@pseolint/core 0.5.15 → 0.6.0

package/dist/algorithms/wikipedia-paraphrase.d.ts

@@ -0,0 +1,23 @@
+/**
+ * wikipedia-paraphrase.ts
+ *
+ * Loads the prebuilt Wikipedia trigram bloom filter and provides a
+ * paraphrase-rate estimator. Used by content/wikipedia-paraphrase rule.
+ *
+ * Bloom filter layout (data/wikipedia-trigrams.bin):
+ *   m = 65536 bits  (8192 bytes)
+ *   k = 3 FNV-1a-32 hash functions with distinct seeds
+ *
+ * FP rate ~5% for the curated corpus of ~10 k unique trigrams.
+ */
+/** Load and cache the bloom filter binary. */
+export declare function loadWikipediaBloomFilter(): Uint8Array;
+/**
+ * Compute the fraction of the text's trigrams that match the Wikipedia
+ * bloom filter. Returns a 0-1 ratio. Returns 0 for text with fewer than
+ * 3 words (no trigrams extractable).
+ */
+export declare function wikipediaParaphraseRate(text: string): number;
+/** Reset the in-memory cache. For testing purposes only. */
+export declare function _resetBloomCache(): void;
+//# sourceMappingURL=wikipedia-paraphrase.d.ts.map

package/dist/algorithms/wikipedia-paraphrase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wikipedia-paraphrase.d.ts","sourceRoot":"","sources":["../../src/algorithms/wikipedia-paraphrase.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAyBH,8CAA8C;AAC9C,wBAAgB,wBAAwB,IAAI,UAAU,CAKrD;AAuBD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAU5D;AAED,4DAA4D;AAC5D,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC"}

package/dist/algorithms/wikipedia-paraphrase.js

@@ -0,0 +1,82 @@
+/**
+ * wikipedia-paraphrase.ts
+ *
+ * Loads the prebuilt Wikipedia trigram bloom filter and provides a
+ * paraphrase-rate estimator. Used by content/wikipedia-paraphrase rule.
+ *
+ * Bloom filter layout (data/wikipedia-trigrams.bin):
+ *   m = 65536 bits  (8192 bytes)
+ *   k = 3 FNV-1a-32 hash functions with distinct seeds
+ *
+ * FP rate ~5% for the curated corpus of ~10 k unique trigrams.
+ */
+import { readFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const DATA_PATH = join(__dirname, "..", "..", "data", "wikipedia-trigrams.bin");
+const BLOOM_BITS = 65536;
+const BLOOM_K = 3;
+const FNV_PRIME = 0x01000193;
+const FNV_SEEDS = [0x811c9dc5, 0x6b43a9b5, 0x29f7b4e3];
+function fnv1a32(str, seed) {
+    let hash = seed >>> 0;
+    for (let i = 0; i < str.length; i++) {
+        hash ^= str.charCodeAt(i);
+        hash = Math.imul(hash, FNV_PRIME) >>> 0;
+    }
+    return hash;
+}
+let _cache = null;
+/** Load and cache the bloom filter binary. */
+export function loadWikipediaBloomFilter() {
+    if (_cache !== null)
+        return _cache;
+    const buf = readFileSync(DATA_PATH);
+    _cache = new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+    return _cache;
+}
+function bloomQuery(bits, trigram) {
+    for (let k = 0; k < BLOOM_K; k++) {
+        const pos = fnv1a32(trigram, FNV_SEEDS[k]) % BLOOM_BITS;
+        if ((bits[pos >> 3] & (1 << (pos & 7))) === 0)
+            return false;
+    }
+    return true;
+}
+function extractTrigrams(text) {
+    const tokens = text
+        .toLowerCase()
+        .replace(/[^\p{L}\p{N}\s]+/gu, " ")
+        .split(/\s+/)
+        .filter(Boolean);
+    const trigrams = [];
+    for (let i = 0; i <= tokens.length - 3; i++) {
+        trigrams.push(`${tokens[i]} ${tokens[i + 1]} ${tokens[i + 2]}`);
+    }
+    return trigrams;
+}
+/**
+ * Compute the fraction of the text's trigrams that match the Wikipedia
+ * bloom filter. Returns a 0-1 ratio. Returns 0 for text with fewer than
+ * 3 words (no trigrams extractable).
+ */
+export function wikipediaParaphraseRate(text) {
+    if (!text || text.trim().length === 0)
+        return 0;
+    const trigrams = extractTrigrams(text);
+    if (trigrams.length === 0)
+        return 0;
+    const bits = loadWikipediaBloomFilter();
+    let matched = 0;
+    for (const t of trigrams) {
+        if (bloomQuery(bits, t))
+            matched++;
+    }
+    return matched / trigrams.length;
+}
+/** Reset the in-memory cache. For testing purposes only. */
+export function _resetBloomCache() {
+    _cache = null;
+}
+//# sourceMappingURL=wikipedia-paraphrase.js.map

package/dist/algorithms/wikipedia-paraphrase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wikipedia-paraphrase.js","sourceRoot":"","sources":["../../src/algorithms/wikipedia-paraphrase.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAC;AAEhF,MAAM,UAAU,GAAG,KAAK,CAAC;AACzB,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,SAAS,GAAG,UAAU,CAAC;AAC7B,MAAM,SAAS,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AAEvD,SAAS,OAAO,CAAC,GAAW,EAAE,IAAY;IACxC,IAAI,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,IAAI,MAAM,GAAsB,IAAI,CAAC;AAErC,8CAA8C;AAC9C,MAAM,UAAU,wBAAwB;IACtC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACnC,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,IAAgB,EAAE,OAAe;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,MAAM,GAAG,IAAI;SAChB,WAAW,EAAE;SACb,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC;SAClC,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;IACxC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC;AACnC,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC"}

package/dist/auditor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auditor.d.ts","sourceRoot":"","sources":["../src/auditor.ts"],"names":[],"mappings":"AAiEA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAaZ,UAAU,EAIX,MAAM,YAAY,CAAC;AAQpB,OAAO,EAA8D,KAAK,kBAAkB,EAAiB,MAAM,sBAAsB,CAAC;AAyzB1I;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,UAAU,EAAE,EACtB,cAAc,EAAE,kBAAkB,GAAG,SAAS,GAC7C,UAAU,EAAE,CAed;AA+WD,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBjG;AA2fD,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA6/B/F"}
+{"version":3,"file":"auditor.d.ts","sourceRoot":"","sources":["../src/auditor.ts"],"names":[],"mappings":"AAmEA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAaZ,UAAU,EAIX,MAAM,YAAY,CAAC;AAQpB,OAAO,EAA8D,KAAK,kBAAkB,EAAiB,MAAM,sBAAsB,CAAC;AAm0B1I;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,UAAU,EAAE,EACtB,cAAc,EAAE,kBAAkB,GAAG,SAAS,GAC7C,UAAU,EAAE,CAed;AA+WD,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBjG;AAqhBD,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA4lC/F"}

package/dist/auditor.js

@@ -26,6 +26,8 @@ import { headingStructureRule } from "./rules/content/heading-structure.js";
 import { imageAltTextRule } from "./rules/content/image-alt-text.js";
 import { translationNoOpRule } from "./rules/content/translation-no-op.js";
 import { regurgitatedContentRule } from "./rules/content/regurgitated-content.js";
+import { commonPhraseReuseRule } from "./rules/content/common-phrase-reuse.js";
+import { wikipediaParaphraseRule } from "./rules/content/wikipedia-paraphrase.js";
 import { valueAddRule } from "./rules/content/value-add.js";
 import { canonicalConsistencyRule } from "./rules/tech/canonical-consistency.js";
 import { canonicalNoindexConflictRule } from "./rules/tech/canonical-noindex-conflict.js";
@@ -69,7 +71,7 @@ import { readState, writeState, computeContentHash, STATE_SCHEMA_VERSION, } from
 import { CORE_RULESET_VERSION } from "./ruleset-version.js";
 import { planScrapeStrategy, DEFAULT_AGE_FLOOR_DAYS } from "./scrape-strategy.js";
 import { detectTemplates, buildUrlToTemplateMap, shouldActivateTemplateScoring } from "./template-detection.js";
-import { scoreTemplates } from "./per-template-scoring.js";
+import { scoreTemplates, siteVerdictFromTemplates } from "./per-template-scoring.js";
 const DEFAULTS = {
     nearDuplicateThreshold: 0.85,
     entitySwapThreshold: 0.95,
@@ -397,6 +399,10 @@ const RULE_IMPACTS = {
     "content/translation-no-op": { baseImpact: 30, perInstance: 10, maxImpact: 60 },
     // v1 warning-severity heuristic; lower than translation-no-op since it's speculative
     "content/regurgitated-content": { baseImpact: 15, perInstance: 5, maxImpact: 35 },
+    // v0.5.11 warning/low-confidence cliché density detector; lower than regurgitated-content
+    "content/common-phrase-reuse": { baseImpact: 12, perInstance: 4, maxImpact: 30 },
+    // v0.5.14 speculative/warning Wikipedia trigram overlap; lower than common-phrase-reuse
+    "content/wikipedia-paraphrase": { baseImpact: 10, perInstance: 3, maxImpact: 25 },
     // v0.5.8 composite per-page quality synthesis
     "content/value-add": { baseImpact: 25, perInstance: 8, maxImpact: 50 },
     // Tech — softened in v0.4.3-rc2 after dogfood showed nextjs.org regressing
@@ -639,6 +645,12 @@ sampled = false) {
     if (isEnabled("content/regurgitated-content") && modeOk("content/regurgitated-content")) {
         findings.push(...tag(regurgitatedContentRule(pages)));
     }
+    if (isEnabled("content/common-phrase-reuse") && modeOk("content/common-phrase-reuse")) {
+        findings.push(...tag(commonPhraseReuseRule(pages)));
+    }
+    if (isEnabled("content/wikipedia-paraphrase") && modeOk("content/wikipedia-paraphrase")) {
+        findings.push(...tag(wikipediaParaphraseRule(pages)));
+    }
     // Link rules — use the global link graph
     if (isEnabled("links/orphan-pages") && modeOk("links/orphan-pages")) {
         findings.push(...tag(orphanPagesRule(pages, inbound, rootUrl)));
@@ -1529,6 +1541,31 @@ async function loadPagesFromSource(source, concurrency, timeoutMs, crawlDiscover
         return { pages: [{ url: resolved, html: await readFile(resolved, "utf-8") }] };
     }
     if (sourceStat.isDirectory()) {
+        // v0.5.15: if the directory contains _manifest.json, restore original URLs
+        // from the fixture manifest. Without a manifest (or unparseable JSON), the
+        // engine falls back to file-path URLs (existing behaviour for arbitrary
+        // HTML directories). Missing files listed in a valid manifest are
+        // propagated as errors — a stale manifest is a programmer error, not
+        // a soft condition.
+        const manifestPath = join(resolved, "_manifest.json");
+        let hasManifest = false;
+        let manifest = null;
+        try {
+            const raw = await readFile(manifestPath, "utf-8");
+            manifest = JSON.parse(raw);
+            hasManifest = true;
+        }
+        catch {
+            // No manifest file or invalid JSON — fall through to path-based loading
+        }
+        if (hasManifest && manifest !== null) {
+            // Propagate missing-file errors (fail-loud: stale manifests must be noticed)
+            const pages = await Promise.all(Object.entries(manifest).map(async ([originalUrl, relPath]) => ({
+                url: originalUrl,
+                html: await readFile(join(resolved, relPath), "utf-8"),
+            })));
+            return { pages };
+        }
         const htmlFiles = await collectHtmlFiles(resolved);
         const pages = await Promise.all(htmlFiles.map(async (filePath) => ({
             url: filePath,
@@ -1556,7 +1593,11 @@ export async function auditSource(source, options) {
     const skipBoilerplate = options?.skipBoilerplate ?? false;
     const skipSearchPages = options?.skipSearchPages ?? false;
     const skipEmptyBody = options?.skipEmptyBody ?? false;
-    const sampleSize = options?.sampleSize ?? preset.sampleSize ?? 0;
+    // v0.5.12: when pinnedUrls is non-empty, sampleSize is irrelevant — the
+    // pinned list IS the sample. Force to 0 so the post-fetch sampling step
+    // is a no-op and all pinned pages pass through untruncated.
+    const hasPinnedUrlsEarly = Array.isArray(options?.pinnedUrls) && options.pinnedUrls.length > 0;
+    const sampleSize = hasPinnedUrlsEarly ? 0 : (options?.sampleSize ?? preset.sampleSize ?? 0);
     const externalSignal = options?.signal;
     const guardSsrf = options?.guardSsrf ?? preset.guardSsrf ?? false;
     const respectRobotsTxt = options?.respectRobotsTxt ?? preset.respectRobotsTxt ?? true;
@@ -1714,7 +1755,84 @@ export async function auditSource(source, options) {
     if (!priorState && options?.state?.since) {
         console.error("no prior state found — performing full baseline audit");
     }
-    const { pages: loadedPagesRaw, sitemapUrls: sitemapUrlSet, sitemapLastmodByUrl, discoveredUrlCount, scrapePlan } = await loadPagesFromSource(source, concurrency, timeoutMs, crawlDiscovery, discoveryBudget, cacheConfig, cacheStats, fillBudgetViaLinkDiscovery, fetchByteBudget, signal, guardSsrf, respectRobotsTxt, skippedByRobots, followRedirects, maxCrawlDiscovered, monitoringContext);
+    // v0.5.12 — pinnedUrls fast path: bypass sitemap discovery + random sampling
+    // entirely. Only fetch the caller-specified URLs. Validated same-origin for
+    // HTTP sources. Filesystem sources treat pinnedUrls as absolute paths.
+    let loadedPagesRaw;
+    let sitemapUrlSet;
+    let sitemapLastmodByUrl;
+    let discoveredUrlCount;
+    let scrapePlan;
+    if (hasPinnedUrlsEarly) {
+        const pinned = options.pinnedUrls;
+        // Validate same-origin for HTTP sources
+        if (/^https?:\/\//i.test(source)) {
+            let sourceOriginStr;
+            try {
+                sourceOriginStr = new URL(source).origin;
+            }
+            catch {
+                throw new Error(`pinnedUrls: source URL is not a valid URL: ${source}`);
+            }
+            for (const u of pinned) {
+                let pinnedOrigin;
+                try {
+                    pinnedOrigin = new URL(u).origin;
+                }
+                catch {
+                    throw new Error(`pinnedUrls: "${u}" is not a valid absolute URL`);
+                }
+                if (pinnedOrigin !== sourceOriginStr) {
+                    throw new Error(`pinnedUrls: cross-origin URL rejected. Source origin is "${sourceOriginStr}" but pinned URL "${u}" has origin "${pinnedOrigin}". All pinnedUrls must be same-origin as the source.`);
+                }
+            }
+        }
+        // Fetch pinned URLs directly — no sitemap fetch, no sampling
+        const ssrfCache = new Map();
+        const validateHopPinned = guardSsrf
+            ? async (u) => {
+                let host;
+                try {
+                    host = new URL(u).hostname;
+                }
+                catch {
+                    throw new Error(`Refusing to fetch invalid URL: ${u}`);
+                }
+                let pending = ssrfCache.get(host);
+                if (!pending) {
+                    pending = validateTargetHost(host).catch((err) => {
+                        if (err instanceof SSRFError)
+                            throw new Error(`Refusing to fetch ${u}: ${err.reason}`);
+                        throw err;
+                    });
+                    ssrfCache.set(host, pending);
+                }
+                await pending;
+            }
+            : undefined;
+        const pinnedPages = [];
+        await runWithConcurrency(Array.from(pinned), concurrency, async (url) => {
+            const result = await fetchPageWithMeta(url, timeoutMs, cacheConfig, cacheStats, signal, validateHopPinned, followRedirects);
+            if (result) {
+                fetchByteBudget.used += result.html.length;
+                pinnedPages.push(result);
+            }
+        });
+        loadedPagesRaw = pinnedPages;
+        // No sitemap context in pinned mode
+        sitemapUrlSet = undefined;
+        sitemapLastmodByUrl = undefined;
+        discoveredUrlCount = undefined;
+        scrapePlan = undefined;
+    }
+    else {
+        const loaded = await loadPagesFromSource(source, concurrency, timeoutMs, crawlDiscovery, discoveryBudget, cacheConfig, cacheStats, fillBudgetViaLinkDiscovery, fetchByteBudget, signal, guardSsrf, respectRobotsTxt, skippedByRobots, followRedirects, maxCrawlDiscovered, monitoringContext);
+        loadedPagesRaw = loaded.pages;
+        sitemapUrlSet = loaded.sitemapUrls;
+        sitemapLastmodByUrl = loaded.sitemapLastmodByUrl;
+        discoveredUrlCount = loaded.discoveredUrlCount;
+        scrapePlan = loaded.scrapePlan;
+    }
     // The scrapePlan tells us which URLs were skipped pre-fetch under monitoring
     // mode. Surface them in skippedUrls so they show up under summary.skippedUrls
     // (kept for back-compat with --since consumers); T7 will carry their prior
@@ -1963,7 +2081,15 @@ export async function auditSource(source, options) {
             continue;
         const groupRules = resolveGroupRules(resolvedRules, groupConfig?.overrides);
         const enabledCheck = (ruleId) => !suppressedRuleSet.has(ruleId) && isRuleEnabled(ruleId, groupConfig?.rules);
-        const findings = runRulesOnPages(groupPages, parsedPagesAll, groupRules, enabledCheck, groupName, knownUrls, adjacency, inbound, rootUrl, normalizeUrlOptions, source, DEFAULT_ENTITY_PATTERNS, groupConfig?.overrides, options?.mode ?? "full", isSampledAudit);
+        const findings = runRulesOnPages(groupPages, parsedPagesAll, groupRules, enabledCheck, groupName, knownUrls, adjacency, inbound, rootUrl, normalizeUrlOptions, source, DEFAULT_ENTITY_PATTERNS, groupConfig?.overrides, options?.mode ?? "full", 
+        // 2026-05-06 calibration fix: pinnedUrls mode fetches a hand-picked subset
+        // of the full site — the link graph across those pages is structurally
+        // incomplete, just like a random-sampled crawl. Pass `true` so
+        // links/unreachable-from-root skips its check rather than emitting
+        // sampling-artifact false positives (22/25 Wise pages flagged "unreachable"
+        // because the nav paths between locale-specific currency-converter URLs
+        // were not in the pinned set).
+        isSampledAudit || hasPinnedUrlsEarly);
         allFindings.push(...findings);
         groupPageCounts[groupName] = groupPages.length;
         // v0.4.3: per-group scoring uses the same site-classification profile so
@@ -2061,7 +2187,14 @@ export async function auditSource(source, options) {
     const { risk, categories, bucketCounts } = scoreFromFindings(enriched.findings, siteClassification, parsedPages.length);
     const auditedPageCount = Object.values(groupPageCounts).reduce((a, b) => a + b, 0);
     const issues = bucketIssues(enriched.findings);
-    const verdict = shiftVerdictForAuthority(verdictForRisk(risk), options?.authorityScore);
+    // v0.6.0 — spec §15.1: site verdict comes from siteVerdictFromTemplates when
+    // ≥1 template has ≥5% coverage. Falls back to the legacy risk-ladder verdict
+    // when no template meets the threshold (single-template sites, `unclear`/
+    // `small-marketing` classifications, or the long-tail-only case).
+    // The `risk` score is intentionally unchanged — §15.1 governs verdict only.
+    const legacyVerdict = shiftVerdictForAuthority(verdictForRisk(risk), options?.authorityScore);
+    const templateVerdict = siteVerdictFromTemplates(siteTemplates);
+    const verdict = templateVerdict !== null ? templateVerdict : legacyVerdict;
     const headline = buildHeadline(bucketCounts);
     // audit/* findings are diagnostic-only and never appear in summary.issues.
     // Surface them under diagnostics so consumers (telemetry, debug UIs) can
@@ -2094,6 +2227,10 @@ export async function auditSource(source, options) {
         pageCount: auditedPageCount || parsedPages.length,
         templateDetected: enriched.templateDetected,
         rawFindingCount: enriched.rawFindingCount,
+        // v0.5.12 — sorted list of audited page URLs for --repin capture
+        auditedUrls: parsedPages.length > 0
+            ? [...parsedPages.map((p) => p.url)].sort()
+            : undefined,
     };
     if (cacheConfig) {
         summary.cacheStats = cacheStats;