mjolnir-qa 1.0.9 → 2.0.2

package/dist/mcp/stdio.mjs

@@ -3,7 +3,7 @@ import { createInterface } from "node:readline";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import { delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import * as ts$2 from "ts-morph";
 import ts, { Project, SyntaxKind, ts as ts$1 } from "ts-morph";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -56,115 +56,52 @@ const DEDUCTIONS = {
 	info: 1
 };
 //#endregion
-//#region src/engine/evidence-core.ts
-/**
-* The core's own version — stamped into every record's provenance so a
-* consumer can tell which normalization contract produced a record.
-* Bump ONLY on a semantic change to the normalization itself.
-*/
-const EVIDENCE_CORE_VERSION = "evidence-core@1";
-/** Deterministic canonical order: file → line (absent last) → title → source. */
-function compareEvidenceRecords(a, b) {
-	if (a.file !== b.file) return a.file < b.file ? -1 : 1;
-	const la = a.line ?? Number.POSITIVE_INFINITY;
-	const lb = b.line ?? Number.POSITIVE_INFINITY;
-	if (la !== lb) return la - lb;
-	if (a.title !== b.title) return a.title < b.title ? -1 : 1;
-	if (a.source !== b.source) return a.source < b.source ? -1 : 1;
-	return 0;
-}
-function normalizeOne(report, artifact, v) {
-	const last = v.attempts > 0 ? v.finalStatus : "skipped";
-	return {
-		source: report.source,
-		artifact,
-		file: v.file,
-		title: v.title,
-		...v.line !== void 0 ? { line: v.line } : {},
-		status: {
-			final: last,
-			failed: v.everFailed,
-			retried: v.attempts > 1,
-			passedOnRetry: v.passedOnRetry,
-			skipped: v.skipped,
-			timedOut: v.finalStatus === "timedOut"
-		},
-		attempts: v.attempts,
-		durationMs: v.totalDurationMs,
-		errors: [],
-		attachments: [],
-		provenance: {
-			core: EVIDENCE_CORE_VERSION,
-			ingest: "mjolnir.forensics"
-		}
-	};
-}
-/**
-* Normalize a forensics report into deterministically-ordered evidence
-* records. The same report + artifact identity ALWAYS produces the same
-* record list — report verdict order never leaks into the output.
-*/
-function buildEvidenceRecords(report, artifact) {
-	return report.verdicts.map((v) => normalizeOne(report, artifact, v)).sort(compareEvidenceRecords);
-}
-/**
-* The test whose declaration span contains `line` — the exact matching
-* semantics runtime corroboration has always used, extracted verbatim
-* (Audit W8 honesty rule included: a verdict without a line can never
-* be a test-level match). Returns the record with the greatest
-* declaration line ≤ the finding's line in that file; ties resolve by
-* the canonical order (deterministic refinement over report order).
-*/
-function findTestAt(records, file, line) {
-	const inFile = records.filter((r) => r.file === file);
-	if (inFile.length === 0) return void 0;
-	if (inFile.length === 1) {
-		const only = inFile[0];
-		return only.line !== void 0 && only.line <= line ? only : void 0;
-	}
-	for (const r of inFile) if (r.line === void 0) return void 0;
-	let match;
-	for (const r of inFile) {
-		const l = r.line;
-		if (l <= line && (match === void 0 || match.line <= l)) match = r;
-	}
-	return match;
-}
-/** Per-file test count — the honest ceiling for file-level corroboration. */
-function countTestsIn(records, file) {
-	return records.filter((r) => r.file === file).length;
-}
-//#endregion
 //#region src/engine/runtime-corroboration.ts
 /**
 * Stamp runtime corroboration + trust levels onto findings (mutates in
 * place, the same contract as stampEvidenceLevels). Returns the number
 * of findings that gained runtime corroboration.
 *
-* WI-2 (Canonical Evidence Core): matching is delegated to the core —
-* `evidence` is the pipeline's normalized record set; when omitted, the
-* records are built from the report internally. Either way the stamped
-* output is identical (preservation suite pins this).
+* @param scanRoot - when provided, report file paths are normalized to
+*   repo-relative forward-slash form relative to this root, so platform
+*   absolute paths from runtime reports match the pipeline's
+*   normalized relative paths (src/foo.test.ts).
 */
-function stampRuntimeCorroboration(findings, report, evidence) {
-	const records = evidence ?? buildEvidenceRecords(report, "runtime-report");
+function stampRuntimeCorroboration(findings, report, scanRoot) {
+	const normalize = (p) => {
+		let n = p.replace(/\\/g, "/");
+		if (scanRoot) {
+			const root = scanRoot.replace(/\\/g, "/").replace(/\/?$/, "/");
+			if (n.startsWith(root)) n = n.slice(root.length);
+		}
+		return n.replace(/^\.\//, "").replace(/^\/+/, "");
+	};
+	const byFile = /* @__PURE__ */ new Map();
+	for (const v of report.verdicts) {
+		const key = normalize(v.file);
+		const list = byFile.get(key) ?? [];
+		list.push(v);
+		byFile.set(key, list);
+	}
 	let corroborated = 0;
 	for (const f of findings) {
-		const testsExecuted = countTestsIn(records, f.file);
-		if (testsExecuted === 0) continue;
-		const matched = findTestAt(records, f.file, f.line);
+		const verdicts = byFile.get(f.file);
+		if (!verdicts || verdicts.length === 0) continue;
+		const testsExecuted = verdicts.filter((v) => !v.skipped).length;
+		const matched = findContainingTest(verdicts, f.line);
 		let corroboration;
-		if (matched) corroboration = {
+		if (testsExecuted === 0) continue;
+		if (matched && !matched.skipped) corroboration = {
 			level: "test",
 			source: report.source,
 			testsExecuted,
 			matchedTest: {
 				title: matched.title,
-				finalStatus: matched.status.final,
+				finalStatus: matched.finalStatus,
 				attempts: matched.attempts,
-				passedOnRetry: matched.status.passedOnRetry,
-				everFailed: matched.status.failed,
-				skipped: matched.status.skipped
+				passedOnRetry: matched.passedOnRetry,
+				everFailed: matched.everFailed,
+				skipped: false
 			}
 		};
 		else corroboration = {
@@ -172,20 +109,22 @@ function stampRuntimeCorroboration(findings, report, evidence) {
 			source: report.source,
 			testsExecuted
 		};
-		if (f.qaImpact === "FLAKY-RISK" && matched !== void 0 && (matched.status.passedOnRetry || matched.status.failed || matched.status.final === "timedOut")) corroboration.level = "defect";
+		if (f.qaImpact === "FLAKY-RISK" && matched !== void 0 && !matched.skipped && (matched.passedOnRetry || matched.finalStatus === "timedOut") && deriveTrustLevel(f, {
+			...corroboration,
+			level: "defect"
+		}) === "L5") corroboration.level = "defect";
 		f.runtimeCorroboration = corroboration;
 		f.trustLevel = deriveTrustLevel(f, corroboration);
 		corroborated++;
 	}
 	return corroborated;
 }
-/**
-* (Matching semantics live in the evidence core — `findTestAt`. The
-* doc comments below were the pre-core contract and are preserved
-* there; Audit W8's honesty rule is enforced by `findTestAt` verbatim:
-* a record without a declaration line can never produce a test-level
-* match.)
-*/
+function findContainingTest(verdicts, line) {
+	if (!Number.isInteger(line) || line < 1) return void 0;
+	if (verdicts.some((v) => v.line === void 0)) return void 0;
+	const matches = verdicts.filter((v) => v.line === line);
+	return matches.length === 1 ? matches[0] : void 0;
+}
 /**
 * The deterministic L0–L5 derivation (see TRUST_ORDER). Static base
 * from the E-ladder; runtime evidence upgrades, never downgrades.
@@ -193,18 +132,9 @@ function stampRuntimeCorroboration(findings, report, evidence) {
 * produce L4/L5 for a static-only finding.
 */
 function deriveTrustLevel(finding, corroboration) {
-	let level;
-	if (finding.evidenceLevel !== void 0) level = finding.evidenceLevel;
-	else if (finding.findingType === "observation") level = "E0";
-	else if (finding.findingType === "heuristic-risk") level = "E1";
-	else if (finding.confidence === "low") level = "E1";
-	else level = "E2";
-	if (!corroboration) {
-		if (level === "E0") return "L0";
-		if (level === "E1") return "L1";
-		return "L2";
-	}
-	if (corroboration.level === "defect") return "L5";
+	const level = finding.evidenceLevel ?? (finding.findingType === "observation" ? "E0" : finding.findingType === "heuristic-risk" ? "E1" : finding.confidence === "low" ? "E1" : "E2");
+	if (!corroboration) return level === "E0" ? "L0" : level === "E1" ? "L1" : "L2";
+	if (corroboration.level === "defect") return level === "E0" ? "L4" : "L5";
 	if (corroboration.level === "test") return "L4";
 	return "L3";
 }
@@ -417,7 +347,7 @@ const MEASURED_FP = {
 	"QA-PW-004": {
 		fpRate: .429,
 		n: 14,
-		detectorRevision: 1,
+		detectorRevision: 2,
 		ciLow: .2138,
 		ciHigh: .6741
 	},
@@ -501,7 +431,7 @@ const MEASURED_FP = {
 	"QA-PW-125": {
 		fpRate: 0,
 		n: 10,
-		detectorRevision: 1,
+		detectorRevision: 2,
 		ciLow: 0,
 		ciHigh: .2775
 	},
@@ -564,7 +494,7 @@ const MEASURED_FP = {
 	"QA-PY-003": {
 		fpRate: .467,
 		n: 30,
-		detectorRevision: 3,
+		detectorRevision: 4,
 		ciLow: .3023,
 		ciHigh: .6386
 	},
@@ -895,21 +825,33 @@ function canonical(value) {
 	return JSON.stringify(value);
 }
 function buildRunIdentity(input) {
-	const inputFingerprint = sha256$1([...input.files].map((f) => `${f.path}:${f.size}`).sort().join("\n"));
+	const inputFingerprint = sha256$1([...input.files].map((f) => f.hash ? `${f.path}:${f.hash}` : `${f.path}:${f.size}`).sort().join("\n"));
 	const rulesDigest = sha256$1([...input.rules].map((r) => `${r.id}:${r.detectorRevision}`).sort().join("\n"));
 	const configFingerprint = sha256$1(canonical(input.config ?? null));
-	return {
-		scanId: sha256$1(canonical({
-			inputFingerprint,
-			rulesDigest,
-			configFingerprint,
-			engineVersion: input.engineVersion
-		})),
+	const verdictInputs = {
 		inputFingerprint,
 		rulesDigest,
 		configFingerprint,
 		engineVersion: input.engineVersion
 	};
+	if (input.reportDigest) verdictInputs.reportDigest = input.reportDigest;
+	if (input.trustModelVersion !== void 0) verdictInputs.trustModelVersion = input.trustModelVersion;
+	if (input.scoringModelVersion !== void 0) verdictInputs.scoringModelVersion = input.scoringModelVersion;
+	if (input.frameworkSupportMatrixVersion !== void 0) verdictInputs.frameworkSupportMatrixVersion = input.frameworkSupportMatrixVersion;
+	if (input.evidenceSchemaVersions !== void 0) verdictInputs.evidenceSchemaVersions = [...input.evidenceSchemaVersions].sort((a, b) => a - b);
+	if (input.suppressionFingerprint !== void 0) verdictInputs.suppressionFingerprint = input.suppressionFingerprint;
+	if (input.policyFingerprint !== void 0) verdictInputs.policyFingerprint = input.policyFingerprint;
+	if (input.historicalEvidenceFingerprint !== void 0) verdictInputs.historicalEvidenceFingerprint = input.historicalEvidenceFingerprint;
+	return {
+		scanId: sha256$1(canonical(verdictInputs)),
+		inputFingerprint,
+		rulesDigest,
+		configFingerprint,
+		engineVersion: input.engineVersion,
+		...input.trustModelVersion !== void 0 ? { trustModelVersion: input.trustModelVersion } : {},
+		...input.scoringModelVersion !== void 0 ? { scoringModelVersion: input.scoringModelVersion } : {},
+		...input.frameworkSupportMatrixVersion !== void 0 ? { frameworkSupportMatrixVersion: input.frameworkSupportMatrixVersion } : {}
+	};
 }
 /**
 * Builds the Evidence Graph for a run. No fabrication: a link's `ref`
@@ -962,7 +904,20 @@ function buildEvidenceGraph(parts) {
 * scripts/sync-sarif-version.cjs and guarded by the version-consistency
 * spec. cli.ts re-exports this as CLI_VERSION.
 */
-const ENGINE_VERSION = "1.0.9";
+const ENGINE_VERSION = "2.0.2";
+//#endregion
+//#region src/engine/contract-versions.ts
+/**
+* Versioned contract registry (VERSION-001).
+*
+* Single source of truth for every version constant the engine exposes
+* to consumers (run identity, evidence graph, machine contract).
+* Constants are `as const` — literal types flow into the identity
+* surface without widening.
+*/
+const TRUST_MODEL_VERSION = "1.0.0";
+const SCORING_MODEL_VERSION = "1.0.0";
+const FRAMEWORK_SUPPORT_MATRIX_VERSION = "1.0.0";
 //#endregion
 //#region src/discovery/evidence-discovery.ts
 /**
@@ -1020,7 +975,7 @@ const SKIP_DIRS = /* @__PURE__ */ new Set([
 ]);
 function listDirs(dir) {
 	try {
-		return readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && !SKIP_DIRS.has(e.name)).map((e) => join(dir, e.name));
+		return readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && !SKIP_DIRS.has(e.name)).map((e) => join(dir, e.name)).sort();
 	} catch {
 		return [];
 	}
@@ -1041,14 +996,15 @@ function discoverEvidenceCandidates(scanRoot) {
 				const st = statSync(p);
 				if (conv.kind === "dir" ? st.isDirectory() : st.isFile()) out.push({
 					path: p,
-					convention: conv.convention
+					convention: conv.convention,
+					depth
 				});
 			}
 			if (depth < SEARCH_DEPTH) next.push(...listDirs(dir));
 		}
 		levels.push(next);
 	}
-	return out.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+	return out.sort((a, b) => a.depth - b.depth || (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
 }
 //#endregion
 //#region src/discovery/workspace.ts
@@ -1057,10 +1013,17 @@ function discoverEvidenceCandidates(scanRoot) {
 * Finds project root, parses package.json, detects npm/yarn/pnpm workspaces.
 * Monorepo depth beyond workspaces is a documented launch cut (§29.1).
 */
+const PROJECT_MARKERS = [
+	"package.json",
+	"pyproject.toml",
+	"pom.xml",
+	"build.gradle",
+	"build.gradle.kts"
+];
 function findProjectRoot(startDir) {
 	let dir = resolve(startDir);
 	while (true) {
-		if (existsSync(join(dir, "package.json"))) return dir;
+		for (const marker of PROJECT_MARKERS) if (existsSync(join(dir, marker))) return dir;
 		const parent = dirname(dir);
 		if (parent === dir) return null;
 		dir = parent;
@@ -1079,16 +1042,252 @@ function discoverWorkspace(rootDir) {
 	else if (rawWorkspaces && typeof rawWorkspaces === "object" && Array.isArray(rawWorkspaces.packages)) globs = rawWorkspaces.packages.filter((w) => typeof w === "string");
 	return {
 		root,
-		name: typeof pkg["name"] === "string" ? pkg["name"] : basename(root),
+		name: typeof pkg["name"] === "string" ? pkg["name"] : basename$1(root),
 		packageJson: pkg,
 		workspaceGlobs: globs
 	};
 }
-function basename(p) {
+function basename$1(p) {
 	const parts = p.split(/[\\/]/);
 	return parts[parts.length - 1];
 }
 //#endregion
+//#region src/lib/safe-json.ts
+/**
+* Reusable safe-JSON parse-and-validate helper.
+*
+* Replaces the `JSON.parse(text) as T` pattern with a two-step process:
+*   1. Try/catch around JSON.parse (descriptive error on bad JSON)
+*   2. Runtime validation of the parsed shape (caller-supplied predicate)
+*
+* The `validate` predicate is intentionally lightweight — it checks the
+* expected shape exists rather than exhaustively type-guarding every field.
+* Internal files (cache, hashes) use `isRecord`; user-facing files
+* (config, plugins) use stricter checks that throw descriptive errors.
+*/
+function parseJsonFile(text, source, validate) {
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch (err) {
+		throw new Error(`invalid JSON in ${source}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+	}
+	if (!validate(parsed)) throw new Error(`unexpected shape in ${source}`, { cause: parsed });
+	return parsed;
+}
+/**
+* Minimal validator: value is a plain object (not null, not array).
+* Sufficient for internal files (cache, hashes) where downstream
+* code already checks individual fields.
+*/
+function isRecord(v) {
+	return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+//#endregion
+//#region src/config/config-schema.ts
+const VALID_GATES = /* @__PURE__ */ new Set([
+	"advisory",
+	"error",
+	"warning"
+]);
+const VALID_SEVERITIES = /* @__PURE__ */ new Set([
+	"error",
+	"warning",
+	"info"
+]);
+/**
+* Validates a config object against the structural schema.
+* Returns { valid: true } when the config is structurally sound,
+* or { valid: false, errors } listing each violation.
+*/
+function validateConfigSchema(config) {
+	const errors = [];
+	if (config === null || typeof config !== "object" || Array.isArray(config)) return {
+		valid: false,
+		errors: ["config must be a non-null object"]
+	};
+	const cfg = config;
+	if (cfg["gate"] !== void 0) {
+		if (typeof cfg["gate"] !== "string") errors.push(`gate must be a string, got ${typeof cfg["gate"]}`);
+		else if (!VALID_GATES.has(cfg["gate"])) errors.push(`gate must be one of advisory|error|warning, got "${cfg["gate"]}"`);
+	}
+	if (cfg["exclude"] !== void 0) {
+		if (!Array.isArray(cfg["exclude"])) errors.push(`exclude must be an array, got ${typeof cfg["exclude"]}`);
+		else for (let i = 0; i < cfg["exclude"].length; i++) if (typeof cfg["exclude"][i] !== "string") errors.push(`exclude[${i}] must be a string, got ${typeof cfg["exclude"][i]}`);
+	}
+	if (cfg["severityOverrides"] !== void 0) {
+		if (typeof cfg["severityOverrides"] !== "object" || cfg["severityOverrides"] === null || Array.isArray(cfg["severityOverrides"])) errors.push("severityOverrides must be an object");
+		else for (const [key, value] of Object.entries(cfg["severityOverrides"])) if (typeof value !== "string") errors.push(`severityOverrides["${key}"] must be a string, got ${typeof value}`);
+		else if (!VALID_SEVERITIES.has(value)) errors.push(`severityOverrides["${key}"] must be one of error|warning|info, got "${value}"`);
+	}
+	if (cfg["ignore"] !== void 0) {
+		if (!Array.isArray(cfg["ignore"])) errors.push(`ignore must be an array, got ${typeof cfg["ignore"]}`);
+		else for (let i = 0; i < cfg["ignore"].length; i++) {
+			const entry = cfg["ignore"][i];
+			const prefix = `ignore[${i}]`;
+			if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
+				errors.push(`${prefix} must be an object`);
+				continue;
+			}
+			const ign = entry;
+			if (typeof ign["ruleId"] !== "string" || ign["ruleId"] === "") errors.push(`${prefix}.ruleId must be a non-empty string`);
+			if (typeof ign["reason"] !== "string" || ign["reason"] === "") errors.push(`${prefix}.reason must be a non-empty string`);
+			if (ign["files"] !== void 0) {
+				if (!Array.isArray(ign["files"])) errors.push(`${prefix}.files must be an array`);
+				else for (let j = 0; j < ign["files"].length; j++) if (typeof ign["files"][j] !== "string") errors.push(`${prefix}.files[${j}] must be a string, got ${typeof ign["files"][j]}`);
+			}
+			if (ign["expires"] !== void 0 && typeof ign["expires"] !== "string") errors.push(`${prefix}.expires must be a string, got ${typeof ign["expires"]}`);
+			const allowedKeys = /* @__PURE__ */ new Set([
+				"ruleId",
+				"reason",
+				"files",
+				"expires"
+			]);
+			for (const key of Object.keys(ign)) if (!allowedKeys.has(key)) errors.push(`${prefix} has unknown property "${key}"`);
+		}
+	}
+	if (cfg["plugins"] !== void 0) {
+		if (cfg["plugins"] === null || typeof cfg["plugins"] !== "object") errors.push("plugins must be an object or array");
+	}
+	return {
+		valid: errors.length === 0,
+		errors
+	};
+}
+//#endregion
+//#region src/config/config.ts
+/**
+* Config file support (Sprint-Plan W7, Product-MVP §27 + GAP-F).
+* Zero-config preserved: config presence never changes detection
+* semantics — only severity, scope, and gating.
+*/
+/**
+* Audit S7: every config key the engine consumes. A top-level key
+* OUTSIDE this set is a likely typo ("severities", "ingore") — unknown
+* keys emit a warning (fail-noisy, not fail-silent) and are ignored.
+*/
+const KNOWN_CONFIG_KEYS = /* @__PURE__ */ new Set([
+	"gate",
+	"exclude",
+	"severityOverrides",
+	"ignore",
+	"plugins"
+]);
+const CONFIG_NAMES = ["mjolnir.config.json", ".mjolnir.json"];
+/**
+* Returns the absolute path of the first config file found, or null.
+* Shared by config loader, ignores, and plugin loading so all three
+* respect the same config file name priority.
+*/
+function findConfigPath(root) {
+	for (const name of CONFIG_NAMES) {
+		const p = join(root, name);
+		if (existsSync(p)) return p;
+	}
+	return null;
+}
+/**
+* Distinguished from other load failures so the CLI can exit 10 (usage)
+* instead of 20 (internal): a typo in the user's config is a user error
+* with a fixable message, not a tool malfunction (bug-audit M4).
+*/
+var ConfigValidationError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "ConfigValidationError";
+	}
+};
+function loadConfig(root, options = {}) {
+	for (const name of CONFIG_NAMES) {
+		const p = join(root, name);
+		if (!existsSync(p)) continue;
+		try {
+			const parsed = parseJsonFile(readFileSync(p, "utf8"), p, (v) => isRecord(v));
+			return {
+				config: parsed,
+				path: p,
+				warnings: validate(parsed, options.knownRuleIds)
+			};
+		} catch (err) {
+			const msg = err.message;
+			throw new ConfigValidationError(`Invalid mjolnir config at ${p}: ${msg}`, { cause: err });
+		}
+	}
+	return {
+		config: {},
+		path: null,
+		warnings: []
+	};
+}
+function validate(cfg, knownRuleIds) {
+	const warnings = [];
+	const schemaResult = validateConfigSchema(cfg);
+	if (!schemaResult.valid) throw new Error(schemaResult.errors.join("; "));
+	if (cfg.gate && ![
+		"advisory",
+		"error",
+		"warning"
+	].includes(cfg.gate)) throw new Error(`gate must be advisory|error|warning, got "${cfg.gate}"`);
+	for (const [ruleId, severity] of Object.entries(cfg.severityOverrides ?? {})) {
+		if (!SEVERITY_ORDER.includes(severity)) throw new Error(`severityOverrides["${ruleId}"] must be one of ${SEVERITY_ORDER.join("|")}, got "${String(severity)}"`);
+		if (knownRuleIds && !knownRuleIds.has(ruleId)) warnings.push(`warning: severityOverrides["${ruleId}"] names no registered rule (typo? plugin rule?) — the entry is kept but currently matches nothing.`);
+	}
+	for (const ign of cfg.ignore ?? []) {
+		if (!ign.ruleId) throw new Error("ignore entries require ruleId");
+		if (!ign.reason) throw new Error(`ignore for ${ign.ruleId} requires a "reason" (§27)`);
+		if (ign.files !== void 0) {
+			if (!Array.isArray(ign.files)) throw new Error(`ignore for ${ign.ruleId}: "files" must be an array of glob strings, got ${typeof ign.files}`);
+			for (const g of ign.files) if (typeof g !== "string") throw new Error(`ignore for ${ign.ruleId}: "files" entries must be strings, got ${typeof g} (${JSON.stringify(g)})`);
+		}
+		if (ign.expires !== void 0 && Number.isNaN(new Date(ign.expires).getTime())) throw new Error(`ignore for ${ign.ruleId}: "expires" must be an ISO date, got "${ign.expires}"`);
+		if (ign.expires !== void 0 && !Number.isNaN(new Date(ign.expires).getTime()) && new Date(ign.expires).getTime() < Date.now()) warnings.push(`warning: ignore for ${ign.ruleId} has expired (expires "${ign.expires}") — the entry is kept but currently inactive.`);
+	}
+	for (const key of Object.keys(cfg)) if (!KNOWN_CONFIG_KEYS.has(key)) warnings.push(`warning: mjolnir.config.json has an unknown top-level key "${key}" — ignored (typo? see README §Configuration).`);
+	if (cfg.exclude !== void 0) {
+		if (!Array.isArray(cfg.exclude)) throw new Error(`exclude must be an array of strings, got ${typeof cfg.exclude}`);
+		for (const p of cfg.exclude) if (typeof p !== "string") throw new Error(`exclude entries must be strings, got ${typeof p} (${JSON.stringify(p)})`);
+	}
+	return warnings;
+}
+/**
+* Bug-audit QA-2026-08-30 QA-6: the 90-day policy in the README was only
+* applied at WRITE time by the `ignore` command — a hand-written entry
+* without `expires` stayed active forever, silently bypassing the
+* documented window.
+*
+* Audit S4 (remediation plan): the config-file MTIME is no longer an
+* expiry anchor. Anchoring the 90-day default at mtime meant ANY edit to
+* mjolnir.config.json — a reformat, an unrelated key, a `touch` — reset
+* the 90-day window for EVERY hand-authored entry: suppressions could be
+* extended indefinitely without touching their own fields. The expiry is
+* now the entry's explicit `expires` date alone; an entry without one
+* stays active and is honestly labeled "(no expiry set)" in the
+* suppressions report. Hand-authored entries should declare `expires` at
+* creation (README §Configuration documents the shape).
+*/
+function isSuppressionActive(ign, now = /* @__PURE__ */ new Date()) {
+	if (!ign.expires) return true;
+	return utcMidnight(ign.expires) > utcMidnightOf(now);
+}
+/** UTC-midnight timestamp of an ISO date string (YYYY-MM-DD). */
+function utcMidnight(isoDate) {
+	if (!/^\d{4}-\d{2}-\d{2}$/.test(isoDate)) return NaN;
+	const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(isoDate);
+	if (!m) return NaN;
+	return Date.UTC(Number(m[1]), Number(m[2]) - 1, Number(m[3]));
+}
+/** UTC-midnight timestamp of a Date (calendar day, timezone-independent). */
+function utcMidnightOf(d) {
+	return Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate());
+}
+function applySeverityOverrides(findings, cfg) {
+	const overrides = cfg.severityOverrides ?? {};
+	for (const f of findings) {
+		const override = overrides[f.ruleId];
+		if (override && SEVERITY_ORDER.includes(override)) f.severity = override;
+	}
+}
+//#endregion
 //#region src/discovery/ignores.ts
 /**
 * Ignore resolution (Product-MVP.txt R1 — Tier-1 launch blocker).
@@ -1118,6 +1317,7 @@ const DEFAULT_IGNORES = [
 	"node_modules",
 	".git",
 	".mjolnir",
+	".claude",
 	"dist",
 	"build",
 	"out",
@@ -1203,8 +1403,8 @@ function loadExtraPatterns(root) {
 		const patterns = readFileSync(ignorePath, "utf8").split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
 		extra.push(...patterns);
 	} catch {}
-	const configPath = join(root, "mjolnir.config.json");
-	if (existsSync(configPath)) try {
+	const configPath = findConfigPath(root);
+	if (configPath) try {
 		const cfg = JSON.parse(readFileSync(configPath, "utf8"));
 		if (Array.isArray(cfg.exclude)) extra.push(...cfg.exclude.filter((p) => typeof p === "string"));
 	} catch {}
@@ -1503,41 +1703,25 @@ function getCodeOnlyText(file) {
 	try {
 		const text = file.text;
 		const ranges = [];
-		for (const d of sf.getDescendantsOfKind(ts$1.SyntaxKind.StringLiteral)) {
-			const s = d.getStart();
-			ranges.push({
-				start: s,
-				end: s + d.getWidth()
-			});
-		}
-		for (const d of sf.getDescendantsOfKind(ts$1.SyntaxKind.NoSubstitutionTemplateLiteral)) {
-			const s = d.getStart();
-			ranges.push({
-				start: s,
-				end: s + d.getWidth()
-			});
-		}
-		for (const d of sf.getDescendantsOfKind(ts$1.SyntaxKind.TemplateHead)) {
-			const s = d.getStart();
-			ranges.push({
-				start: s,
-				end: s + d.getWidth()
-			});
-		}
-		for (const d of sf.getDescendantsOfKind(ts$1.SyntaxKind.TemplateMiddle)) {
-			const s = d.getStart();
-			ranges.push({
-				start: s,
-				end: s + d.getWidth()
-			});
-		}
-		for (const d of sf.getDescendantsOfKind(ts$1.SyntaxKind.TemplateTail)) {
-			const s = d.getStart();
-			ranges.push({
-				start: s,
-				end: s + d.getWidth()
-			});
-		}
+		const compiler = sf.compilerNode;
+		const stringAndTemplateKinds = {
+			[ts$1.SyntaxKind.StringLiteral]: true,
+			[ts$1.SyntaxKind.NoSubstitutionTemplateLiteral]: true,
+			[ts$1.SyntaxKind.TemplateHead]: true,
+			[ts$1.SyntaxKind.TemplateMiddle]: true,
+			[ts$1.SyntaxKind.TemplateTail]: true
+		};
+		const collect = (node) => {
+			if (stringAndTemplateKinds[node.kind]) {
+				const s = node.getStart(compiler);
+				ranges.push({
+					start: s,
+					end: s + node.getWidth()
+				});
+			}
+			ts$1.forEachChild(node, collect);
+		};
+		ts$1.forEachChild(compiler, collect);
 		for (const r of commentAndStringRanges({
 			...file,
 			ast: sf
@@ -1551,6 +1735,10 @@ function getCodeOnlyText(file) {
 		return file.text;
 	}
 }
+/** Release the shared ts-morph Project between scans to free memory. */
+function resetTsMorphProject() {
+	project = null;
+}
 //#endregion
 //#region src/engine/code-text.ts
 /**
@@ -1577,6 +1765,7 @@ function computeCodeText(file, language) {
 		case "python": return maskPython(file.text);
 		case "java": return maskJava(file.text);
 		case "csharp": return maskCSharp(file.text);
+		default: return file.text;
 	}
 }
 /**
@@ -1802,18 +1991,36 @@ function maskCSharp(text) {
 			i = prefixStart + 1;
 			continue;
 		}
-		if (chars[i] === "\"" && i + 2 < len && chars[i + 1] === "\"" && chars[i + 2] === "\"") {
-			const start = i;
-			i += 3;
-			while (i < len) {
-				if (chars[i] === "\"" && i + 1 < len && chars[i + 1] === "\"" && i + 2 < len && chars[i + 2] === "\"") {
-					i += 3;
-					break;
+		if (chars[i] === "\"") {
+			let quoteCount = 0;
+			let j = i;
+			while (j < len && chars[j] === "\"") {
+				quoteCount++;
+				j++;
+			}
+			if (quoteCount >= 3) {
+				const start = i;
+				i = j;
+				while (i < len) {
+					let closeCount = 0;
+					let k = i;
+					while (k < len && chars[k] === "\"") {
+						closeCount++;
+						k++;
+					}
+					if (closeCount === quoteCount) {
+						i = k;
+						break;
+					}
+					if (closeCount > 0) {
+						i = k;
+						continue;
+					}
+					i++;
 				}
-				i++;
+				blankRange(chars, start, i);
+				continue;
 			}
-			blankRange(chars, start, i);
-			continue;
 		}
 		if (chars[i] === "\"") {
 			const start = i;
@@ -1843,6 +2050,50 @@ function maskCSharp(text) {
 	return chars.join("");
 }
 /**
+* Blanks TypeScript/JavaScript string literals and comments to spaces
+* using the TypeScript compiler scanner with `reScanTemplateToken`
+* tracking for template interpolation boundaries. No AST required.
+*
+* This reuses the same pattern as `detector-hash.ts` (walkTokens) which
+* already solves the exact same template-interpolation problem for hash
+* computation. The phantom-comment edge case only occurs when
+* `reScanTemplateToken` is NOT called — calling it closes the gap.
+*/
+function maskTypeScriptBasic(text) {
+	const chars = text.split("");
+	const scanner = ts$1.createScanner(ts$1.ScriptTarget.ES2022, false, ts$1.LanguageVariant.Standard, text);
+	let templateDepth = 0;
+	let tok = scanner.scan();
+	while (tok !== ts$1.SyntaxKind.EndOfFileToken) {
+		if (tok === ts$1.SyntaxKind.CloseBraceToken && templateDepth > 0) tok = scanner.reScanTemplateToken(false);
+		const start = scanner.getTokenPos();
+		const end = scanner.getTextPos();
+		if (tok === ts$1.SyntaxKind.SingleLineCommentTrivia || tok === ts$1.SyntaxKind.MultiLineCommentTrivia || tok === ts$1.SyntaxKind.StringLiteral || tok === ts$1.SyntaxKind.NoSubstitutionTemplateLiteral || tok === ts$1.SyntaxKind.TemplateHead || tok === ts$1.SyntaxKind.TemplateMiddle || tok === ts$1.SyntaxKind.TemplateTail) {
+			for (let i = start; i < end && i < chars.length; i++) if (chars[i] !== "\n" && chars[i] !== "\r") chars[i] = " ";
+		}
+		if (tok === ts$1.SyntaxKind.TemplateHead) templateDepth++;
+		else if (tok === ts$1.SyntaxKind.LastTemplateToken) templateDepth = Math.max(0, templateDepth - 1);
+		tok = scanner.scan();
+	}
+	return chars.join("");
+}
+/**
+* Compute the code-only text for counting test declarations. Dispatches
+* to the appropriate masker per language. Never falls back to raw text —
+* always produces a masked view with comments/strings blanked.
+*
+* Used when `parsedFile.codeText` is not available (e.g., AST parse failed).
+*/
+function getCodeTextForCounting(text, language) {
+	switch (language) {
+		case "typescript": return maskTypeScriptBasic(text);
+		case "python": return maskPython(text);
+		case "java": return maskJava(text);
+		case "csharp": return maskCSharp(text);
+		default: return text;
+	}
+}
+/**
 * Blanks a range of characters to spaces, preserving newlines so
 * line/column computations remain valid.
 */
@@ -3203,7 +3454,9 @@ const azurePipelinesAdapter = {
 	dirSkips: [],
 	isTestFile(path) {
 		const normalized = path.replaceAll("\\", "/");
-		return AZURE_PIPELINE_NAMES.includes(normalized);
+		const basename = normalized.split("/").pop() ?? normalized;
+		if (!AZURE_PIPELINE_NAMES.includes(basename)) return false;
+		return normalized === basename || normalized.startsWith("/") || /^[A-Z]:/i.test(normalized);
 	},
 	detectFrameworks() {
 		return {
@@ -3285,7 +3538,10 @@ const jenkinsAdapter = {
 	testFileGlobs: ["Jenkinsfile"],
 	dirSkips: [],
 	isTestFile(path) {
-		return JENKINS_FILENAMES.includes(path.replaceAll("\\", "/"));
+		const normalized = path.replaceAll("\\", "/");
+		const basename = normalized.split("/").pop() ?? normalized;
+		if (!JENKINS_FILENAMES.includes(basename)) return false;
+		return normalized === basename || normalized.startsWith("/") || /^[A-Z]:/i.test(normalized);
 	},
 	detectFrameworks() {
 		return {
@@ -3538,18 +3794,19 @@ function collectNameStatus(output) {
 	return files;
 }
 function computeChangedScope(root, baseBranch) {
-	if (!existsSync(join(root, ".git"))) return {
+	const gitRoot = runGit(root, ["rev-parse", "--show-toplevel"])?.trim() ?? root;
+	if (!existsSync(join(gitRoot, ".git"))) return {
 		changed: {},
 		degraded: true,
 		reason: "not-a-git-repo"
 	};
-	const mergeBase = resolveMergeBase(root, baseBranch);
+	const mergeBase = resolveMergeBase(gitRoot, baseBranch);
 	if (!mergeBase) return {
 		changed: {},
 		degraded: true,
 		reason: "no-merge-base"
 	};
-	const committed = runGit(root, [
+	const committed = runGit(gitRoot, [
 		"diff",
 		"--name-status",
 		"-z",
@@ -3562,7 +3819,7 @@ function computeChangedScope(root, baseBranch) {
 		degraded: true,
 		reason: "diff-failed"
 	};
-	const workingTree = runGit(root, [
+	const workingTree = runGit(gitRoot, [
 		"diff",
 		"--name-status",
 		"-z",
@@ -3574,7 +3831,7 @@ function computeChangedScope(root, baseBranch) {
 		degraded: true,
 		reason: "diff-failed"
 	};
-	const untracked = runGit(root, [
+	const untracked = runGit(gitRoot, [
 		"ls-files",
 		"-z",
 		"--others",
@@ -3598,7 +3855,7 @@ function computeChangedScope(root, baseBranch) {
 		const CHUNK = 200;
 		for (let start = 0; start < files.length; start += CHUNK) {
 			const chunk = files.slice(start, start + CHUNK);
-			const output = runGit(root, [
+			const output = runGit(gitRoot, [
 				...args,
 				"--",
 				...chunk
@@ -3607,7 +3864,14 @@ function computeChangedScope(root, baseBranch) {
 			const sections = output.split("\ndiff --git ");
 			for (const section of sections) {
 				const body = section.startsWith("diff --git ") ? section : `diff --git ${section}`;
-				const file = /^diff --git a\/.+ b\/(.+)\n/.exec(`${body}\n`)?.[1];
+				const header = body.split("\n")[0] ?? "";
+				let file;
+				const canonM = /^diff --git "a\/.+?" "b\/(.+?)"/.exec(header);
+				if (canonM) file = canonM[1];
+				else {
+					const simpleM = /^diff --git a\/\S+\s+b\/(\S+)/.exec(header);
+					if (simpleM) file = simpleM[1];
+				}
 				if (file !== void 0) perFile.set(file, body);
 			}
 		}
@@ -3704,8 +3968,9 @@ function filterToChanged(findings, diff) {
 * an honest stderr note). Empty list = genuinely nothing staged.
 */
 function computeStagedFiles(root) {
-	if (!existsSync(join(root, ".git"))) return null;
-	const raw = runGit(root, [
+	const gitRoot = runGit(root, ["rev-parse", "--show-toplevel"])?.trim() ?? root;
+	if (!existsSync(join(gitRoot, ".git"))) return null;
+	const raw = runGit(gitRoot, [
 		"diff",
 		"--cached",
 		"--name-only",
@@ -4345,12 +4610,12 @@ const unawaitedPromiseAssertion = defineRule({
 	detectorRevision: 2,
 	run(ctx) {
 		const sourceFile = getTsSourceFile(ctx.ast);
-		if (sourceFile) return astArm$2(ctx, sourceFile);
-		return regexArm$1(ctx);
+		if (sourceFile) return astArm$1(ctx, sourceFile);
+		return regexArm(ctx);
 	}
 });
 /** The rev-1 line-walk detector — the parse-or-fallback path (§10.1). */
-function regexArm$1(ctx) {
+function regexArm(ctx) {
 	const text = ctx.codeText ?? ctx.text;
 	const findings = [];
 	const thenRe = /\.then\s*\(/g;
@@ -4410,7 +4675,7 @@ function regexArm$1(ctx) {
 *  - `void`-wrapped chains: a deliberate fire-and-forget marker.
 * Everything else the rev-1 diagnosis covers still fires, one per file.
 */
-function astArm$2(ctx, sourceFile) {
+function astArm$1(ctx, sourceFile) {
 	const findings = [];
 	const thenCalls = sourceFile.getDescendantsOfKind(ts.SyntaxKind.PropertyAccessExpression).filter((p) => p.getName() === "then" && p.getParent()?.getKind() === ts.SyntaxKind.CallExpression);
 	for (const thenAccess of thenCalls) {
@@ -4552,7 +4817,13 @@ const COMMENTED_TEST_RE = /^(?:await\s+)?(?:it|test)(?:\.\w+)?\s*\(/;
 * continuation of a block comment — those cannot be a commented-out test.
 */
 function stripCommentMarkers(line) {
-	const consumed = /^\s*(?:\/{2,}|\/\*\*?|\*)?\s*/.exec(line)[0].length;
+	const m = /^\s*(?:\/{2,}|\/\*\*?|\*)?\s*/.exec(line);
+	if (!m) return {
+		text: line,
+		consumed: 0,
+		matched: false
+	};
+	const consumed = m[0].length;
 	return {
 		text: line.slice(consumed),
 		consumed,
@@ -4813,6 +5084,7 @@ const brittleSelectors = defineRule({
 	},
 	detectionNotes: "regex pattern + inside-string oracle",
 	introduced: "0.1.0",
+	detectorRevision: 2,
 	tier: "quarantine",
 	run(ctx) {
 		const findings = [];
@@ -4869,7 +5141,7 @@ function stripComments(ctx) {
 				const slice = ctx.text.slice(r.start, r.end);
 				return slice.startsWith("//") || slice.startsWith("/*");
 			});
-			const chars = [...ctx.text];
+			const chars = ctx.text.split("");
 			for (const r of ranges) for (let i = r.start; i < r.end && i < chars.length; i++) if (chars[i] !== "\n" && chars[i] !== "\r") chars[i] = " ";
 			return chars.join("");
 		}
@@ -4980,11 +5252,11 @@ function locateAzureStepKey(text, step, keyName) {
 	if (anchorAt !== -1) {
 		keyRe.lastIndex = anchorAt;
 		const m = keyRe.exec(text);
-		if (m) return lineOf$1(text, m.index);
-		return lineOf$1(text, anchorAt);
+		if (m) return lineAt(text, m.index);
+		return lineAt(text, anchorAt);
 	}
 	const m = keyRe.exec(text);
-	if (m) return lineOf$1(text, m.index);
+	if (m) return lineAt(text, m.index);
 	return 1;
 }
 /** Line of a job-level key: anchored at the job's own kind key or name. */
@@ -4995,18 +5267,13 @@ function locateAzureJobKey(text, job, keyName) {
 	if (anchorAt !== -1) {
 		keyRe.lastIndex = anchorAt;
 		const m = keyRe.exec(text);
-		if (m) return lineOf$1(text, m.index);
-		return lineOf$1(text, anchorAt);
+		if (m) return lineAt(text, m.index);
+		return lineAt(text, anchorAt);
 	}
 	const m = keyRe.exec(text);
-	if (m) return lineOf$1(text, m.index);
+	if (m) return lineAt(text, m.index);
 	return 1;
 }
-function lineOf$1(text, index) {
-	let line = 1;
-	for (let i = 0; i < index; i++) if (text[i] === "\n") line++;
-	return line;
-}
 //#endregion
 //#region src/rules/ci/qa-ci-001-continue-on-error.ts
 /**
@@ -5165,19 +5432,14 @@ function locateStepContinueOnError(text, step) {
 	const re = /continue-on-error:\s*true/g;
 	re.lastIndex = searchFrom;
 	const m = re.exec(text);
-	if (m) return lineOf(text, m.index);
-	if (anchorAt !== -1) return lineOf(text, anchorAt);
+	if (m) return lineAt(text, m.index);
+	if (anchorAt !== -1) return lineAt(text, anchorAt);
 	return 1;
 }
 function findLine$2(text, re) {
 	const m = re.exec(text);
 	if (!m) return 1;
-	return lineOf(text, m.index);
-}
-function lineOf(text, index) {
-	let line = 1;
-	for (let i = 0; i < index; i++) if (text[i] === "\n") line++;
-	return line;
+	return lineAt(text, m.index);
 }
 function escapeRe$1(s) {
 	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -5604,14 +5866,9 @@ function findJobConsumerLine(text, jobName, consumerRe) {
 	const re = new RegExp(consumerRe.source, "gi");
 	re.lastIndex = declMatch ? declMatch.index : 0;
 	const anchored = re.exec(text);
-	if (anchored) return lineOfIndex(text, anchored.index);
+	if (anchored) return lineAt(text, anchored.index);
 	const anywhere = new RegExp(consumerRe.source, "i").exec(text);
-	return anywhere ? lineOfIndex(text, anywhere.index) : 1;
-}
-function lineOfIndex(text, index) {
-	let line = 1;
-	for (let i = 0; i < index; i++) if (text[i] === "\n") line++;
-	return line;
+	return anywhere ? lineAt(text, anywhere.index) : 1;
 }
 //#endregion
 //#region src/rules/ci/jenkins-gates.ts
@@ -5858,9 +6115,7 @@ function textIsVerificationGate(text) {
 }
 /** Line (1-based) of an offset — for finding anchors. */
 function lineOfOffset(text, offset) {
-	let line = 1;
-	for (let i = 0; i < offset && i < text.length; i++) if (text[i] === "\n") line++;
-	return line;
+	return lineAt(text, offset);
 }
 //#endregion
 //#region src/rules/ci/qa-ci-008-always-success.ts
@@ -6085,6 +6340,7 @@ const exitCodeNotPropagated = defineRule({
 			for (const line of lines) {
 				if (!TEST_CMD$1.test(line)) continue;
 				const m = TEST_CMD$1.exec(line);
+				if (!m) continue;
 				const afterCmd = line.slice(m.index + m[0].length);
 				if (/^\s*\|(?!\|)/.exec(afterCmd) && !/\|\|\s|&&\s/.test(afterCmd)) findings.push({
 					severity: "error",
@@ -6248,6 +6504,7 @@ const nonBlockingTestJob = defineRule({
 });
 function findLine(text, re) {
 	const m = re.exec(text);
+	if (!m) return 1;
 	let line = 1;
 	for (let i = 0; i < m.index; i++) if (text[i] === "\n") line++;
 	return line;
@@ -6445,7 +6702,7 @@ const pyNoAssertions = defineRule({
 	},
 	introduced: "0.3.0",
 	tier: "quarantine",
-	detectorRevision: 3,
+	detectorRevision: 4,
 	run(ctx) {
 		const text = ctx.codeText ?? ctx.text;
 		const findings = [];
@@ -6453,7 +6710,8 @@ const pyNoAssertions = defineRule({
 		const fnRe = /^([ \t]*)def\s+(test_\w+)\s*\([^)]*\)\s*:/gm;
 		let m;
 		while ((m = fnRe.exec(text)) !== null) {
-			if (m[1].length > 0) continue;
+			const indent = m[1];
+			if (indent.length > 0 && !isCollectedTestMethod(text, m.index, indent)) continue;
 			const body = extractBlock$1(text, m.index + m[0].length);
 			if (body === null) continue;
 			if (!(/^[ \t]*assert\b/m.test(body) || /pytest\.raises/.test(body) || /pytest\.(?:warns|deprecated_call|fail\s*\()/.test(body) || /self\.assert/.test(body) || /\bexpect\b/.test(body) || /\b_?(?:assert|expect|verify|check)[_A-Z]\w*\s*\(/.test(body) || /\b_?wait_for_\w+\s*\(/.test(body))) {
@@ -6482,6 +6740,35 @@ const pyNoAssertions = defineRule({
 		return findings;
 	}
 });
+/**
+* detectorRevision 4: true when the def at `defAt` (indent `indent`) is
+* a `test_*` METHOD of a pytest-collectable class — every header between
+* the def and the file top at a SMALLER indent must be either another
+* def (the method is nested in a function → not collected) or a
+* `class Test*` (collected). A class with a non-Test name, or any
+* non-header line at a smaller indent before a class header, means the
+* def is data → not collected.
+*/
+function isCollectedTestMethod(text, defAt, indent) {
+	const lines = text.slice(0, defAt).split("\n");
+	for (let i = lines.length - 1; i >= 0; i--) {
+		const line = lines[i];
+		if (line.trim() === "") continue;
+		const indentMatch = /^[ \t]*/.exec(line);
+		if (!indentMatch) continue;
+		const lineIndent = indentMatch[0];
+		if (lineIndent.length >= indent.length) continue;
+		const classM = /^[ \t]*class\s+(\w+)/.exec(line);
+		if (classM) {
+			if (!/^Test/.test(classM[1])) return false;
+			const classBody = lines.slice(i + 1).join("\n");
+			if (new RegExp(`^${lineIndent}(?:    |\t)\\s*def\\s+__init__\\s*\\(`, "m").test(classBody)) return false;
+			return true;
+		}
+		return false;
+	}
+	return false;
+}
 /** Extract an indented block starting after a `:` line; returns null if empty. */
 function extractBlock$1(text, afterColon) {
 	const rest = text.slice(afterColon).replace(/\r\n/g, "\n");
@@ -6490,7 +6777,11 @@ function extractBlock$1(text, afterColon) {
 	const firstIdx = firstContent.index;
 	if (rest.slice(0, firstIdx).includes("\n")) {
 		const lines = rest.split("\n").slice(1);
-		const indent = /^[ \t]*/.exec(lines.find((l) => l.trim() !== ""))[0];
+		const nonBlank = lines.find((l) => l.trim() !== "");
+		if (!nonBlank) return null;
+		const indentMatch = /^[ \t]*/.exec(nonBlank);
+		if (!indentMatch) return null;
+		const indent = indentMatch[0];
 		if (!indent) return null;
 		const collected = [];
 		for (const line of lines) {
@@ -6744,12 +7035,9 @@ function getTreeSitterTree(ast) {
 * source. The helper exists so this finding is pinned in one place.
 */
 function nodeLineCol(text, charIndex) {
-	let line = 1;
-	for (let i = 0; i < charIndex; i++) if (text.charCodeAt(i) === 10) line++;
-	const lastBreak = charIndex <= 0 ? -1 : text.lastIndexOf("\n", charIndex - 1);
 	return {
-		line,
-		column: charIndex - lastBreak
+		line: lineAt(text, charIndex),
+		column: colAt(text, charIndex)
 	};
 }
 function lastIdentifierText(node) {
@@ -6802,8 +7090,7 @@ function isCsTestAttribute(node) {
 	if (node.type !== "attribute") return false;
 	const nameNode = node.childForFieldName("name");
 	if (!nameNode) return false;
-	const last = lastIdentifierText(nameNode);
-	return last !== void 0 && CS_TEST_ATTRIBUTES.has(last);
+	return CS_TEST_ATTRIBUTES.has(lastIdentifierText(nameNode) ?? "");
 }
 /**
 * Every method declaration carrying a `[Test]`/`[Fact]`/`[TestMethod]`
@@ -6855,8 +7142,7 @@ function isInvocation(node) {
 function callName(node) {
 	if (node.type === "method_invocation") {
 		const nameNode = node.childForFieldName("name");
-		if (!nameNode) return void 0;
-		return lastIdentifierText(nameNode);
+		return nameNode ? lastIdentifierText(nameNode) : void 0;
 	}
 	if (node.type === "invocation_expression") {
 		const fn = node.childForFieldName("function");
@@ -6890,7 +7176,7 @@ function invocationsWithin(node) {
 	const out = [];
 	const visit = (n) => {
 		if (isInvocation(n)) out.push(n);
-		for (const child of n.namedChildren) visit(child);
+		for (const child of n.namedChildren) if (child) visit(child);
 	};
 	visit(node);
 	return out;
@@ -7017,7 +7303,7 @@ const pyRaisesWithoutMatch = defineRule({
 		const findings = [];
 		if (!ctx.path.endsWith(".py")) return findings;
 		const tree = getPythonTree(ctx.ast);
-		if (tree) return astArm$1(ctx, tree);
+		if (tree) return astArm(ctx, tree);
 		const text = ctx.codeText ?? ctx.text;
 		const re = /pytest\.raises\s*\(/g;
 		let m;
@@ -7082,7 +7368,7 @@ function matchParen$1(text, open) {
 * Broad root types (Exception/BaseException/…Group) always fire — the
 * type alone pins nothing.
 */
-function astArm$1(ctx, tree) {
+function astArm(ctx, tree) {
 	const raw = ctx.text;
 	const findings = [];
 	for (const block of pythonWithRaisesBlocks(tree)) {
@@ -7793,6 +8079,7 @@ const pwGlobalSetupSharedState = defineRule({
 	},
 	detectionNotes: "regex heuristic",
 	introduced: "0.3.0",
+	detectorRevision: 2,
 	run(ctx) {
 		const text = ctx.text;
 		const findings = [];
@@ -7800,6 +8087,7 @@ const pwGlobalSetupSharedState = defineRule({
 		const re = /(?:execSync|exec|spawn|query|request)\s*\(\s*[`'"][^`'"]*(?:migrate|migration|seed|TRUNCATE|DROP\s+(?:TABLE|DATABASE)|DELETE\s+FROM)[^`'"]*[`'"]/gi;
 		let m;
 		while ((m = re.exec(text)) !== null) {
+			if (isMasked(ctx, m.index)) continue;
 			const lineStart = text.lastIndexOf("\n", m.index) + 1;
 			const lineEnd = text.indexOf("\n", m.index);
 			const prevLineStart = text.lastIndexOf("\n", lineStart - 2) + 1;
@@ -8343,8 +8631,8 @@ const pwLocatorNormalize = defineRule({
 	autofix: false,
 	detectionStrategy: "LEXICAL",
 	strategyJustification: {
-		reasonCode: "string-content-defect",
-		detail: "CSS/XPath string selectors are string-argument shapes (css=/xpath= engines, bare id/class/attr CSS, nth-child); the detector classifies the string shapes directly"
+		reasonCode: "lexical-artifact",
+		detail: "CSS/XPath string selectors in locator()/waitForSelector() calls and raw page.$/page.$$ handles detected via regex on the raw text view"
 	},
 	detectionNotes: "string-selector shapes (css=/xpath= engines, bare id/class/attr CSS, nth-child) inside .locator()/waitForSelector()/page.$ APIs, on the RAW text view (the selector text lives inside string literals, which the code-only view blanks)",
 	introduced: "0.6.0",
@@ -8407,75 +8695,32 @@ const pwCodegenArtifact = defineRule({
 	detectionStrategy: "LEXICAL",
 	strategyJustification: {
 		reasonCode: "lexical-artifact",
-		detail: "the codegen recorder's default title ('test', 'test 1', …) committed is a recording artifact — the default-title string is the finding; the detector matches the recorder's exact title shapes"
+		detail: "codegen recorder's default test title ('test', 'test 1', …) committed verbatim — the regex matches the literal title string on the RAW text view"
 	},
 	detectionNotes: "the codegen recorder's default test title ('test', 'test 1', 'test 2', …) committed verbatim, on the RAW text view (the title is a string literal)",
 	introduced: "0.6.0",
 	tier: "quarantine",
 	detectorRevision: 2,
 	run(ctx) {
-		const sourceFile = getTsSourceFile(ctx.ast);
-		if (sourceFile) return astArm(ctx, sourceFile);
-		return regexArm(ctx);
-	}
-});
-/** The rev-1 raw-text detector — the parse-or-fallback path (§10.1). */
-function regexArm(ctx) {
-	const text = ctx.text;
-	const findings = [];
-	const re = new RegExp(CODEGEN_DEFAULT_TITLE_RE$1.source, "g");
-	let m;
-	while ((m = re.exec(text)) !== null) findings.push({
-		severity: "info",
-		confidence: "medium",
-		findingType: "observation",
-		qaImpact: "HYGIENE",
-		file: ctx.path,
-		line: lineAt(text, m.index),
-		column: colAt(text, m.index),
-		message: `Codegen default test title (${m[0].replace(/\s+/g, " ").trim()}) — an unreviewed recording artifact.`,
-		why: WHY$7,
-		fix: FIX$6
-	});
-	return findings;
-}
-/**
-* AST arm (detectorRevision 2 — P6 final attempt): only REAL test/it
-* CallExpressions with a default-title StringLiteral fire. The
-* adjudicated FP class — `test('test', …)` written as a synthetic code
-* string inside unit tests of lint rules — is code-as-data: the parser
-* sees it as a string VALUE, never as a CallExpression, so it cannot
-* fire here.
-*/
-function astArm(ctx, sourceFile) {
-	const findings = [];
-	const calls = sourceFile.getDescendantsOfKind(ts.SyntaxKind.CallExpression).filter((c) => {
-		const expr = c.getExpression();
-		if (expr.getKind() !== ts.SyntaxKind.Identifier) return false;
-		const name = expr.getText();
-		return name === "test" || name === "it";
-	});
-	for (const call of calls) {
-		const firstArg = call.getArguments()[0];
-		if (!firstArg || firstArg.getKind() !== ts.SyntaxKind.StringLiteral) continue;
-		const title = firstArg.getText().slice(1, -1);
-		if (!/^test(?:\s+\d+)?$/.test(title)) continue;
-		const pos = call.getStart();
-		findings.push({
+		const text = ctx.text;
+		const findings = [];
+		const re = new RegExp(CODEGEN_DEFAULT_TITLE_RE$1.source, "g");
+		let m;
+		while ((m = re.exec(text)) !== null) findings.push({
 			severity: "info",
 			confidence: "medium",
 			findingType: "observation",
 			qaImpact: "HYGIENE",
 			file: ctx.path,
-			line: sourceFile.getLineAndColumnAtPos(pos).line,
-			column: sourceFile.getLineAndColumnAtPos(pos).column,
-			message: `Codegen default test title (test declaration titled "${title}") — an unreviewed recording artifact.`,
+			line: lineAt(text, m.index),
+			column: colAt(text, m.index),
+			message: `Codegen default test title (${m[0].replace(/\s+/g, " ").trim()}) — an unreviewed recording artifact.`,
 			why: WHY$7,
 			fix: FIX$6
 		});
+		return findings;
 	}
-	return findings;
-}
+});
 //#endregion
 //#region src/rules/python/qa-py-101-sync-async-mix.ts
 /**
@@ -8849,7 +9094,17 @@ function matchBrace$1(text, open) {
 			else if (ch === inStr) inStr = null;
 			continue;
 		}
-		if (ch === "\"") inStr = ch;
+		if (ch === "/" && text[i + 1] === "/") {
+			const nl = text.indexOf("\n", i);
+			i = nl === -1 ? text.length - 1 : nl;
+			continue;
+		}
+		if (ch === "/" && text[i + 1] === "*") {
+			const end = text.indexOf("*/", i + 2);
+			i = end === -1 ? text.length - 1 : end + 1;
+			continue;
+		}
+		if (ch === "\"" || ch === "'") inStr = ch;
 		else if (ch === "{") depth++;
 		else if (ch === "}") {
 			depth--;
@@ -8870,7 +9125,11 @@ function extractQaModel(file) {
 	if (file.path.endsWith(".java")) return extractJavaModel(file);
 	if (file.path.endsWith(".cs")) return extractCSharpModel(file);
 	if (file.path.endsWith(".py")) return extractPythonModel(file);
-	if (/\.[cm]?[jt]sx?$/.test(file.path)) return extractTsModel(file, parseTsFile(file));
+	if (/\.[cm]?[jt]sx?$/.test(file.path)) {
+		const sf = parseTsFile(file);
+		if (!sf) return void 0;
+		return extractTsModel(file, sf);
+	}
 }
 function pos(text, index) {
 	return {
@@ -8921,18 +9180,16 @@ function extractJavaModel(file) {
 		truncated: test.body.hasError
 	});
 	for (const decl of tree.rootNode.descendantsOfType("method_declaration")) {
+		if (!decl) continue;
 		const modifiers = decl.childForFieldName("modifiers") ?? decl.children[0];
 		if (!modifiers || modifiers.type !== "modifiers") continue;
-		const body = decl.childForFieldName("body");
-		if (!body) continue;
 		const nameNode = decl.childForFieldName("name");
-		if (!nameNode) continue;
+		const body = decl.childForFieldName("body");
+		if (!nameNode || !body) continue;
 		for (const annotation of javaAnnotationNames(modifiers)) {
 			if (JAVA_HOOK_ANNOTATIONS.has(annotation)) {
-				let concept = "setup";
-				if (annotation.startsWith("After")) concept = "teardown";
 				nodes.push({
-					concept,
+					concept: annotation.startsWith("After") ? "teardown" : "setup",
 					name: nameNode.text,
 					start: pos(text, decl.startIndex),
 					end: pos(text, body.endIndex),
@@ -8992,10 +9249,10 @@ function extractCSharpModel(file) {
 		truncated: test.body.hasError
 	});
 	for (const decl of tree.rootNode.descendantsOfType("method_declaration")) {
-		const body = decl.childForFieldName("body");
-		if (!body) continue;
+		if (!decl) continue;
 		const nameNode = decl.childForFieldName("name");
-		if (!nameNode) continue;
+		const body = decl.childForFieldName("body");
+		if (!nameNode || !body) continue;
 		let attr;
 		for (const child of decl.children) {
 			if (child?.type !== "attribute_list") continue;
@@ -9014,12 +9271,8 @@ function extractCSharpModel(file) {
 			if (attr) break;
 		}
 		if (!attr) continue;
-		let concept;
-		if (attr.includes("TearDown") || attr.includes("Cleanup")) concept = "teardown";
-		else if (CS_RETRY_ATTRIBUTES.has(attr)) concept = "retry";
-		else concept = "setup";
 		nodes.push({
-			concept,
+			concept: attr.includes("TearDown") || attr.includes("Cleanup") ? "teardown" : CS_RETRY_ATTRIBUTES.has(attr) ? "retry" : "setup",
 			name: nameNode.text,
 			start: pos(text, decl.startIndex),
 			end: pos(text, body.endIndex),
@@ -9028,12 +9281,12 @@ function extractCSharpModel(file) {
 	}
 	nodes.push(...javaCSharpCallNodes(tree, text, CS_CALLEE_CONCEPTS));
 	for (const throwStmt of tree.rootNode.descendantsOfType("throw_statement")) {
+		if (!throwStmt) continue;
 		const creation = throwStmt.namedChildren.find((c) => c?.type === "object_creation_expression");
 		if (!creation) continue;
-		const typeNode = creation.childForFieldName("type");
-		if (!typeNode) continue;
-		const typeName = typeNode.text;
-		if (/assert/i.test(typeName) && /exception/i.test(typeName)) nodes.push({
+		const typeName = creation.childForFieldName("type")?.text ?? "";
+		if (!/assert/i.test(typeName) || !/exception/i.test(typeName)) continue;
+		nodes.push({
 			concept: "assertion",
 			name: typeName,
 			callee: typeName,
@@ -9104,7 +9357,6 @@ const JAVA_CALLEE_CONCEPTS = {
 */
 const CS_CALLEE_CONCEPTS = {
 	exact: {
-		expect: "assertion",
 		Expect: "assertion",
 		GotoAsync: "navigation",
 		GoToAsync: "navigation",
@@ -9180,17 +9432,16 @@ function javaCSharpCallNodes(tree, text, table) {
 			}
 		}
 		if (concept === void 0) continue;
-		const node = {
+		nodes.push({
 			concept,
 			name: callee,
 			callee,
+			...receiver !== void 0 ? { receiver } : {},
 			start: pos(text, call.startIndex),
 			end: pos(text, call.endIndex),
 			text: call.text,
 			ancestors: ancestorCallNames(call)
-		};
-		if (receiver !== void 0) node.receiver = receiver;
-		nodes.push(node);
+		});
 	}
 	return nodes;
 }
@@ -9280,8 +9531,7 @@ function extractTsModel(file, sf) {
 	const nodes = [];
 	for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
 		const chain = calleeChainText(call.getExpression());
-		const parts = chain.split(".");
-		const base = parts[parts.length - 1];
+		const base = chain.split(".").pop() ?? chain;
 		const start = pos(text, call.getStart());
 		const end = pos(text, call.getEnd());
 		if (TS_TEST_CALLEE_RE.test(chain)) {
@@ -9299,13 +9549,12 @@ function extractTsModel(file, sf) {
 		const hook = TS_HOOK_CONCEPTS[base];
 		if (hook && /(?:^|\.)(?:beforeEach|beforeAll|afterEach|afterAll)$/.test(chain)) {
 			const callback = call.getArguments().find((a) => a.getKindName().includes("Function"));
-			const node = {
+			nodes.push({
 				concept: hook,
 				name: chain,
-				start
-			};
-			if (callback) node.end = pos(text, callback.getEnd());
-			nodes.push(node);
+				start,
+				...callback ? { end: pos(text, callback.getEnd()) } : {}
+			});
 			continue;
 		}
 		if (/^describe(?:\.\w+)*\.serial$/.test(chain) || /\.describe\.serial/.test(chain)) {
@@ -9318,9 +9567,8 @@ function extractTsModel(file, sf) {
 			continue;
 		}
 		const receiverParts = chain.split(".");
-		const name = receiverParts[receiverParts.length - 1];
-		let receiver;
-		if (receiverParts.length > 1) receiver = receiverParts.slice(0, -1).join(".");
+		const name = receiverParts.at(-1) ?? chain;
+		const receiver = receiverParts.length > 1 ? receiverParts.slice(0, -1).join(".") : void 0;
 		let concept = TS_CALLEE_CONCEPTS.exact[name];
 		if (concept === void 0) {
 			for (const p of TS_CALLEE_CONCEPTS.prefixes) if (p.test(name)) {
@@ -9328,23 +9576,21 @@ function extractTsModel(file, sf) {
 				break;
 			}
 		}
+		if (concept === void 0 && receiver !== void 0 && /^(?:jest|vi)$/.test(receiver) && (name === "mock" || name === "fn" || name === "spyOn" || name === "retryTimes")) concept = name === "retryTimes" ? "retry" : "mock";
 		if (concept === void 0) continue;
-		const node = {
+		nodes.push({
 			concept,
 			name,
 			callee: name,
+			...receiver !== void 0 ? { receiver } : {},
 			start,
 			end,
 			text: call.getText(),
 			awaited: isAwaitedTsCall(call)
-		};
-		if (receiver !== void 0) node.receiver = receiver;
-		nodes.push(node);
+		});
 	}
-	let language = "javascript";
-	if (/\.[cm]?ts$/.test(file.path) || /\.tsx$/.test(file.path)) language = "typescript";
 	return {
-		language,
+		language: /(?:^|\.)tsx?$/.test(file.path) ? "typescript" : "javascript",
 		nodes
 	};
 }
@@ -9379,8 +9625,9 @@ function extractPythonModel(file) {
 	const text = file.text;
 	const nodes = [];
 	const push = (concept, m, name) => {
-		const node = {
+		nodes.push({
 			concept,
+			...name !== void 0 ? { name } : {},
 			start: {
 				index: m.index,
 				line: lineAt(text, m.index),
@@ -9392,9 +9639,7 @@ function extractPythonModel(file) {
 				column: colAt(text, m.index + m[0].length)
 			},
 			text: m[0]
-		};
-		if (name !== void 0) node.name = name;
-		nodes.push(node);
+		});
 	};
 	for (const re of [
 		PY_TEST_RE,
@@ -9405,13 +9650,7 @@ function extractPythonModel(file) {
 	]) {
 		re.lastIndex = 0;
 		let m;
-		while ((m = re.exec(text)) !== null) {
-			let concept = "assertion";
-			if (re === PY_TEST_RE) concept = "test";
-			else if (re === PY_FIXTURE_RE) concept = "fixture";
-			else if (re === PY_WAIT_RE) concept = "wait";
-			push(concept, m, re === PY_TEST_RE ? m[2] : void 0);
-		}
+		while ((m = re.exec(text)) !== null) push(re === PY_TEST_RE ? "test" : re === PY_FIXTURE_RE ? "fixture" : re === PY_WAIT_RE ? "wait" : "assertion", m, re === PY_TEST_RE ? m[2] : void 0);
 	}
 	return {
 		language: "python",
@@ -9749,7 +9988,17 @@ function matchBrace(text, open) {
 			else if (ch === inStr) inStr = null;
 			continue;
 		}
-		if (ch === "\"") inStr = ch;
+		if (ch === "/" && text[i + 1] === "/") {
+			const nl = text.indexOf("\n", i);
+			i = nl === -1 ? text.length - 1 : nl;
+			continue;
+		}
+		if (ch === "/" && text[i + 1] === "*") {
+			const end = text.indexOf("*/", i + 2);
+			i = end === -1 ? text.length - 1 : end + 1;
+			continue;
+		}
+		if (ch === "\"" || ch === "'") inStr = ch;
 		else if (ch === "{") depth++;
 		else if (ch === "}") {
 			depth--;
@@ -9887,8 +10136,8 @@ const cypCyWait = defineRule({
 	autofix: false,
 	detectionStrategy: "LEXICAL",
 	strategyJustification: {
-		reasonCode: "runner-semantic",
-		detail: "cy.wait(numeric) is a Cypress runner wait contract; the detector matches the member-call token with a numeric-literal argument on the code-only text — alias waits (cy.wait('@…')) are structurally distinct and excluded by the argument shape"
+		reasonCode: "lexical-artifact",
+		detail: "cy.wait with a numeric-literal argument only — alias waits (cy.wait('@…')) are the legitimate routed-request form and never fire"
 	},
 	detectionNotes: "cy.wait with a numeric-literal argument only — alias waits (cy.wait('@…')) are the legitimate routed-request form and never fire",
 	introduced: "0.6.0",
@@ -9896,7 +10145,7 @@ const cypCyWait = defineRule({
 	detectorRevision: 1,
 	run(ctx) {
 		if (!isCypressFile(ctx)) return [];
-		const text = ctx.codeText !== void 0 ? ctx.codeText : ctx.text;
+		const text = ctx.codeText ?? ctx.text;
 		const findings = [];
 		const re = new RegExp(CY_WAIT_NUMBER_RE.source, "g");
 		let m;
@@ -9963,8 +10212,8 @@ const cypFocusedTest = defineRule({
 	autofix: false,
 	detectionStrategy: "LEXICAL",
 	strategyJustification: {
-		reasonCode: "runner-semantic",
-		detail: "Cypress .only is the runner's focus token; the detector matches the it/describe/context .only member-call shape on the code-only text — exact-key precision"
+		reasonCode: "lexical-artifact",
+		detail: "Cypress .only() is a lexical modifier — the regex matches the literal `.only(` call target in source text"
 	},
 	detectionNotes: "it/describe/context .only member-call shape on the code-only text view",
 	introduced: "0.6.0",
@@ -9972,7 +10221,7 @@ const cypFocusedTest = defineRule({
 	detectorRevision: 1,
 	run(ctx) {
 		if (!isCypressFile(ctx)) return [];
-		const text = ctx.codeText !== void 0 ? ctx.codeText : ctx.text;
+		const text = ctx.codeText ?? ctx.text;
 		const findings = [];
 		const re = new RegExp(FOCUS_RE.source, "g");
 		let m;
@@ -10033,15 +10282,15 @@ const cypConfigSecurity = defineRule({
 	autofix: false,
 	detectionStrategy: "LEXICAL",
 	strategyJustification: {
-		reasonCode: "exact-key-match",
-		detail: "chromeWebSecurity:false is an exact config key/value pair inside cypress.config.*; the detector matches the key and value literally — the config surface's statements are the finding"
+		reasonCode: "string-content-defect",
+		detail: "chromeWebSecurity:false in cypress.config is a string-content match in the config file — the regex detects the boolean literal"
 	},
 	detectionNotes: "positive match on chromeWebSecurity:false inside cypress.config.* (the config is the artifact — no heuristic)",
 	introduced: "0.6.0",
 	tier: "quarantine",
 	detectorRevision: 1,
 	run(ctx) {
-		const base = ctx.path.replace(/\\/g, "/").split("/").pop();
+		const base = ctx.path.replace(/\\/g, "/").split("/").pop() ?? "";
 		if (!CYPRESS_CONFIG_RE.test(base)) return [];
 		const text = ctx.text;
 		const findings = [];
@@ -10128,7 +10377,7 @@ function sleepBeforeLookup(ctx, sleepRe, lookupRe, id) {
 	return findings;
 }
 const JAVA_SLEEP_RE = /\bThread\.sleep\s*\([^)]*\)/;
-const JAVA_LOOKUP_RE = /\bdriver\.findElement|\.\s*sendKeys\s*\(|\.\s*click\s*\(|\.\s*clear\s*\(|findElement\s*\(/;
+const JAVA_LOOKUP_RE = /\bdriver\.findElement|\bdriver\.findElements|\.\s*sendKeys\s*\(|\.\s*click\s*\(|\.\s*clear\s*\(|findElement\s*\(/;
 const seJavaSleepLookup = defineRule({
 	id: "QA-SE-001",
 	category: "QA-PW",
@@ -10144,8 +10393,8 @@ const seJavaSleepLookup = defineRule({
 	autofix: false,
 	detectionStrategy: "LEXICAL",
 	strategyJustification: {
-		reasonCode: "runner-semantic",
-		detail: "the Selenium family's variants (QA-SE-001/002/003): the defect is the SEQUENCE sleep-then-interact — runner timing semantics, not a single node; the detector matches the sleep token followed by a lookup within the recorded window"
+		reasonCode: "lexical-artifact",
+		detail: "sleep-then-lookup sequence: Thread.sleep/Thread.Sleep/time.sleep regex match followed by findElement/FindElement/find_element within 3 lines on code-only view"
 	},
 	detectionNotes: "sequence shape: Thread.sleep followed by a findElement/interaction call within 3 lines (code-only view)",
 	introduced: "0.6.0",
@@ -10157,7 +10406,7 @@ const seJavaSleepLookup = defineRule({
 	}
 });
 const CS_SLEEP_RE = /\b(?:Thread\.Sleep|Task\.Delay)\s*\([^)]*\)/;
-const CS_LOOKUP_RE = /\bdriver\.FindElement|\.\s*SendKeys\s*\(|\.\s*Click\s*\(|\.\s*Clear\s*\(|FindElement\s*\(/;
+const CS_LOOKUP_RE = /\bdriver\.FindElement|\bdriver\.FindElements|\.\s*SendKeys\s*\(|\.\s*Click\s*\(|\.\s*Clear\s*\(|FindElement\s*\(/;
 const seCSharpSleepLookup = defineRule({
 	id: "QA-SE-002",
 	category: "QA-PW",
@@ -10173,8 +10422,8 @@ const seCSharpSleepLookup = defineRule({
 	autofix: false,
 	detectionStrategy: "LEXICAL",
 	strategyJustification: {
-		reasonCode: "runner-semantic",
-		detail: "the Selenium family's variants (QA-SE-001/002/003): the defect is the SEQUENCE sleep-then-interact — runner timing semantics, not a single node; the detector matches the sleep token followed by a lookup within the recorded window"
+		reasonCode: "lexical-artifact",
+		detail: "sleep-then-lookup sequence: Thread.sleep/Thread.Sleep/time.sleep regex match followed by findElement/FindElement/find_element within 3 lines on code-only view"
 	},
 	detectionNotes: "sequence shape: Thread.Sleep/Task.Delay followed by a FindElement/interaction call within 3 lines (code-only view)",
 	introduced: "0.6.0",
@@ -10186,7 +10435,7 @@ const seCSharpSleepLookup = defineRule({
 	}
 });
 const PY_SLEEP_RE = /\btime\.sleep\s*\([^)]*\)/;
-const PY_LOOKUP_RE = /\bdriver\.find_element|\.find_element\s*\(|\.find_elements\s*\(|\.send_keys\s*\(|\.click\s*\(|\.clear\s*\(/;
+const PY_LOOKUP_RE = /\bdriver\.find_element|\bdriver\.find_elements|\.find_element\s*\(|\.find_elements\s*\(|\.send_keys\s*\(|\.click\s*\(|\.clear\s*\(/;
 const sePythonSleepLookup = defineRule({
 	id: "QA-SE-003",
 	category: "QA-PW",
@@ -10202,8 +10451,8 @@ const sePythonSleepLookup = defineRule({
 	autofix: false,
 	detectionStrategy: "LEXICAL",
 	strategyJustification: {
-		reasonCode: "runner-semantic",
-		detail: "the Selenium family's variants (QA-SE-001/002/003): the defect is the SEQUENCE sleep-then-interact — runner timing semantics, not a single node; the detector matches the sleep token followed by a lookup within the recorded window"
+		reasonCode: "lexical-artifact",
+		detail: "sleep-then-lookup sequence: Thread.sleep/Thread.Sleep/time.sleep regex match followed by findElement/FindElement/find_element within 3 lines on code-only view"
 	},
 	detectionNotes: "sequence shape: time.sleep followed by a find_element/interaction call within 3 lines (code-only view)",
 	introduced: "0.6.0",
@@ -10917,6 +11166,10 @@ const RULES = [
 	seCSharpSleepLookup,
 	sePythonSleepLookup
 ];
+/**
+* Look up a rule by its ID in the active registry.
+* Returns undefined if the ID is not found (including retired IDs).
+*/
 function getRule(id) {
 	return RULES.find((r) => r.id === id);
 }
@@ -11149,6 +11402,58 @@ function enforceTierPolicy(findings, tierByRuleId) {
 	}
 }
 //#endregion
+//#region src/engine/evidence-core.ts
+/**
+* The core's own version — stamped into every record's provenance so a
+* consumer can tell which normalization contract produced a record.
+* Bump ONLY on a semantic change to the normalization itself.
+*/
+const EVIDENCE_CORE_VERSION = "evidence-core@1";
+/** Deterministic canonical order: file → line (absent last) → title → source. */
+function compareEvidenceRecords(a, b) {
+	if (a.file !== b.file) return a.file < b.file ? -1 : 1;
+	const la = a.line ?? Number.POSITIVE_INFINITY;
+	const lb = b.line ?? Number.POSITIVE_INFINITY;
+	if (la !== lb) return la - lb;
+	if (a.title !== b.title) return a.title < b.title ? -1 : 1;
+	if (a.source !== b.source) return a.source < b.source ? -1 : 1;
+	return 0;
+}
+function normalizeOne(report, artifact, v) {
+	const last = v.attempts > 0 ? v.finalStatus : "skipped";
+	return {
+		source: report.source,
+		artifact,
+		file: v.file,
+		title: v.title,
+		...v.line !== void 0 ? { line: v.line } : {},
+		status: {
+			final: last,
+			failed: v.everFailed,
+			retried: v.attempts > 1,
+			passedOnRetry: v.passedOnRetry,
+			skipped: v.skipped,
+			timedOut: v.finalStatus === "timedOut"
+		},
+		attempts: v.attempts,
+		durationMs: v.totalDurationMs,
+		errors: [],
+		attachments: [],
+		provenance: {
+			core: EVIDENCE_CORE_VERSION,
+			ingest: "mjolnir.forensics"
+		}
+	};
+}
+/**
+* Normalize a forensics report into deterministically-ordered evidence
+* records. The same report + artifact identity ALWAYS produces the same
+* record list — report verdict order never leaks into the output.
+*/
+function buildEvidenceRecords(report, artifact) {
+	return report.verdicts.map((v) => normalizeOne(report, artifact, v)).sort(compareEvidenceRecords);
+}
+//#endregion
 //#region src/engine/provenance.ts
 const GENERATED_HEADER_RE = /^\s*(?:\/\/|#|\/\*)\s*(?:auto[- ]?generated|generated by|do not edit)/i;
 /**
@@ -11250,6 +11555,7 @@ function isDeclaredByPresent(f, present, metaByRuleId) {
 	for (const g of present) {
 		if (g === f || g.ruleId === f.ruleId) continue;
 		if (!metaByRuleId.get(g.ruleId)?.overlapWith?.includes(f.ruleId)) continue;
+		if (f.column === void 0 || g.column === void 0) continue;
 		if (Math.abs(g.column - f.column) > MAX_SAME_ROOT_COLUMN_DELTA) continue;
 		return true;
 	}
@@ -11283,69 +11589,486 @@ function ranksBefore(a, b, metaByRuleId) {
 function dropOrderBefore(a, b, metaByRuleId) {
 	if (ranksBefore(a, b, metaByRuleId)) return false;
 	if (ranksBefore(b, a, metaByRuleId)) return true;
-	return a.column < b.column;
+	return (a.column ?? Number.MAX_SAFE_INTEGER) < (b.column ?? Number.MAX_SAFE_INTEGER);
 }
 //#endregion
-//#region src/engine/scan-cache.ts
+//#region src/engine/correlation-engine.ts
+const EVIDENCE_RANK = {
+	E0: 0,
+	E1: 1,
+	E2: 2
+};
+function bestEvidence(findings) {
+	let best = "E0";
+	for (const f of findings) {
+		const level = f.evidenceLevel ?? "E0";
+		if (EVIDENCE_RANK[level] > EVIDENCE_RANK[best]) best = level;
+	}
+	return best;
+}
+function hasRuntimeCorroboration(findings) {
+	return findings.some((f) => f.runtimeCorroboration !== void 0);
+}
 /**
-* Local incremental scan cache (Beta-to-Stable 1.0 plan, M5.2 / A-2).
-*
-* Content-addressed, local-only verdict cache: `--cache` reuses the
-* per-file rule outputs of a previous scan when the file's bytes AND the
-* active rule set are unchanged, and invalidates everything else. The
-* key is `sha256(fileText) + rulesDigest` + the file's own identity
-* (repo-relative path + adapter id + parse mode — audit C1/W9), where
-* the rules digest folds
-* in every active rule's id + `detectorRevision ?? 1` (the existing
-* stale-measurement machinery — Verification Trust Evolution Plan §07 —
-* reused as the cache invalidation signal, per A-2) plus a source hash
-* of each external plugin/local rule's `run` function, so a plugin that
-* changes code without bumping its revision still misses.
-*
-* Privacy posture: the cache lives under `<repo>/.mjolnir/cache/`, is
-* gitignored, never leaves the machine, and this module performs zero
-* network I/O — fs and crypto only (asserted by the privacy spec).
+* Determine the correlation strength for a group of findings.
 *
-* Only raw rule-loop outputs are cached. Everything after the loop
-* (severity overrides, suppressions, overlap dedup, evidence stamping,
-* tier policy, runtime corroboration, scoring) re-runs on every scan,
-* so a cached scan is byte-equivalent to a fresh one by construction.
+* TI-009: E1+E1+E1 ≠ E2. Multiple weak findings SUPPORT but never
+* STRONG. Only E2 or runtime corroboration yields STRONG.
 */
-const CACHE_VERSION = 2;
-/** Entry cap: a monorepo-scale suite stays far below this; bounded file. */
-const MAX_ENTRIES = 4096;
+function correlationStrength(findings) {
+	const best = bestEvidence(findings);
+	if (hasRuntimeCorroboration(findings)) return "STRONG";
+	if (best === "E2") return "STRONG";
+	if (best === "E1" && findings.length > 1) return "SUPPORTING";
+	if (best === "E1") return "SUPPORTING";
+	return "NONE";
+}
 /**
-* Audit M5: total byte budget. The old cap counted only ENTRIES, so
-* 4096 files × ~100KB of findings each could still produce a
-* multi-hundred-MB writeFileSync on persist. The budget bounds the
-* serialized size; the newest entries win (real LRU-by-use).
+* Group findings by file to detect file-level convergence.
 */
-const MAX_TOTAL_BYTES = 33554432;
-/** sha256 hex of a string — the only hash this module needs. */
-function sha256(text) {
-	return createHash("sha256").update(text).digest("hex");
+function groupByFile(findings) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const f of findings) {
+		const list = groups.get(f.file) ?? [];
+		list.push(f);
+		groups.set(f.file, list);
+	}
+	return groups;
 }
 /**
-* Digest of the active rule set: id + effective detectorRevision for
-* every rule (sorted for determinism), plus a source hash per rule's
-* `run` function. Any detector change — revision bump OR code edit —
-* produces a different digest, invalidating every cached entry. Takes a
-* structural subset on purpose: only these three fields feed the key.
+* Group findings by rootCauseId (or ruleId when rootCauseId is absent)
+* to detect convergent findings pointing at the same root cause.
 */
-function computeRulesDigest(rules) {
-	return sha256(rules.map((r) => `${r.id}:${r.detectorRevision ?? 1}:${sha256(String(r.run)).slice(0, 12)}`).sort().join("|"));
+function groupByRootCause(findings) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const f of findings) {
+		const key = f.rootCauseId ?? f.ruleId;
+		const list = groups.get(key) ?? [];
+		list.push(f);
+		groups.set(key, list);
+	}
+	return groups;
 }
 /**
-* Content-addressed key for one file's rule-loop verdicts.
-*
-* Audit C1: the key MUST identify the verdict's producer, not just the
-* bytes — two files with byte-identical text (a copied spec, a generated
-* snapshot) previously shared one entry, and the first file's cached
-* findings were re-emitted for the second with the wrong `file` stamp.
-* The key therefore folds in the repo-relative path AND the adapter id,
-* plus a parse-mode token (audit W9): a file whose analysis degraded to
-* the regex fallback (or skipped the AST path) must not collide with a
-* fully-AST-analyzed verdict for the same bytes — the fallback output
+* Correlate findings and produce conclusions WITHOUT modifying them.
+* Deterministic — same input always produces same output.
+*/
+function correlateFindings(findings) {
+	const conclusions = [];
+	const rootCauseGroups = groupByRootCause(findings);
+	for (const [rootCause, group] of Array.from(rootCauseGroups.entries()).sort((a, b) => a[0].localeCompare(b[0]))) {
+		if (group.length < 2) continue;
+		const findingIds = group.map((f) => f.findingId ?? f.ruleId);
+		conclusions.push({
+			conclusionType: "CONVERGENT",
+			certainty: correlationStrength(group),
+			corroboration: `${group.length} findings share root cause ${rootCause}`,
+			sourceCount: group.length,
+			findingIds
+		});
+	}
+	const fileGroups = groupByFile(findings);
+	for (const [file, group] of Array.from(fileGroups.entries()).sort((a, b) => a[0].localeCompare(b[0]))) {
+		if (group.length < 2) continue;
+		const alreadyConvergent = /* @__PURE__ */ new Set();
+		for (const c of conclusions) if (c.conclusionType === "CONVERGENT") for (const id of c.findingIds) alreadyConvergent.add(id);
+		const novel = group.filter((f) => !alreadyConvergent.has(f.findingId ?? f.ruleId));
+		if (novel.length < 2) continue;
+		const findingIds = novel.map((f) => f.findingId ?? f.ruleId);
+		conclusions.push({
+			conclusionType: "AMPLIFIED",
+			certainty: correlationStrength(novel),
+			corroboration: `${novel.length} findings in ${file}`,
+			sourceCount: novel.length,
+			findingIds
+		});
+	}
+	const corroborated = findings.filter((f) => f.runtimeCorroboration !== void 0);
+	if (corroborated.length > 0) conclusions.push({
+		conclusionType: "CORROBORATED",
+		certainty: "STRONG",
+		corroboration: `${corroborated.length} finding(s) with runtime corroboration`,
+		sourceCount: corroborated.length,
+		findingIds: corroborated.map((f) => f.findingId ?? f.ruleId)
+	});
+	return conclusions;
+}
+//#endregion
+//#region src/engine/dependency-graph.ts
+/**
+* Dependency Graph (ECO-005).
+*
+* Parses package manifests (package.json, pyproject.toml, pom.xml) to
+* build a dependency graph. Supports transitive dependency resolution,
+* dependent lookup, and reachable-file computation from test files.
+*/
+var DependencyGraph = class {
+	nodes = /* @__PURE__ */ new Map();
+	addNode(node) {
+		this.nodes.set(node.path, {
+			path: node.path,
+			dependencies: [...node.dependencies]
+		});
+	}
+	getDependencies(path) {
+		return this.nodes.get(path)?.dependencies ?? [];
+	}
+	getTransitiveDependencies(path) {
+		const visited = /* @__PURE__ */ new Set();
+		const stack = [path];
+		while (stack.length > 0) {
+			const current = stack.pop();
+			if (current === void 0) continue;
+			if (visited.has(current)) continue;
+			visited.add(current);
+			const node = this.nodes.get(current);
+			if (node) {
+				for (const dep of node.dependencies) if (!visited.has(dep)) stack.push(dep);
+			}
+		}
+		visited.delete(path);
+		return [...visited].sort();
+	}
+	getDependents(path) {
+		const dependents = [];
+		for (const [key, node] of this.nodes) if (node.dependencies.includes(path)) dependents.push(key);
+		return dependents.sort();
+	}
+	get allPaths() {
+		return [...this.nodes.keys()].sort();
+	}
+	get size() {
+		return this.nodes.size;
+	}
+};
+function parsePackageJson(filePath) {
+	if (!existsSync(filePath)) return void 0;
+	try {
+		const raw = readFileSync(filePath, "utf8");
+		const pkg = JSON.parse(raw);
+		return {
+			path: filePath,
+			dependencies: [...Object.keys(pkg["dependencies"] ?? {}), ...Object.keys(pkg["devDependencies"] ?? {})]
+		};
+	} catch {
+		return;
+	}
+}
+function parsePyprojectToml(filePath) {
+	if (!existsSync(filePath)) return void 0;
+	try {
+		const raw = readFileSync(filePath, "utf8");
+		const deps = [];
+		const depSection = raw.match(/\[project\][\s\S]*?dependencies\s*=\s*\[([\s\S]*?)\]/);
+		if (depSection?.[1]) {
+			const lines = depSection[1].split("\n");
+			for (const line of lines) {
+				const match = line.match(/^\s*"([\w-]+)/);
+				if (match?.[1]) deps.push(match[1]);
+			}
+		}
+		return {
+			path: filePath,
+			dependencies: deps
+		};
+	} catch {
+		return;
+	}
+}
+function parsePomXml(filePath) {
+	if (!existsSync(filePath)) return void 0;
+	try {
+		const raw = readFileSync(filePath, "utf8");
+		const deps = [];
+		const re = /<artifactId>([^<]+)<\/artifactId>/g;
+		let m;
+		while ((m = re.exec(raw)) !== null) if (m[1]) deps.push(m[1]);
+		return {
+			path: filePath,
+			dependencies: deps
+		};
+	} catch {
+		return;
+	}
+}
+/**
+* Build a dependency graph from project manifests. Scans for package.json,
+* pyproject.toml, and pom.xml at the project root and one level deep.
+*/
+function buildDependencyGraph(projectRoot) {
+	const graph = new DependencyGraph();
+	const manifestPatterns = [
+		"package.json",
+		"pyproject.toml",
+		"pom.xml",
+		join("packages", "*", "package.json")
+	];
+	for (const pattern of manifestPatterns) if (pattern.includes("*")) {
+		const [base, , file] = pattern.split(/[\\/]/);
+		if (base === void 0 || file === void 0) continue;
+		const baseDir = resolve(projectRoot, base);
+		if (!existsSync(baseDir)) continue;
+		try {
+			const entries = readdirSync(baseDir, { withFileTypes: true });
+			for (const entry of entries) if (entry.isDirectory()) {
+				const node = parseManifest(resolve(baseDir, entry.name, file));
+				if (node) graph.addNode(node);
+			}
+		} catch {}
+	} else {
+		const node = parseManifest(resolve(projectRoot, pattern));
+		if (node) graph.addNode(node);
+	}
+	return graph;
+}
+function parseManifest(filePath) {
+	if (filePath.endsWith("package.json")) return parsePackageJson(filePath);
+	if (filePath.endsWith("pyproject.toml")) return parsePyprojectToml(filePath);
+	if (filePath.endsWith("pom.xml")) return parsePomXml(filePath);
+}
+//#endregion
+//#region src/engine/incremental-analysis.ts
+/**
+* Semantic inputs that affect the full scan beyond individual file content.
+* If any of these changed, an incremental run is NOT safe — a full scan
+* is required for equivalence (TI-005).
+*/
+const SEMANTIC_INPUT_PATTERNS = [
+	"mjolnir.config",
+	".mjolnirignore",
+	"package.json",
+	"tsconfig",
+	"vitest.config",
+	"jest.config",
+	"playwright.config"
+];
+/**
+* Verify whether an incremental scan is safe. Returns true when ONLY
+* regular source/test files changed and no semantic config inputs were
+* touched. When false, the caller must fall back to a full scan.
+*
+* TI-005 contract: incremental safety is a prerequisite for equivalence.
+* A safe incremental run re-scans only changed files and merges their
+* results with cached verdicts for unchanged files — the aggregate must
+* match a full scan byte-for-byte.
+*/
+function isIncrementalSafe(changedFiles) {
+	const reasons = [];
+	for (const f of changedFiles) {
+		const lower = f.path.toLowerCase().replace(/\\/g, "/");
+		for (const pattern of SEMANTIC_INPUT_PATTERNS) if (lower.includes(pattern)) reasons.push(`semantic input changed: ${f.path} matches "${pattern}" pattern`);
+	}
+	return {
+		safe: reasons.length === 0,
+		reasons
+	};
+}
+//#endregion
+//#region src/engine/monorepo-analysis.ts
+const WORTHY_THRESHOLD = 80;
+const NEEDS_WORK_THRESHOLD = 50;
+function verdictOf(score) {
+	if (score === null) return "fail";
+	if (score >= WORTHY_THRESHOLD) return "pass";
+	if (score >= NEEDS_WORK_THRESHOLD) return "warn";
+	return "fail";
+}
+function hasBlocker(findings) {
+	return findings.some((f) => f.severity === "error");
+}
+/**
+* Aggregate per-package results into an overall verdict.
+*
+* Worst-package propagation: if ANY package has a blocker (error-severity
+* finding) or a failing score, the overall result fails regardless of
+* strategy. This is the safety net — a single poisoned package must not
+* hide behind averaging.
+*/
+function analyzeMonorepo(packages, config) {
+	const results = packages.map((p) => ({
+		...p,
+		verdict: hasBlocker(p.findings) ? "fail" : verdictOf(p.score)
+	}));
+	if (results.length === 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	const blockerPkg = results.find((r) => r.verdict === "fail" || hasBlocker(r.findings));
+	if (blockerPkg) return {
+		packages: results,
+		overallScore: blockerPkg.score,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy,
+		blockerPackage: blockerPkg.packageName
+	};
+	switch (config.weightingStrategy) {
+		case "worst-package": return worstPackageAggregation(results, config);
+		case "average": return averageAggregation(results, config);
+		case "configurable": return configurableAggregation(results, config);
+	}
+}
+function worstPackageAggregation(results, config) {
+	const firstResult = results[0];
+	if (firstResult === void 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	let worst = firstResult;
+	for (const r of results) if ((r.score ?? 0) < (worst.score ?? 0)) worst = r;
+	return {
+		packages: results,
+		overallScore: worst.score,
+		overallVerdict: worst.verdict,
+		strategy: config.weightingStrategy,
+		...worst.verdict === "fail" ? { blockerPackage: worst.packageName } : {}
+	};
+}
+function averageAggregation(results, config) {
+	const scored = results.filter((r) => r.score !== null);
+	if (scored.length === 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	const avg = scored.reduce((sum, r) => sum + (r.score ?? 0), 0) / scored.length;
+	return {
+		packages: results,
+		overallScore: Math.round(avg),
+		overallVerdict: verdictOf(Math.round(avg)),
+		strategy: config.weightingStrategy
+	};
+}
+function configurableAggregation(results, config) {
+	const weights = config.packageWeights ?? {};
+	let totalWeight = 0;
+	let weightedSum = 0;
+	for (const r of results) {
+		const w = weights[r.packageName] ?? 1;
+		totalWeight += w;
+		weightedSum += (r.score ?? 0) * w;
+	}
+	if (totalWeight === 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	const score = Math.round(weightedSum / totalWeight);
+	return {
+		packages: results,
+		overallScore: score,
+		overallVerdict: verdictOf(score),
+		strategy: config.weightingStrategy
+	};
+}
+//#endregion
+//#region src/engine/scan-cache.ts
+/**
+* Local incremental scan cache (Beta-to-Stable 1.0 plan, M5.2 / A-2).
+*
+* Content-addressed, local-only verdict cache: `--cache` reuses the
+* per-file rule outputs of a previous scan when the file's bytes AND the
+* active rule set are unchanged, and invalidates everything else. The
+* key is `sha256(fileText) + rulesDigest` + the file's own identity
+* (repo-relative path + adapter id + parse mode — audit C1/W9), where
+* the rules digest folds
+* in every active rule's id + `detectorRevision ?? 1` (the existing
+* stale-measurement machinery — Verification Trust Evolution Plan §07 —
+* reused as the cache invalidation signal, per A-2) plus a source hash
+* of each external plugin/local rule's `run` function, so a plugin that
+* changes code without bumping its revision still misses.
+*
+* Privacy posture: the cache lives under `<repo>/.mjolnir/cache/`, is
+* gitignored, never leaves the machine, and this module performs zero
+* network I/O — fs and crypto only (asserted by the privacy spec).
+*
+* Only raw rule-loop outputs are cached. Everything after the loop
+* (severity overrides, suppressions, overlap dedup, evidence stamping,
+* tier policy, runtime corroboration, scoring) re-runs on every scan,
+* so a cached scan is byte-equivalent to a fresh one by construction.
+*/
+const CACHE_VERSION = 2;
+/** Entry cap: a monorepo-scale suite stays far below this; bounded file. */
+const MAX_ENTRIES$1 = 4096;
+/**
+* Audit M5: total byte budget. The old cap counted only ENTRIES, so
+* 4096 files × ~100KB of findings each could still produce a
+* multi-hundred-MB writeFileSync on persist. The budget bounds the
+* serialized size; the newest entries win (real LRU-by-use).
+*/
+const MAX_TOTAL_BYTES = 33554432;
+/** sha256 hex of a string — the only hash this module needs. */
+function sha256(text) {
+	return createHash("sha256").update(text).digest("hex");
+}
+/**
+* Digest of the active rule set: id + effective detectorRevision for
+* every rule (sorted for determinism), plus a content hash of all rule
+* source files. The directory-tree hash catches changes to ANY file
+* under src/rules/ — same-file helpers, cross-module imports, shared
+* utilities — without needing to trace the import graph. This is the
+* only reliable way to detect helper function changes in a bundled
+* ESM codebase where String(fn) doesn't reveal transitive dependencies.
+*/
+function computeRulesDigest(rules) {
+	const parts = rules.map((r) => `${r.id}:${r.detectorRevision ?? 1}`).sort();
+	const rulesDirHash = hashRulesSourceTree(rules);
+	return sha256(parts.join("|") + "\0" + rulesDirHash);
+}
+/**
+* Hash all .ts files under src/rules/ (when the first rule's modulePath
+* reveals the project root). Falls back to per-rule function source
+* hashing when the directory cannot be resolved.
+*/
+function hashRulesSourceTree(rules) {
+	const firstPath = rules.find((r) => r.modulePath)?.modulePath;
+	if (!firstPath) return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
+	const idx = firstPath.replace(/\\/g, "/").indexOf("/src/rules/");
+	if (idx < 0) return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
+	const rulesDir = firstPath.replace(/\\/g, "/").slice(0, idx + 11);
+	try {
+		const hash = createHash("sha256");
+		hashDir(rulesDir, hash, 0);
+		return hash.digest("hex").slice(0, 16);
+	} catch {
+		return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
+	}
+}
+function hashDir(dir, hash, depth) {
+	if (depth > 8) return;
+	let entries;
+	try {
+		entries = readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return;
+	}
+	entries.sort((a, b) => a.name.localeCompare(b.name));
+	for (const entry of entries) {
+		if (entry.name === "node_modules" || entry.name === ".git") continue;
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) hashDir(full, hash, depth + 1);
+		else if (entry.isFile() && /\.tsx?$/.test(entry.name)) try {
+			hash.update(entry.name);
+			hash.update(readFileSync(full));
+		} catch {}
+	}
+}
+/**
+* Content-addressed key for one file's rule-loop verdicts.
+*
+* Audit C1: the key MUST identify the verdict's producer, not just the
+* bytes — two files with byte-identical text (a copied spec, a generated
+* snapshot) previously shared one entry, and the first file's cached
+* findings were re-emitted for the second with the wrong `file` stamp.
+* The key therefore folds in the repo-relative path AND the adapter id,
+* plus a parse-mode token (audit W9): a file whose analysis degraded to
+* the regex fallback (or skipped the AST path) must not collide with a
+* fully-AST-analyzed verdict for the same bytes — the fallback output
 * belongs only to the fallback mode.
 */
 function fileCacheKey(rulesDigest, fileText, identity) {
@@ -11377,14 +12100,11 @@ function createScanCache(root) {
 	let totalBytes = 0;
 	try {
 		if (existsSync(file)) {
-			const parsed = JSON.parse(readFileSync(file, "utf8"));
-			if (parsed?.version === CACHE_VERSION && parsed.entries) {
-				entries = parsed.entries;
-				for (const [k, v] of Object.entries(entries)) {
-					const size = JSON.stringify(v).length + k.length + 4;
-					entryBytes.set(k, size);
-					totalBytes += size;
-				}
+			entries = parseJsonFile(readFileSync(file, "utf8"), file, (v) => isRecord(v) && v["version"] === CACHE_VERSION && isRecord(v["entries"])).entries;
+			for (const [k, v] of Object.entries(entries)) {
+				const size = JSON.stringify(v).length + k.length + 4;
+				entryBytes.set(k, size);
+				totalBytes += size;
 			}
 		}
 	} catch {
@@ -11419,7 +12139,7 @@ function createScanCache(root) {
 			entryBytes.set(key, newBytes);
 			totalBytes = totalBytes - replacedBytes + newBytes;
 			let count = Object.keys(entries).length;
-			while ((count > MAX_ENTRIES || totalBytes > MAX_TOTAL_BYTES) && count > 1) {
+			while ((count > MAX_ENTRIES$1 || totalBytes > MAX_TOTAL_BYTES) && count > 1) {
 				const oldest = Object.keys(entries)[0];
 				totalBytes -= entryBytes.get(oldest);
 				delete entries[oldest];
@@ -11498,6 +12218,10 @@ const BRAND = {
 	aurora: "#37ABBD",
 	auroraBright: "#45C1D4",
 	auroraCyan: "#5CBDE0",
+	/** The aurora's outer curtains: atmosphere and section identity only,
+	* never a verdict or a status. */
+	auroraGreen: "#5FD6A4",
+	auroraViolet: "#9D8CF5",
 	steel: "#C8CBCF",
 	steelDim: "#8B939D"
 };
@@ -11601,7 +12325,7 @@ const TRUST = {
 	l4: "#45C1D4",
 	l5: "#5CC4E0"
 };
-SURFACE.ink950, SURFACE.ink900, SURFACE.ink850, SURFACE.ink800, BRAND.steel, BRAND.steelDim, BRAND.gold, BRAND.goldBright, BRAND.goldHot, BRAND.aurora, BRAND.auroraBright, BRAND.auroraCyan;
+SURFACE.ink950, SURFACE.ink900, SURFACE.ink850, SURFACE.ink800, BRAND.steel, BRAND.steelDim, BRAND.gold, BRAND.goldBright, BRAND.goldHot, BRAND.aurora, BRAND.auroraBright, BRAND.auroraCyan, BRAND.auroraGreen, BRAND.auroraViolet;
 SCORE.trusted, SCORE.forged, SCORE.warning, SCORE.critical, STATUS.info, TEXT.onGold, STATUS.ok, EVIDENCE.e0, EVIDENCE.e1, EVIDENCE.e2, TRUST.l0, TRUST.l1, TRUST.l2, TRUST.l3, TRUST.l4, TRUST.l5;
 //#endregion
 //#region src/reporter/theme.ts
@@ -11720,9 +12444,14 @@ function plainContext(width = 80) {
 	};
 }
 const FLAKE_GLYPH = "🔥";
-/** Section header: `▚ TITLE` (ascii `= TITLE`). The one header style. */
+/**
+* Section header: `▍ TITLE` (ascii `= TITLE`). The one header style.
+* A thin accent bar, the terminal's version of the rule that opens each
+* chapter on the website; it replaced a checkerboard quadrant (▚) that
+* read as a rendering glitch rather than a mark.
+*/
 function sectionHeader(title, ui) {
-	const glyph = ui.ascii ? "=" : "▚";
+	const glyph = ui.ascii ? "=" : "▍";
 	return `  ${ui.p.accent(`${glyph} ${title}`)}`;
 }
 //#endregion
@@ -11852,6 +12581,7 @@ const ui$5 = plainContext();
 const MAX_RECORDS = 1e5;
 function analyze(records, source) {
 	const verdicts = [];
+	const networkObservations = [];
 	let failed = 0;
 	let skipped = 0;
 	let retried = 0;
@@ -11861,6 +12591,16 @@ function analyze(records, source) {
 		const attempts = rec.attempts;
 		const finalStatus = attempts[attempts.length - 1]?.status ?? "skipped";
 		const totalDurationMs = attempts.reduce((s, a) => s + a.durationMs, 0);
+		if (rec.evidenceKind === "network-observation") {
+			networkObservations.push({
+				file: rec.file,
+				title: rec.title,
+				outcome: finalStatus === "passed" ? "succeeded" : finalStatus === "skipped" ? "unknown" : "failed",
+				durationMs: totalDurationMs,
+				...rec.errors !== void 0 ? { errors: rec.errors } : {}
+			});
+			continue;
+		}
 		totalDuration += totalDurationMs;
 		const everFailed = attempts.some((a) => a.status === "failed" || a.status === "timedOut");
 		const passedOnRetry = finalStatus === "passed" && attempts.length >= 2 && everFailed;
@@ -11892,6 +12632,7 @@ function analyze(records, source) {
 		});
 	}
 	return {
+		forensicsSchemaVersion: 1,
 		source,
 		totalTests: verdicts.length,
 		failed,
@@ -11899,7 +12640,15 @@ function analyze(records, source) {
 		retriedTests: retried,
 		flakyTests: flaky,
 		totalDurationMs: totalDuration,
-		verdicts
+		verdicts,
+		...networkObservations.length > 0 ? {
+			totalNetworkObservations: networkObservations.length,
+			failedNetworkObservations: networkObservations.filter((observation) => observation.outcome === "failed").length,
+			networkObservations
+		} : {},
+		analysisComplete: records.length <= MAX_RECORDS,
+		skippedReports: 0,
+		incompleteReasons: records.length > MAX_RECORDS ? ["record-count-limit"] : []
 	};
 }
 /** Flakiness Leaderboard: flakiest first, then slowest. */
@@ -11914,15 +12663,36 @@ function bar(ms, maxMs, width = 20) {
 	const filled = Math.round(ms / maxMs * width);
 	return "█".repeat(Math.min(width, filled)) + "░".repeat(Math.max(0, width - filled));
 }
+function renderNetworkObservations(report) {
+	if (!report.networkObservations?.length) return [];
+	const failures = report.networkObservations.filter((observation) => observation.outcome === "failed");
+	return [
+		`${report.networkObservations.length} network observations · ${failures.length} network failures (not test outcomes)`,
+		...failures.slice(0, 25).map((observation) => `NETWORK FAILURE ${observation.title} · ${(observation.durationMs / 1e3).toFixed(1)}s`),
+		""
+	];
+}
+function partialAnalysisMessage(report) {
+	const skippedReasons = report.incompleteReasons.filter((reason) => reason !== "record-count-limit");
+	const partialReasons = report.incompleteReasons.filter((reason) => reason === "record-count-limit").map(() => "record count limit reached");
+	if (report.skippedReports > 0) {
+		const skippedReasonText = skippedReasons.length > 0 ? ` (${skippedReasons.join(", ")})` : "";
+		const suffix = partialReasons.length > 0 ? `; ${partialReasons.join(", ")}.` : ".";
+		return `Analysis is partial — ${report.skippedReports} report(s) skipped${skippedReasonText}${suffix}`;
+	}
+	return `${partialReasons.length > 0 ? partialReasons.join(", ") : report.incompleteReasons.join(", ")}; analysis is partial.`;
+}
 function renderLeaderboard(report) {
 	const lines = [];
 	lines.push(sectionHeader("FLAKINESS LEADERBOARD", ui$5));
 	lines.push("");
 	lines.push(`${report.totalTests} tests · ${report.failed} failed · ${report.flakyTests} flaky · ${report.retriedTests} retried`);
 	lines.push("");
+	lines.push(...renderNetworkObservations(report));
 	const top = leaderboard(report);
 	if (top.length === 0) {
-		lines.push("No failures or retries found — nothing suspicious this run.");
+		lines.push(report.totalTests === 0 && (report.totalNetworkObservations ?? 0) > 0 ? "No test outcomes available from network observations." : (report.totalNetworkObservations ?? 0) > 0 ? "No flaky or failing tests detected; network evidence is listed separately." : "No failures or retries found — nothing suspicious this run.");
+		if (!report.analysisComplete) lines.push(`⚠ ${partialAnalysisMessage(report)}`);
 		return lines.join("\n");
 	}
 	const maxMs = Math.max(...top.map((v) => v.totalDurationMs), 1);
@@ -11930,6 +12700,10 @@ function renderLeaderboard(report) {
 		const flag = v.passedOnRetry ? "TRUE-FLAKE" : "FAILING";
 		lines.push(`${flag.padEnd(10)} ${v.title} (${v.file})`, `           ${bar(v.totalDurationMs, maxMs)} ${(v.totalDurationMs / 1e3).toFixed(1)}s · ${v.attempts} attempt${v.attempts === 1 ? "" : "s"}`);
 	}
+	if (!report.analysisComplete) {
+		lines.push("");
+		lines.push(`⚠ ${partialAnalysisMessage(report)}`);
+	}
 	return lines.join("\n");
 }
 /** FLAKY.md — the committed artifact. */
@@ -11942,9 +12716,14 @@ function renderFlakyMd(report) {
 	lines.push("");
 	lines.push(`**${report.totalTests}** tests analyzed · **${report.flakyTests}** true flakes · **${report.retriedTests}** retried · **${report.failed}** failing`);
 	lines.push("");
+	lines.push(...renderNetworkObservations(report));
 	const top = leaderboard(report);
 	if (top.length === 0) {
-		lines.push("_No flaky or failing tests detected in this run._");
+		lines.push(report.totalTests === 0 && (report.totalNetworkObservations ?? 0) > 0 ? "_No test outcomes available from network observations._" : "_No flaky or failing tests detected in this run._");
+		if (!report.analysisComplete) {
+			lines.push("");
+			lines.push(`> ⚠ ${partialAnalysisMessage(report)}`);
+		}
 		return lines.join("\n");
 	}
 	lines.push("| Status | Test | File | Attempts | Duration |");
@@ -11953,10 +12732,77 @@ function renderFlakyMd(report) {
 		const status = v.passedOnRetry ? `${FLAKE_GLYPH} TRUE-FLAKE` : "❌ failing";
 		lines.push(`| ${status} | \`${v.title}\` | \`${v.file}\` | ${v.attempts} | ${(v.totalDurationMs / 1e3).toFixed(1)}s |`);
 	}
+	if (!report.analysisComplete) {
+		lines.push("");
+		lines.push(`> ⚠ ${partialAnalysisMessage(report)}`);
+	}
 	lines.push("");
 	return lines.join("\n");
 }
 //#endregion
+//#region src/forensics/evidence-hygiene.ts
+/**
+* Evidence hygiene — secret redaction + control-char sanitization
+* (ENGINE-012).
+*
+* Pure, deterministic, bounded. Every error text entering the forensics
+* pipeline passes through `sanitizeErrorText` so that secrets, control
+* characters, and oversized payloads never survive into reports or
+* committed artifacts.
+*/
+const MAX_LENGTH_DEFAULT = 10240;
+const REDACTION_PATTERNS = [
+	{
+		name: "aws-key",
+		regex: /AKIA[0-9A-Z]{16}/g
+	},
+	{
+		name: "github-token",
+		regex: /gh[pousr]_\w{36,}/g
+	},
+	{
+		name: "jwt",
+		regex: /eyJ[\w-]+\.eyJ[\w-]+\.[\w-]+/g
+	},
+	{
+		name: "bearer-token",
+		regex: /[Bb]earer\s+[\w.+-]+/g
+	},
+	{
+		name: "api-key-assignment",
+		regex: /apikey\s*[:=]\s*['"]?[\w.]{8,}['"]?|api[_-]?key\s*[:=]\s*['"]?[\w.]{8,}['"]?/gi
+	},
+	{
+		name: "password-assignment",
+		regex: /(?:password|passwd|pwd)\s*[:=]\s*['"]?[^\s'"]{4,}['"]?/gi
+	},
+	{
+		name: "private-key",
+		regex: /-----BEGIN[A\s][^-]*KEY-----[\s\S]*?-----END[A\s][^-]*KEY-----/g
+	},
+	{
+		name: "hex-secret",
+		regex: /\b[0-9a-f]{33,}\b/gi
+	},
+	{
+		name: "base64-secret",
+		regex: /\b[\w+/]{100,}={0,2}\b/g
+	}
+];
+const CONTROL_CHAR_PATTERN = /[\0\x07\x08\v\f\x0e\x0f\x1b\x7f\x80-\x9f]/g;
+/**
+* Sanitize error text: redact secrets, strip control characters, cap length.
+* Pure and deterministic — same input always yields the same output.
+*/
+function sanitizeErrorText(text, options) {
+	const maxLength = options?.maxLength ?? MAX_LENGTH_DEFAULT;
+	let result = text;
+	for (const { name, regex } of REDACTION_PATTERNS) result = result.replace(regex, `[REDACTED:${name}]`);
+	result = result.replace(CONTROL_CHAR_PATTERN, "");
+	if (result.length > maxLength) result = result.slice(0, maxLength) + `[truncated at ${maxLength} chars]`;
+	return result;
+}
+//#endregion
 //#region src/forensics/trace.ts
 /**
 * Playwright trace ingester (product-gap master plan §9 R5 / WI-17).
@@ -12053,7 +12899,7 @@ function parseTraceNdjson(text) {
 		if (start !== void 0 && end !== void 0 && end >= start) action.durationMs = Math.round((end - start) * 1e3);
 		if (ev.error !== null && typeof ev.error === "object" && ev.error !== void 0) {
 			const msg = ev.error.message;
-			action.error = typeof msg === "string" ? { message: msg } : { message: "action failed" };
+			action.error = typeof msg === "string" ? { message: sanitizeErrorText(msg) } : { message: "action failed" };
 		}
 		actions.set(ev.callId, action);
 	}
@@ -12073,7 +12919,7 @@ function traceActionsToRecord(actions, artifact) {
 		totalMs += a.durationMs;
 		if (a.error !== void 0) {
 			failed = true;
-			const msg = a.error.message ?? "action failed";
+			const msg = sanitizeErrorText(a.error.message ?? "action failed");
 			errors.push(msg);
 			if (/timed\s*out|timeout\s+of/i.test(msg)) timedOut = true;
 		}
@@ -12194,11 +13040,18 @@ function parseJestJson(json) {
 			};
 			const line = typeof assertion.location?.line === "number" && assertion.location.line > 0 ? assertion.location.line : void 0;
 			const title = assertion.title ?? "(unnamed)";
+			const errors = [];
+			for (const msgs of [assertion.failureMessages, assertion.failureDetails]) {
+				if (!Array.isArray(msgs)) continue;
+				for (const m of msgs) if (typeof m === "string" && m.length > 0) errors.push(sanitizeErrorText(m));
+				else if (m !== null && typeof m === "object" && "message" in m && typeof m.message === "string") errors.push(sanitizeErrorText(m.message));
+			}
 			out.push({
 				file,
 				title,
 				attempts: [attempt],
-				...line !== void 0 ? { line } : {}
+				...line !== void 0 ? { line } : {},
+				...errors.length > 0 ? { errors } : {}
 			});
 		}
 	}
@@ -12244,15 +13097,36 @@ function parseJunitXml(xml) {
 		const timeRaw = attr(attrs, "time");
 		const timeSec = timeRaw !== void 0 && Number.isFinite(Number(timeRaw)) ? Number(timeRaw) : 0;
 		const failed = /<(?:failure|error)\b/i.test(inner);
+		const skipped = /<skipped\b/i.test(inner);
+		const errors = [];
+		if (failed) {
+			const failRe = /<(?:failure|error)\b([^>]*)>([\s\S]*?)<\/(?:failure|error)\s*>/gi;
+			let failMatch;
+			while ((failMatch = failRe.exec(inner)) !== null) {
+				const attrsStr = failMatch[1] ?? "";
+				const msgAttr = /\smessage\s*=\s*"([^"]*)"/i.exec(attrsStr)?.[1];
+				if (msgAttr) errors.push(sanitizeErrorText(decodeEntities(msgAttr)));
+				const body = failMatch[2]?.trim();
+				if (body && body !== msgAttr) errors.push(sanitizeErrorText(decodeEntities(body)));
+			}
+			const selfCloseRe = /<(?:failure|error)\b([^>]*)\/>/gi;
+			let scMatch;
+			while ((scMatch = selfCloseRe.exec(inner)) !== null) {
+				const scAttrs = scMatch[1] ?? "";
+				const scMsgMatch = /\smessage\s*=\s*"([^"]*)"/i.exec(scAttrs);
+				if (scMsgMatch?.[1]) errors.push(sanitizeErrorText(decodeEntities(scMsgMatch[1])));
+			}
+		}
 		const attempt = {
 			index: 1,
-			status: /<skipped\b/i.test(inner) ? "skipped" : failed ? "failed" : "passed",
+			status: skipped ? "skipped" : failed ? "failed" : "passed",
 			durationMs: Math.round(timeSec * 1e3)
 		};
 		out.push({
 			file: classname || "unknown",
 			title: name,
-			attempts: [attempt]
+			attempts: [attempt],
+			...errors.length > 0 ? { errors } : {}
 		});
 	}
 	return out;
@@ -12289,6 +13163,7 @@ function parsePlaywrightJson(json) {
 				const attempts = [];
 				let i = 0;
 				const results = Array.isArray(test.results) ? test.results : [];
+				const collectedErrors = [];
 				for (const r of results) {
 					if (!r || typeof r !== "object") continue;
 					attempts.push({
@@ -12296,6 +13171,16 @@ function parsePlaywrightJson(json) {
 						status: toStatus$1(r.status),
 						durationMs: Number.isFinite(r.duration) ? Math.max(0, r.duration) : 0
 					});
+					if (r.error !== void 0 && r.error !== null) {
+						const errObj = r.error;
+						if (typeof errObj.message === "string" && errObj.message.length > 0) collectedErrors.push(sanitizeErrorText(errObj.message));
+					}
+					if (Array.isArray(r.errors)) {
+						for (const e of r.errors) if (e !== null && typeof e === "object") {
+							const eObj = e;
+							if (typeof eObj.message === "string" && eObj.message.length > 0) collectedErrors.push(sanitizeErrorText(eObj.message));
+						} else if (typeof e === "string" && e.length > 0) collectedErrors.push(sanitizeErrorText(e));
+					}
 				}
 				if (attempts.length === 0) continue;
 				const specLine = typeof spec.location?.line === "number" && spec.location.line >= 0 ? spec.location.line + 1 : void 0;
@@ -12303,7 +13188,8 @@ function parsePlaywrightJson(json) {
 					file,
 					title: spec.title ?? "(unnamed)",
 					attempts,
-					...specLine !== void 0 ? { line: specLine } : {}
+					...specLine !== void 0 ? { line: specLine } : {},
+					...collectedErrors.length > 0 ? { errors: collectedErrors } : {}
 				});
 			}
 		}
@@ -12349,17 +13235,110 @@ function parseVitestJson(json) {
 				durationMs
 			};
 			const line = typeof assertion.location?.line === "number" && assertion.location.line > 0 ? assertion.location.line : void 0;
+			const errors = [];
+			for (const msgs of [assertion.failureMessages, assertion.failureDetails]) {
+				if (!Array.isArray(msgs)) continue;
+				for (const m of msgs) if (typeof m === "string" && m.length > 0) errors.push(sanitizeErrorText(m));
+				else if (m !== null && typeof m === "object" && "message" in m && typeof m.message === "string") errors.push(sanitizeErrorText(m.message));
+			}
 			out.push({
 				file,
 				title: assertion.title ?? "(unnamed)",
 				attempts: [attempt],
-				...line !== void 0 ? { line } : {}
+				...line !== void 0 ? { line } : {},
+				...errors.length > 0 ? { errors } : {}
 			});
 		}
 	}
 	return out;
 }
 //#endregion
+//#region src/forensics/parse-har.ts
+const MAX_ENTRIES = 2e4;
+function sanitizeTitleUrl(url) {
+	try {
+		const parsed = new URL(url);
+		parsed.username = "";
+		parsed.password = "";
+		parsed.search = "";
+		parsed.hash = "";
+		return `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
+	} catch {
+		return url.split(/[?#]/, 1)[0] ?? url;
+	}
+}
+function serializeTransportError(value) {
+	if (typeof value === "string") return value;
+	try {
+		const serialized = JSON.stringify(value);
+		return serialized === void 0 ? String(value) : serialized;
+	} catch {
+		return "[unserializable transport error]";
+	}
+}
+function isValidHttpStatus(status) {
+	return typeof status === "number" && Number.isInteger(status) && status >= 100 && status <= 599;
+}
+/**
+* Sniff: a HAR root is `{ log: { entries: [...] } }` — distinct from
+* every other JSON shape the forensics layer accepts (Playwright/Jest/
+* Vitest all key on `testResults` or `suites`).
+*/
+function looksLikeHarJson(json) {
+	if (!json || typeof json !== "object") return false;
+	const log = json.log;
+	if (!log || typeof log !== "object") return false;
+	return Array.isArray(log.entries);
+}
+function parseHarJsonDetailed(json) {
+	if (!json || typeof json !== "object") return {
+		records: [],
+		truncated: false
+	};
+	const entries = json.log?.entries;
+	if (!Array.isArray(entries)) return {
+		records: [],
+		truncated: false
+	};
+	const out = [];
+	const truncated = entries.length > MAX_ENTRIES;
+	for (const entry of entries.slice(0, MAX_ENTRIES)) {
+		if (!entry || typeof entry !== "object") continue;
+		const method = typeof entry.request?.method === "string" ? entry.request.method : "GET";
+		const url = typeof entry.request?.url === "string" ? entry.request.url : void 0;
+		if (url === void 0 || url.length === 0) continue;
+		const status = typeof entry.response?.status === "number" ? entry.response.status : void 0;
+		const transportError = entry.response?._error ?? entry.response?.error ?? void 0;
+		const hasTransportError = transportError !== void 0 && transportError !== null;
+		const hasValidStatus = isValidHttpStatus(status);
+		if (!hasValidStatus && !hasTransportError) continue;
+		const httpFailed = hasValidStatus && status >= 400;
+		const errors = [];
+		if (hasTransportError) errors.push(sanitizeErrorText(serializeTransportError(transportError)));
+		if (httpFailed) {
+			const text = typeof entry.response?.statusText === "string" && entry.response.statusText.length > 0 ? entry.response.statusText : `HTTP ${status}`;
+			errors.push(sanitizeErrorText(`${status} ${text}`));
+		}
+		const durationMs = typeof entry.time === "number" && Number.isFinite(entry.time) ? Math.max(0, Math.round(entry.time)) : 0;
+		const attempt = {
+			index: 1,
+			status: hasTransportError || httpFailed ? "failed" : "passed",
+			durationMs
+		};
+		out.push({
+			file: "har",
+			evidenceKind: "network-observation",
+			title: `${method} ${sanitizeTitleUrl(url)}`,
+			attempts: [attempt],
+			...errors.length > 0 ? { errors } : {}
+		});
+	}
+	return {
+		records: out,
+		truncated
+	};
+}
+//#endregion
 //#region src/forensics/run.ts
 /**
 * `mjolnir forensics <dir-or-file>` — runtime evidence entry point (R4).
@@ -12374,9 +13353,23 @@ function parseVitestJson(json) {
 * Writes FLAKY.md next to the scan target unless --no-flaky-md.
 */
 const MAX_FILES = 500;
+const MAX_REPORT_FILE_BYTES = 1048576;
+const MAX_CUMULATIVE_BYTES = 52428800;
+/**
+* Run forensics analysis on test result artifacts.
+*
+* Parses test result files (Playwright JSON, JUnit XML, HAR, etc.),
+* analyzes them for flakiness, determinism, and trust signals, and
+* returns a structured report plus rendered output strings.
+*
+* @param target - path to the test result artifact or directory
+* @param options - writeFlakyMd (default true) controls FLAKY.md output
+*/
 function runForensics(target, options = {}) {
 	const records = [];
 	let source = "playwright-json";
+	let skippedReports = 0;
+	const incompleteReasons = [];
 	if (!existsSync(target)) {
 		const report = analyze(records, source);
 		return {
@@ -12384,12 +13377,28 @@ function runForensics(target, options = {}) {
 			output: [
 				renderLeaderboard(report),
 				"",
-				renderFlakyMdHint()
+				renderFlakyMdNotWritten(options)
 			].join("\n")
 		};
 	}
 	const stat = statSync(target);
 	if (stat.isFile()) {
+		if (stat.size > MAX_REPORT_FILE_BYTES) {
+			skippedReports = 1;
+			incompleteReasons.push("size-limit");
+			const report = analyze([], source);
+			report.analysisComplete = false;
+			report.skippedReports = skippedReports;
+			report.incompleteReasons = incompleteReasons;
+			return {
+				report,
+				output: [
+					renderLeaderboard(report),
+					"",
+					renderFlakyMdNotWritten(options)
+				].join("\n")
+			};
+		}
 		if (/\.(?:zip|trace|ndjson)$/i.test(target)) try {
 			const record = parseTraceArtifact(readFileSync(target), traceArtifactName(target));
 			if (record === void 0) {
@@ -12403,51 +13412,95 @@ function runForensics(target, options = {}) {
 					].join("\n")
 				};
 			}
-			const report = analyze([record], "playwright-trace");
+			records.push(record);
+			source = "playwright-trace";
+		} catch {
+			const report = analyze([], "playwright-trace");
+			report.analysisComplete = false;
+			report.skippedReports = 1;
+			report.incompleteReasons = ["parse-failure"];
 			return {
 				report,
 				output: [
 					renderLeaderboard(report),
 					"",
-					renderFlakyMdHint()
-				].join("\n")
-			};
-		} catch {
-			const report = analyze([], "playwright-trace");
-			return {
-				report,
-				output: [
-					renderLeaderboard(report),
-					"",
-					renderFlakyMdNotWritten(options)
+					renderFlakyMdNotWritten(options)
 				].join("\n")
 			};
 		}
-		try {
+		else try {
 			const parsed = parseFile(target, readFileSync(target, "utf8"));
 			records.push(...parsed.records);
 			source = parsed.source;
-		} catch {}
+			if (parsed.parseFailed) {
+				skippedReports = 1;
+				incompleteReasons.push("parse-failure");
+			}
+			if (parsed.truncated && !incompleteReasons.includes("entry-count-limit")) incompleteReasons.push("entry-count-limit");
+		} catch {
+			skippedReports = 1;
+			incompleteReasons.push("parse-failure");
+		}
 	} else {
 		let count = 0;
-		for (const full of listFiles(target)) {
-			if (++count > MAX_FILES) break;
+		let cumulativeBytes = 0;
+		let hitFileLimit = false;
+		let hitCumulativeLimit = false;
+		const allFiles = listFiles(target);
+		for (const full of allFiles) {
+			if (++count > MAX_FILES) {
+				hitFileLimit = true;
+				break;
+			}
 			try {
+				const fileStat = statSync(full);
+				if (fileStat.size > MAX_REPORT_FILE_BYTES) {
+					skippedReports++;
+					if (!incompleteReasons.includes("size-limit")) incompleteReasons.push("size-limit");
+					continue;
+				}
+				cumulativeBytes += fileStat.size;
+				if (cumulativeBytes > MAX_CUMULATIVE_BYTES) {
+					hitCumulativeLimit = true;
+					if (!incompleteReasons.includes("cumulative-size-limit")) incompleteReasons.push("cumulative-size-limit");
+					break;
+				}
 				if (/\.(?:zip|trace|ndjson)$/i.test(full)) {
 					const record = parseTraceArtifact(readFileSync(full), traceArtifactName(full));
 					if (record === void 0) continue;
-					if (records.length === 0) source = "playwright-trace";
+					if (records.length === 0 || source === "har") source = "playwright-trace";
 					records.push(record);
 					continue;
 				}
 				const parsed = parseFile(full, readFileSync(full, "utf8"));
+				if (parsed.parseFailed) {
+					skippedReports++;
+					if (!incompleteReasons.includes("parse-failure")) incompleteReasons.push("parse-failure");
+				}
+				if (parsed.truncated && !incompleteReasons.includes("entry-count-limit")) incompleteReasons.push("entry-count-limit");
 				if (parsed.records.length === 0) continue;
-				if (records.length === 0) source = parsed.source;
+				if (records.length === 0 || source === "har" && parsed.source !== "har") source = parsed.source;
 				records.push(...parsed.records);
-			} catch {}
+			} catch {
+				skippedReports++;
+				if (!incompleteReasons.includes("parse-failure")) incompleteReasons.push("parse-failure");
+			}
+		}
+		if (hitFileLimit) {
+			if (!incompleteReasons.includes("file-count-limit")) incompleteReasons.push("file-count-limit");
+			skippedReports += allFiles.length - count + 1;
+		}
+		if (hitCumulativeLimit) {
+			if (!incompleteReasons.includes("cumulative-size-limit")) incompleteReasons.push("cumulative-size-limit");
+			skippedReports += allFiles.length - count + 1;
 		}
 	}
 	const report = analyze(records, source);
+	if (skippedReports > 0 || incompleteReasons.length > 0) {
+		report.analysisComplete = false;
+		report.skippedReports = skippedReports;
+		report.incompleteReasons = [.../* @__PURE__ */ new Set([...report.incompleteReasons, ...incompleteReasons])];
+	}
 	let flakyMdPath;
 	if ((options.writeFlakyMd ?? true) && report.totalTests > 0) {
 		const base = stat.isFile() ? dirname(target) : target;
@@ -12463,7 +13516,7 @@ function runForensics(target, options = {}) {
 		output: [
 			renderLeaderboard(report),
 			"",
-			flakyMdPath !== void 0 ? renderFlakyMdHint() : renderFlakyMdNotWritten(options)
+			flakyMdPath !== void 0 ? renderFlakyMdHint() : report.totalTests === 0 && (report.totalNetworkObservations ?? 0) > 0 && options.writeFlakyMd !== false ? "FLAKY.md was not written — network observations do not establish test outcomes." : renderFlakyMdNotWritten(options)
 		].join("\n"),
 		flakyMdPath
 	};
@@ -12493,14 +13546,33 @@ function parseFile(path, text) {
 		source: "junit-xml"
 	};
 	let json;
+	const isHarFile = /\.har$/i.test(path);
 	try {
 		json = JSON.parse(text);
 	} catch {
 		return {
 			records: [],
-			source: "playwright-json"
+			source: isHarFile ? "har" : "playwright-json",
+			parseFailed: true
+		};
+	}
+	if (looksLikeHarJson(json)) {
+		const parsed = parseHarJsonDetailed(json);
+		return {
+			records: parsed.records,
+			source: "har",
+			truncated: parsed.truncated
 		};
 	}
+	if (isHarFile || json !== null && typeof json === "object" && [
+		"suites",
+		"specs",
+		"testResults"
+	].some((key) => key in json && !Array.isArray(json[key]))) return {
+		records: [],
+		source: isHarFile ? "har" : "playwright-json",
+		parseFailed: true
+	};
 	if (looksLikeJestJson(json)) return {
 		records: parseJestJson(json),
 		source: "jest-json"
@@ -12529,119 +13601,12 @@ function listFiles(dir) {
 			if (e.isDirectory()) {
 				if (["node_modules", ".git"].includes(e.name)) continue;
 				walk(full, depth + 1);
-			} else if (e.isFile() && /\.(?:json|xml|zip|trace|ndjson)$/i.test(e.name)) out.push(full);
+			} else if (e.isFile() && /\.(?:json|xml|zip|trace|ndjson|har)$/i.test(e.name)) out.push(full);
 		}
 	};
 	walk(dir, 0);
 	return out.map((p) => p);
 }
-//#endregion
-//#region src/config/config.ts
-/**
-* Config file support (Sprint-Plan W7, Product-MVP §27 + GAP-F).
-* Zero-config preserved: config presence never changes detection
-* semantics — only severity, scope, and gating.
-*/
-/**
-* Audit S7: every config key the engine consumes. A top-level key
-* OUTSIDE this set is a likely typo ("severities", "ingore") — unknown
-* keys emit a warning (fail-noisy, not fail-silent) and are ignored.
-*/
-const KNOWN_CONFIG_KEYS = /* @__PURE__ */ new Set([
-	"gate",
-	"exclude",
-	"severityOverrides",
-	"ignore",
-	"plugins"
-]);
-const CONFIG_NAMES = ["mjolnir.config.json", ".mjolnir.json"];
-/**
-* Distinguished from other load failures so the CLI can exit 10 (usage)
-* instead of 20 (internal): a typo in the user's config is a user error
-* with a fixable message, not a tool malfunction (bug-audit M4).
-*/
-var ConfigValidationError = class extends Error {
-	constructor(message, options) {
-		super(message, options);
-		this.name = "ConfigValidationError";
-	}
-};
-function loadConfig(root, options = {}) {
-	for (const name of CONFIG_NAMES) {
-		const p = join(root, name);
-		if (!existsSync(p)) continue;
-		try {
-			const parsed = JSON.parse(readFileSync(p, "utf8"));
-			return {
-				config: parsed,
-				path: p,
-				warnings: validate(parsed, options.knownRuleIds)
-			};
-		} catch (err) {
-			const msg = err.message;
-			throw new ConfigValidationError(`Invalid mjolnir config at ${p}: ${msg}`, { cause: err });
-		}
-	}
-	return {
-		config: {},
-		path: null,
-		warnings: []
-	};
-}
-function validate(cfg, knownRuleIds) {
-	const warnings = [];
-	if (cfg.gate && ![
-		"advisory",
-		"error",
-		"warning"
-	].includes(cfg.gate)) throw new Error(`gate must be advisory|error|warning, got "${cfg.gate}"`);
-	for (const [ruleId, severity] of Object.entries(cfg.severityOverrides ?? {})) {
-		if (!SEVERITY_ORDER.includes(severity)) throw new Error(`severityOverrides["${ruleId}"] must be one of ${SEVERITY_ORDER.join("|")}, got "${String(severity)}"`);
-		if (knownRuleIds && !knownRuleIds.has(ruleId)) warnings.push(`warning: severityOverrides["${ruleId}"] names no registered rule (typo? plugin rule?) — the entry is kept but currently matches nothing.`);
-	}
-	for (const ign of cfg.ignore ?? []) {
-		if (!ign.ruleId) throw new Error("ignore entries require ruleId");
-		if (!ign.reason) throw new Error(`ignore for ${ign.ruleId} requires a "reason" (§27)`);
-		if (ign.files !== void 0) {
-			if (!Array.isArray(ign.files)) throw new Error(`ignore for ${ign.ruleId}: "files" must be an array of glob strings, got ${typeof ign.files}`);
-			for (const g of ign.files) if (typeof g !== "string") throw new Error(`ignore for ${ign.ruleId}: "files" entries must be strings, got ${typeof g} (${JSON.stringify(g)})`);
-		}
-		if (ign.expires !== void 0 && Number.isNaN(new Date(ign.expires).getTime())) throw new Error(`ignore for ${ign.ruleId}: "expires" must be an ISO date, got "${ign.expires}"`);
-	}
-	for (const key of Object.keys(cfg)) if (!KNOWN_CONFIG_KEYS.has(key)) warnings.push(`warning: mjolnir.config.json has an unknown top-level key "${key}" — ignored (typo? see README §Configuration).`);
-	if (cfg.exclude !== void 0) {
-		if (!Array.isArray(cfg.exclude)) throw new Error(`exclude must be an array of strings, got ${typeof cfg.exclude}`);
-		for (const p of cfg.exclude) if (typeof p !== "string") throw new Error(`exclude entries must be strings, got ${typeof p} (${JSON.stringify(p)})`);
-	}
-	return warnings;
-}
-/**
-* Bug-audit QA-2026-08-30 QA-6: the 90-day policy in the README was only
-* applied at WRITE time by the `ignore` command — a hand-written entry
-* without `expires` stayed active forever, silently bypassing the
-* documented window.
-*
-* Audit S4 (remediation plan): the config-file MTIME is no longer an
-* expiry anchor. Anchoring the 90-day default at mtime meant ANY edit to
-* mjolnir.config.json — a reformat, an unrelated key, a `touch` — reset
-* the 90-day window for EVERY hand-authored entry: suppressions could be
-* extended indefinitely without touching their own fields. The expiry is
-* now the entry's explicit `expires` date alone; an entry without one
-* stays active and is honestly labeled "(no expiry set)" in the
-* suppressions report. Hand-authored entries should declare `expires` at
-* creation (README §Configuration documents the shape).
-*/
-function isSuppressionActive(ign, now = /* @__PURE__ */ new Date()) {
-	if (!ign.expires) return true;
-	return new Date(ign.expires) > now;
-}
-function applySeverityOverrides(findings, cfg) {
-	const overrides = cfg.severityOverrides ?? {};
-	for (const f of findings) {
-		const override = overrides[f.ruleId];
-		if (override && SEVERITY_ORDER.includes(override)) f.severity = override;
-	}
-}
 plainContext();
 function loadSuppressions(root) {
 	const { config } = loadConfig(root);
@@ -12737,11 +13702,11 @@ function loadPlugins(root, gateOpen = false) {
 		errors: [],
 		skipped: []
 	};
-	const cfgPath = join(root, "mjolnir.config.json");
-	if (!existsSync(cfgPath)) return result;
+	const cfgPath = findConfigPath(root);
+	if (!cfgPath) return result;
 	let raw;
 	try {
-		raw = JSON.parse(readFileSync(cfgPath, "utf8"));
+		raw = parseJsonFile(readFileSync(cfgPath, "utf8"), cfgPath, isRecord);
 	} catch {
 		return result;
 	}
@@ -12857,17 +13822,12 @@ const ALLOWED_QA_IMPACTS = /* @__PURE__ */ new Set([
 	"FALSE-GREEN",
 	"HYGIENE"
 ]);
-/** Consistent error message extraction (v8 branch-friendly form). */
-function errorMessage$1(err) {
-	if (err instanceof Error) return err.message;
-	return String(err);
-}
 /**
 * Discover + load external rules from `<root>/mjolnir-rules/`.
 * Missing directory → empty result (not an error — most workspaces
 * carry none).
 */
-async function loadLocalRules(root, gateOpen = false) {
+async function loadLocalRules(root, gateOpen = true) {
 	const result = {
 		rules: [],
 		errors: [],
@@ -12879,18 +13839,15 @@ async function loadLocalRules(root, gateOpen = false) {
 	try {
 		entries = readdirSync(dir);
 	} catch (err) {
-		result.errors.push(`external rules directory "${LOCAL_RULES_DIR}/" could not be read: ${errorMessage$1(err)}`);
+		result.errors.push(`external rules directory "${LOCAL_RULES_DIR}/" could not be read: ${err instanceof Error ? err.message : String(err)}`);
 		return result;
 	}
 	for (const entry of entries.sort()) {
 		const path = join(dir, entry);
 		if (entry.endsWith(".json")) loadJsonRule(path, result);
 		else if (entry.endsWith(".mjs") || entry.endsWith(".js")) {
-			if (!gateOpen) {
-				result.skipped.push(`${LOCAL_RULES_DIR}/${entry}`);
-				continue;
-			}
-			await loadModuleRules(path, result);
+			if (!gateOpen) result.skipped.push(`${LOCAL_RULES_DIR}/${entry}`);
+			else await loadModuleRules(path, result);
 		}
 	}
 	return result;
@@ -12901,7 +13858,7 @@ function loadJsonRule(path, result) {
 	try {
 		raw = JSON.parse(readFileSync(path, "utf8"));
 	} catch (err) {
-		result.errors.push(`external rule "${name}" is not valid JSON: ${errorMessage$1(err)}`);
+		result.errors.push(`external rule "${name}" is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
 		return;
 	}
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
@@ -12923,23 +13880,24 @@ function loadJsonRule(path, result) {
 		result.errors.push(`external rule ${id} must declare a non-empty "patterns" array of regex source strings.`);
 		return;
 	}
+	let regexes;
+	try {
+		regexes = patterns.map((p) => new RegExp(p, "g"));
+	} catch (err) {
+		result.errors.push(`external rule ${id} declares an invalid regex: ${err instanceof Error ? err.message : String(err)}`);
+		return;
+	}
 	for (const p of patterns) {
 		if (p.length > 512) {
-			result.errors.push(`external rule ${id} declares a pattern longer than 512 chars — rejected (bound on sync regex cost).`);
+			result.errors.push(`external rule ${id} has a pattern longer than 512 chars — likely a copy-paste error.`);
 			return;
 		}
-		if ((p.match(/[*+?{]/g) ?? []).length > 64) {
-			result.errors.push(`external rule ${id} declares a pattern with more than 64 quantifier/wildcard tokens — rejected (bound on sync regex cost).`);
+		const quantifiers = p.match(/[+*?]|\{\d/g);
+		if (quantifiers && quantifiers.length > 64) {
+			result.errors.push(`external rule ${id} has a pattern with more than 64 quantifier/wildcard tokens — likely catastrophic backtracking.`);
 			return;
 		}
 	}
-	let regexes;
-	try {
-		regexes = patterns.map((p) => new RegExp(p, "g"));
-	} catch (err) {
-		result.errors.push(`external rule ${id} declares an invalid regex: ${errorMessage$1(err)}`);
-		return;
-	}
 	const severity = decl["severity"];
 	const category = decl["category"];
 	const appliesTo = decl["appliesTo"];
@@ -12960,20 +13918,14 @@ function loadJsonRule(path, result) {
 		result.errors.push(`external rule ${id} declares an invalid "qaImpact".`);
 		return;
 	}
-	let title = id;
-	if (typeof decl["title"] === "string") title = decl["title"];
-	let message = title;
-	if (typeof decl["message"] === "string") message = decl["message"];
+	const title = typeof decl["title"] === "string" ? decl["title"] : id;
+	const message = typeof decl["message"] === "string" ? decl["message"] : title;
 	const why = typeof decl["why"] === "string" ? decl["why"] : "Declared by a workspace-local external rule.";
 	const fix = typeof decl["fix"] === "string" ? decl["fix"] : "Review the matched code against the rule's intent.";
 	const confidence = decl["confidence"] === "high" || decl["confidence"] === "low" ? decl["confidence"] : "medium";
-	let languages;
-	const rawLanguages = decl["languages"];
-	if (Array.isArray(rawLanguages) && rawLanguages.every((l) => typeof l === "string")) languages = rawLanguages;
-	let frameworks;
-	const rawFrameworks = decl["frameworks"];
-	if (Array.isArray(rawFrameworks) && rawFrameworks.every((l) => typeof l === "string")) frameworks = rawFrameworks;
-	const rule = {
+	const languages = Array.isArray(decl["languages"]) && decl["languages"].every((l) => typeof l === "string") ? decl["languages"] : void 0;
+	const frameworks = Array.isArray(decl["frameworks"]) && decl["frameworks"].every((l) => typeof l === "string") ? decl["frameworks"] : void 0;
+	result.rules.push({
 		id,
 		category,
 		title,
@@ -12982,6 +13934,8 @@ function loadJsonRule(path, result) {
 		findingType: "heuristic-risk",
 		qaImpact,
 		appliesTo,
+		...languages !== void 0 ? { languages } : {},
+		...frameworks !== void 0 ? { frameworks } : {},
 		falsePositiveRisk: decl["falsePositiveRisk"] === "low" || decl["falsePositiveRisk"] === "high" ? decl["falsePositiveRisk"] : "medium",
 		autofix: false,
 		detectionStrategy: "LEXICAL",
@@ -12990,41 +13944,30 @@ function loadJsonRule(path, result) {
 		detectorRevision: 1,
 		run(ctx) {
 			const view = ctx.text;
-			const lineStarts = [0];
-			for (let i = 0; i < view.length; i++) if (view.charCodeAt(i) === 10) lineStarts.push(i + 1);
-			const lineOf = (index) => {
-				let lo = 0;
-				let hi = lineStarts.length - 1;
-				while (lo < hi) {
-					const mid = lo + hi + 1 >> 1;
-					if (lineStarts.at(mid) <= index) lo = mid;
-					else hi = mid - 1;
-				}
-				return lo + 1;
-			};
 			const findings = [];
 			for (const re of regexes) {
 				const run = new RegExp(re.source, "g");
 				let m;
-				while ((m = run.exec(view)) !== null) findings.push({
-					severity,
-					confidence,
-					findingType: "heuristic-risk",
-					qaImpact,
-					file: ctx.path,
-					line: lineOf(m.index),
-					column: m.index - (view.lastIndexOf("\n", m.index - 1) + 1) + 1,
-					message,
-					why,
-					fix
-				});
+				while ((m = run.exec(view)) !== null) {
+					if (findings.length >= 1e4) throw new Error(`External rule ${id} exceeded its match limit`);
+					if (m[0].length === 0) run.lastIndex = m.index + 1;
+					findings.push({
+						severity,
+						confidence,
+						findingType: "heuristic-risk",
+						qaImpact,
+						file: ctx.path,
+						line: 1 + view.slice(0, m.index).split("\n").length - 1,
+						column: m.index - (view.lastIndexOf("\n", m.index - 1) + 1) + 1,
+						message,
+						why,
+						fix
+					});
+				}
 			}
 			return findings;
 		}
-	};
-	if (languages !== void 0) rule.languages = languages;
-	if (frameworks !== void 0) rule.frameworks = frameworks;
-	result.rules.push(rule);
+	});
 }
 async function loadModuleRules(path, result) {
 	const name = `${LOCAL_RULES_DIR}/${path.split(/[\\/]/).pop()}`;
@@ -13032,7 +13975,7 @@ async function loadModuleRules(path, result) {
 	try {
 		mod = await import(pathToFileURL(path).href);
 	} catch (err) {
-		result.errors.push(`external rule module "${name}" failed to load: ${errorMessage$1(err)}`);
+		result.errors.push(`external rule module "${name}" failed to load: ${err instanceof Error ? err.message : String(err)}`);
 		return;
 	}
 	const rules = mod?.rules;
@@ -13051,25 +13994,25 @@ async function loadModuleRules(path, result) {
 			result.errors.push(`external rule module "${name}" rule ${ruleId} uses a reserved core prefix — rejected. Use your own family.`);
 			continue;
 		}
-		if (typeof r.severity !== "string" || !ALLOWED_SEVERITIES.has(r.severity)) {
-			result.errors.push(`external rule module "${name}" rule ${ruleId} declares an invalid "severity" (need error|warning|info) — skipped.`);
-			continue;
+		if (r.tier === "core") {
+			result.errors.push(`external rule ${r.id} declares tier "core" — clamped to "extended" (core requires a measured FP rate from the corpus sidecar; external rules are outside that registry).`);
+			rule.tier = "extended";
 		}
-		if (typeof r.category !== "string" || !ALLOWED_CATEGORIES.has(r.category)) {
-			result.errors.push(`external rule module "${name}" rule ${ruleId} declares an invalid "category" (need one of ${[...ALLOWED_CATEGORIES].join("|")}) — skipped.`);
+		if (typeof r.severity === "string" && !ALLOWED_SEVERITIES.has(r.severity)) {
+			result.errors.push(`external rule ${r.id} declares an invalid "severity" (need error|warning|info).`);
 			continue;
 		}
-		if (typeof r.appliesTo !== "string" || !ALLOWED_APPLIES_TO.has(r.appliesTo)) {
-			result.errors.push(`external rule module "${name}" rule ${ruleId} declares an invalid "appliesTo" (need one of ${[...ALLOWED_APPLIES_TO].join("|")}) — skipped.`);
+		if (typeof r.category === "string" && !ALLOWED_CATEGORIES.has(r.category)) {
+			result.errors.push(`external rule ${r.id} declares an invalid "category" (need ${[...ALLOWED_CATEGORIES].join("|")}).`);
 			continue;
 		}
-		if (r.qaImpact !== void 0 && (typeof r.qaImpact !== "string" || !ALLOWED_QA_IMPACTS.has(r.qaImpact))) {
-			result.errors.push(`external rule module "${name}" rule ${ruleId} declares an invalid "qaImpact" — skipped.`);
+		if (typeof r.appliesTo === "string" && !ALLOWED_APPLIES_TO.has(r.appliesTo)) {
+			result.errors.push(`external rule ${r.id} declares an invalid "appliesTo" (need ${[...ALLOWED_APPLIES_TO].join("|")}).`);
 			continue;
 		}
-		if (r.tier === "core") {
-			result.errors.push(`external rule ${r.id} declares tier "core" — clamped to "extended" (core requires a measured FP rate from the corpus sidecar; external rules are outside that registry).`);
-			rule.tier = "extended";
+		if (typeof r.qaImpact === "string" && !ALLOWED_QA_IMPACTS.has(r.qaImpact)) {
+			result.errors.push(`external rule ${r.id} declares an invalid "qaImpact" (need ${[...ALLOWED_QA_IMPACTS].join("|")}).`);
+			continue;
 		}
 		result.rules.push(rule);
 	}
@@ -13228,131 +14171,73 @@ function pathMatchesGlob(path, glob) {
 		const last = i === segments.length - 1;
 		if (segment === "**") {
 			if (last) re += "(?:[^/]+/)*[^/]+";
-			else re += "(?:[^/]+/)*";
-			continue;
-		}
-		re += segment.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replaceAll("*", "[^/]*");
-		if (!last) re += "/";
-	}
-	return new RegExp(`${re}$`).test(p);
-}
-/**
-* Plan §16 + WI-11: locate a runtime run report next to the scan
-* target, using the exact conventions the forensics ingestion already
-* accepts. Zero-config search over conventional artifact names at
-* depth ≤ 2 (src/discovery/evidence-discovery.ts); the FIRST parsable
-* candidate wins (priority: mjolnir-report > playwright-json >
-* test-results-dir > junit-file). Returns the path for `runForensics`,
-* or undefined when no convention is present ("no runtime evidence" —
-* never guessed; the CLI surfaces the missing-evidence message).
-*/
-function discoverRuntimeReport(scanRoot) {
-	for (const c of discoverEvidenceCandidates(scanRoot)) return c.path;
-}
-/**
-* Audit W10 — runtime shape validation at the rule→Finding boundary.
-* A finding record coming out of a rule (plugin/JSON-manifest rules are
-* external data, not trusted internal code) must carry the fields the
-* whole downstream pipeline indexes on: severity within the enum,
-* integer line ≥ 1, non-empty message, and a file path. Malformed
-* records are rejected (routed to the crash/plugin-error channel by the
-* caller) — never silently scored.
-*/
-function isValidFindingRecord(f) {
-	if (typeof f !== "object" || f === null) return false;
-	const rec = f;
-	if (rec["severity"] !== "error" && rec["severity"] !== "warning" && rec["severity"] !== "info") return false;
-	if (typeof rec["line"] !== "number" || !Number.isInteger(rec["line"]) || rec["line"] < 1) return false;
-	if (typeof rec["message"] !== "string" || rec["message"] === "") return false;
-	if (typeof rec["file"] !== "string" || rec["file"] === "") return false;
-	return true;
-}
-/**
-* Testable default scan path core. `hooks` lets callers observe
-* normally-invisible events (swallowed rule crashes) without changing
-* the ScanResult contract beyond the rulesCrashed counter.
-*
-* Async since the Verification Trust Evolution Plan Phase 0.5 (§10): the
-* per-file loop awaits the adapter parse stage (WASM grammar load is
-* inherently async); `runRules` and every rule stay synchronous and
-* consume `ParsedFile.ast`. Callers await the returned promise.
-*/
-async function runScan(args, hooks = {}) {
-	const started = Date.now();
-	const deadline = started + args.maxDurationMs;
-	const discovered = discoverWorkspace(args.target);
-	const targetAbs = resolve(args.target);
-	const scanRoot = discovered && discovered.root !== targetAbs && targetAbs.startsWith(discovered.root + sep) ? {
-		...discovered,
-		root: targetAbs
-	} : discovered ?? fallbackWorkspace(targetAbs);
-	const workspace = scanRoot;
-	if (args.verbose) hooks.onConfigWarning?.(`verbose: scan root (config/ignore anchor): ${workspace.root}`);
-	const findings = [];
-	let skippedFiles = 0;
-	let testFileCount = 0;
-	let testDeclarationCount = 0;
-	const declarationsByFile = /* @__PURE__ */ new Map();
-	let rulesCrashed = 0;
-	const truncationReasons = /* @__PURE__ */ new Set();
-	let discoveryTruncated = false;
-	let rulesPartial = false;
-	let scopeIgnored = 0;
-	let scopeUnrecognized = 0;
-	let parseFailed = 0;
-	const fileProvenance = [];
-	const { rules: activeRules, pluginErrors, tierByRuleId: tiers, pluginMeta } = await buildUniversalRules(workspace.root, args.strict, {
-		...args.enablePlugins !== void 0 ? { enablePlugins: args.enablePlugins } : {},
-		onGateNotice: (notice) => hooks.onGateNotice ? hooks.onGateNotice(notice) : console.error(notice)
-	});
-	const tierByRuleId = tiers;
-	const pluginsLoaded = pluginMeta;
-	const REVISION_BY_RULE_ID = new Map(activeRules.map((r) => [r.id, r.detectorRevision ?? MEASURED_FP[r.id]?.detectorRevision ?? 1]));
-	const cache = args.cache ? createScanCache(workspace.root) : disabledScanCache;
-	const rulesDigest = computeRulesDigest(activeRules);
-	for (const perr of pluginErrors) findings.push({
-		ruleId: "QA-PLUGIN-000",
-		category: "QA-PW",
-		severity: "warning",
-		confidence: "high",
-		findingType: "deterministic-defect",
-		qaImpact: "HYGIENE",
-		evidenceLevel: "E2",
-		file: "mjolnir.config.json",
-		line: 1,
-		column: 1,
-		message: `Plugin problem: ${perr}`,
-		why: "A configured plugin could not be loaded or declared invalid rules — its checks are silently missing from this scan.",
-		fix: "Fix or remove the plugin entry in mjolnir.config.json."
-	});
-	const ctx = {
-		workspace,
-		testFiles: [],
-		deadline,
-		maxFiles: LIMITS$1.maxFilesPerAdapter,
-		ignoreMatcher: createIgnoreMatcher(workspace.root),
-		onSkippedFile: (reason) => {
-			skippedFiles++;
-			truncationReasons.add(reason);
-		},
-		onDiscoveryTruncated: (reason) => {
-			discoveryTruncated = true;
-			if (!truncationReasons.has(reason)) {
-				truncationReasons.add(reason);
-				skippedFiles++;
-			}
-		},
-		onRuleCrash: (ruleId, file, error) => {
-			rulesCrashed++;
-			hooks.onRuleCrash?.(ruleId, file, error);
-		},
-		onIgnored: () => {
-			scopeIgnored++;
-		},
-		onUnrecognized: () => {
-			scopeUnrecognized++;
+			else re += "(?:[^/]+/)*";
+			continue;
 		}
-	};
+		re += segment.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replaceAll("*", "[^/]*");
+		if (!last) re += "/";
+	}
+	return new RegExp(`${re}$`).test(p);
+}
+/**
+* Plan §16 + WI-11: locate a runtime run report next to the scan
+* target, using the exact conventions the forensics ingestion already
+* accepts. Zero-config search over conventional artifact names at
+* depth ≤ 2 (src/discovery/evidence-discovery.ts). The FIRST parsable
+* candidate with `totalTests > 0` is kept as a fallback; the loop
+* continues and returns a later candidate when one with
+* `analysisComplete === true` is found. Returns the parsed report
+* alongside the path to avoid double-parsing.
+*/
+function discoverAndParseRuntimeReport(scanRoot) {
+	let fallback;
+	for (const c of discoverEvidenceCandidates(scanRoot)) try {
+		const fr = runForensics(c.path, { writeFlakyMd: false });
+		if (fr.report.totalTests <= 0) continue;
+		if (!fallback) fallback = {
+			path: c.path,
+			report: fr.report
+		};
+		if (fr.report.analysisComplete === true) return {
+			path: c.path,
+			report: fr.report
+		};
+	} catch {}
+	return fallback;
+}
+/**
+* Audit W10 — runtime shape validation at the rule→Finding boundary.
+* A finding record coming out of a rule (plugin/JSON-manifest rules are
+* external data, not trusted internal code) must carry the fields the
+* whole downstream pipeline indexes on: severity within the enum,
+* integer line ≥ 1, non-empty message, and a file path. Malformed
+* records are rejected (routed to the crash/plugin-error channel by the
+* caller) — never silently scored.
+*/
+function isValidFindingRecord(f) {
+	if (typeof f !== "object" || f === null) return false;
+	const rec = f;
+	if (rec["severity"] !== "error" && rec["severity"] !== "warning" && rec["severity"] !== "info") return false;
+	if (typeof rec["line"] !== "number" || !Number.isInteger(rec["line"]) || rec["line"] < 1) return false;
+	if (typeof rec["message"] !== "string" || rec["message"] === "") return false;
+	if (typeof rec["file"] !== "string" || rec["file"] === "") return false;
+	return true;
+}
+/**
+* Replace 7-way nested ternary with a linear probe.
+* Returns the adapter whose `isTestFile` matches the path, falling
+* back to the TypeScript adapter (the default language).
+*/
+function selectAdapter(path) {
+	if (githubActionsAdapter.isTestFile(path)) return githubActionsAdapter;
+	if (azurePipelinesAdapter.isTestFile(path)) return azurePipelinesAdapter;
+	if (jenkinsAdapter.isTestFile(path)) return jenkinsAdapter;
+	if (pythonAdapter.isTestFile(path)) return pythonAdapter;
+	if (javaAdapter.isTestFile(path)) return javaAdapter;
+	if (csharpAdapter.isTestFile(path)) return csharpAdapter;
+	return typescriptAdapter;
+}
+function discoverTestFilesPhase(workspace, args, hooks, scanRoot, ctx) {
 	const languageAdapters = SCAN_ADAPTERS.filter((a) => a.id !== "github-actions" && a.id !== "azure-pipelines" && a.id !== "jenkins");
 	const buckets = new Map(languageAdapters.map((a) => [a.id, []]));
 	discoverAllTestFiles(ctx, languageAdapters, buckets, /* @__PURE__ */ new Map());
@@ -13391,22 +14276,29 @@ async function runScan(args, hooks = {}) {
 		done: ctx.testFiles.length,
 		total: ctx.testFiles.length
 	});
+	return {
+		testFiles: ctx.testFiles,
+		stagedSurface
+	};
+}
+async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules, hooks, cache, rulesDigest, deadline, truncationReasons, declarationsByFile, fileProvenance, onRuleCrash) {
+	let skippedFiles = 0;
+	let testFileCount = 0;
+	let testDeclarationCount = 0;
+	let rulesPartial = false;
+	let parseFailed = 0;
 	let scanned = 0;
-	for (const path of ctx.testFiles) {
+	for (const path of testFiles) {
 		if (Date.now() > deadline) {
 			rulesPartial = true;
-			skippedFiles += ctx.testFiles.length - scanned;
+			skippedFiles += testFiles.length - scanned;
 			truncationReasons.add("rule-loop-deadline");
 			break;
 		}
 		scanned++;
-		const isWorkflow = githubActionsAdapter.isTestFile(path);
-		const isAzurePipeline = azurePipelinesAdapter.isTestFile(path);
-		const isJenkinsfile = jenkinsAdapter.isTestFile(path);
-		const isPython = pythonAdapter.isTestFile(path);
-		const isJava = javaAdapter.isTestFile(path);
-		const isCs = csharpAdapter.isTestFile(path);
-		if (!isWorkflow && !isAzurePipeline && !isJenkinsfile) testFileCount++;
+		const adapter = selectAdapter(path);
+		const isCiAdapter = adapter.id === "github-actions" || adapter.id === "azure-pipelines" || adapter.id === "jenkins";
+		if (!isCiAdapter) testFileCount++;
 		let text;
 		try {
 			text = readFileSync(path, "utf8").replace(/^\uFEFF/, "").replace(/\r\n?/g, "\n");
@@ -13415,9 +14307,17 @@ async function runScan(args, hooks = {}) {
 			continue;
 		}
 		let fileBudgetExceeded = false;
+		let fileRuleFailed = false;
 		const relPath = relative(workspace.root, path).replaceAll("\\", "/");
-		if (!isWorkflow && !isAzurePipeline && !isJenkinsfile) {
-			const decls = countTestDeclarations(text);
+		if (!isCiAdapter) {
+			const lang = {
+				typescript: "typescript",
+				python: "python",
+				java: "java",
+				csharp: "csharp"
+			}[adapter.id] ?? "typescript";
+			const codeView = getCodeTextForCounting(text, lang);
+			const decls = countTestDeclarations(text, codeView);
 			testDeclarationCount += decls;
 			declarationsByFile.set(relPath, decls);
 			fileProvenance.push({
@@ -13425,7 +14325,6 @@ async function runScan(args, hooks = {}) {
 				provenance: classifyProvenance({ text })
 			});
 		}
-		const adapter = isWorkflow ? githubActionsAdapter : isAzurePipeline ? azurePipelinesAdapter : isJenkinsfile ? jenkinsAdapter : isPython ? pythonAdapter : isJava ? javaAdapter : isCs ? csharpAdapter : typescriptAdapter;
 		const wantsAst = adapter.parseAst !== void 0 && Date.now() <= deadline;
 		const identity = (mode) => ({
 			relPath,
@@ -13441,7 +14340,7 @@ async function runScan(args, hooks = {}) {
 		hooks.onProgress?.({
 			phase: "parse",
 			done: scanned,
-			total: ctx.testFiles.length,
+			total: testFiles.length,
 			detail: relPath
 		});
 		const parsedFile = {
@@ -13455,7 +14354,7 @@ async function runScan(args, hooks = {}) {
 				hooks.onProgress?.({
 					phase: "rules",
 					done: scanned,
-					total: ctx.testFiles.length,
+					total: testFiles.length,
 					detail: relPath
 				});
 				parsed = await adapter.parseAst(parsedFile);
@@ -13475,7 +14374,8 @@ async function runScan(args, hooks = {}) {
 			} : parsedFile;
 			adapter.runRules(activeRules, fileForRules, (f, ruleId, category) => {
 				if (!isValidFindingRecord(f)) {
-					ctx.onRuleCrash?.(ruleId, relPath, /* @__PURE__ */ new Error(`malformed finding record rejected (severity/line/message must be present, severity ∈ error|warning|info): ${JSON.stringify(f)}`));
+					fileRuleFailed = true;
+					onRuleCrash?.(ruleId, relPath, /* @__PURE__ */ new Error(`malformed finding record rejected (severity/line/message must be present, severity ∈ error|warning|info): ${JSON.stringify(f)}`));
 					return;
 				}
 				findings.push({
@@ -13484,7 +14384,8 @@ async function runScan(args, hooks = {}) {
 					category
 				});
 			}, (ruleId, error) => {
-				ctx.onRuleCrash?.(ruleId, relPath, error);
+				fileRuleFailed = true;
+				onRuleCrash?.(ruleId, relPath, error);
 			}, {
 				deadline: Math.min(deadline, Date.now() + LIMITS$1.maxFileAnalysisMs),
 				onExceeded: () => {
@@ -13494,7 +14395,7 @@ async function runScan(args, hooks = {}) {
 					fileBudgetExceeded = true;
 				}
 			});
-			cache.store(cacheKey, findings.slice(findingsStart), fileBudgetExceeded);
+			if (!fileRuleFailed) cache.store(cacheKey, findings.slice(findingsStart), fileBudgetExceeded);
 		} catch {
 			skippedFiles++;
 			parseFailed++;
@@ -13502,6 +14403,41 @@ async function runScan(args, hooks = {}) {
 			parsed?.dispose();
 		}
 	}
+	return {
+		skippedFiles,
+		testFileCount,
+		testDeclarationCount,
+		rulesPartial,
+		parseFailed,
+		scanned
+	};
+}
+/**
+* Summarize forensic classifications from an ingested runtime report
+* (plan §10.4, WAVE 5). Returns undefined when no verdict carries a
+* classification — the machine contract slot stays absent rather than
+* reporting all-zero counts.
+*/
+function summarizeForensicVerdicts(report) {
+	if (report.analysisComplete !== true) return void 0;
+	const byVerdict = {};
+	let classifications = 0;
+	let inconclusive = 0;
+	for (const v of report.verdicts) {
+		if (!v.forensic) continue;
+		classifications++;
+		const label = v.forensic.verdict;
+		byVerdict[label] = (byVerdict[label] ?? 0) + 1;
+		if (label === "inconclusive") inconclusive++;
+	}
+	if (classifications === 0) return void 0;
+	return {
+		classifications,
+		byVerdict,
+		inconclusive
+	};
+}
+function applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, declarationsByFile, testDeclarationCount, tierByRuleId, REVISION_BY_RULE_ID) {
 	let scopeInfo = { scope: "all" };
 	if (args.scopeChanged) {
 		const diff = computeChangedScope(workspace.root, args.base);
@@ -13547,104 +14483,350 @@ async function runScan(args, hooks = {}) {
 	}
 	enforceTierPolicy(findings, tierByRuleId);
 	for (const f of findings) f.fixGroupId = f.ruleId;
-	const runtimeReportPath = discoverRuntimeReport(scanRoot.root);
-	if (runtimeReportPath) try {
-		const fr = runForensics(runtimeReportPath, { writeFlakyMd: false });
-		const evidence = buildEvidenceRecords(fr.report, runtimeReportPath);
-		stampRuntimeCorroboration(findings, fr.report, evidence);
+	const discoveredReport = discoverAndParseRuntimeReport(scanRoot.root);
+	const runtimeReportPath = discoveredReport?.path;
+	let forensicVerdicts;
+	if (discoveredReport && discoveredReport.report.analysisComplete === true) try {
+		buildEvidenceRecords(discoveredReport.report, discoveredReport.path);
+		stampRuntimeCorroboration(findings, discoveredReport.report, workspace.root);
+		forensicVerdicts = summarizeForensicVerdicts(discoveredReport.report);
 	} catch {}
-	hooks.onProgress?.({
+	return {
+		testDeclarationCount,
+		scopeInfo,
+		suppressionCount,
+		frameworks,
+		runtimeReportPath,
+		forensicVerdicts,
+		config
+	};
+}
+/**
+* ECO-003: Partition findings by package for monorepo analysis.
+* Uses the dependency graph to assign findings to their nearest package
+* manifest, falling back to the workspace root.
+*/
+function partitionFindingsByPackage(findings, depGraph, workspaceRoot, declarationsByFile, analysisComplete) {
+	const packageMap = /* @__PURE__ */ new Map();
+	const addPackage = (path) => {
+		const entry = {
+			packageName: path === "" ? "root" : basename(path),
+			path: path || ".",
+			findings: [],
+			testDeclarations: 0,
+			testFileCount: 0
+		};
+		packageMap.set(path, entry);
+		return entry;
+	};
+	for (const manifestPath of depGraph.allPaths) {
+		const path = relative(workspaceRoot, dirname(manifestPath)).replaceAll("\\", "/");
+		if (path === ".." || path.startsWith("../")) continue;
+		if (!packageMap.has(path)) addPackage(path);
+	}
+	const packageForFile = (file) => {
+		const normalizedFile = file.replaceAll("\\", "/");
+		let bestPath = "";
+		for (const path of packageMap.keys()) if (path.length > bestPath.length && normalizedFile.startsWith(path + "/")) bestPath = path;
+		return packageMap.get(bestPath) ?? addPackage("");
+	};
+	for (const f of findings) packageForFile(f.file).findings.push(f);
+	for (const [file, declarations] of declarationsByFile) {
+		const target = packageForFile(file);
+		target.testDeclarations += declarations;
+		target.testFileCount++;
+	}
+	return [...packageMap.values()].map((p) => ({
+		packageName: p.packageName,
+		path: p.path,
+		findings: p.findings,
+		score: analysisComplete && p.testDeclarations > 0 && p.testFileCount > 0 ? computeTotal(computeDimensions(p.findings), p.findings, {
+			testDeclarations: p.testDeclarations,
+			testFileCount: p.testFileCount,
+			suiteInvalidatingRuleIds: SUITE_INVALIDATING_RULE_IDS
+		}) : null
+	}));
+}
+function assembleScanResult(o) {
+	o.hooks.onProgress?.({
 		phase: "score",
-		done: findings.length
+		done: o.findings.length
 	});
-	const dimensions = computeDimensions(findings);
-	const rawDeductions = findings.reduce((sum, f) => sum + deductionFor(f), 0);
+	const dimensions = computeDimensions(o.findings);
+	const rawDeductions = o.findings.reduce((sum, f) => sum + deductionFor(f), 0);
 	const effectiveDeductions = rawDeductions;
-	const total = computeTotal(dimensions, findings, {
-		testDeclarations: testDeclarationCount,
-		testFileCount,
+	const total = computeTotal(dimensions, o.findings, {
+		testDeclarations: o.testDeclarationCount,
+		testFileCount: o.testFileCount,
 		suiteInvalidatingRuleIds: SUITE_INVALIDATING_RULE_IDS
 	});
-	const elapsed = Date.now() - started;
+	const elapsed = Date.now() - o.started;
 	const scopeReasons = [];
-	if (scopeIgnored > 0) scopeReasons.push(`ignored:${scopeIgnored}`);
-	if (scopeUnrecognized > 0) scopeReasons.push(`unrecognized:${scopeUnrecognized}`);
-	if (parseFailed > 0) scopeReasons.push(`parseFailed:${parseFailed}`);
-	for (const reason of truncationReasons) scopeReasons.push(`truncated:${reason}`);
+	if (o.scopeIgnored > 0) scopeReasons.push(`ignored:${o.scopeIgnored}`);
+	if (o.scopeUnrecognized > 0) scopeReasons.push(`unrecognized:${o.scopeUnrecognized}`);
+	if (o.parseFailed > 0) scopeReasons.push(`parseFailed:${o.parseFailed}`);
+	for (const reason of o.truncationReasons) scopeReasons.push(`truncated:${reason}`);
 	const scopeIntegrity = {
-		discovered: ctx.testFiles.length,
-		analyzed: Math.max(0, scanned),
-		ignored: scopeIgnored,
-		unrecognized: scopeUnrecognized,
-		parseFailed,
-		truncated: truncationReasons.size,
+		discovered: o.testFiles.length,
+		analyzed: Math.max(0, o.scanned),
+		ignored: o.scopeIgnored,
+		unrecognized: o.scopeUnrecognized,
+		parseFailed: o.parseFailed,
+		truncated: o.truncationReasons.size,
 		scopeVerdict: scopeReasons.length === 0 ? "PROVEN" : "PARTIAL",
 		...scopeReasons.length > 0 ? { reasons: scopeReasons } : {}
 	};
+	const scopeAdjustedTotal = scopeReasons.length > 0 && total >= 100 ? 99 : total;
+	const inputSnapshot = o.testFiles.map((p) => {
+		const relPath = relative(o.workspace.root, p).replaceAll("\\", "/");
+		try {
+			const content = readFileSync(p);
+			const hash = createHash("sha256").update(content).digest("hex").slice(0, 16);
+			return {
+				path: relPath,
+				size: content.length,
+				hash
+			};
+		} catch {
+			return {
+				path: relPath,
+				size: 0
+			};
+		}
+	});
+	let reportDigest;
+	if (o.runtimeReportPath) try {
+		const reportBytes = readFileSync(o.runtimeReportPath);
+		reportDigest = createHash("sha256").update(reportBytes).digest("hex").slice(0, 16);
+	} catch {}
 	const runIdentity = buildRunIdentity({
-		files: ctx.testFiles.map((p) => {
-			try {
-				return {
-					path: relative(workspace.root, p).replaceAll("\\", "/"),
-					size: statSync(p).size
-				};
-			} catch {
-				return {
-					path: relative(workspace.root, p).replaceAll("\\", "/"),
-					size: 0
-				};
-			}
-		}),
-		rules: [...REVISION_BY_RULE_ID.entries()].map(([id, detectorRevision]) => ({
+		files: inputSnapshot,
+		rules: [...o.REVISION_BY_RULE_ID.entries()].map(([id, detectorRevision]) => ({
 			id,
 			detectorRevision
 		})),
-		config: null,
-		engineVersion: ENGINE_VERSION
+		config: o.config ?? null,
+		engineVersion: ENGINE_VERSION,
+		reportDigest,
+		trustModelVersion: TRUST_MODEL_VERSION,
+		scoringModelVersion: SCORING_MODEL_VERSION,
+		frameworkSupportMatrixVersion: FRAMEWORK_SUPPORT_MATRIX_VERSION,
+		evidenceSchemaVersions: [1]
 	});
 	const evidenceGraph = buildEvidenceGraph({ runId: runIdentity });
-	const hasTests = testFileCount > 0;
+	const hasTests = o.testFileCount > 0 && o.testDeclarationCount > 0;
+	const suiteInvalidatedBy = [...new Set(o.findings.filter((f) => SUITE_INVALIDATING_RULE_IDS.has(f.ruleId)).map((f) => f.ruleId))].sort();
 	const result = {
 		schemaVersion: 1,
-		partial: discoveryTruncated || rulesPartial || skippedFiles > 0,
+		partial: o.discoveryTruncated || o.rulesPartial || o.skippedFiles > 0 || o.rulesCrashed > 0 || o.scopeInfo.degraded !== void 0,
 		scopeIntegrity,
 		runIdentity,
 		evidenceGraph,
-		score: hasTests ? total : null,
+		score: hasTests ? scopeAdjustedTotal : null,
 		...hasTests ? {} : { reason: "no-tests-found" },
-		frameworks: frameworks.frameworks,
-		frameworkDetectionUnknown: frameworks.unknown,
-		...args.scopeChanged ? {
-			scope: scopeInfo.scope,
-			...scopeInfo.degraded ? { scopeDegraded: scopeInfo.degraded } : {}
+		frameworks: o.frameworks.frameworks,
+		frameworkDetectionUnknown: o.frameworks.unknown,
+		...o.args.scopeChanged ? {
+			scope: o.scopeInfo.scope,
+			...o.scopeInfo.degraded ? { scopeDegraded: o.scopeInfo.degraded } : {}
 		} : {},
-		...stagedSurface ? { staged: { files: testFileCount } } : {},
+		...o.stagedSurface ? { staged: { files: o.testFileCount } } : {},
 		dimensions,
-		findings,
-		testFileCount,
-		testDeclarationCount,
+		findings: o.findings,
+		testFileCount: o.testFileCount,
+		testDeclarationCount: o.testDeclarationCount,
 		rawDeductions,
 		effectiveDeductions,
-		suppressionCount,
-		...pluginsLoaded.length > 0 ? { plugins: pluginsLoaded } : {},
-		agenticProfile: computeAgenticProfile(fileProvenance, findings),
-		...args.cache ? { cache: {
-			hits: cache.stats.hits,
-			misses: cache.stats.misses,
-			file: cache.stats.file
+		suppressionCount: o.suppressionCount,
+		...o.pluginsLoaded.length > 0 ? { plugins: o.pluginsLoaded } : {},
+		...suiteInvalidatedBy.length > 0 ? { suiteInvalidatedBy } : {},
+		agenticProfile: computeAgenticProfile(o.fileProvenance, o.findings),
+		...o.forensicVerdicts !== void 0 ? { forensicVerdicts: o.forensicVerdicts } : {},
+		...o.args.cache ? { cache: {
+			hits: o.cache.stats.hits,
+			misses: o.cache.stats.misses,
+			file: o.cache.stats.file
 		} } : {},
 		analysisStatus: {
-			discovery: discoveryTruncated ? "partial" : "complete",
-			rules: rulesPartial ? "partial" : "complete",
-			skippedFiles,
+			discovery: o.discoveryTruncated ? "partial" : "complete",
+			rules: o.rulesPartial ? "partial" : "complete",
+			skippedFiles: o.skippedFiles,
 			durationMs: elapsed,
-			rulesCrashed,
-			...truncationReasons.size > 0 ? { truncationReasons: [...truncationReasons].sort() } : {}
-		}
+			rulesCrashed: o.rulesCrashed,
+			...o.truncationReasons.size > 0 ? { truncationReasons: [...o.truncationReasons].sort() } : {}
+		},
+		scoringModelVersion: SCORING_MODEL_VERSION
 	};
-	result.trustSummary = buildTrustSummary(result, declarationsByFile);
-	cache.persist();
+	result.trustSummary = buildTrustSummary(result, o.declarationsByFile);
+	if (o.findings.length > 0) result.correlationConclusions = correlateFindings(o.findings);
+	if (o.dependencyGraph && o.dependencyGraph.size > 0) {
+		let edges = 0;
+		for (const p of o.dependencyGraph.allPaths) edges += o.dependencyGraph.getDependencies(p).length;
+		result.dependencyGraph = {
+			nodes: o.dependencyGraph.size,
+			edges
+		};
+	}
+	if (o.args.monorepo && o.dependencyGraph && o.dependencyGraph.size > 1) {
+		const packages = partitionFindingsByPackage(o.findings, o.dependencyGraph, o.workspace.root, o.declarationsByFile, !result.partial && scopeReasons.length === 0 && !o.args.scopeChanged);
+		if (packages.length > 1) {
+			const monorepoResult = analyzeMonorepo(packages, { weightingStrategy: "worst-package" });
+			result.monorepoAnalysis = {
+				packages: monorepoResult.packages.map((p) => ({
+					packageName: p.packageName,
+					path: p.path,
+					findings: p.findings.length,
+					score: p.score,
+					verdict: p.verdict
+				})),
+				overallScore: monorepoResult.overallScore,
+				overallVerdict: monorepoResult.overallVerdict,
+				strategy: monorepoResult.strategy,
+				...monorepoResult.blockerPackage ? { blockerPackage: monorepoResult.blockerPackage } : {}
+			};
+		}
+	}
+	o.cache.persist();
+	return result;
+}
+/**
+* Testable default scan path core. `hooks` lets callers observe
+* normally-invisible events (swallowed rule crashes) without changing
+* the ScanResult contract beyond the rulesCrashed counter.
+*
+* Async since the Verification Trust Evolution Plan Phase 0.5 (§10): the
+* per-file loop awaits the adapter parse stage (WASM grammar load is
+* inherently async); `runRules` and every rule stay synchronous and
+* consume `ParsedFile.ast`. Callers await the returned promise.
+*/
+async function runScan(args, hooks = {}) {
+	const started = Date.now();
+	const deadline = started + args.maxDurationMs;
+	const discovered = discoverWorkspace(args.target);
+	const targetAbs = resolve(args.target);
+	const scanRoot = discovered && discovered.root !== targetAbs && targetAbs.startsWith(discovered.root + sep) ? {
+		...discovered,
+		root: targetAbs
+	} : discovered ?? fallbackWorkspace(targetAbs);
+	const workspace = scanRoot;
+	if (args.verbose) hooks.onConfigWarning?.(`verbose: scan root (config/ignore anchor): ${workspace.root}`);
+	const findings = [];
+	let skippedFiles = 0;
+	let testFileCount = 0;
+	let testDeclarationCount = 0;
+	const declarationsByFile = /* @__PURE__ */ new Map();
+	let rulesCrashed = 0;
+	const truncationReasons = /* @__PURE__ */ new Set();
+	let discoveryTruncated = false;
+	let rulesPartial = false;
+	let scopeIgnored = 0;
+	let scopeUnrecognized = 0;
+	let parseFailed = 0;
+	const fileProvenance = [];
+	const { rules: activeRules, pluginErrors, tierByRuleId: tiers, pluginMeta } = await buildUniversalRules(workspace.root, args.strict, {
+		...args.enablePlugins !== void 0 ? { enablePlugins: args.enablePlugins } : {},
+		onGateNotice: (notice) => hooks.onGateNotice ? hooks.onGateNotice(notice) : console.error(notice)
+	});
+	const tierByRuleId = tiers;
+	const pluginsLoaded = pluginMeta;
+	const REVISION_BY_RULE_ID = new Map(activeRules.map((r) => [r.id, r.detectorRevision ?? MEASURED_FP[r.id]?.detectorRevision ?? 1]));
+	const cache = args.cache ? createScanCache(workspace.root) : disabledScanCache;
+	const depGraph = buildDependencyGraph(workspace.root);
+	const rulesDigest = `complete-file-v1:${computeRulesDigest(activeRules)}`;
+	if (args.cache && args.verbose) {
+		const safety = isIncrementalSafe([]);
+		if (!safety.safe) hooks.onConfigWarning?.(`incremental: ${safety.reasons.join("; ")}`);
+	}
+	for (const perr of pluginErrors) findings.push({
+		ruleId: "QA-PLUGIN-000",
+		category: "QA-PW",
+		severity: "warning",
+		confidence: "high",
+		findingType: "deterministic-defect",
+		qaImpact: "HYGIENE",
+		evidenceLevel: "E2",
+		file: "mjolnir.config.json",
+		line: 1,
+		column: 1,
+		message: `Plugin problem: ${perr}`,
+		why: "A configured plugin could not be loaded or declared invalid rules — its checks are silently missing from this scan.",
+		fix: "Fix or remove the plugin entry in mjolnir.config.json."
+	});
+	const { testFiles, stagedSurface } = discoverTestFilesPhase(workspace, args, hooks, scanRoot, {
+		workspace,
+		testFiles: [],
+		deadline,
+		maxFiles: LIMITS$1.maxFilesPerAdapter,
+		ignoreMatcher: createIgnoreMatcher(workspace.root),
+		onSkippedFile: (reason) => {
+			skippedFiles++;
+			truncationReasons.add(reason);
+		},
+		onDiscoveryTruncated: (reason) => {
+			discoveryTruncated = true;
+			if (!truncationReasons.has(reason)) {
+				truncationReasons.add(reason);
+				skippedFiles++;
+			}
+		},
+		onRuleCrash: (ruleId, file, error) => {
+			rulesCrashed++;
+			hooks.onRuleCrash?.(ruleId, file, error);
+		},
+		onIgnored: () => {
+			scopeIgnored++;
+		},
+		onUnrecognized: () => {
+			scopeUnrecognized++;
+		}
+	});
+	const analysis = await runFileAnalysisPhase(findings, testFiles, workspace, activeRules, hooks, cache, rulesDigest, deadline, truncationReasons, declarationsByFile, fileProvenance, (ruleId, file, error) => {
+		rulesCrashed++;
+		hooks.onRuleCrash?.(ruleId, file, error);
+	});
+	skippedFiles += analysis.skippedFiles;
+	testFileCount = analysis.testFileCount;
+	testDeclarationCount = analysis.testDeclarationCount;
+	rulesPartial = analysis.rulesPartial;
+	parseFailed = analysis.parseFailed;
+	const scanned = analysis.scanned;
+	const postScan = applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, declarationsByFile, testDeclarationCount, tierByRuleId, REVISION_BY_RULE_ID);
+	testDeclarationCount = postScan.testDeclarationCount;
+	const result = assembleScanResult({
+		findings,
+		testFileCount,
+		testDeclarationCount,
+		declarationsByFile,
+		skippedFiles,
+		rulesCrashed,
+		truncationReasons,
+		discoveryTruncated,
+		rulesPartial,
+		scopeIgnored,
+		scopeUnrecognized,
+		parseFailed,
+		scanned,
+		testFiles,
+		workspace,
+		scanRoot,
+		args,
+		hooks,
+		cache,
+		REVISION_BY_RULE_ID,
+		pluginsLoaded,
+		scopeInfo: postScan.scopeInfo,
+		suppressionCount: postScan.suppressionCount,
+		frameworks: postScan.frameworks,
+		runtimeReportPath: postScan.runtimeReportPath,
+		forensicVerdicts: postScan.forensicVerdicts,
+		config: postScan.config,
+		fileProvenance,
+		started,
+		stagedSurface,
+		dependencyGraph: depGraph
+	});
 	await releaseTreeSitterResources();
+	resetTsMorphProject();
 	return result;
 }
 /**
@@ -13693,10 +14875,14 @@ function canonicalScanJson(result) {
 	});
 }
 /** Advisory when the DERIVED evidence level is E0 (same rule as scoring). */
+function effectiveEvidenceLevel(f) {
+	return f.evidenceLevel ?? deriveEvidenceLevel(f.findingType, f.confidence);
+}
 function isAdvisory(f) {
-	return (f.evidenceLevel ?? deriveEvidenceLevel(f.findingType, f.confidence)) === "E0";
+	return effectiveEvidenceLevel(f) === "E0";
 }
-function levelFor(f) {
+function levelFor(f, evidenceLevel = effectiveEvidenceLevel(f)) {
+	if (evidenceLevel === "E0") return "notice";
 	if (f.severity === "error") return "failure";
 	if (f.severity === "warning") return "warning";
 	return "notice";
@@ -13710,15 +14896,18 @@ function countBy(findings, predicate) {
 */
 function buildMachineContract(result) {
 	const digest = createHash("sha256").update(canonicalScanJson(result)).digest("hex");
-	const annotations = result.findings.map((f) => ({
-		path: f.file,
-		start_line: f.line,
-		annotation_level: levelFor(f),
-		message: `${f.ruleId}: ${f.message}`,
-		ruleId: f.ruleId,
-		...f.detectorRevision !== void 0 ? { detectorRevision: f.detectorRevision } : {},
-		advisory: isAdvisory(f)
-	}));
+	const annotations = result.findings.map((f) => {
+		const evidenceLevel = effectiveEvidenceLevel(f);
+		return {
+			path: f.file,
+			start_line: f.line,
+			annotation_level: levelFor(f, evidenceLevel),
+			message: `${f.ruleId}: ${f.message}`,
+			ruleId: f.ruleId,
+			...f.detectorRevision !== void 0 ? { detectorRevision: f.detectorRevision } : {},
+			advisory: evidenceLevel === "E0"
+		};
+	});
 	return {
 		contractVersion: 1,
 		summary: {
@@ -13743,7 +14932,8 @@ function buildMachineContract(result) {
 			durationMs: result.analysisStatus.durationMs
 		},
 		...result.trustSummary !== void 0 ? { trustSummary: result.trustSummary } : {},
-		...result.agenticProfile !== void 0 ? { provenance: result.agenticProfile } : {}
+		...result.agenticProfile !== void 0 ? { provenance: result.agenticProfile } : {},
+		...result.forensicVerdicts !== void 0 ? { forensicVerdicts: result.forensicVerdicts } : {}
 	};
 }
 //#endregion
@@ -13838,11 +15028,19 @@ function explainRule(ruleId, fixturesRoot) {
 	};
 }
 //#endregion
+//#region src/engine/finding-identity.ts
+/**
+* Correlation identity for before/after comparison: ruleId + file +
+* message, deliberately EXCLUDING line — a source edit that shifts a
+* finding still correlates. Shared by baseline, impact, and resolution.
+*/
+function findingFingerprint(f) {
+	return `${f.ruleId}\u0000${f.file}\u0000${f.message}`;
+}
+//#endregion
 //#region src/engine/resolution.ts
 /** Correlation identity (v1-compatible): ruleId\0file\0message. */
-function fingerprint$1(entry) {
-	return `${entry.ruleId}\u0000${entry.file}\u0000${entry.message}`;
-}
+const fingerprint$1 = findingFingerprint;
 /**
 * The §15 ordered algorithm. Pure; first match wins.
 */
@@ -13917,11 +15115,9 @@ const REGISTRY_REVISIONS = new Map(RULES.map((r) => [r.id, r.detectorRevision ??
 * occurrence location, not a durable identity; message rewording,
 * file renames and rule-id changes correlate as resolved+new
 * (documented limitation). Exported for the handoff verification
-* contract — do not duplicate this algorithm.
+* contract — re-exported from engine/finding-identity.js (ENGINE-002).
 */
-function fingerprint(f) {
-	return `${f.ruleId}\u0000${f.file}\u0000${f.message}`;
-}
+const fingerprint = findingFingerprint;
 function loadBaseline(path, onWarning) {
 	if (!existsSync(path)) return null;
 	try {
@@ -14098,7 +15294,7 @@ function nextActionFor(v) {
 	switch (classifyVerdict(v)) {
 		case "RETRY-DEPENDENT": return `repeat execution of this test (3+ runs) to confirm the flake rate, then quarantine + ticket: ${v.file}`;
 		case "TIMEOUT": return `re-run in isolation to separate slowness from a hang: npx playwright test ${v.file} --timeout 60000`;
-		case "FAILING": return `reproduce locally: npx playwright test ${v.file} -g "${v.title.replace(/"/g, "\\\"")}" — then fix and re-run`;
+		case "FAILING": return `reproduce locally: npx playwright test ${v.file} -g "${v.title.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}" — then fix and re-run`;
 		case "SKIPPED": return `inspect the skip condition in ${v.file} — a skip after a failure usually hides an environment problem`;
 	}
 }
@@ -14127,6 +15323,9 @@ function renderTriageWorkflowJson(report) {
 		artifact: "mjolnir-triage-workflow",
 		source: report.source,
 		totalTests: report.totalTests,
+		analysisComplete: report.analysisComplete,
+		skippedReports: report.skippedReports,
+		incompleteReasons: report.incompleteReasons,
 		rows: workflowRows(report)
 	}, null, 2) + "\n";
 }
@@ -14225,10 +15424,16 @@ const MCP_TOOLS = [
 		description: "Explain one rule: what it detects, why it matters, how to fix it, plus its measured FP rate and trust metadata. Read-only; never runs a scan.",
 		inputSchema: {
 			type: "object",
-			properties: { ruleId: {
-				type: "string",
-				description: "e.g. QA-PW-101"
-			} },
+			properties: {
+				ruleId: {
+					type: "string",
+					description: "e.g. QA-PW-101"
+				},
+				fixturesRoot: {
+					type: "string",
+					description: "Root directory for fixture lookups (defaults to cwd)."
+				}
+			},
 			required: ["ruleId"]
 		}
 	},
@@ -14380,7 +15585,16 @@ async function handleToolCall(call) {
 		}
 		if (call.name === "explain") {
 			const ruleId = call.args["ruleId"];
-			const explanation = explainRule(ruleId, process.cwd());
+			const rawFixturesRoot = call.args["fixturesRoot"];
+			if (rawFixturesRoot !== void 0 && typeof rawFixturesRoot !== "string") return {
+				jsonrpc: "2.0",
+				id: call.id,
+				error: {
+					code: MCP_ERRORS.INVALID_PARAMS,
+					message: "fixturesRoot must be a string"
+				}
+			};
+			const explanation = explainRule(ruleId, (typeof rawFixturesRoot === "string" ? rawFixturesRoot : void 0) ?? process.cwd());
 			if (!explanation.ok) return {
 				jsonrpc: "2.0",
 				id: call.id,
@@ -14525,13 +15739,13 @@ async function handleToolCall(call) {
 			id: call.id,
 			error: {
 				code: MCP_ERRORS.INTERNAL,
-				message: errorMessage(err)
+				message: errorMessage$1(err)
 			}
 		};
 	}
 }
 /** Normalize any thrown value to a string (unit-tested both arms). */
-function errorMessage(err) {
+function errorMessage$1(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 /** JSON-RPC request shape validation (strict — §21). */
@@ -14636,6 +15850,14 @@ async function handleMcpMessage(msg) {
 	};
 }
 //#endregion
+//#region src/cli-io.ts
+/**
+* The single error-to-message derivation shared by every catch site:
+* Error instances render their message; anything else is stringified
+* honestly (a hostile non-Error throw must surface, not vanish).
+*/
+const errorMessage = (err) => err instanceof Error ? err.message : String(err);
+//#endregion
 //#region src/mcp/transport.ts
 /**
 * MCP stdio transport loop (blueprint §21 — the framing around the
@@ -14648,12 +15870,52 @@ async function handleMcpMessage(msg) {
 * (stdio.ts) exits 0 after it.
 */
 /**
+* Extract and validate a JSON-RPC request ID. Returns null if absent or
+* invalid (JSON-RPC ID must be a string, number, or null — not an object).
+*/
+function normalizeJsonRpcId(msg) {
+	if (typeof msg !== "object" || msg === null) return null;
+	const id = msg["id"];
+	if (typeof id === "string" || typeof id === "number") return id;
+	return null;
+}
+/**
 * Drive the transport over arbitrary streams (real stdio in the binary,
 * PassThrough in tests). Resolves on input EOF.
 */
 async function runStdioTransport(input, output) {
 	const rl = createInterface({ input });
-	for await (const line of rl) await handleStdioLine(line, (s) => output.write(s));
+	let outputFailed = false;
+	const onOutputError = () => {
+		outputFailed = true;
+		rl.close();
+	};
+	output.once("error", onOutputError);
+	try {
+		for await (const line of rl) {
+			if (outputFailed) break;
+			try {
+				await handleStdioLine(line, (s) => {
+					if (!outputFailed) output.write(s);
+				});
+			} catch {
+				try {
+					output.write(JSON.stringify({
+						jsonrpc: "2.0",
+						id: null,
+						error: {
+							code: -32603,
+							message: "internal transport error"
+						}
+					}) + "\n");
+				} catch {
+					break;
+				}
+			}
+		}
+	} finally {
+		output.removeListener("error", onOutputError);
+	}
 }
 /**
 * Process one newline-delimited JSON-RPC frame; write the response to
@@ -14677,7 +15939,20 @@ async function handleStdioLine(line, write) {
 		})}\n`);
 		return;
 	}
-	const response = await handleMcpMessage(parsed);
+	let response;
+	try {
+		response = await handleMcpMessage(parsed);
+		if (response) response.id = normalizeJsonRpcId(parsed);
+	} catch (err) {
+		response = {
+			jsonrpc: "2.0",
+			id: normalizeJsonRpcId(parsed),
+			error: {
+				code: -32603,
+				message: errorMessage(err)
+			}
+		};
+	}
 	write(`${JSON.stringify(response)}\n`);
 }
 //#endregion
@@ -14699,6 +15974,9 @@ async function handleStdioLine(line, write) {
 * subprocess coverage cannot merge into the parent istanbul report,
 * same class as dist/**), so it is excluded from the coverage ratchet.
 */
-runStdioTransport(process.stdin, process.stdout).then(() => process.exit(0));
+runStdioTransport(process.stdin, process.stdout).then(() => process.exit(0)).catch((err) => {
+	process.stderr.write(`mjolnir mcp fatal: ${err instanceof Error ? err.message : err}\n`);
+	process.exitCode = 20;
+});
 //#endregion
 export {};