      }
+      /*
+       * The same grouping the server applies, so the counter does not change shape as soon as
+       * someone types in the box.
+       *
+       * \u26D4 Every backslash here is DOUBLED because this script is written inside a template
+       * literal, which eats one layer: the single-backslash spelling compiled to /B(?=(d{3})...)/
+       * and looked for the letter B. It never threw, it simply never grouped, and the page said
+       * 1 of 244 shown either way. Our own lint caught it as no-useless-escape.
+       */
+      var group = function (n) { return String(n).replace(/\\B(?=(\\d{3})+(?!\\d))/g, '\\u202f') }
+      count.textContent = group(shown) + ' of ' + group(rows.length) + ' shown'
+      // \u26A0\uFE0F Silent at rest: a counter reading 244 of 244 beside an empty box is noise, and the
+      // reader needs it only once something is hidden.
+      count.hidden = shown === rows.length
+    }
+    box.addEventListener('input', apply)
+    chips.forEach(function (chip) {
+      chip.addEventListener('click', function () {
+        kind = chip.getAttribute('data-kind')
+        chips.forEach(function (other) { other.classList.toggle('on', other === chip) })
+        apply()
+      })
+    })
+    // The shortcut the placeholder advertises. Ignored while typing somewhere else.
+    document.addEventListener('keydown', function (event) {
+      if (event.key === '/' && event.target === document.body) {
+        event.preventDefault()
+        box.focus()
+      }
+    })
+  })()
+`;
+var STYLES = `
+  /*
+   * The Hublo palette, token by token, read from "libs/front/theme/src/branding/definitions/hublo"
+   * rather than approximated: "commonColors.ts" holds the values and "colorTokens.ts" the semantic
+   * names used in the comments below.
+   *
+   * \u26A0\uFE0F This block is the LIGHT palette only. It used to say the page had one theme on purpose,
+   * because the component package has no dark variant and inventing one would have been charter
+   * this page made up; the dark block below borrows the status page's values instead, so that
+   * sentence became false and is replaced rather than left to be quoted.
+   */
+  :root {
+    color-scheme: light dark;
+    --page: #faf7f1;      /* --bg */
+    --surface: #ffffff;   /* --panel */
+    --ink: #23091c;       /* --ink */
+    --ink-soft: #4a3344;  /* between --ink and --muted, for body prose */
+    --label: #6f5a67;     /* --muted */
+    --rule: #e1dcd0;      /* --line */
+    --brand: #491b3c;     /* --accent */
+    --brand-bg: #f3e9ee;  /* a tint of --accent, for the one filled surface */
+    --moved: #a3341f;     /* --warn */
+    --ok: #2f6b4f;        /* --done */
+    --near: #99513a;      /* --todo */
+    --over: #a3341f;      /* --warn */
+    /*
+     * \u26A0\uFE0F A third surface, under the page and the card. Measured off the validated screen rather
+     * than picked: the note reads as a statement ABOUT the table under it, and on the card colour
+     * it became a first row of that table. No dark value is invented for it below: in the dark
+     * palette it falls back to the card surface, which is a value this page borrowed and did not
+     * make up.
+     */
+    --note: #fdf6ee;
+    --radius: 10px;
+  }
+  /*
+   * \u2B50 A dark palette, which this page refused to have until now for a reason that was true at the
+   * time: the component theme package has no dark variant, so inventing one here would have been
+   * charter this page made up. The status page HAS one, and these are its values, so the dark
+   * theme is now borrowed rather than invented.
+   */
+  @media (prefers-color-scheme: dark) {
+    :root {
+      --page: #23091c;
+      --surface: #2f1128;
+      --ink: #faf7f1;
+      --ink-soft: #d8c6d1;
+      --label: #b298ab;
+      --rule: #45253d;
+      --brand: #ffab93;
+      --brand-bg: #3a1830;
+      --moved: #ef8f78;
+      --ok: #7ed3a5;
+      --near: #ffab93;
+      --over: #ef8f78;
+      --note: #2f1128; /* = --surface: borrowed, not invented */
+    }
+  }
+  /*
+   * The brand faces first, then Inter, then the system. They are loaded at runtime from a branding
+   * artefact in the applications, so they cannot be embedded here without an external request, and
+   * an external request is the one thing this page must not make. A viewer who has them sees them.
+   */
+  body {
+    margin: 0;
+    padding: 2.5rem 1rem 4rem;
+    background: var(--page);
+    color: var(--ink);
+    font: 15px/1.6 'Brand Sans', Inter, ui-sans-serif, system-ui, sans-serif;
+  }
+  main { max-width: 64rem; margin: 0 auto; }
+  header { border-left: 3px solid var(--brand); padding-left: 0.9rem; margin-bottom: 2rem; }
+  h1 { font-size: 1.3rem; font-weight: 600; margin: 0 0 0.2rem; letter-spacing: -0.01em; }
+  h2 {
+    font-size: 0.74rem; text-transform: uppercase; letter-spacing: 0.08em;
+    color: var(--label); margin: 2.5rem 0 0.6rem; font-weight: 600;
+  }
+  p.sub { color: var(--ink-soft); margin: 0; font-size: 0.9rem; }
+  section {
+    background: var(--surface); border: 1px solid var(--rule); border-radius: 10px;
+    padding: 0.25rem 1.1rem; overflow-x: auto;
+  }
+  table { width: 100%; border-collapse: collapse; }
+  th, td { text-align: left; padding: 0.7rem 0.6rem; border-bottom: 1px solid var(--rule); vertical-align: top; }
+  tbody tr:last-child th, tbody tr:last-child td { border-bottom: 0; }
+  thead th { font-size: 0.72rem; text-transform: uppercase; letter-spacing: 0.07em; color: var(--label); font-weight: 600; }
+  tbody th { font-weight: 500; white-space: nowrap; }
+  td.num { font-variant-numeric: tabular-nums; white-space: nowrap; font-weight: 500; }
+  /*
+   * The settings table does NOT force its value column wide. One of its values is the test glob,
+   * long enough to push the table past the card, and the origin column then slid out of view and
+   * was clipped: "overridden in this mo". Long values wrap instead, and the origin stays readable.
+   */
+  table.settings td.num { white-space: normal; overflow-wrap: anywhere; font-weight: 400; }
+  /*
+   * The settings table is a bordered GRID, as the validated screen draws it: an outer card, a
+   * header row, and a rule between each of the three columns.
+   *
+   * \u26D4 Those vertical rules are not decoration. A setting is read as a triple, key then value then
+   * where the value came from, and without them a long value ran visually into the origin beside
+   * it: the glob row is one line of 110 characters and the words "the role's value" sat at its end
+   * looking like part of it.
+   */
+  table.settings {
+    border: 1px solid var(--rule); border-radius: var(--radius); background: var(--surface);
+    border-collapse: separate; border-spacing: 0; overflow: hidden; margin-top: 1.1rem;
+  }
+  table.settings th, table.settings td { border-right: 1px solid var(--rule); }
+  table.settings th:last-child, table.settings td:last-child { border-right: 0; }
+  /*
+   * \u26A0\uFE0F The uppercase is CSS, never the text. text-transform paints the key as the screen draws
+   * it while the document still holds duplication.minTokens, so a reader who copies the cell or
+   * searches the page gets the real key, with its camel case, and not a spelling no config file
+   * would accept.
+   */
+  table.settings tbody th code {
+    text-transform: uppercase; letter-spacing: 0.06em; font-size: 0.72rem; color: var(--label);
+  }
+  table.settings tbody th { width: 13rem; vertical-align: middle; padding-block: 1rem; }
+  /* Narrow on purpose, so the origin cannot take the width the glob value needs. It wraps to two
+     lines when the column gets tighter, which is what the validated screen shows. */
+  table.settings td:last-child {
+    width: 7rem; color: var(--label); font-size: 0.82rem;
+  }
+  /* The header row is a label strip, not a row of data: it takes the smaller padding. */
+  table.settings thead th { padding-block: 0.6rem; }
+  .num { font-variant-numeric: tabular-nums; }
+  td.read { color: var(--ink-soft); font-size: 0.88rem; }
+  tbody th { color: var(--ink); }
+  code { font: 0.86em ui-monospace, SFMono-Regular, Menlo, monospace; color: var(--ink-soft); }
+  .unit { color: var(--label); font-size: 0.82em; font-weight: 400; }
+  .reason {
+    font: 0.74rem ui-monospace, SFMono-Regular, Menlo, monospace;
+    background: var(--brand-bg); color: var(--brand);
+    padding: 0.1rem 0.4rem; border-radius: 4px; white-space: nowrap;
+  }
+  .moved {
+    color: var(--moved); font-size: 0.78rem; font-weight: 500;
+    white-space: nowrap;
+  }
+  /* The graph. The svg carries a viewBox, so dropping its fixed width lets it fill the column. */
+  .g svg { width: 100%; height: auto; display: block; }
+  /* The intro sat flush against the tab strip, which reads as a caption glued to the border
+     rather than as the paragraph that explains the drawing. It needs room above AND below. */
+  .g p.read { margin: 0 0 1.6rem; padding: 1.4rem 0.9rem 0; color: var(--ink-soft); font-size: 0.88rem; max-width: 52rem; }
+  section.panel > section.g { margin-top: 0.8rem; }
+  /* Every edge in one path, faint: it carries the shape, not a readable dependency. */
+  .g .ge { stroke: var(--rule); stroke-width: 0.6; fill: none; }
+  /* The selected file's own edges, drawn on top only once something is picked. */
+  .g .gh { stroke: var(--brand); stroke-width: 1.4; fill: none; }
+  .g .gn circle { cursor: pointer; }
+  /* Dim the module once a file is picked, so its neighbourhood is what is left to read. The
+     opacity sits on the GROUP and the exceptions raise themselves back: one rule instead of one
+     class per dot, which matters at 4 380 of them. */
+  .g.gsel .gn circle { opacity: 0.12; }
+  .g.gsel .gn circle.gon { opacity: 1; }
+  .g.gsel .gn circle.gpick { opacity: 1; stroke: var(--ink); stroke-width: 2; }
+  .g.gsel .ge { opacity: 0.25; }
+  /* The caption. A min-height and not a conditional row: the drawing must not jump by a line
+     when a name appears, which is exactly what pointing at a dot would cause. */
+  .gbar {
+    display: flex; gap: 0.6rem; align-items: center; justify-content: space-between;
+    min-height: 1.9rem; padding: 0 0.6rem; margin-bottom: 0.3rem;
+  }
+  .gbar output {
+    font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 0.82rem;
+    color: var(--ink); overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+  }
+  .gbar button {
+    font: inherit; font-size: 0.8rem; cursor: pointer; white-space: nowrap;
+    padding: 0.2rem 0.6rem; border: 1px solid var(--rule); border-radius: 0.3rem;
+    background: var(--surface); color: var(--ink-soft);
+  }
+
+  /* The collapsed reserves. Closed by default: the figures are what the page opens on. */
+  details { border-bottom: 1px solid var(--rule); }
+  details:last-of-type { border-bottom: 0; }
+  summary {
+    cursor: pointer; padding: 0.7rem 0.6rem; font-size: 0.9rem; font-weight: 500;
+    display: flex; flex-wrap: wrap; gap: 0.5rem; align-items: baseline;
+  }
+  /*
+   * The chevron is drawn, not inherited: "display: flex" on a summary removes the native marker,
+   * and a collapsed block with no affordance is a block nobody opens.
+   */
+  summary { list-style: none; }
+  summary::-webkit-details-marker { display: none; }
+  summary::before {
+    content: ''; flex: none; width: 0.38rem; height: 0.38rem; margin: 0.3rem 0.1rem 0 0;
+    border-right: 1.5px solid var(--label); border-bottom: 1.5px solid var(--label);
+    transform: rotate(-45deg); transition: transform 0.15s ease;
+  }
+  details[open] summary::before { transform: rotate(45deg); border-color: var(--brand); }
+  @media (prefers-reduced-motion: reduce) { summary::before { transition: none; } }
+  summary:hover { color: var(--brand); }
+  /* One line, truncated: the summary is a hint, the body is the text. Opening it shows all. */
+  summary .what {
+    color: var(--label); font-size: 0.82rem; font-weight: 400;
+    flex: 1 1 18rem; min-width: 0;
+    white-space: nowrap; overflow: hidden; text-overflow: ellipsis;
+  }
+  details[open] summary .what { white-space: normal; overflow: visible; }
+  details[open] summary { color: var(--brand); }
+  details p.read { color: var(--ink-soft); }
+  details p b { color: var(--ink); font-weight: 600; }
+  details p { margin: 0 0 0.7rem; padding: 0 0.6rem; color: var(--ink-soft); font-size: 0.88rem; max-width: 52rem; }
+  details p.source { color: var(--label); font-size: 0.8rem; }
+  /* The lever reads as the actionable line, so it is the one that carries weight on the page. */
+  details p.fix { border-left: 2px solid var(--accent, currentColor); padding-left: 0.7rem; }
+  details p.links { font-size: 0.85rem; }
+  details p.links a { color: inherit; }
+  /* ---- One place, as a card ----
+   *
+   * \u26D4 Cards and not table rows, and the reason is three defects a reader listed in one breath:
+   * "les separateurs dans la liste parfois on a deux separateurs, le dernier separateur dans la
+   * list a supp car il n'est pas bien avec la bordure de la liste, la meme remarque le separateur
+   * top a supp". All three are the same mistake, a divider meeting another edge, and none of them
+   * can happen between bordered boxes with a gap. There is not one divider left on this page's
+   * place lists.
+   *
+   * Three grounds alternate down the nesting so each level reads as inset rather than flat:
+   * --page for the panel, --surface for the figure card, --page again for a place, and
+   * --surface for the code. Both tokens exist in both themes, so nothing is invented for dark.
+   */
+  .cards { display: flex; flex-direction: column; gap: 0.55rem; margin-top: 0.85rem; }
+  .pcard {
+    background: var(--page); border: 1px solid var(--rule); border-radius: 8px;
+    padding: 0.6rem 0.75rem;
+  }
+  .phead {
+    display: flex; flex-wrap: wrap; gap: 0.3rem 0.8rem;
+    align-items: baseline; justify-content: space-between;
+  }
+  /* The path is the point of the card, so it gets the ink and breaks anywhere rather than
+     pushing the measure off the card: a 90-character path under src/modules/.../view-models
+     is the ordinary case here, not the exception. */
+  .path { color: var(--ink); overflow-wrap: anywhere; }
+  .pright { display: flex; align-items: baseline; gap: 0.45rem; white-space: nowrap; }
+  .pmeas { font-variant-numeric: tabular-nums; font-weight: 600; }
+  .pmeas .unit { margin-left: 0.3rem; font-weight: 400; }
+  /* Which gauge fired and at what value. Both halves come from GAUGE_THRESHOLDS. */
+  .chip {
+    font-size: 0.72rem; color: var(--label); background: var(--surface);
+    border: 1px solid var(--rule); border-radius: 999px; padding: 0.08rem 0.5rem;
+  }
+  .chip code { color: inherit; font-size: 0.95em; }
+  .pmeta {
+    display: flex; flex-wrap: wrap; gap: 0.2rem 0.9rem;
+    margin-top: 0.35rem; font-size: 0.8rem; color: var(--ink-soft);
+  }
+  .pair .k { color: var(--label); margin-right: 0.3rem; }
+  details.pcode { margin-top: 0.45rem; }
+  details.pcode > summary { cursor: pointer; font-size: 0.78rem; color: var(--label); font-weight: 400; }
+  details.pcode > summary:hover { color: var(--brand); }
+  pre.code {
+    margin: 0.45rem 0 0; padding: 0.65rem 0.85rem 0.65rem 0; background: var(--surface);
+    border: 1px solid var(--rule); border-radius: 6px; overflow-x: auto;
+    font: 0.8rem/1.6 ui-monospace, SFMono-Regular, Menlo, monospace;
+    color: var(--ink); white-space: pre;
+  }
+  /* The line number. An inline-block with a fixed width aligns the gutter without a second
+     element, and the number stays in the text flow, so the block is still readable as numbered
+     lines if the stylesheet never arrives. */
+  pre.code .n {
+    display: inline-block; width: 4em; padding-right: 0.9rem; text-align: right;
+    color: var(--label); user-select: none;
+  }
+  /* ---- Tabs, with no script. The radios are hidden but still focusable by keyboard. ---- */
+  input.tab { position: absolute; opacity: 0; pointer-events: none; }
+  nav.tabs { display: flex; flex-wrap: wrap; gap: 0.3rem; margin: 1.6rem 0 0; border-bottom: 1px solid var(--rule); }
+  nav.tabs label {
+    padding: 0.5rem 0.9rem; cursor: pointer; font-size: 0.86rem; color: var(--label);
+    border: 1px solid transparent; border-bottom: none; border-radius: 6px 6px 0 0; margin-bottom: -1px;
+  }
+  nav.tabs label:hover { color: var(--ink); }
+  nav.tabs .tabn { font-size: 0.76rem; color: var(--label); }
+  /* \u26D4 The panel gives up its own ground and border so the figures can be the cards. Two bordered
+     surfaces of the same colour nested in each other read as one flat block, which is what the
+     page looked like, and the reference a reader named is Sonar: white cards on a plain ground. */
+  section.panel { display: none; padding: 1.4rem 0 0; background: none; border: 0; border-radius: 0; }
+  /* One rule per tab index, from tabRules: the selector has to name the id to stay script-free. */
+__TAB_RULES__
+  /* Focus has to be visible although the control is: the label is what a keyboard user lands on. */
+  input.tab:focus-visible ~ nav.tabs label { outline: 2px solid var(--accent, currentColor); outline-offset: 2px; }
+  /* \u26A0\uFE0F No style at all means every panel shows, which is the readable fallback rather than a blank page. */
+
+  /* ---- One figure, its status and its help: a card ---- */
+  .figure {
+    background: var(--surface); border: 1px solid var(--rule); border-radius: var(--radius);
+    padding: 0.85rem 1.05rem; margin-bottom: 0.7rem;
+  }
+  .figure .head { display: flex; flex-wrap: wrap; gap: 0.4rem 1rem; align-items: baseline; justify-content: space-between; }
+  .figure .name { font-weight: 500; }
+  .figure .val { font-variant-numeric: tabular-nums; }
+  .figure details { margin-top: 0.5rem; }
+  .figure summary { cursor: pointer; font-size: 0.8rem; color: var(--label); }
+  .figure details p { max-width: 52rem; font-size: 0.86rem; }
+  .figure p.noref { color: var(--label); font-style: italic; }
+  /* ---- The header: what this report is, before any figure ---- */
+  .brand { display: flex; align-items: baseline; gap: 0.5rem; font-size: 0.8rem; margin-bottom: 1.1rem; }
+  .brand b { font-weight: 700; }
+  .brand span { color: var(--label); }
+  .brand .stamp { margin-left: auto; text-align: right; }
+  header h1 { font-size: 1.6rem; margin: 0 0 0.35rem; letter-spacing: -0.01em; }
+  .lede { font-size: 0.95rem; color: var(--ink-soft); margin: 0; }
+  .lede b { color: var(--ink); font-weight: 600; }
+  .pops { font-size: 0.8rem; color: var(--label); margin: 0.45rem 0 0; }
+
+  /* ---- A family, as a panel of the overview ---- */
+  .fam { margin-top: 1.9rem; }
+  .fam > h2 { font-size: 0.72rem; letter-spacing: 0.09em; text-transform: uppercase; color: var(--label); font-weight: 600; margin: 0 0 0.7rem; }
+
+  /* \u26D4 The one line a reader acts on, outside the fold. It used to be the fifth of six items
+     inside a disclosure labelled "what this means", so 37 sentences were written and none read. */
+  .figure p.fix { background: var(--brand-bg, #f3e9ee); border-radius: 0.5rem; padding: 0.55rem 0.8rem; margin: 0.6rem 0 0; font-size: 0.84rem; line-height: 1.5; }
+  .figure p.fix b { color: var(--accent, #491b3c); }
+
+  /* \u26D4 A view's opening note sits in a box rather than running as prose into the first row: it is
+     a statement ABOUT the table under it, and prose at the same weight reads as the table's first
+     line. Both the findings and the settings views open with one. */
+  .panel-note { background: var(--note); border: 1px solid var(--rule); border-radius: var(--radius); padding: 0.75rem 1rem; margin: 1.1rem 0 0; font-size: 0.86rem; line-height: 1.55; color: var(--ink-soft); }
+
+  /* ---- The findings filter: the one place the page has a script ---- */
+  .ftools { position: relative; margin: 1.6rem 0 0; }
+  .ftools input { width: 100%; font: inherit; font-size: 0.88rem; padding: 0.6rem 2.4rem 0.6rem 0.9rem; border: 1px solid var(--rule); border-radius: 0.5rem; background: var(--surface); color: var(--ink); }
+  .ftools input:focus-visible { outline: 2px solid var(--accent, currentColor); outline-offset: 1px; }
+  .ftools kbd { position: absolute; right: 0.85rem; top: 50%; transform: translateY(-50%);
+    font-family: var(--mono, ui-monospace, monospace); font-size: 0.78rem; color: var(--label); }
+  button.fchip { font: inherit; cursor: pointer; background: var(--surface); }
+  button.fchip.on { background: var(--accent, #491b3c); border-color: var(--accent, #491b3c); color: #fff; }
+  button.fchip.on span { color: #fff; }
+  .fcount { font-size: 0.76rem; color: var(--label); margin: 0 0 0.9rem; }
+  table.findings tr.hidden { display: none; }
+
+  /* ---- The findings list: a row per finding, never a card ---- */
+  .fchips { display: flex; flex-wrap: wrap; gap: 0.4rem; margin: 0.9rem 0 0.7rem; }
+  .fchip { font-size: 0.72rem; padding: 0.18rem 0.6rem; border-radius: 0.8rem; border: 1px solid var(--rule); color: var(--ink-soft); }
+  .fchip span { color: var(--label); }
+  table.findings { width: 100%; border-collapse: collapse; background: var(--surface); border: 1px solid var(--rule); border-radius: var(--radius); overflow: hidden; }
+  table.findings th { text-align: left; font-size: 0.68rem; letter-spacing: 0.08em; text-transform: uppercase; color: var(--label); font-weight: 600; padding: 0.6rem 0.9rem; border-bottom: 1px solid var(--rule); }
+  table.findings td { padding: 0.5rem 0.9rem; border-bottom: 1px solid var(--rule); vertical-align: top; }
+  table.findings tr:last-child td { border-bottom: 0; }
+  table.findings .kind { display: inline-block; font-size: 0.68rem; padding: 0.12rem 0.5rem; border-radius: 0.7rem; background: var(--accent-bg, #f3e9ee); color: var(--accent, #491b3c); white-space: nowrap; }
+  /* \u26A0\uFE0F The directory is dimmed and the file name is not: the eye scans the name, and a path where
+     every character carries the same weight is a path nobody reads. */
+  table.findings .where { font-family: var(--mono, ui-monospace, monospace); font-size: 0.76rem; line-height: 1.5; word-break: break-all; }
+  table.findings .where .dir { color: var(--label); }
+  table.findings .where .sym { display: block; color: var(--label); font-size: 0.72rem; }
+  table.findings .meas { text-align: right; white-space: nowrap; font-family: var(--mono, ui-monospace, monospace); }
+  table.findings .meas b { font-size: 0.9rem; font-weight: 500; }
+  table.findings .meas span { display: block; font-size: 0.66rem; color: var(--label); }
+  .capped { font-size: 0.72rem; color: var(--label); font-weight: 400; margin-left: 0.5rem; }
+  .mark { display: inline-block; font-size: 0.68rem; font-weight: 600; letter-spacing: 0.06em; text-transform: uppercase; padding: 0.1rem 0.42rem; border-radius: 0.7rem; vertical-align: 0.14rem; margin: 0 0.4rem; }
+  .mark.s-ok { background: #e4efe9; color: var(--ok); }
+  .mark.s-near { background: #f6ebe3; color: var(--near); }
+  .mark.s-exceed { background: #f7e4e0; color: var(--over); }
+  /* \u26D4 Colour is never the only carrier: each dot has a title attribute, and the band is in the help text. */
+
+  /* ---- What was not measured ---- */
+  p.noref { font-size: 0.9rem; }
+  .notes { margin-top: 1.4rem; }
+  .notes h2 { font-size: 0.8rem; margin: 0 0 0.3rem; text-transform: uppercase; letter-spacing: 0.08em; color: var(--label); }
+  .notes p { font-size: 0.86rem; color: var(--ink-soft); }
+  p.census { color: var(--label); margin-top: 1.6rem; }
+
+  /* The places of one figure, inside its card: counted on the summary, closed. No filet, the
+     card's own border is the only edge at this level. */
+  details.place { margin-top: 0.6rem; }
+  details.place > summary { cursor: pointer; font-weight: 500; font-size: 0.86rem; }
+  details.place > summary .count { color: var(--label); font-weight: 400; font-size: 0.85rem; margin-left: 0.5rem; }
+  footer { color: var(--label); font-size: 0.78rem; margin-top: 2.5rem; }
+  @media (max-width: 40rem) {
+    section { padding: 0.25rem 0.6rem; }
+    summary .what { display: none; }
+  }
+`;
+function renderHtml(report) {
+  const placesByMetric = new Map(
+    [...listedByMetric(report.findings).entries()].map(([metric, group]) => [
+      metric,
+      placesFor(group)
+    ])
+  );
+  const settings = report.settings.map(
+    (setting) => `      <tr>
+        <th scope="row"><code>${escape(setting.key)}</code></th>
+        <td class="num">${escape(setting.value)}</td>
+        <td>${setting.moved ? '<span class="moved">overridden by this module</span>' : '<span class="u">the role&rsquo;s value</span>'}</td>
+      </tr>`
+  ).join("\n");
+  const shown = new Set(report.rows.map((row) => row.metric));
+  const orphansByFamily = /* @__PURE__ */ new Map();
+  for (const [metric, places] of placesByMetric) {
+    if (shown.has(metric)) continue;
+    const orphanHelp = helpFor(metric);
+    const orphanAction = orphanHelp?.fix === void 0 ? "" : `
+        <p class="fix"><b>What to do.</b> ${prose(orphanHelp.fix)}</p>`;
+    const block = `      <div class="figure">
+        <div class="head"><span class="name">${escape(orphanHelp?.label ?? metric)}</span></div>${orphanAction}
+${orphanHelp === void 0 ? "" : helpDetails(orphanHelp, true)}
+${places}
+      </div>`;
+    const family = familyOf(metric) ?? "Other";
+    orphansByFamily.set(family, [...orphansByFamily.get(family) ?? [], block]);
+  }
+  const orphansFor = (label) => (orphansByFamily.get(label) ?? []).join("\n");
+  const families = byFamily(report.rows);
+  const withOrphansOnly = FAMILIES.filter(
+    (family) => orphansByFamily.has(family.label) && !families.some((f) => f.label === family.label)
+  ).map((family) => ({ label: family.label, rows: [] }));
+  const complete = [...families, ...withOrphansOnly];
+  const ordered = [
+    ...complete.filter((family) => family.label === "Bundle"),
+    ...complete.filter((family) => family.label !== "Bundle")
+  ];
+  const absences = report.notes.length === 0 ? "" : `      <div class="notes"><h2>Not measured</h2>${report.notes.map((note) => `<p>${escape(note)}</p>`).join("")}</div>`;
+  const overview = `${ordered.map(
+    (family, index) => `      <section class="fam">
+        <h2>${escape(family.label)}</h2>
+${family.rows.map((row) => figureBlock(row, placesByMetric.get(row.metric) ?? "")).join("\n")}${orphansFor(family.label)}${index === 0 ? absences : ""}
+      </section>`
+  ).join(
+    "\n"
+  )}${report.picture === void 0 ? "" : `
+      <section class="fam">
+        <h2>Shape</h2>
+${report.picture}
+      </section>`}`;
+  const panels = [
+    { label: "Overview", body: overview },
+    { label: "Findings", body: findingsPanel(report), count: report.findings?.length ?? 0 },
+    {
+      label: "Settings",
+      count: report.settings.length,
+      body: `      <p class="panel-note">The settings these figures were produced with. Two modules measured with
+        different settings cannot be compared, which is why they travel with the numbers.</p>
+      <table class="settings">
+        <thead>
+          <tr><th scope="col">Setting</th><th scope="col">Value</th><th scope="col">Origin</th></tr>
+        </thead>
+        <tbody>
+${settings}
+        </tbody>
+      </table>`
+    }
+  ];
+  const tabInputs = panels.map(
+    (panel, index) => `  <input class="tab" type="radio" name="tab" id="tab-${index}"${index === 0 ? " checked" : ""}>`
+  ).join("\n");
+  const tabLabels = panels.map(
+    (panel, index) => `    <label for="tab-${index}" id="tablabel-${index}" aria-controls="panel-${index}">${escape(panel.label)}${panel.count === void 0 ? "" : ` <span class="tabn">${grouped(panel.count)}</span>`}</label>`
+  ).join("\n");
+  const tabPanels = panels.map(
+    (panel, index) => `  <section class="panel" data-tab="${index}" id="panel-${index}" aria-labelledby="tablabel-${index}">
+${panel.body}
+  </section>`
+  ).join("\n");
+  const page = `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>Static analysis: ${escape(report.module)}</title>
+<style>${STYLES.replace("__TAB_RULES__", tabRules(panels.length))}</style>
+</head>
+<body>
+<main>
+  <header>
+    <div class="brand"><b>sentinel</b> <span>static analysis</span><span class="stamp">${report.commit == null ? "" : `commit <code>${escape(report.commit)}</code> &middot; `}${escape(report.passes.join(" / "))}</span></div>
+    <h1>${escape(report.module)}</h1>
+    <p class="lede">${summaryLine(report)}</p>
+${populationsLine(report)}
+  </header>
+
+${tabInputs}
+  <nav class="tabs" aria-label="Figure families">
+${tabLabels}
+  </nav>
+${tabPanels}
+  <footer>sentinel static-analysis</footer>
+</main>
+<script>${FINDINGS_SCRIPT}</script>
+</body>
+</html>
+`;
+  return page.split("\n").map((line) => line.replace(/[ \t]+$/, "")).join("\n");
+}
+
+// src/roles/static-analysis/excerpt.ts
+var WINDOW = { lines: 10, nesting: { before: 3, after: 6 } };
+var NESTS_UPWARD = /* @__PURE__ */ new Set(["max-depth", "max-nested-callbacks"]);
+var SHOWS_THE_HEAD = /* @__PURE__ */ new Set(["max-lines"]);
+var WHOLE_FILE = /* @__PURE__ */ new Set(["unusedFiles"]);
+function linesOf(cache, cwd, relative5) {
+  if (cache.has(relative5)) return cache.get(relative5);
+  let lines;
+  try {
+    lines = readFileSync17(join22(cwd, relative5), "utf8").split("\n");
+  } catch {
+    lines = void 0;
+  }
+  cache.set(relative5, lines);
+  return lines;
+}
+function pointOf(path2) {
+  const cut = path2.lastIndexOf(":");
+  if (cut <= 0) return { file: path2 };
+  const tail = path2.slice(cut + 1);
+  if (!/^\d+$/.test(tail)) return { file: path2 };
+  return { file: path2.slice(0, cut), line: Number(tail) };
+}
+function declarationOf(lines, name) {
+  const named = new RegExp(`\\b${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`);
+  const declares = /\b(export|const|function|class|type|interface|enum|let|var)\b/;
+  const hits = [];
+  for (const [index, line] of lines.entries()) {
+    if (named.test(line) && declares.test(line)) hits.push(index + 1);
+  }
+  return hits.length === 1 ? hits[0] : void 0;
+}
+function windowFor(finding, lines) {
+  const { line } = pointOf(finding.path);
+  const head = () => ({
+    firstLine: 1,
+    text: lines.slice(0, WINDOW.lines).join("\n")
+  });
+  if (WHOLE_FILE.has(finding.metric) || SHOWS_THE_HEAD.has(finding.metric)) return head();
+  const at = line ?? (finding.name ? declarationOf(lines, finding.name) : void 0);
+  if (at === void 0) return void 0;
+  const nests = NESTS_UPWARD.has(finding.metric);
+  const from = nests ? Math.max(1, at - WINDOW.nesting.before) : at;
+  const to = Math.min(lines.length, nests ? at + WINDOW.nesting.after : at + WINDOW.lines - 1);
+  if (from > lines.length) return void 0;
+  return { firstLine: from, text: lines.slice(from - 1, to).join("\n") };
+}
+function withExcerpts(report, cwd) {
+  const wanted = /* @__PURE__ */ new Set();
+  for (const group of listedByMetric(report.findings).values()) {
+    for (const finding of group.listed) {
+      if (finding.excerpt === void 0) wanted.add(finding);
+    }
+  }
+  if (wanted.size === 0) return report;
+  const cache = /* @__PURE__ */ new Map();
+  const findings = report.findings.map((finding) => {
+    if (!wanted.has(finding)) return finding;
+    const lines = linesOf(cache, cwd, pointOf(finding.path).file);
+    if (lines === void 0) return finding;
+    const found = windowFor(finding, lines);
+    return found === void 0 ? finding : { ...finding, excerpt: found.text, excerptFirstLine: found.firstLine };
+  });
+  return { ...report, findings };
+}
+
+// src/roles/static-analysis/graph/picture.ts
+import forceAtlas2 from "graphology-layout-forceatlas2";
+import circular from "graphology-layout/circular.js";
+import renderSvg from "graphology-svg";
+var ITERATIONS = 300;
+var LABELLED = 10;
+var BLANK = " ";
+var SIZE = { width: 1600, height: 1200, margin: 30 };
+function hueOf(community) {
+  return `hsl(${community * 137 % 360} 65% 52%)`;
+}
+function layOut(graph, communities) {
+  const drawn = graph.copy();
+  circular.assign(drawn);
+  forceAtlas2.assign(drawn, { iterations: ITERATIONS, settings: forceAtlas2.inferSettings(drawn) });
+  const named = new Set(
+    drawn.nodes().sort((left, right) => drawn.degree(right) - drawn.degree(left) || left.localeCompare(right)).slice(0, LABELLED)
+  );
+  drawn.forEachNode((node) => {
+    drawn.setNodeAttribute(node, "size", 3.5 + Math.sqrt(drawn.degree(node)));
+    drawn.setNodeAttribute(node, "color", hueOf(communities[node] ?? 0));
+    drawn.setNodeAttribute(node, "label", named.has(node) ? node.split("/").pop() ?? node : BLANK);
+  });
+  return drawn;
+}
+function writeGraphPicture(drawn, path2) {
+  return new Promise((resolve5) => {
+    renderSvg(drawn, path2, SIZE, () => resolve5());
+  });
+}
+
+// src/roles/static-analysis/graph/explorer.ts
+function place(graph) {
+  const nodes = graph.nodes();
+  let minX = Infinity;
+  let maxX = -Infinity;
+  let minY = Infinity;
+  let maxY = -Infinity;
+  for (const node of nodes) {
+    const x = graph.getNodeAttribute(node, "x");
+    const y = graph.getNodeAttribute(node, "y");
+    if (x < minX) minX = x;
+    if (x > maxX) maxX = x;
+    if (y < minY) minY = y;
+    if (y > maxY) maxY = y;
+  }
+  const usableWidth = SIZE.width - 2 * SIZE.margin;
+  const usableHeight = SIZE.height - 2 * SIZE.margin;
+  const spanX = maxX - minX || 1;
+  const spanY = maxY - minY || 1;
+  const scale = Math.min(usableWidth / spanX, usableHeight / spanY);
+  const offsetX = SIZE.margin + (usableWidth - spanX * scale) / 2;
+  const offsetY = SIZE.margin + (usableHeight - spanY * scale) / 2;
+  const placed = /* @__PURE__ */ new Map();
+  for (const node of nodes) {
+    const x = graph.getNodeAttribute(node, "x");
+    const y = graph.getNodeAttribute(node, "y");
+    placed.set(node, {
+      x: offsetX + (x - minX) * scale,
+      y: offsetY + (y - minY) * scale,
+      // `size` is already the sqrt-damped degree `picture.ts` computed, in the same units as the
+      // standalone image, so the two drawings show a file at the same weight.
+      r: graph.getNodeAttribute(node, "size")
+    });
+  }
+  return placed;
+}
+function round(value) {
+  return (Math.round(value * 100) / 100).toString();
+}
+function hueOf2(community) {
+  return `hsl(${community * 137 % 360} 65% 52%)`;
+}
+function jsonInScript(value) {
+  return value.replace(/</g, "\\u003c");
+}
+function buildExplorer(drawn, communities) {
+  const placed = place(drawn);
+  const nodes = [...placed.keys()];
+  const index = new Map(nodes.map((node, position) => [node, position]));
+  const edges = [];
+  const segments = [];
+  drawn.forEachEdge((_edge, _attributes, source, target) => {
+    const from = placed.get(source);
+    const to = placed.get(target);
+    const sourceIndex = index.get(source);
+    const targetIndex = index.get(target);
+    if (!from || !to || sourceIndex === void 0 || targetIndex === void 0) return;
+    segments.push(`M${round(from.x)} ${round(from.y)}L${round(to.x)} ${round(to.y)}`);
+    edges.push(sourceIndex, targetIndex);
+  });
+  const used = [...new Set(nodes.map((node) => communities[node] ?? 0))].sort((a, b) => a - b);
+  const palette2 = used.map((community) => `.g svg .k${community}{fill:${hueOf2(community)}}`).join("");
+  const circles = nodes.map((node) => {
+    const spot = placed.get(node);
+    if (!spot) return "";
+    const community = communities[node] ?? 0;
+    return `<circle cx="${round(spot.x)}" cy="${round(spot.y)}" r="${round(spot.r)}" class="k${community}"><title>${escape(node)}</title></circle>`;
+  }).join("");
+  const payload = JSON.stringify({ f: nodes, e: edges });
+  const markup = `<section class="g">
+  <p class="read">One dot per file, sized by how many imports touch it, coloured by the community it landed in. The shape is the answer to how many lobes there are and whether they are joined. <b>Point at a dot for its path, click it to keep only that file and its neighbours, click the background to come back.</b></p>
+  <div class="gbar"><output id="gname">&nbsp;</output><button type="button" id="greset" hidden>show everything</button></div>
+  <svg viewBox="0 0 ${SIZE.width} ${SIZE.height}" role="img" aria-label="The module's import graph, one dot per file">
+    <path class="ge" d="${segments.join("")}"/>
+    <path class="gh" d=""/>
+    <g class="gn">${circles}</g>
+    ${/* ⛔ INSIDE the svg, where `<style>` is permitted content. It sat under the `<section>`,
+     which html-validate refuses as `element-permitted-content`, and that is our own matcher:
+     `toBeValidHtml` would fail this page. The svg is also the right scope, since every rule
+     in here colours an svg element. */
+  ""}
+    <style>${palette2}</style>
+  </svg>
+  <script type="application/json" id="gdata">${jsonInScript(payload)}</script>
+  <script>${SCRIPT}</script>
+</section>`;
+  return { markup, bytes: Buffer.byteLength(markup, "utf8") };
+}
+var SCRIPT = `(function(){
+  var root=document.currentScript.closest('.g');
+  var data=JSON.parse(root.querySelector('#gdata').textContent);
+  var dots=root.querySelectorAll('.gn circle');
+  var name=root.querySelector('#gname');
+  var reset=root.querySelector('#greset');
+  var highlight=root.querySelector('.gh');
+  var out=[],inn=[];
+  for(var i=0;i<data.f.length;i++){out.push([]);inn.push([]);}
+  for(var k=0;k<data.e.length;k+=2){out[data.e[k]].push(data.e[k+1]);inn[data.e[k+1]].push(data.e[k]);}
+  function show(i){
+    name.textContent=data.f[i]+'  ('+out[i].length+' imported, '+inn[i].length+' importing)';
+  }
+  function clear(){
+    root.classList.remove('gsel');
+    highlight.setAttribute('d','');
+    for(var i=0;i<dots.length;i++)dots[i].classList.remove('gon','gpick');
+    name.innerHTML='&nbsp;';
+    reset.hidden=true;
+  }
+  function pick(i){
+    root.classList.add('gsel');
+    var near={};near[i]=1;
+    var d='';
+    function seg(a,b){
+      d+='M'+dots[a].getAttribute('cx')+' '+dots[a].getAttribute('cy')+'L'+dots[b].getAttribute('cx')+' '+dots[b].getAttribute('cy');
+    }
+    for(var a=0;a<out[i].length;a++){near[out[i][a]]=1;seg(i,out[i][a]);}
+    for(var b=0;b<inn[i].length;b++){near[inn[i][b]]=1;seg(inn[i][b],i);}
+    highlight.setAttribute('d',d);
+    for(var j=0;j<dots.length;j++){
+      dots[j].classList.toggle('gon',!!near[j]);
+      dots[j].classList.toggle('gpick',j===i);
+    }
+    show(i);
+    reset.hidden=false;
+  }
+  for(var n=0;n<dots.length;n++){
+    (function(i){
+      dots[i].addEventListener('mouseenter',function(){show(i);});
+      dots[i].addEventListener('click',function(event){event.stopPropagation();pick(i);});
+    })(n);
+  }
+  root.querySelector('svg').addEventListener('click',clear);
+  reset.addEventListener('click',clear);
+})();`;
+
+// src/roles/static-analysis/graph/scan.ts
+import Graph from "graphology";
+import louvain from "graphology-communities-louvain";
+import { stronglyConnectedComponents } from "graphology-components";
+import { degreeCentrality } from "graphology-metrics/centrality/degree.js";
+import { density } from "graphology-metrics/graph/density.js";
+
+// src/roles/static-analysis/graph/imports.ts
+import { readFileSync as readFileSync18 } from "node:fs";
+import { dirname, join as join23 } from "node:path";
+import { parseSync as parseSync3 } from "oxc-parser";
+import { globSync as globSync5 } from "tinyglobby";
+var EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
+var TS_BEHIND_JS = {
+  ".js": [".ts", ".tsx"],
+  ".mjs": [".mts"],
+  ".cjs": [".cts"]
+};
+function isTypeOnly(node) {
+  if (node.importKind === "type" || node.exportKind === "type") return true;
+  const specifiers = node.specifiers;
+  if (!Array.isArray(specifiers) || specifiers.length === 0) return false;
+  return specifiers.every((specifier) => specifier?.importKind === "type");
+}
+function specifiersOf(program) {
+  const found = [];
+  const walk3 = (node) => {
+    if (!node || typeof node !== "object") return;
+    if (Array.isArray(node)) {
+      for (const child of node) walk3(child);
+      return;
+    }
+    const current = node;
+    const source = current.source?.value;
+    switch (current.type) {
+      // `import x from './a'`, and the two re-export forms, which are imports that also publish.
+      case "ImportDeclaration":
+      case "ExportNamedDeclaration":
+      case "ExportAllDeclaration":
+        if (typeof source === "string")
+          found.push({ specifier: source, typeOnly: isTypeOnly(current) });
+        break;
+      // `import('./a')`, the lazy route and the split bundle. A real runtime edge, always.
+      case "ImportExpression":
+        if (typeof source === "string") found.push({ specifier: source, typeOnly: false });
+        break;
+      case "CallExpression": {
+        const argument = current.arguments?.[0]?.value;
+        if (current.callee?.name === "require" && typeof argument === "string")
+          found.push({ specifier: argument, typeOnly: false });
+        break;
+      }
+      default:
+        break;
+    }
+    for (const [field, value] of Object.entries(current)) {
+      if (field === "type" || field === "start" || field === "end") continue;
+      walk3(value);
+    }
+  };
+  walk3(program);
+  return found;
+}
+function resolveSpecifier(from, specifier, known) {
+  if (!specifier.startsWith(".")) return void 0;
+  const base = join23(dirname(from), specifier);
+  if (known.has(base)) return base;
+  for (const extension of EXTENSIONS) {
+    if (known.has(base + extension)) return base + extension;
+  }
+  const written = EXTENSIONS.find((extension) => base.endsWith(extension));
+  for (const extension of TS_BEHIND_JS[written ?? ""] ?? []) {
+    const swapped = base.slice(0, -(written ?? "").length) + extension;
+    if (known.has(swapped)) return swapped;
+  }
+  for (const extension of EXTENSIONS) {
+    const index = join23(base, `index${extension}`);
+    if (known.has(index)) return index;
+  }
+  return void 0;
+}
+function buildImportGraph(cwd, config) {
+  const extensions = extensionsOf(config.languages).map((extension) => extension.slice(1)).join(",");
+  const files = globSync5(
+    measuredRoots(cwd).map(
+      (root) => root === "." ? `**/*.{${extensions}}` : `${root}/**/*.{${extensions}}`
+    ),
+    {
+      cwd,
+      ignore: exclusions(config, "product"),
+      dot: false
+    }
+  );
+  const known = new Set(files);
+  const all2 = {};
+  const value = {};
+  for (const file of files) {
+    all2[file] = [];
+    value[file] = [];
+    let parsed;
+    try {
+      parsed = parseSync3(file, readFileSync18(join23(cwd, file), "utf8"));
+    } catch {
+      continue;
+    }
+    if (parsed.errors.length > 0) continue;
+    for (const { specifier, typeOnly } of specifiersOf(parsed.program)) {
+      const target = resolveSpecifier(file, specifier, known);
+      if (!target || target === file) continue;
+      if (!all2[file].includes(target)) all2[file].push(target);
+      if (!typeOnly && !value[file].includes(target)) value[file].push(target);
+    }
+  }
+  return { all: all2, value };
+}
+
+// src/roles/static-analysis/graph/scan.ts
+var MOST_IMPORTED_LISTED = 10;
+function seeded() {
+  let state = 42;
+  return () => {
+    state = (state * 1664525 + 1013904223) % 4294967296;
+    return state / 4294967296;
+  };
+}
+function toGraph(tree) {
+  const graph = new Graph({ type: "directed", allowSelfLoops: false });
+  for (const file of Object.keys(tree)) if (!graph.hasNode(file)) graph.addNode(file);
+  for (const [from, targets2] of Object.entries(tree)) {
+    for (const to of targets2) {
+      if (!graph.hasNode(to)) graph.addNode(to);
+      if (from !== to && !graph.hasDirectedEdge(from, to)) graph.addDirectedEdge(from, to);
+    }
+  }
+  return graph;
+}
+function scanGraph(cwd, config) {
+  const trees = buildImportGraph(cwd, config);
+  const graph = toGraph(trees.all);
+  const groupsOf = (candidate) => stronglyConnectedComponents(candidate).filter((component) => component.length > 1).map((files) => ({ files })).sort((left, right) => right.files.length - left.files.length);
+  const cycles = groupsOf(toGraph(trees.value));
+  const erased = groupsOf(graph).length - cycles.length;
+  const partition = graph.size > 0 ? louvain.detailed(graph, { resolution: config.graph.resolution, rng: seeded() }) : { count: graph.order, modularity: void 0, communities: {} };
+  const centrality = degreeCentrality(graph);
+  const mostImported = graph.nodes().map((path2) => {
+    const afferent = graph.inDegree(path2);
+    const efferent = graph.outDegree(path2);
+    return {
+      path: path2,
+      importedBy: afferent,
+      dependsOn: efferent,
+      // Both zero cannot reach here, the filter below drops them, but the guard stays: the
+      // formula is the only place in this pass that divides.
+      instability: afferent + efferent === 0 ? 1 : efferent / (afferent + efferent),
+      centrality: centrality[path2] ?? 0
+    };
+  }).filter((file) => file.importedBy > 0).sort(
+    (left, right) => right.importedBy - left.importedBy || left.path.localeCompare(right.path)
+  ).slice(0, MOST_IMPORTED_LISTED);
+  return {
+    files: graph.order,
+    edges: graph.size,
+    density: graph.order > 1 ? density(graph) : 0,
+    cycles,
+    filesInCycles: cycles.reduce((total, cycle) => total + cycle.files.length, 0),
+    // ⚠️ Clamped at 0: the two runs are independent, and a group that SHRANK rather than died
+    // leaves both counts equal while fewer files are caught. Never a negative in the report.
+    cyclesErasedAtBuild: Math.max(erased, 0),
+    communities: partition.count,
+    modularity: partition.modularity,
+    mostImported,
+    graph,
+    communityOf: partition.communities
+  };
+}
+
+// src/roles/static-analysis/workspace/consumers.ts
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { existsSync as existsSync17, mkdirSync, readFileSync as readFileSync19, statSync as statSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname2, join as join24, relative as relative4, resolve as resolve3, sep } from "node:path";
+var CACHE_DIR = join24("node_modules", ".cache", "sentinel");
+var CACHE_FILE = "consumer-index.json";
+var SHAPE = 4;
+var EXTENSIONS2 = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
+function workspaceRootFrom(cwd) {
+  let dir = resolve3(cwd);
+  for (; ; ) {
+    if (existsSync17(join24(dir, WORKSPACE_ROOT_MARKER))) return dir;
+    const parent = dirname2(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function aliasTable(workspaceRoot) {
+  const file = join24(workspaceRoot, "tsconfig.base.json");
+  if (!existsSync17(file)) return /* @__PURE__ */ new Map();
+  let paths;
+  try {
+    const parsed = JSON.parse(readFileSync19(file, "utf8"));
+    paths = parsed.compilerOptions?.paths ?? {};
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+  const table = /* @__PURE__ */ new Map();
+  for (const [alias, targets2] of Object.entries(paths)) {
+    if (alias === "apps/*" || alias === "libs/*") continue;
+    table.set(
+      alias,
+      targets2.map((target) => target.replace(/^\.\//, ""))
+    );
+  }
+  return table;
+}
+function resolveSpecifier2(specifier, table, workspaceRoot) {
+  const isFile = (candidate) => {
+    try {
+      return statSync5(join24(workspaceRoot, candidate)).isFile();
+    } catch {
+      return false;
+    }
+  };
+  const exists = (candidate) => {
+    if (isFile(candidate)) return candidate;
+    for (const extension of EXTENSIONS2) {
+      if (isFile(candidate + extension)) return candidate + extension;
+    }
+    for (const extension of EXTENSIONS2) {
+      const index = `${candidate}/index${extension}`;
+      if (isFile(index)) return index;
+    }
+    return void 0;
+  };
+  const exact = table.get(specifier);
+  if (exact) {
+    for (const target of exact) {
+      const hit = exists(target);
+      if (hit) return hit;
+    }
+  }
+  for (const [alias, targets2] of table) {
+    if (!alias.endsWith("/*")) continue;
+    const prefix = alias.slice(0, -1);
+    if (!specifier.startsWith(prefix)) continue;
+    const rest = specifier.slice(prefix.length);
+    for (const target of targets2) {
+      if (!target.endsWith("/*")) continue;
+      const hit = exists(target.slice(0, -1) + rest);
+      if (hit) return hit;
+    }
+  }
+  return void 0;
+}
+function resolveRelative(importer, specifier, workspaceRoot) {
+  const base = join24(dirname2(importer), specifier).split(sep).join("/");
+  if (base.startsWith("..")) return void 0;
+  const isFile = (candidate) => {
+    try {
+      return statSync5(join24(workspaceRoot, candidate)).isFile();
+    } catch {
+      return false;
+    }
+  };
+  if (isFile(base)) return base;
+  for (const extension of EXTENSIONS2) if (isFile(base + extension)) return base + extension;
+  for (const extension of EXTENSIONS2) {
+    const index = `${base}/index${extension}`;
+    if (isFile(index)) return index;
+  }
+  return void 0;
+}
+function isTestFile(path2) {
+  return /\.(test|spec|steps|e2e-spec|integration-spec|stories)\.[cm]?[jt]sx?$|(^|\/)(tests|__tests__|test|testing|stubs|__mocks__|mocks)\//.test(
+    path2
+  );
+}
+function moduleOf(path2, roots) {
+  let best;
+  for (const root of roots) {
+    if ((path2 === root || path2.startsWith(`${root}/`)) && (!best || root.length > best.length)) {
+      best = root;
+    }
+  }
+  return best;
+}
+function buildConsumerIndex(workspaceRoot, moduleRoots) {
+  const table = aliasTable(workspaceRoot);
+  const imported = /* @__PURE__ */ new Set();
+  const testOnly = /* @__PURE__ */ new Set();
+  if (table.size === 0) return { imported, testOnly, builtFrom: "no alias table" };
+  const result = spawnSync5(
+    "git",
+    [
+      "grep",
+      "-I",
+      "-n",
+      "-o",
+      "-E",
+      "@[A-Za-z0-9_-]+/[A-Za-z0-9_./-]+|from '(\\.\\./)+[^']+'",
+      "--",
+      "*.ts",
+      "*.tsx"
+    ],
+    { cwd: workspaceRoot, encoding: "utf8", maxBuffer: 1024 * 1024 * 1024 }
+  );
+  if (result.error || result.status !== 0 && result.status !== 1) {
+    return { imported, testOnly, builtFrom: "git grep failed" };
+  }
+  const fromProduct = /* @__PURE__ */ new Map();
+  const seen = /* @__PURE__ */ new Map();
+  for (const line of (result.stdout ?? "").split("\n")) {
+    if (!line) continue;
+    const first = line.indexOf(":");
+    const second = line.indexOf(":", first + 1);
+    if (first < 0 || second < 0) continue;
+    const importer = line.slice(0, first).split(sep).join("/");
+    const specifier = line.slice(second + 1);
+    let target;
+    const relative5 = /^from '((?:\.\.\/)+[^']+)'$/.exec(specifier)?.[1];
+    if (relative5) {
+      target = resolveRelative(importer, relative5, workspaceRoot);
+    } else {
+      if (!seen.has(specifier)) {
+        seen.set(specifier, resolveSpecifier2(specifier, table, workspaceRoot));
+      }
+      target = seen.get(specifier);
+    }
+    if (!target) continue;
+    if (moduleOf(importer, moduleRoots) === moduleOf(target, moduleRoots)) continue;
+    imported.add(target);
+    const product = !isTestFile(importer);
+    fromProduct.set(target, (fromProduct.get(target) ?? false) || product);
+  }
+  for (const [target, product] of fromProduct) if (!product) testOnly.add(target);
+  return { imported, testOnly, builtFrom: `git grep over ${seen.size} distinct specifiers` };
+}
+function cacheKey(workspaceRoot) {
+  const run = (args) => {
+    const out = spawnSync5("git", args, { cwd: workspaceRoot, encoding: "utf8" });
+    return out.error || out.status !== 0 ? void 0 : out.stdout ?? "";
+  };
+  const head = run(["rev-parse", "HEAD"]);
+  const dirty = run(["status", "--porcelain=v1", "--untracked-files=no"]);
+  if (head === void 0 || dirty === void 0) return void 0;
+  return `${SHAPE}:${head.trim()}:${hash(dirty)}`;
+}
+function hash(text) {
+  let value = 5381;
+  for (let index = 0; index < text.length; index += 1) {
+    value = (value << 5) + value + text.charCodeAt(index) >>> 0;
+  }
+  return value.toString(36);
+}
+function consumerIndex(workspaceRoot, moduleRoots) {
+  const key = cacheKey(workspaceRoot);
+  const file = join24(workspaceRoot, CACHE_DIR, CACHE_FILE);
+  if (key && existsSync17(file)) {
+    try {
+      const cached = JSON.parse(readFileSync19(file, "utf8"));
+      if (cached.key === key) {
+        return {
+          imported: new Set(cached.imported),
+          testOnly: new Set(cached.testOnly),
+          builtFrom: `${cached.builtFrom}, from cache`
+        };
+      }
+    } catch {
+    }
+  }
+  const index = buildConsumerIndex(workspaceRoot, moduleRoots());
+  if (key) {
+    try {
+      mkdirSync(join24(workspaceRoot, CACHE_DIR), { recursive: true });
+      const payload = {
+        key,
+        imported: [...index.imported],
+        testOnly: [...index.testOnly],
+        builtFrom: index.builtFrom
+      };
+      writeFileSync5(file, JSON.stringify(payload), "utf8");
+    } catch {
     }
   }
-  return `${lines.join("\n")}
-`;
-}
-function renderJson(report) {
-  const rows = report.rows.map((row) => ({ ...row, help: helpFor(row.metric) ?? null }));
-  return `${JSON.stringify({ ...report, rows }, null, 2)}
-`;
-}
-function escape(text) {
-  return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+  return index;
 }
-function renderHtml(report) {
-  const rows = report.rows.map((row) => {
-    const help = helpFor(row.metric);
-    return `      <tr class="${row.over ? "over" : ""}">
-        <th scope="row">${escape(help?.label ?? row.metric)}</th>
-        <td class="num">${escape(String(row.value))} <span class="unit">${escape(row.unit)}</span></td>
-        <td class="num">${row.threshold === null ? '<span class="unit">none</span>' : escape(String(row.threshold))}${row.moved ? ' <span class="moved">module</span>' : ""}</td>
-        <td class="caveat">${escape(help?.caveat ?? "")}</td>
-      </tr>`;
-  }).join("\n");
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<title>Static analysis: ${escape(report.module)}</title>
-<style>
-  :root { color-scheme: light dark; --ink: #1a1a1a; --bg: #fdfdfc; --rule: #e2e0da; --warn: #9a3412; --dim: #6b6b6b; }
-  @media (prefers-color-scheme: dark) {
-    :root { --ink: #e8e6e1; --bg: #1b1b1a; --rule: #35332e; --warn: #fb923c; --dim: #9b9892; }
+function outsideView(index, workspaceRoot, moduleRoot) {
+  const prefix = relative4(workspaceRoot, moduleRoot).split(sep).join("/");
+  const within = (path2) => prefix === "" ? path2 : path2.startsWith(`${prefix}/`) ? path2.slice(prefix.length + 1) : void 0;
+  const imported = /* @__PURE__ */ new Set();
+  const testOnly = /* @__PURE__ */ new Set();
+  for (const path2 of index.imported) {
+    const local = within(path2);
+    if (local) imported.add(local);
   }
-  body { margin: 0; padding: 2rem 1rem; background: var(--bg); color: var(--ink);
-         font: 15px/1.55 ui-sans-serif, system-ui, sans-serif; }
-  main { max-width: 60rem; margin: 0 auto; }
-  h1 { font-size: 1.25rem; margin: 0 0 0.25rem; }
-  p.sub { color: var(--dim); margin: 0 0 1.5rem; }
-  table { width: 100%; border-collapse: collapse; }
-  th, td { text-align: left; padding: 0.6rem 0.75rem; border-bottom: 1px solid var(--rule);
-           vertical-align: top; }
-  thead th { font-size: 0.78rem; text-transform: uppercase; letter-spacing: 0.06em; color: var(--dim); }
-  td.num { font-variant-numeric: tabular-nums; white-space: nowrap; }
-  .unit, .moved { color: var(--dim); font-size: 0.85em; }
-  .caveat { color: var(--dim); font-size: 0.9em; }
-  tr.over th, tr.over td.num { color: var(--warn); font-weight: 600; }
-</style>
-</head>
-<body>
-<main>
-  <h1>Static analysis: ${escape(report.module)}</h1>
-  <p class="sub">Passes: ${escape(report.passes.join(", "))}</p>
-  <table>
-    <thead>
-      <tr><th scope="col">Metric</th><th scope="col">Value</th><th scope="col">Threshold</th><th scope="col">What it does not say</th></tr>
-    </thead>
-    <tbody>
-${rows}
-    </tbody>
-  </table>
-</main>
-</body>
-</html>
-`;
-}
-
-// src/roles/static-analysis/adapters/jscpd/config.ts
-import { mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
-import { tmpdir } from "node:os";
-import { join as join18 } from "node:path";
-function fileSettings(config) {
-  return {
-    // The detection window. Stated rather than defaulted, because it decides what is invisible.
-    minTokens: config.duplication.minTokens,
-    minLines: config.duplication.minLines,
-    // `format` is jscpd's name for what we call `languages`. Naming `typescript` alone would
-    // leave out `.tsx`, which is a separate language to it: 300 files of 523 on front/console.
-    format: config.languages,
-    ignore: config.ignore,
-    // A scan that analyses nothing otherwise exits 0 with only a warning, which reads as a pass.
-    failOnEmpty: true,
-    // The dead-code engine keeps its own section, and its own `minLines`: jscpd's documentation is
-    // explicit that the top-level one is about clones and is never carried into a dead-code run.
-    deadCode: {
-      entry: config.entry,
-      minConfidence: config.deadCode.minConfidence,
-      categories: config.deadCode.categories
-    },
-    // The escape hatch, last so it wins, and empty unless a module asked for it.
-    ...config.tools.jscpd
-  };
-}
-function duplicationRun(config, paths) {
-  const dir = mkdtempSync(join18(tmpdir(), "sentinel-static-"));
-  const configPath = join18(dir, "jscpd.json");
-  writeFileSync3(configPath, `${JSON.stringify(fileSettings(config), null, 2)}
-`, "utf8");
-  const args = [
-    "--config",
-    configPath,
-    // Always json, and only json, whatever shape the caller asked for. The three shapes are
-    // rendered by this role from the figures, not by the tool: one report lives under
-    // `static-analysis`, assembled from several passes, so a per-pass console table from the tool
-    // would be a fourth voice saying the same numbers differently. `--output` below is jscpd's
-    // output DIRECTORY, not our `--output` shape.
-    "--reporters",
-    "json",
-    "--output",
-    dir,
-    "--no-tips",
-    ...paths
-  ];
-  return { args, rawReportDir: dir, dispose: () => rmSync3(dir, { force: true, recursive: true }) };
+  for (const path2 of index.testOnly) {
+    const local = within(path2);
+    if (local) testOnly.add(local);
+  }
+  return { imported, testOnly };
 }
 
-// src/roles/static-analysis/adapters/jscpd/resolve.ts
+// src/roles/static-analysis/adapters/jscpd/resolve-binary.ts
 function resolveJscpd(cwd) {
   return resolveBin(cwd, "jscpd") ?? binFromOwnInstall("jscpd", "jscpd");
 }
 
 // src/roles/static-analysis/adapters/jscpd/jscpd.adapter.ts
-var EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".css", ".scss"];
-var SCRIPT = "static-analysis";
-var SHAPES = ["console", "json", "html"];
+var EXTENSIONS3 = extensionsOf(defaults.languages);
 var scripts = () => ({
-  [SCRIPT]: `sentinel --run --${SCRIPT}`,
-  [`${SCRIPT}:json`]: `sentinel --run --${SCRIPT} --output json`,
-  [`${SCRIPT}:html`]: `sentinel --run --${SCRIPT} --output html`
+  [SCRIPTS.console]: `sentinel --run --${TARGET}`,
+  [SCRIPTS.json]: `sentinel --run --${TARGET} --output json`,
+  [SCRIPTS.html]: `sentinel --run --${TARGET} --output html`
 });
 var targets = () => ({
-  [SCRIPT]: { cache: true, inputs: ["default", `{projectRoot}/${STATIC_CONFIG_FILE}`] },
-  [`${SCRIPT}:json`]: { cache: false },
-  [`${SCRIPT}:html`]: { cache: false }
+  [TARGET]: { cache: true, inputs: ["default", `{projectRoot}/${STATIC_CONFIG_FILE}`] }
 });
-var CONFIG_STUB = `import { defineStaticAnalysis } from '@hublo/sentinel/static-analysis'
+function configStub() {
+  const rows = overridableSettings();
+  const pad = Math.max(...rows.map((row) => row.key.length));
+  const show = (row) => `  //   ${row.key.padEnd(pad)}  ${row.value}`;
+  const movable = rows.filter((row) => row.where === "overrides").map(show);
+  const refused = rows.filter((row) => row.where === "refused").map((row) => `  //   ${row.key}: ${row.note}`);
+  return `import { defineStaticAnalysis } from '@hublo/sentinel/static-analysis'
 
 export default defineStaticAnalysis({
   root: import.meta.dirname,
@@ -4983,38 +7514,60 @@ export default defineStaticAnalysis({
   // the patterns sentinel ships, never replacing them.
   entry: [],
 
-  // Named product journeys, as { 'the name product uses': ['src/some/path/**'] }. Paths are
-  // relative to this module, because one run measures one module.
-  journeys: {},
+  // ---------------------------------------------------------------------------------------------
+  // What this module can move, with the role's value today. A setting you leave out keeps that
+  // value; a setting you write REPLACES it, including inside a list. Anything you set is printed
+  // under "measured with" in the report and marked \`(module)\`, because two modules measured with
+  // different settings can no longer be compared.
+  //
+${movable.join("\n")}
+  //
+  // A list shown as a count is not copyable, and replacing one means writing back what you keep,
+  // so read the values in full with:
+  //
+  //   pnpm exec sentinel --inspect --${TARGET} --json
+  //
+${refused.join("\n")}
+  //
+  // overrides: {
+  //   duplication: { minTokens: 100 },
+  // },
 })
 `;
+}
+function configValue(config, path2) {
+  return path2.split(".").reduce(
+    (node, key) => node && typeof node === "object" ? node[key] : void 0,
+    config
+  );
+}
 var JscpdAdapter = class extends BaseAdapter {
-  target = "static-analysis";
+  target = TARGET;
   runner = "jscpd";
   /** Every preset: duplication, dead code and complexity are not stack-specific. */
   appliesTo(_preset) {
     return true;
   }
-  plan(context) {
-    if (!hasSourceFiles(context.cwd, EXTENSIONS)) {
+  plan(context2) {
+    if (!hasSourceFiles(context2.cwd, EXTENSIONS3)) {
       return {
         operations: [],
-        skipped: `no file ${this.runner} can read (looked for ${EXTENSIONS.join(", ")}).`
+        skipped: `no file ${this.runner} can read (looked for ${EXTENSIONS3.join(", ")}).`
       };
     }
     return {
       operations: [
         // `write` and not `merge-json`: this file is code, and the engine's in-place merge is for
         // JSON. A re-init therefore RESTORES the stub, so an existing one is left alone below.
-        ...existsSync14(join19(context.cwd, STATIC_CONFIG_FILE)) ? [] : [{ kind: "write", path: STATIC_CONFIG_FILE, contents: CONFIG_STUB }],
-        manifestOperation(context.cwd, scripts()),
-        ...nxTargetOperations({ cwd: context.cwd, targets: targets() }),
-        // The reports are build output. Without this every adopting module grows an untracked
-        // directory nobody can explain, which is exactly what the format role's `lint/` did.
-        { kind: "ensure-lines", path: ".gitignore", lines: [`/${REPORT_DIR}/`] }
+        ...existsSync18(join25(context2.cwd, STATIC_CONFIG_FILE)) ? [] : [{ kind: "write", path: STATIC_CONFIG_FILE, contents: configStub() }],
+        manifestOperation(context2.cwd, scripts()),
+        ...nxTargetOperations({ cwd: context2.cwd, targets: targets() })
+        // The report directory is ignored ONCE at the workspace root, by `--init`'s workspace prep,
+        // and not here: a per-module rule creates a `.gitignore` in modules that had none and
+        // repeats the same line in every adopting module.
       ],
       notes: [
-        `added the three \`${SCRIPT}\` scripts and ${STATIC_CONFIG_FILE}; declare this module's entry points and journeys there, everything else comes from the role`
+        `added the three \`${TARGET}\` scripts and ${STATIC_CONFIG_FILE}; declare this module's entry points there, everything else comes from the role`
       ]
     };
   }
@@ -5027,17 +7580,19 @@ var JscpdAdapter = class extends BaseAdapter {
    * would be the one nobody reads.
    */
   async measure(ctx, emitting) {
-    const shape = ctx.output ?? "console";
-    if (!SHAPES.includes(shape)) {
+    const asked = (ctx.output ?? "console").split(",").map((one) => one.trim()).filter((one) => one !== "");
+    const shapes = [...new Set(asked)];
+    const unknown = shapes.filter((one) => !SHAPES.includes(one));
+    if (shapes.length === 0 || unknown.length > 0) {
       process.stderr.write(
-        `sentinel static-analysis(jscpd): unknown --output "${ctx.output}" (known: ${SHAPES.join(", ")}).
+        `sentinel static-analysis(jscpd): unknown --output "${ctx.output}" (known: ${SHAPES.join(", ")}; several at once with a comma).
 `
       );
       return { ok: false, code: 1 };
     }
-    if (!hasSourceFiles(ctx.cwd, EXTENSIONS)) {
+    if (!hasSourceFiles(ctx.cwd, EXTENSIONS3)) {
       process.stderr.write(
-        `sentinel static-analysis(jscpd): no file to measure in this module (looked for ${EXTENSIONS.join(", ")}).
+        `sentinel static-analysis(jscpd): no file to measure in this module (looked for ${EXTENSIONS3.join(", ")}).
 `
       );
       return { ok: true, code: 0 };
@@ -5065,46 +7620,171 @@ var JscpdAdapter = class extends BaseAdapter {
       return { ok: false, code: 1 };
     }
     const { paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, { valueFlags: ["-c", "--config"] });
-    const { args, rawReportDir, dispose } = duplicationRun(config, paths.length > 0 ? paths : ["."]);
-    try {
-      const result = spawnSync5(jscpd, args, { cwd: ctx.cwd, encoding: "utf8" });
-      if (result.error) {
-        process.stderr.write(
-          `sentinel static-analysis(jscpd): could not run jscpd (${result.error.message})
+    const scanned = paths.length > 0 ? paths : measuredRoots(ctx.cwd);
+    const coverage = coverageOf(ctx.cwd, config);
+    const unreadableCode = hasUnreadableCode(coverage);
+    const product = runDuplication(jscpd, config, scanned, "product", ctx.cwd);
+    if (product.kind === "failed") return { ok: false, code: product.code };
+    if (product.kind === "empty") {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): nothing left to measure in this module once the exclusions applied, so no figure is reported (a figure of 0% would be a different claim).
 `
-        );
-        return { ok: false, code: 1 };
-      }
-      if (result.status !== 0) {
-        if (analysedNothing(result.stderr)) {
-          process.stderr.write(
-            `sentinel static-analysis(jscpd): nothing left to measure in this module once the exclusions applied, so no figure is reported (a figure of 0% would be a different claim).
+      );
+      return { ok: true, code: 0 };
+    }
+    const tests = runDuplication(jscpd, config, scanned, "tests", ctx.cwd);
+    if (tests.kind === "failed") return { ok: false, code: tests.code };
+    const outside = outsideOf(ctx.cwd);
+    const dead = runDeadCode(jscpd, config, paths.length > 0 ? paths : ["."], ctx.cwd, [
+      ...outside.imported
+    ]);
+    if (dead.kind === "failed") return { ok: false, code: dead.code };
+    if (dead.kind === "no-entry-point" && !unreadableCode) {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): no entry point found in this module, so nothing could be reached and no dead-code figure is reported (${dead.files} file(s) scanned). Declare what runs here in \`entry\` inside ${STATIC_CONFIG_FILE}: a lambda handler, a framework bootstrap, a script. A figure of 100% would describe the walk, not the code.
 `
-          );
-          return { ok: true, code: 0 };
-        }
-        process.stderr.write(
-          `sentinel static-analysis(jscpd): jscpd exited ${result.status}
-${result.stderr ?? ""}`
-        );
-        return { ok: false, code: result.status ?? 1 };
-      }
-      const report = buildReport(ctx, rawReportDir);
-      if (!report) {
-        process.stderr.write(`sentinel static-analysis(jscpd): jscpd wrote no report
-`);
-        return { ok: false, code: 1 };
+      );
+    }
+    const complexity = scanComplexity(ctx.cwd, config);
+    const graph = scanGraph(ctx.cwd, config);
+    const size = scanSizeRules(
+      ctx.cwd,
+      scanned,
+      exclusions(config, "product"),
+      resolveOxlint(ctx.cwd),
+      (bin, args, cwd) => {
+        const result = spawnSync6(bin, args, { cwd, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+        return { status: result.error ? 1 : result.status, stdout: result.stdout ?? "" };
       }
-      if (emitting) emit(report, shape, ctx.cwd);
-      return { ok: true, code: 0, metrics: metricsOf(report) };
-    } finally {
-      dispose();
+    );
+    const bundle = await scanBundle(ctx.cwd);
+    const report = assembleReport(
+      ctx,
+      config,
+      product,
+      tests,
+      dead,
+      complexity,
+      graph,
+      coverage,
+      size,
+      outside,
+      bundle
+    );
+    if (emitting) {
+      for (const shape of shapes) await emit(report, shape, ctx.cwd, graph, coverage);
+    }
+    return { ok: true, code: 0, metrics: metricsOf(report) };
+  }
+  /**
+   * Format what `--init` wrote, with the MODULE's own formatter.
+   *
+   * ⛔ Found by adopting the role on `libs/front/ui`, where the module's `lint` target is
+   * `prettier --check . && eslint .`. Adoption turned it red on the two files adoption itself had
+   * just written:
+   *
+   *     [warn] package.json
+   *     [warn] static-analysis.config.mjs
+   *
+   * So a team adopting this role is handed a red lint on a target the adoption never touched, for
+   * something the adoption caused. That is what the test role already refuses in its own words:
+   * "the migration handing its own consequence to whoever adopts, which is the one thing this role
+   * must not do". It had the mechanism and this role did not use it.
+   *
+   * ⚠️ The blast radius is small and measured: **2 modules of 243** run `prettier --check` in their
+   * own lint without having adopted our format role, `apps/front/host-admin` and `libs/front/ui`.
+   * Small is not a reason to leave it: the two are exactly the modules a team would adopt by hand.
+   *
+   * The formatter is borrowed from the test role rather than written again, the same way the size
+   * gauge borrows `resolveOxlint` from the lint role: it already knows how a module declares a
+   * style, including the case where that style IS ours.
+   *
+   * ⛔ Never fatal. Adoption succeeded; only the tidy-up did not. Reverting an adoption over a
+   * formatting pass would be the wrong trade, so a failure here is reported as what it is.
+   *
+   * No batching, unlike the test role: `--init` writes two files, and the OOM that forced batches
+   * there came from handing a formatter 273 at once.
+   */
+  async afterInit(ctx) {
+    const written = ctx.written ?? [];
+    if (written.length === 0) return Promise.resolve();
+    const formatter = writtenFileFormatter(ctx.cwd);
+    if (formatter === void 0) {
+      this.say(
+        `no style is declared here, by this module or its workspace, so the ${written.length} file(s) this wrote keep the shape they were written in. Run your own formatter over them before committing.`
+      );
+      return Promise.resolve();
     }
+    const pass = spawnSync6(formatter.bin, [...formatter.args, ...written], {
+      cwd: ctx.cwd,
+      encoding: "utf8"
+    });
+    this.say(
+      pass.status === 0 ? `formatted the ${written.length} file(s) this wrote with ${formatter.origin}, so a format check passes on files it did not write itself.` : `${formatter.origin} could not run over the ${written.length} file(s) this wrote. Adoption itself is applied; run your formatter before committing.`
+    );
+    return Promise.resolve();
+  }
+  /** One line, prefixed like every other message this role writes. */
+  say(message) {
+    process.stderr.write(`sentinel static-analysis(jscpd): ${message}
+`);
   }
   /** `--run`: measure and show it. */
   async run(ctx) {
     return this.measure(ctx, true);
   }
+  /**
+   * `--inspect`: the settings that apply here, IN FULL.
+   *
+   * It exists because of the other half of documenting an override. The config stub lists what a
+   * module can move, but a list it summarises as "19 patterns" cannot be copied from, and
+   * `overrides` REPLACES a list rather than extending it: a developer who wants one more exclusion
+   * has to write the current ones back, so they need to read them. This is where.
+   *
+   * ⚠️ `--run` answers a narrower question, on purpose. The report prints the settings its FIGURES
+   * came from, which is what makes two modules comparable; this prints everything that applies,
+   * including what no pass has used yet. The two are not interchangeable.
+   */
+  async inspect(ctx) {
+    const { config, from, unreadable } = await loadStaticConfig(ctx.cwd);
+    const roleValue = (path2) => path2.split(".").reduce(
+      (node, key) => node && typeof node === "object" ? node[key] : void 0,
+      defaults
+    );
+    return {
+      runner: this.runner,
+      configFile: from,
+      ...unreadable ? { unreadable } : {},
+      reportDir: REPORT_DIR,
+      // The resolved values, not the role's: what this module measures with.
+      settings: {
+        entry: config.entry,
+        ignore: config.ignore,
+        languages: config.languages,
+        journeys: config.journeys,
+        duplication: config.duplication,
+        deadCode: config.deadCode,
+        // ⚠️ `graph` was missing from the view this very stub calls "the values in full", while the
+        // `overrides` list two fields below happily reported an override of `graph.resolution`. A
+        // developer reading both at once was told the setting does not exist and that they had
+        // moved it.
+        graph: config.graph
+      },
+      // What this module moved, with the role's value beside it, so the difference is readable
+      // without opening the package.
+      overrides: config.moved.map((path2) => ({
+        setting: path2,
+        module: roleValue(path2) === void 0 ? "set" : JSON.stringify(configValue(config, path2)),
+        role: JSON.stringify(roleValue(path2))
+      })),
+      // What the two passes will actually do with the globs, which is where a mistaken override
+      // shows up first: a product pass excluding nothing, or a test pass selecting nothing.
+      passes: {
+        product: { excludes: exclusions(config, "product").length },
+        tests: { excludes: exclusions(config, "tests").length, selects: config.duplication.tests }
+      }
+    };
+  }
   /**
    * `--report`: the same figures, for a machine.
    *
@@ -5122,7 +7802,7 @@ ${result.stderr ?? ""}`
     const declared = moduleScripts(ctx.cwd);
     const missing = Object.keys(scripts()).filter((name) => !(name in declared));
     const adopted = missing.length < Object.keys(scripts()).length;
-    const hasConfig = existsSync14(join19(ctx.cwd, STATIC_CONFIG_FILE));
+    const hasConfig = existsSync18(join25(ctx.cwd, STATIC_CONFIG_FILE));
     return {
       adopted,
       preset: adopted ? ctx.preset : null,
@@ -5137,42 +7817,578 @@ ${result.stderr ?? ""}`
 function analysedNothing(stderr) {
   return typeof stderr === "string" && stderr.includes("--fail-on-empty");
 }
-function buildReport(ctx, reportDir) {
-  const path = join19(reportDir, "jscpd-report.json");
-  if (!existsSync14(path)) return void 0;
-  let parsed;
+function measuredWith(config) {
+  const moved = (key) => config.moved.some((path2) => path2 === key || path2.startsWith(`${key}.`));
+  const row = (key, value) => ({ key, value, moved: moved(key) });
+  return [
+    /**
+     * ⭐ The tool's own version, first, and it is the same argument this list already makes about
+     * every other line: "6.81% found with `minTokens` at 50 and 6.81% found with it at 100 are not
+     * the same measurement". The version is the stronger case, because the numbers a module cannot
+     * override live HERE: the nine gauge thresholds, the complexity bands, the bundle budgets, and
+     * what each figure's unit means. `max-nested-callbacks` sat at 10 and now sits at 3;
+     * `complexityMax` carried a unit and no longer does. A report that does not name the version
+     * that produced it cannot be held against a report from last month, and nothing on the page
+     * would say why the two disagree.
+     *
+     * Never `moved`: it is not a setting a module can turn, which is exactly why it has to be said.
+     */
+    { key: "sentinel", value: readOwnPackage().version, moved: false },
+    row("duplication.minTokens", String(config.duplication.minTokens)),
+    row("duplication.minLines", String(config.duplication.minLines)),
+    row("duplication.kinds", config.duplication.kinds.join(", ")),
+    row("languages", `${config.languages.length}: ${config.languages.join(", ")}`),
+    // The count the SCAN received, not the module's list: the role unions its own artefacts in,
+    // and printing 20 while measuring with 22 is the kind of small lie that costs an afternoon.
+    // The product pass, which is the one the headline figure comes from.
+    row("ignore", `${exclusions(config, "product").length} patterns`),
+    row("duplication.tests", config.duplication.tests.join("  ")),
+    // The dead-code pass's own two, and the reason they are in the same block: a reader comparing
+    // two modules' unreachable share needs the confidence floor as much as the detection window.
+    row("deadCode.minConfidence", String(config.deadCode.minConfidence)),
+    row("deadCode.categories", config.deadCode.categories.join(", ")),
+    row("entry", `${config.entry.length} patterns`),
+    // ⛔ Always printed, even when no size row appears, because this is the line that tells a
+    // reader why a breach can sit beside a green lint. The thresholds are not a module setting and
+    // never appear as `(module)`: a gauge whose scale moves per module compares nothing.
+    row(
+      "size indicators",
+      `${Object.entries(GAUGE_THRESHOLDS).map(([rule, threshold]) => `${rule} ${threshold}`).join(", ")} (min(research, our p90, the rule's default), oxlint run outside the module)`
+    ),
+    // ⚠️ The graph pass's one knob, and it has to be here: it changes both the community count and
+    // `Q`, so the two figures are meaningless without it. The seed is NOT printed beside it,
+    // because it is not a setting: see `graph/scan.ts` for why the role owns it.
+    row("graph.resolution", String(config.graph.resolution)),
+    // Not a setting a module can move: it is McCabe's own published figure, and the row says so
+    // rather than letting a reader take it for one of ours.
+    {
+      key: "complexity bands",
+      value: RISK_BANDS.map(
+        (band) => `${band.from}${band.to === Infinity ? "+" : `-${band.to}`}`
+      ).join(" / "),
+      moved: false
+    }
+  ];
+}
+function runTool(jscpd, args, cwd, pass) {
+  const result = spawnSync6(jscpd, args, { cwd, encoding: "utf8" });
+  if (result.error) {
+    process.stderr.write(
+      `sentinel static-analysis(jscpd): could not run the ${pass} pass (${result.error.message})
+`
+    );
+    return { kind: "failed", code: 1 };
+  }
+  if (result.status !== 0) {
+    if (analysedNothing(result.stderr)) return { kind: "empty" };
+    process.stderr.write(
+      `sentinel static-analysis(jscpd): the ${pass} pass exited ${result.status}
+${result.stderr ?? ""}`
+    );
+    return { kind: "failed", code: result.status ?? 1 };
+  }
+  return { kind: "ran" };
+}
+function runDeadCode(jscpd, config, paths, cwd, extraEntries = []) {
+  const { args, rawReportDir, dispose } = deadCodeRun(config, paths, extraEntries);
+  try {
+    const ran = runTool(jscpd, args, cwd, "dead-code");
+    if (ran.kind !== "ran") return ran;
+    const path2 = join25(rawReportDir, RAW_REPORT["dead-code"]);
+    if (!existsSync18(path2)) {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): the dead-code pass wrote no ${RAW_REPORT["dead-code"]}
+`
+      );
+      return { kind: "failed", code: 1 };
+    }
+    const parsed = safeParseDeadCode(readFileSync20(path2, "utf8"));
+    const statistics = parsed?.statistics;
+    if (!statistics) {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): the dead-code report has no readable figures
+`
+      );
+      return { kind: "failed", code: 1 };
+    }
+    if ((statistics.entryPoints ?? 0) === 0) {
+      return { kind: "no-entry-point", files: statistics.files ?? 0 };
+    }
+    const byCategory = {};
+    for (const finding of parsed?.findings ?? []) {
+      const category = finding.category ?? "unknown";
+      byCategory[category] = (byCategory[category] ?? 0) + 1;
+    }
+    return { kind: "figures", statistics, byCategory, findings: parsed?.findings ?? [] };
+  } finally {
+    dispose();
+  }
+}
+function moduleRelative(name, roots, cwd) {
+  if (existsSync18(join25(cwd, name))) return name;
+  for (const root of roots) {
+    if (root === ".") continue;
+    const candidate = `${root}/${name}`;
+    if (existsSync18(join25(cwd, candidate))) return candidate;
+  }
+  return name;
+}
+function runDuplication(jscpd, config, paths, scope, cwd) {
+  const { args, rawReportDir, dispose } = duplicationRun(config, paths, scope);
   try {
-    parsed = JSON.parse(readFileSync14(path, "utf8"));
+    const ran = runTool(jscpd, args, cwd, scope);
+    if (ran.kind !== "ran") return ran;
+    const path2 = join25(rawReportDir, RAW_REPORT.duplication);
+    const parsed = existsSync18(path2) ? safeParse(readFileSync20(path2, "utf8")) : void 0;
+    const total = parsed?.statistics?.total;
+    if (!total) {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): the ${scope} pass wrote no readable report
+`
+      );
+      return { kind: "failed", code: 1 };
+    }
+    const seen = /* @__PURE__ */ new Map();
+    const relative5 = (name) => {
+      if (name === void 0) return void 0;
+      const hit = seen.get(name);
+      if (hit !== void 0) return hit;
+      const resolved = moduleRelative(name, paths, cwd);
+      seen.set(name, resolved);
+      return resolved;
+    };
+    return {
+      kind: "figures",
+      total,
+      formats: parsed?.statistics?.formats ?? {},
+      duplicates: (parsed?.duplicates ?? []).map((entry) => ({
+        ...entry,
+        ...entry.firstFile ? { firstFile: { ...entry.firstFile, name: relative5(entry.firstFile.name) } } : {},
+        ...entry.secondFile ? { secondFile: { ...entry.secondFile, name: relative5(entry.secondFile.name) } } : {}
+      }))
+    };
+  } finally {
+    dispose();
+  }
+}
+function safeParse(text) {
+  try {
+    return JSON.parse(text);
   } catch {
     return void 0;
   }
-  const total = parsed.statistics?.total;
-  if (!total) return void 0;
-  const percent = Number((total.percentage ?? 0).toFixed(2));
-  const rows = [
+}
+function safeParseDeadCode(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+function placesToLook(product, tests, dead, complexity, graph, size, outsideTestOnly, unreadable) {
+  const at = (side) => `${side?.name ?? "(unknown)"}${side?.start === void 0 ? "" : `:${side.start}`}`;
+  const clones = (outcome, metric) => outcome.kind === "figures" ? outcome.duplicates.map((entry) => ({
+    metric,
+    path: at(entry.firstFile),
+    other: at(entry.secondFile),
+    ...entry.lines === void 0 ? {} : { lines: entry.lines },
+    ...entry.fragment ? { excerpt: entry.fragment } : {}
+  })) : [];
+  const deadMetric = {
+    "unused-file": "unusedFiles",
+    "unused-export": "unusedExports",
+    "unused-symbol": "unusedSymbols",
+    "unused-import": "unusedImports"
+  };
+  const toolTestOnlyPaths = new Set(
+    dead.kind === "figures" ? dead.findings.filter((f) => f.category === "unused-file" && f.reasons?.includes("used-only-by-tests")).map((f) => f.path ?? "").filter(Boolean) : []
+  );
+  const metricOf = (finding) => finding.category === "unused-file" && finding.reasons?.includes("used-only-by-tests") === true ? "usedOnlyByTests" : deadMetric[finding.category ?? ""] ?? "deadLinesPercent";
+  const weight = (f) => f.value ?? f.lines ?? 0;
+  const inOrder = (all2) => [...all2].sort(
+    (left, right) => left.metric.localeCompare(right.metric) || weight(right) - weight(left) || left.path.localeCompare(right.path) || (left.other ?? "").localeCompare(right.other ?? "")
+  );
+  return inOrder([
+    ...clones(product, "clones"),
+    ...clones(tests, "clonesTests"),
+    // Each one under the band it falls in, so it sits beside the caveat that applies to it.
+    ...complexity.complex.map((fn) => ({
+      metric: RISK_BANDS.find((band) => fn.complexity >= band.from && fn.complexity <= band.to)?.metric ?? "complexityMax",
+      path: `${fn.path}:${fn.line}`,
+      name: fn.name,
+      value: fn.complexity
+    })),
+    ...dead.kind === "figures" && !unreadable ? dead.findings.map((finding) => ({
+      metric: metricOf(finding),
+      path: finding.path ?? "(unknown)",
+      ...finding.name ? { name: finding.name } : {},
+      ...finding.lines === void 0 ? {} : { lines: finding.lines },
+      ...finding.confidence === void 0 ? {} : { confidence: finding.confidence },
+      ...finding.reasons?.length ? { reason: finding.reasons.join(", ") } : {},
+      ...finding.message ? { message: finding.message } : {}
+    })) : [],
+    /*
+     * The files the workspace index found, which the tool cannot see.
+     *
+     * ⚠️ A DIFFERENT fact from the tool's own `used-only-by-tests`, and the reason says which:
+     * the tool sees a file only this module's specs reach, the index sees one only another
+     * MODULE's specs import. Measured on `libs/nest/auth` the two sets are disjoint, 5 and 6.
+     * Deduplicated against the tool's anyway, because a file could in principle be both.
+     */
+    ...unreadable ? [] : [...outsideTestOnly].filter((path2) => !toolTestOnlyPaths.has(path2)).sort().map((path2) => ({
+      metric: "usedOnlyByTests",
+      path: path2,
+      reason: "used only by another module's specs"
+    })),
+    // One finding per GROUP of mutually importing files, not per cycle path: see `graph/scan.ts`.
+    // The first file names the finding and the rest go in `other`, which is the shape the report
+    // already renders for a clone's two sides.
+    ...(unreadable ? [] : graph.cycles).map((cycle) => ({
+      metric: "cycles",
+      path: cycle.files[0] ?? "(unknown)",
+      other: cycle.files.slice(1).join(", "),
+      value: cycle.files.length
+    })),
+    /**
+     * The size breaches, one place per file that broke a rule.
+     *
+     * ⭐ This data was computed and thrown away. The gauge already produces the file, the rule, the
+     * worst value and the LINE for every breach, and the report printed only a count: "43 files
+     * over 150, of 495", with no way to reach one of the 43. A reader's question about every count
+     * in this report is the same one, and it is the only one that gets them into an editor.
+     *
+     * The metric key is the rule name, which is exactly the key the size rows already use, so each
+     * place lands under the figure it belongs to with no mapping table to drift.
+     */
+    ...(size?.breaches ?? []).map((breach) => ({
+      metric: breach.rule,
+      path: `${breach.file}:${breach.line}`,
+      value: breach.value
+    })),
+    /**
+     * The single worst function, under the figure that reports it.
+     *
+     * ⚠️ It is also in one of the risk bands above, deliberately: `complexityMax` answers "how bad
+     * is the worst one" and the bands answer "how many are there", so a reader following the max
+     * must not have to guess which band it fell into. `complex` is sorted worst first, which
+     * is what makes the first element the right one.
+     */
+    ...complexity.complex.slice(0, 1).map((worst) => ({
+      metric: "complexityMax",
+      path: `${worst.path}:${worst.line}`,
+      name: worst.name,
+      value: worst.complexity
+    })),
+    // ⛔ Context, not defects. Every module has a most-imported file, and nothing here says the
+    // count is too high: the caveat on the metric says so in the reader's own words.
+    ...(unreadable ? [] : graph.mostImported).map((file) => ({
+      metric: "mostImported",
+      path: file.path,
+      value: file.importedBy,
+      dependsOn: file.dependsOn,
+      instability: Number(file.instability.toFixed(2)),
+      centrality: Number(file.centrality.toFixed(4))
+    }))
+  ]);
+}
+function outsideOf(cwd) {
+  const empty = { imported: /* @__PURE__ */ new Set(), testOnly: /* @__PURE__ */ new Set() };
+  const root = workspaceRootFrom(cwd);
+  if (!root) return empty;
+  try {
+    return outsideView(
+      consumerIndex(root, () => moduleRootsOf(root)),
+      root,
+      cwd
+    );
+  } catch {
+    return empty;
+  }
+}
+function moduleRootsOf(workspaceRoot) {
+  const roots = [];
+  for (const area of ["apps", "libs"]) {
+    const base = join25(workspaceRoot, area);
+    if (!existsSync18(base)) continue;
+    for (const entry of globSync6([`${area}/**/package.json`, `${area}/**/project.json`], {
+      cwd: workspaceRoot,
+      ignore: ["**/node_modules/**"],
+      dot: false
+    })) {
+      const root = entry.split("/").slice(0, -1).join("/");
+      if (root) roots.push(root);
+    }
+  }
+  return [...new Set(roots)];
+}
+function weightOf(bytes) {
+  return bytes < 1024 ? `${bytes} B` : `${Math.round(bytes / 1024)} KB`;
+}
+function stamp(at) {
+  return `${at.toISOString().slice(0, 16).replace("T", " ")} UTC`;
+}
+function commitOf(cwd) {
+  const result = spawnSync6("git", ["rev-parse", "--short", "HEAD"], { cwd, encoding: "utf8" });
+  const sha = result.status === 0 ? result.stdout.trim() : "";
+  return sha === "" ? void 0 : sha;
+}
+function ageOf(at) {
+  const minutes = Math.round((Date.now() - at.getTime()) / 6e4);
+  if (minutes < 2) return "measured a moment later";
+  if (minutes < 90) return `measured ${minutes} minutes later`;
+  const hours = Math.round(minutes / 60);
+  if (hours < 36) return `measured ${hours} hours later`;
+  return `measured ${Math.round(hours / 24)} days later`;
+}
+function addBundleConditions(settings, bundle) {
+  const conditions = bundle.conditions;
+  if (conditions === void 0) return;
+  settings.push(
     {
-      metric: "duplicatedLinesPercent",
-      value: percent,
-      unit: "%",
-      // No threshold, and none is coming from here: see `preset-data.ts`. The figure is reported as
-      // measured, and what makes it readable is the distribution it sits in, which one module
-      // cannot know.
-      threshold: null,
-      over: false,
+      key: "bundle.build",
+      value: `${stamp(conditions.builtAt)}, ${ageOf(conditions.builtAt)}, from the ${conditions.builtAtFrom}`,
       moved: false
     },
     {
-      metric: "clones",
-      value: total.clones ?? 0,
-      unit: "entries",
-      threshold: null,
-      over: false,
+      key: "bundle.brand",
+      // ⚠️ Always unknown today, and said rather than left blank: two of the fronts refuse to build
+      // without a brand selected, so these figures are one brand's, and nothing in a build output
+      // records which. A blank here would read as "no brand involved".
+      value: conditions.brandKnown ? "recorded in the output" : "not recorded in the output",
       moved: false
     }
+  );
+}
+function addBundleRows(rows, notes, bundle) {
+  if (bundle.notMeasured !== void 0) {
+    notes.push(`no bundle figure: ${bundle.notMeasured.reason}`);
+    return;
+  }
+  const js = bundle.initialLoad?.js;
+  if (js !== void 0 && bundle.verdict !== void 0) {
+    rows.push(
+      {
+        metric: "bundleInitialTransfer",
+        value: weightOf(js.transfer),
+        unit: `gzip, against the 170 KB budget; ${bundle.verdict.transferVsWebMedian} against the 747.5 KB web median`,
+        // The dot carries the budget, which is the reference that asks "are we good". The median
+        // stays in the text: two dots on one row would read as two verdicts.
+        status: bundle.verdict.transferVsBudget
+      },
+      {
+        metric: "bundleInitialParsed",
+        value: weightOf(js.parsed),
+        unit: "decompressed, against the 717 KB budget",
+        status: bundle.verdict.parsedVsBudget
+      },
+      { metric: "bundleInitialFiles", value: js.files, unit: "files the entry pulls" }
+    );
+  }
+  const heaviest = bundle.heaviest?.find((asset) => asset.kind === "js");
+  if (heaviest !== void 0) {
+    rows.push({
+      metric: "bundleHeaviestAsset",
+      value: weightOf(heaviest.weight.parsed),
+      unit: `decompressed, against 100 KB per script, in ${heaviest.name}`,
+      status: heaviest.band
+    });
+  }
+  const dynamic = bundle.dynamic;
+  if (dynamic !== void 0 && dynamic.groups > 0) {
+    rows.push({
+      metric: "bundleDynamicLayer",
+      value: weightOf(dynamic.upperBound.parsed),
+      // ⚠️ The bound is named IN the unit, because the number alone reads as a total and it is a
+      // ceiling: it takes the heaviest variant of every group, and no session reaches every group.
+      unit: `decompressed, at most, over ${dynamic.groups} groups; ${weightOf(dynamic.lowerBound.parsed)} at least`
+    });
+  }
+  const entrySet = bundle.entrySet?.js;
+  if (entrySet !== void 0) {
+    rows.push({
+      metric: "bundleEntrySet",
+      value: weightOf(entrySet.parsed),
+      unit: `decompressed, over ${entrySet.files} files, which no reader downloads whole`
+    });
+  }
+  if (bundle.unresolved.length > 0) {
+    notes.push(
+      `${bundle.unresolved.length} path(s) the manifest announces resolved to no file, so they are excluded from every bundle figure rather than counted as zero: ${bundle.unresolved.slice(0, 3).join(", ")}`
+    );
+  }
+}
+function assembleReport(ctx, config, product, tests, dead, complexity, graph, coverage, size, outside, bundle) {
+  const unreadable = hasUnreadableCode(coverage);
+  const share = (total) => Number((total.percentage ?? 0).toFixed(2));
+  const rows = [
+    { metric: "duplicatedLinesPercent", value: share(product.total), unit: "%" },
+    { metric: "clones", value: product.total.clones ?? 0, unit: "entries" }
   ];
-  const formats = parsed.statistics?.formats ?? {};
+  const notes = [];
+  if (tests.kind !== "figures") {
+    notes.push("no test file to measure, so no test duplication figure is reported");
+  }
+  if (dead.kind === "no-entry-point" && !unreadable) {
+    notes.push(
+      `no entry point found, so nothing could be reached and no dead-code figure is reported (${dead.files} file(s) scanned): declare what RUNS here in \`entry\``
+    );
+  }
+  if (dead.kind === "empty" && !unreadable) {
+    notes.push("the dead-code pass had nothing left to analyse, so no figure is reported");
+  }
+  if (tests.kind === "figures") {
+    rows.push(
+      { metric: "duplicatedLinesPercentTests", value: share(tests.total), unit: "%" },
+      { metric: "clonesTests", value: tests.total.clones ?? 0, unit: "entries" }
+    );
+  }
+  if (unreadable) {
+    notes.push(unreadableNote(coverage));
+  }
+  const toolTestOnly = new Set(
+    dead.kind === "figures" ? dead.findings.filter(
+      (finding) => finding.category === "unused-file" && finding.reasons?.includes("used-only-by-tests") === true
+    ).map((finding) => finding.path ?? "").filter(Boolean) : []
+  );
+  if (dead.kind === "figures" && !unreadable) {
+    const stats = dead.statistics;
+    rows.push(
+      {
+        metric: "entryPoints",
+        value: stats.entryPoints ?? 0,
+        unit: `of ${stats.files ?? 0} files`
+      },
+      /**
+       * ⛔ The share of LINES, with the share of FILES beside it, because one without the other
+       * misleads and this was measured rather than imagined.
+       *
+       * On `apps/nest/microservices/agency` the line share reads **60.21%**, which in a
+       * pull-request comment says the module is rotten or the tool is broken. Neither is true:
+       * 490 of its 504 files are reachable, and a SINGLE unreachable file,
+       * `app/database/seed/data/legacy-agencies.ts`, holds **52 210 lines**, 59.3% of the module on
+       * its own. Twelve files carry 53 233 of the 53 242 dead lines.
+       *
+       * With both denominators the sentence reads correctly at a glance: 60% of the lines against
+       * 2% of the files, so the reader looks for a big generated or seed file instead of concluding
+       * anything about the code they write. Nothing is computed that the pass did not hand over.
+       *
+       * ⚠️ "N files UNREACHABLE IN FULL" and not "in N files", which is what this said first. The
+       * two numbers do NOT contain one another: dead lines also come from exports and symbols that
+       * are dead inside files the walk DOES reach. Measured on `apps/front/console`, 0 files are
+       * unreachable and 0.64% of lines are still dead, which read as a contradiction. On `agency`
+       * the wording looked right only by coincidence, because 13 files carried 53 233 of its
+       * 53 242 dead lines.
+       *
+       * ⛔ And a COMMA, not a semicolon. The markdown recap truncates a unit at its first `;`,
+       * because the bundle units carry a second comparison that pushes a table row past readable
+       * width. A semicolon here meant the recap silently dropped the very denominator this comment
+       * exists for, which is the shape of defect the denominator was added to prevent.
+       */
+      {
+        metric: "deadLinesPercent",
+        value: share(stats),
+        unit: `% of lines, ${(stats.files ?? 0) - (stats.reachableFiles ?? 0)} of ${stats.files ?? 0} files unreachable in full`
+      },
+      // ⛔ Minus the files the TOOL itself labels `used-only-by-tests`. They were counted as
+      // unreachable while the tool knew better: measured on `libs/nest/auth`, 5 of the 20. A file a
+      // spec reaches is not unreachable, and leaving it in the headline count meant the figure
+      // disagreed with the reason printed beside it.
+      {
+        metric: "unusedFiles",
+        value: Math.max((dead.byCategory["unused-file"] ?? 0) - toolTestOnly.size, 0),
+        unit: "files"
+      },
+      { metric: "unusedExports", value: dead.byCategory["unused-export"] ?? 0, unit: "exports" },
+      { metric: "unusedSymbols", value: dead.byCategory["unused-symbol"] ?? 0, unit: "symbols" },
+      { metric: "unusedImports", value: dead.byCategory["unused-import"] ?? 0, unit: "imports" }
+    );
+  }
+  const testOnly = /* @__PURE__ */ new Set([...toolTestOnly, ...outside.testOnly]);
+  if (testOnly.size > 0 && !unreadable) {
+    rows.push({ metric: "usedOnlyByTests", value: testOnly.size, unit: "files" });
+  }
+  if (complexity.functions > 0) {
+    rows.push({ metric: "complexityMax", value: complexity.max, unit: "" });
+    for (const band of RISK_BANDS) {
+      const count = complexity.bands[band.metric] ?? 0;
+      rows.push({
+        metric: band.metric,
+        value: count,
+        unit: `of ${complexity.functions} functions`
+      });
+    }
+  } else {
+    notes.push("no function to measure, so no complexity figure is reported");
+  }
+  if (graph.files > 1 && !unreadable) {
+    rows.push(
+      { metric: "importEdges", value: graph.edges, unit: `between ${graph.files} files` },
+      {
+        metric: "graphDensity",
+        value: Number(graph.density.toFixed(4)),
+        unit: "of the possible edges"
+      },
+      {
+        metric: "cycles",
+        // ⛔ Zero is the expected value here, so the unit has to read correctly at zero as well as
+        // at one, which `1 groups, 2 files` did not. The file count only means something when
+        // there is a group, so it is absent when there is none.
+        //
+        // ⚠️ And NO unit at all at zero, which `none` was: "Import cycles 0 none" reads as a
+        // defect in the tool. The label already carries the noun, so the bare 0 is the sentence.
+        //
+        // ⛔ The erased count is SAID, and the reason is that the figure got smaller. A reader who
+        // ran madge, or an earlier version of this role, sees a bigger number from it: on
+        // host-admin 36 groups against 5. Without this clause they are left to decide which tool
+        // is broken. With it, the sentence is "5 groups, 15 files, 31 more erased at build", which
+        // is the whole finding in one line.
+        //
+        // ⚠️ Commas, never a semicolon: the markdown recap cuts a unit at its first `;`.
+        value: graph.cycles.length,
+        unit: graph.cycles.length === 0 ? (
+          // ⚠️ At zero the unit has to carry a NOUN, or the line reads "Import cycles 0 2
+          // erased at build", which is two numbers and no sentence. Caught by reading the real
+          // output on this package, whose own two groups are both erased.
+          graph.cyclesErasedAtBuild === 0 ? "" : `that survive the build, ${graph.cyclesErasedAtBuild} erased`
+        ) : [
+          `${graph.cycles.length === 1 ? "group" : "groups"}, ${graph.filesInCycles} files`,
+          graph.cyclesErasedAtBuild === 0 ? "" : `${graph.cyclesErasedAtBuild} more erased at build`
+        ].filter(Boolean).join(", ")
+      },
+      { metric: "communities", value: graph.communities, unit: `of ${graph.files} files` }
+    );
+    if (graph.modularity === void 0) {
+      notes.push("no import between the files, so no modularity is reported");
+    } else {
+      rows.push({ metric: "modularity", value: Number(graph.modularity.toFixed(4)), unit: "" });
+    }
+  } else if (!unreadable) {
+    notes.push("fewer than two files, so no graph figure is reported");
+  }
+  if (size && size.files > 0) {
+    rows.push({ metric: "measuredFiles", value: size.files, unit: "files" });
+  }
+  if (size) {
+    const counts = /* @__PURE__ */ new Map();
+    for (const breach of size.breaches) counts.set(breach.rule, (counts.get(breach.rule) ?? 0) + 1);
+    for (const [rule, threshold] of Object.entries(GAUGE_THRESHOLDS)) {
+      const count = counts.get(rule) ?? 0;
+      rows.push({
+        metric: rule,
+        value: count,
+        // The threshold travels WITH the figure: the same count means two different things at two
+        // thresholds, and this gauge's thresholds are not the ones a module's lint enforces.
+        unit: `files over ${threshold}, of ${size.files}`
+      });
+    }
+  } else {
+    notes.push("oxlint could not be run, so no size indicator is reported");
+  }
+  addBundleRows(rows, notes, bundle);
+  const settings = measuredWith(config);
+  addBundleConditions(settings, bundle);
   const byLanguage = Object.fromEntries(
-    Object.entries(formats).map(([language, stats]) => [
+    Object.entries(product.formats).map(([language, stats]) => [
       language,
       {
         files: stats.sources ?? 0,
@@ -5181,26 +8397,74 @@ function buildReport(ctx, reportDir) {
       }
     ])
   );
-  return { module: ctx.module, passes: ["duplication"], rows, byLanguage };
+  return {
+    module: ctx.module,
+    commit: commitOf(ctx.cwd) ?? null,
+    passes: [
+      "duplication",
+      ...tests.kind === "figures" ? ["duplication (tests)"] : [],
+      ...dead.kind === "figures" ? ["dead code"] : [],
+      ...complexity.functions > 0 ? ["complexity"] : [],
+      ...graph.files > 1 ? ["graph"] : []
+    ],
+    rows,
+    notes,
+    settings,
+    findings: placesToLook(
+      product,
+      tests,
+      dead,
+      complexity,
+      graph,
+      size,
+      outside.testOnly,
+      unreadable
+    ),
+    byLanguage
+  };
 }
-function emit(report, shape, cwd) {
+async function emit(report, shape, cwd, graph, coverage) {
   if (shape === "console") {
     process.stdout.write(renderConsole(report));
     return;
   }
-  const name = shape === "json" ? "static-analysis.json" : "static-analysis.html";
-  const body = shape === "json" ? renderJson(report) : renderHtml(report);
-  mkdirSync(join19(cwd, REPORT_DIR), { recursive: true });
-  writeFileSync4(join19(cwd, REPORT_DIR, name), body, "utf8");
-  process.stdout.write(`${renderConsole(report)}
-  written: ${REPORT_DIR}/${name}
+  const detailed = shape === "markdown" ? report : withExcerpts(report, cwd);
+  mkdirSync2(join25(cwd, REPORT_DIR), { recursive: true });
+  const written = [];
+  if (shape === "html" && graph.files > 1 && !hasUnreadableCode(coverage)) {
+    const drawn = layOut(graph.graph, graph.communityOf);
+    const picture = `${TARGET}-graph.svg`;
+    const path2 = join25(cwd, REPORT_DIR, picture);
+    await writeGraphPicture(drawn, path2);
+    written.push(`${REPORT_DIR}/${picture}`);
+    detailed.picture = buildExplorer(drawn, graph.communityOf).markup;
+  }
+  const FILES = {
+    json: "static-analysis.json",
+    html: "static-analysis.html",
+    markdown: "static-analysis.md"
+  };
+  const RENDER = { json: renderJson, html: renderHtml, markdown: renderMarkdown };
+  const name = FILES[shape];
+  const body = RENDER[shape](detailed);
+  writeFileSync6(join25(cwd, REPORT_DIR, name), body, "utf8");
+  written.unshift(`${REPORT_DIR}/${name}`);
+  process.stdout.write(`${renderConsole(detailed)}
+  written: ${written.join(", ")}
 `);
 }
 function metricsOf(report) {
   return {
     passes: report.passes,
-    finding: hasFinding(report),
+    // Carried for the same reason they are printed: a consumer reading an absent figure needs to
+    // know whether it is clean or unmeasurable.
+    notes: report.notes,
     ...Object.fromEntries(report.rows.map((row) => [row.metric, row.value])),
+    // Carried into `--json` and the CI comment for the same reason the console prints them: a
+    // figure whose settings are unknown cannot be compared with the next module's.
+    settings: Object.fromEntries(
+      report.settings.map((s) => [s.key, { value: s.value, moved: s.moved }])
+    ),
     byLanguage: report.byLanguage
   };
 }
@@ -5218,10 +8482,10 @@ function registerTest() {
 }
 
 // src/roles/typescript/adapters/tsc/tsc.adapter.ts
-import { spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync16 } from "node:fs";
+import { spawnSync as spawnSync7 } from "node:child_process";
+import { existsSync as existsSync19, readFileSync as readFileSync22 } from "node:fs";
 import { createRequire } from "node:module";
-import { join as join21 } from "node:path";
+import { join as join27 } from "node:path";
 
 // src/roles/typescript/presets/nest.json
 var nest_default2 = {
@@ -5401,13 +8665,13 @@ function readTsconfigAdoption(cwd) {
     // Drift is measured against what the preset SETS, not against the allowlist alone: see
     // `presetOwnedKeys`. Without this a module overriding the workspace base reads as
     // non-conformant forever, since re-running `--init` would not (and should not) fix it.
-    presetOwns: (path) => presetCompilerOptionKeys(path.slice(path.lastIndexOf("/") + 1)) ?? []
+    presetOwns: (path2) => presetCompilerOptionKeys(path2.slice(path2.lastIndexOf("/") + 1)) ?? []
   });
 }
 
 // src/roles/typescript/adapters/tsc/plan.ts
-import { readFileSync as readFileSync15 } from "node:fs";
-import { join as join20 } from "node:path";
+import { readFileSync as readFileSync21 } from "node:fs";
+import { join as join26 } from "node:path";
 
 // src/roles/typescript/typecheck-script.ts
 var SENTINEL_TYPECHECK_COMMAND = "sentinel --run --typescript";
@@ -5453,31 +8717,31 @@ function declaredPreset(cwd) {
   const name = preset.slice(preset.lastIndexOf("/") + 1);
   return PRESET_NAMES.includes(name) ? name : void 0;
 }
-function planAdoption(context) {
-  if (!hasShippedPreset(context.preset)) {
+function planAdoption(context2) {
+  if (!hasShippedPreset(context2.preset)) {
     return {
       operations: [],
-      skipped: `sentinel does not ship a TypeScript preset named "${context.preset}" yet (shipped: ${SHIPPED_PRESETS.join(", ")}). Nothing was written, and the module keeps its own tsconfig; the other roles adopt normally.`
+      skipped: `sentinel does not ship a TypeScript preset named "${context2.preset}" yet (shipped: ${SHIPPED_PRESETS.join(", ")}). Nothing was written, and the module keeps its own tsconfig; the other roles adopt normally.`
     };
   }
-  const current = declaredPreset(context.cwd);
-  if (current !== void 0 && current !== context.preset) {
+  const current = declaredPreset(context2.cwd);
+  if (current !== void 0 && current !== context2.preset) {
     return {
       operations: [],
-      blocked: `this module is already adopted as "${current}", and --preset says "${context.preset}". Nothing was written. If the change is deliberate, remove the sentinel preset from the tsconfig \`extends\` chain and re-run; otherwise re-run with --preset ${current}.`
+      blocked: `this module is already adopted as "${current}", and --preset says "${context2.preset}". Nothing was written. If the change is deliberate, remove the sentinel preset from the tsconfig \`extends\` chain and re-run; otherwise re-run with --preset ${current}.`
     };
   }
-  if (!hasSourceFiles(context.cwd, TYPECHECKABLE_EXTENSIONS)) {
+  if (!hasSourceFiles(context2.cwd, TYPECHECKABLE_EXTENSIONS)) {
     return {
       operations: [],
       skipped: `no TypeScript here (looked for ${TYPECHECKABLE_EXTENSIONS.join(", ")}), so there is nothing for tsc to check.`
     };
   }
-  const target = resolveTsconfigTarget(context.cwd);
-  const preset = `@hublo/sentinel/typescript/${context.preset}`;
-  const addScript = manifestOperation(context.cwd, typecheckScripts(context.cwd));
+  const target = resolveTsconfigTarget(context2.cwd);
+  const preset = `@hublo/sentinel/typescript/${context2.preset}`;
+  const addScript = manifestOperation(context2.cwd, typecheckScripts(context2.cwd));
   const nxTargets = nxTargetOperations({
-    cwd: context.cwd,
+    cwd: context2.cwd,
     targets: { typecheck: TYPECHECK_TARGET }
   });
   if (target.reason === "other-chain") {
@@ -5500,12 +8764,12 @@ function planAdoption(context) {
     };
   }
   const existing = parseJsonc(
-    readFileSync15(join20(context.cwd, target.path), "utf8"),
+    readFileSync21(join26(context2.cwd, target.path), "utf8"),
     target.path
   );
   const extendsChain = composeExtends(existing.extends, preset);
-  const drift = presetOwnedKeys2(existing.compilerOptions, context.preset);
-  const keptLocal = localOnlyCompilerOptions(existing.compilerOptions, context.preset);
+  const drift = presetOwnedKeys2(existing.compilerOptions, context2.preset);
+  const keptLocal = localOnlyCompilerOptions(existing.compilerOptions, context2.preset);
   const operations = [
     { kind: "merge-json", path: target.path, value: { extends: extendsChain } }
   ];
@@ -5526,7 +8790,7 @@ function planAdoption(context) {
     );
   }
   operations.push(addScript, ...nxTargets);
-  const existingCheck = moduleScripts(context.cwd)[TYPECHECK_SCRIPT_NAME];
+  const existingCheck = moduleScripts(context2.cwd)[TYPECHECK_SCRIPT_NAME];
   if (keepsForeignChecker(existingCheck)) {
     notes.push(
       `left the \`${TYPECHECK_SCRIPT_NAME}\` script alone (\`${existingCheck}\`): it does not run tsc, and sentinel's check would not cover what that one does. The tsconfig is adopted either way, so \`sentinel --run --typescript\` works when you want it`
@@ -5582,8 +8846,8 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * What `--init` writes. The planning lives in `plan.ts`: adopting a module and running the
    * checker are two different jobs, and the tsconfig composition is the bulk of the first.
    */
-  plan(context) {
-    return planAdoption(context);
+  plan(context2) {
+    return planAdoption(context2);
   }
   declaredPreset(cwd) {
     return declaredPreset(cwd);
@@ -5638,7 +8902,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let chain;
     try {
       const parsed = parseJsonc(
-        readFileSync16(join21(cwd, target.path), "utf8"),
+        readFileSync22(join27(cwd, target.path), "utf8"),
         target.path
       );
       chain = parsed.extends;
@@ -5651,7 +8915,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     );
     if (preset === void 0) return void 0;
     try {
-      createRequire(join21(cwd, "noop.js")).resolve(preset);
+      createRequire(join27(cwd, "noop.js")).resolve(preset);
       return void 0;
     } catch {
       return preset;
@@ -5692,7 +8956,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
       return { ok: false, code: 1 };
     }
     if (options.length > 0) return this.runWithOptions(ctx, tsc, config);
-    const result = spawnSync6(tsc, ["-b", config], { cwd: ctx.cwd, stdio: "inherit" });
+    const result = spawnSync7(tsc, ["-b", config], { cwd: ctx.cwd, stdio: "inherit" });
     if (result.error) {
       process.stderr.write(
         `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -5727,7 +8991,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let worst = 0;
     for (const project of this.referencedProjects(ctx.cwd, config)) {
       const args = ["-p", project, "--noEmit", "--composite", "false", ...ctx.toolArgs ?? []];
-      const result = spawnSync6(tsc, args, { cwd: ctx.cwd, stdio: "inherit" });
+      const result = spawnSync7(tsc, args, { cwd: ctx.cwd, stdio: "inherit" });
       if (result.error) {
         process.stderr.write(
           `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -5747,10 +9011,10 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
   referencedProjects(cwd, config) {
     try {
       const parsed = parseJsonc(
-        readFileSync16(join21(cwd, config), "utf8"),
+        readFileSync22(join27(cwd, config), "utf8"),
         config
       );
-      const referenced = (parsed.references ?? []).map((reference) => reference.path).filter((path) => typeof path === "string" && path.length > 0);
+      const referenced = (parsed.references ?? []).map((reference) => reference.path).filter((path2) => typeof path2 === "string" && path2.length > 0);
       return referenced.length > 0 ? referenced : [config];
     } catch {
       return [config];
@@ -5763,7 +9027,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * check.
    */
   typecheckTarget(cwd) {
-    if (existsSync15(join21(cwd, "tsconfig.json"))) return "tsconfig.json";
+    if (existsSync19(join27(cwd, "tsconfig.json"))) return "tsconfig.json";
     const target = resolveTsconfigTarget(cwd);
     return target.reason === "none" ? null : target.path;
   }
@@ -5816,7 +9080,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
       return { ok: true, code: 0, metrics: _TscAdapter.NOTHING_TO_REPORT };
     }
     const tsc = resolveBin(ctx.cwd, "tsc") ?? "tsc";
-    const result = spawnSync6(tsc, ["-b", config], { cwd: ctx.cwd, encoding: "utf8" });
+    const result = spawnSync7(tsc, ["-b", config], { cwd: ctx.cwd, encoding: "utf8" });
     if (result.error) {
       process.stderr.write(
         `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -5859,7 +9123,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * errors in the output mean the rule must be on.
    */
   noImplicitAnyEnabled(cwd, tsc, config, mainOutput) {
-    const shown = spawnSync6(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
+    const shown = spawnSync7(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
     if (shown.status === 0 && shown.stdout) {
       try {
         const co = parseJsonc(
@@ -5913,7 +9177,7 @@ function detectFramework(packageJson) {
 }
 
 // src/core/dispatch.ts
-import { basename } from "node:path";
+import { basename as basename2 } from "node:path";
 
 // src/shared/text.ts
 function ensureLines(current, lines) {
@@ -5969,31 +9233,31 @@ function replaceLines(current, replacements) {
 }
 
 // src/core/apply-plan.ts
-import { existsSync as existsSync16, readFileSync as readFileSync17, renameSync, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "node:fs";
-import { resolve as resolve3, sep } from "node:path";
+import { existsSync as existsSync20, readFileSync as readFileSync23, renameSync, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "node:fs";
+import { resolve as resolve4, sep as sep2 } from "node:path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
 function resolveWithinRoot(cwd, relativePath) {
-  const root = resolve3(cwd);
-  const absolutePath = resolve3(root, relativePath);
-  if (absolutePath !== root && !absolutePath.startsWith(root + sep)) {
+  const root = resolve4(cwd);
+  const absolutePath = resolve4(root, relativePath);
+  if (absolutePath !== root && !absolutePath.startsWith(root + sep2)) {
     throw new Error(`Refusing to write outside the module root: "${relativePath}".`);
   }
   return absolutePath;
 }
 function readIfExists(absolutePath) {
-  return existsSync16(absolutePath) ? readFileSync17(absolutePath, "utf8") : void 0;
+  return existsSync20(absolutePath) ? readFileSync23(absolutePath, "utf8") : void 0;
 }
 function* leaves(value, prefix = []) {
   for (const [key, keyValue] of Object.entries(value)) {
-    const path = [...prefix, key];
-    if (isPlainObject(keyValue)) yield* leaves(keyValue, path);
-    else yield [path, keyValue];
+    const path2 = [...prefix, key];
+    if (isPlainObject(keyValue)) yield* leaves(keyValue, path2);
+    else yield [path2, keyValue];
   }
 }
 function mergeJsonc(current, value) {
   let text = current.trim().length > 0 ? current : "{}\n";
-  for (const [path, leaf] of leaves(value)) {
-    const edits = modify(text, path, leaf, {
+  for (const [path2, leaf] of leaves(value)) {
+    const edits = modify(text, path2, leaf, {
       formattingOptions: { insertSpaces: true, tabSize: 2 }
     });
     text = applyEdits(text, edits);
@@ -6002,10 +9266,10 @@ function mergeJsonc(current, value) {
 }
 function removeJsoncKeys(current, keys) {
   let text = current.trim().length > 0 ? current : "{}\n";
-  for (const path of keys) {
+  for (const path2 of keys) {
     const root = parseTree(text);
-    if (!root || !findNodeAtLocation(root, path)) continue;
-    const edits = modify(text, path, void 0, {
+    if (!root || !findNodeAtLocation(root, path2)) continue;
+    const edits = modify(text, path2, void 0, {
       formattingOptions: { insertSpaces: true, tabSize: 2 }
     });
     text = applyEdits(text, edits);
@@ -6019,14 +9283,14 @@ function sameJson(left, right) {
     return false;
   }
 }
-function assertParseable(path, current) {
+function assertParseable(path2, current) {
   if (current.trim().length === 0) return;
   try {
-    parseJsonc(current, path);
+    parseJsonc(current, path2);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     throw new Error(
-      `${path} does not parse, so sentinel will not edit it: ${reason}. Nothing was written. Fix the file and re-run.`,
+      `${path2} does not parse, so sentinel will not edit it: ${reason}. Nothing was written. Fix the file and re-run.`,
       { cause: error }
     );
   }
@@ -6083,14 +9347,14 @@ function preparePlan(cwd, plan3) {
 }
 function writeFileAtomic(absolutePath, contents) {
   const tempPath = `${absolutePath}.sentinel-${process.pid}.tmp`;
-  writeFileSync5(tempPath, contents);
+  writeFileSync7(tempPath, contents);
   renameSync(tempPath, absolutePath);
 }
 function applyPlan(cwd, plan3) {
   const changed = preparePlan(cwd, plan3).filter((file) => file.before !== file.after);
   for (const file of changed) {
     if (file.deleted) {
-      rmSync4(file.absolutePath, { force: true });
+      rmSync5(file.absolutePath, { force: true });
       continue;
     }
     writeFileAtomic(file.absolutePath, file.after);
@@ -6099,8 +9363,8 @@ function applyPlan(cwd, plan3) {
 }
 
 // src/core/config/preset-evidence.ts
-import { existsSync as existsSync17, readdirSync as readdirSync3, readFileSync as readFileSync18 } from "node:fs";
-import { join as join22 } from "node:path";
+import { existsSync as existsSync21, readdirSync as readdirSync3, readFileSync as readFileSync24 } from "node:fs";
+import { join as join28 } from "node:path";
 var PATH_SIGNALS = [
   {
     preset: "nest",
@@ -6134,12 +9398,12 @@ function sourceImports(cwd, pattern) {
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (!NOT_SCANNED.has(entry.name)) stack.push(join22(dir, entry.name));
+        if (!NOT_SCANNED.has(entry.name)) stack.push(join28(dir, entry.name));
         continue;
       }
       if (!SOURCE_FILE.test(entry.name)) continue;
       try {
-        if (pattern.test(readFileSync18(join22(dir, entry.name), "utf8"))) return true;
+        if (pattern.test(readFileSync24(join28(dir, entry.name), "utf8"))) return true;
       } catch {
         continue;
       }
@@ -6148,12 +9412,12 @@ function sourceImports(cwd, pattern) {
   return false;
 }
 function dependencyNames(cwd) {
-  const path = join22(cwd, "package.json");
-  if (!existsSync17(path)) return [];
+  const path2 = join28(cwd, "package.json");
+  if (!existsSync21(path2)) return [];
   try {
     const manifest = parseJsonc(
-      readFileSync18(path, "utf8"),
-      path
+      readFileSync24(path2, "utf8"),
+      path2
     );
     return [
       ...Object.keys(manifest.dependencies ?? {}),
@@ -6175,7 +9439,7 @@ function reactTsconfigEvidence(cwd) {
   }
   for (const name of entries) {
     try {
-      const config = parseJsonc(readFileSync18(join22(cwd, name), "utf8"), name);
+      const config = parseJsonc(readFileSync24(join28(cwd, name), "utf8"), name);
       if (config.compilerOptions?.jsx !== void 0) return 'its tsconfig sets "jsx"';
       const extended = Array.isArray(config.extends) ? config.extends : config.extends === void 0 ? [] : [config.extends];
       if (extended.some((entry) => entry === REACT_TYPESCRIPT_PRESET)) {
@@ -6245,8 +9509,8 @@ function previewPlan(opts, plan3) {
         {
           dryRun: true,
           notes: plan3.notes ?? [],
-          files: changed.map(({ path, before, after, deleted }) => ({
-            path,
+          files: changed.map(({ path: path2, before, after, deleted }) => ({
+            path: path2,
             action: deleted ? "delete" : before.length === 0 ? "create" : "update",
             before,
             after
@@ -6265,10 +9529,10 @@ function previewPlan(opts, plan3) {
     process.stderr.write("  nothing to change\n");
     return 0;
   }
-  for (const { path, before, after, deleted } of changed) {
+  for (const { path: path2, before, after, deleted } of changed) {
     const action = deleted ? "delete" : before.length === 0 ? "create" : "update";
     process.stdout.write(`
-  ${action} ${path}
+  ${action} ${path2}
 `);
     for (const line of diffLines(before, after)) process.stdout.write(`    ${line}
 `);
@@ -6308,8 +9572,8 @@ async function dispatch(opts) {
       );
     }
   }
-  const context = { cwd: opts.cwd, preset: effective };
-  const plan3 = await adapter.plan(context);
+  const context2 = { cwd: opts.cwd, preset: effective };
+  const plan3 = await adapter.plan(context2);
   if (plan3.blocked) {
     process.stderr.write(`sentinel (${opts.target}): ${plan3.blocked}
 `);
@@ -6325,7 +9589,7 @@ async function dispatch(opts) {
   }
   if (adapter.beforeInit) {
     await adapter.beforeInit({
-      module: basename(opts.cwd),
+      module: basename2(opts.cwd),
       cwd: opts.cwd,
       preset,
       ci: false,
@@ -6344,7 +9608,7 @@ async function dispatch(opts) {
     process.stderr.write(`  fixing what ${opts.target} can fix automatically...
 `);
     await adapter.afterInit({
-      module: basename(opts.cwd),
+      module: basename2(opts.cwd),
       cwd: opts.cwd,
       preset,
       ci: false,