mjolnir-qa 2.0.0 → 2.1.0

package/CHANGELOG.md

@@ -9,6 +9,101 @@ Rule behavior changes (new rules, FP-rate changes against the corpus,
 severity changes) are first-class entries here — rule IDs are immutable
 once shipped, so this file is the record of what changed between versions.
 
+## [Unreleased]
+
+## [2.1.0] — 2026-09-24
+
+### Added
+
+- Added seven milestone commands to the public CLI and root help:
+  - `mjolnir ci-integrity` validates GitHub/GitLab/Jenkins scan gates and reports non-blocking or disabled candidates.
+  - `mjolnir framework-maturity` reports bounded F0–F5 maturity while preserving human calibration authority.
+  - `mjolnir suppression-gate` evaluates reasons, expiry, allowlists, total counts, and matched-finding mass suppression.
+  - `mjolnir cross-file` reports duplicate test names, shared imports, circular dependencies, and amplified findings.
+  - `mjolnir contract-verify` validates machine-contract fields and binds persisted contracts to a fresh scan.
+  - `mjolnir trust-trend` persists, deduplicates, and compares trust snapshots.
+  - `mjolnir evidence-graph` builds provenance-bearing evidence graphs and supports file/rule queries.
+- Added a zero-touch PR framework: Conventional Commit enforcement, seeded property tests, merge-result verification, and local/CI command-parity checks.
+- Added dedicated, discoverable property and fuzz suites. Fuzz cases use fixed seeds; property tests remain isolated from default coverage collection.
+- Added CI integrity, suppression, contract, provenance, cross-file, and trust regression suites covering malformed input, partial scans, inactive suppressions, and platform-stable exit behavior.
+- Added stable-only `v1`/`v2` action-tag maintenance. RC tags never move stable consumer tags.
+- Added pinned current corpus revisions and local fixture tree revisions. Baseline counts were not rewritten; corpus drift remains an explicit audit failure.
+
+### Fixed
+
+- Fixed false-green milestone engines:
+  - machine-contract verification now compares every contract projection, including optional provenance and forensic verdicts;
+  - trust snapshots use caller-provided timestamps instead of an embedded wall clock;
+  - suppression mass uses actual matched pre-suppression findings and active suppressions;
+  - evidence provenance is derived from real file contents;
+  - cross-file dependency analysis uses the requested target root;
+  - framework maturity uses the supported F5 ceiling.
+- Fixed persisted contract handling: documents use strict runtime schema validation and are verified against a fresh scan rather than self-attesting.
+- Fixed zero-finding and partial-scan reporting so incomplete or unclassified analysis cannot render as a clean, proven, or merge-ready suite.
+- Fixed CI workflow audit parsing to fail closed for dynamic conditions, `continue-on-error`, negated commands, multi-pipe status masking, inactive GitLab rules, advisory `after_script` commands, and missing blocking scans.
+- Fixed the coverage job/ratchet mismatch: merge verification now generates the coverage summary it enforces.
+- Fixed stress determinism by normalizing both analysis and machine-contract duration fields, running real concurrent scans, and making the 10k workflow validate JSON even when findings are advisory.
+- Fixed property/fuzz discovery and workflow trigger/name so required PR checks are actually produced.
+- Fixed root help, command registry, README, and release documentation drift for the new command surface.
+
+### Security
+
+- The composite Action and generated CI surfaces use exact released versions, immutable action references, least-privilege permissions, and explicit exit semantics.
+- The composite Action defaults to blocking on findings and partial scans; advisory behavior requires an explicit opt-out.
+- Release publication is isolated from `main`, uses audited artifacts, npm OIDC trusted publishing with provenance, npm 11.5.1+, a `next` RC dist-tag, and verified GitHub prerelease assets.
+- Pull-request shell inputs and workflow-derived values are passed through environment variables instead of direct `${{ }}` interpolation.
+- Machine-contract, suppression-policy, roadmap, and persisted-artifact validation now reject malformed and adversarial inputs rather than fabricating or trusting them.
+- Main-branch deletion and the complete required PR check matrix are enforced by repository ruleset `01`. The repository is solo-maintained, so the owner explicitly chose not to require a second approving review.
+
+### Performance
+
+- Centralized deterministic CLI timing normalization and expanded replay, soak, and concurrent stress coverage.
+- Added bounded corpus scans, exact source revisions, and fail-closed baseline provenance checks.
+- Added practical pipeline/command regression tests without changing the frozen 96% branch ratchet.
+
+### Testing
+
+- Full instrumented release gate: 408 test files, 10,351 passing tests, one expected failure documenting the outstanding orphan corpus baseline, and five intentional skips.
+- Coverage ratchet at release: 98.58% statements, 96.00% branches, 99.38% functions, and 98.84% lines.
+- Focused gates green: build, lint, typecheck, certification, property, fuzz, stress/soak/concurrency, release/workflow contract tests, pack audit, brand, site, and local/CI parity.
+- Historical failed runs remain historical evidence; they are not retroactively changed.
+
+### Changed
+
+- `ci-local` now runs one complete instrumented suite plus property/fuzz/ratchet/audit/brand/site/parity gates instead of silently omitting release checks.
+- Release promotion is explicit and branch/tag based; merging the version PR does not itself publish npm.
+- Suppression counts and governance outputs distinguish configured, active, expired, and matched findings.
+- Rule IDs remain immutable across the 2.x line. Existing detector contracts,
+  including `QA-PW-001`, retain their identity while framework maturity and
+  evidence quality improve around them.
+- The CLI command registry is shared by help, dispatch, and CI-integrity classification.
+
+### Breaking changes
+
+- The package now requires Node.js `>=22.18`.
+- Direct composite-Action consumers now get blocking defaults for findings and partial scans unless they explicitly opt out.
+- Generated CI installation remains opt-in/advisory for first adoption; use `mjolnir ci install --gate error` when an enforcing install is required.
+- Stable release publication no longer occurs automatically from `main`; use the protected release branch and release workflow.
+- The historical `v2.0.3` tag is retained unchanged. This release does not move, delete, or republish that tag.
+
+### Migration
+
+1. Install or invoke `mjolnir-qa@2.1.0` with Node.js 22.18 or newer.
+2. Replace floating Action versions with `@v2` or the exact `v2.1.0` tag when reproducible enforcement is required.
+3. Review suppression expiry/allowlist policy before enabling `suppression-gate`; existing entries are policy data, not proof of human validation.
+4. Run the seven new commands in report mode first and review their JSON before making them release gates.
+5. Adjudicate remaining corpus count/orphan drift and human/design-partner validation separately; this release does not claim those are closed.
+
+## [2.0.2] — 2026-09-22
+
+### Fixed
+
+- **NPM executable metadata** — shipped the package-name `mjolnir-qa` bin
+  alias alongside `mjolnir` in the packed tarball, so fresh installs and
+  `npx mjolnir-qa@latest` resolve the CLI consistently. This intentionally
+  keeps the Mjölnir package/CLI identity and does not include the abandoned
+  QA Doctor rebrand.
+
 ## [2.0.0] — 2026-09-17
 
 ### Fixed
@@ -19,8 +114,6 @@ once shipped, so this file is the record of what changed between versions.
 
 - **Version bump** — bumped package version from 1.1.1 to 2.0.0 across all surfaces (package.json, ENGINE_VERSION, smithery.yaml, rule metadata, docs).
 
-## [Unreleased]
-
 ## [1.1.1] — 2026-09-16
 
 ### Fixed

package/README.ar.md

@@ -81,7 +81,7 @@ npx mjolnir-qa@latest
 فحص حقيقي لـ [`examples/demo-repo`](examples/demo-repo)، وهي مجموعة Playwright صغيرة مع workflow لـ CI. هنا ذهبت نقاطها:
 
 <p align="center">
-  <img src="assets/readme/terminal-hero.svg" alt="تفصيل الخصومات في Mjölnir: WORTHINESS 75/100 NEEDS WORK، والدرجة حسب الفئة، ومربع الخصومات حسب الخطورة، وقائمة FIX THIS FIRST" width="520" />
+  <img src="assets/readme/terminal-hero.svg" alt="تفصيل الخصومات في Mjölnir: WORTHINESS 80/100 WORTHY، والدرجة حسب الفئة، ومربع الخصومات حسب الخطورة، وقائمة FIX THIS FIRST" width="520" />
 </p>
 
 <sub>مولَّد بواسطة `npm run docs:hero` من فحص حقيقي ومقفل ضد الانحراف في CI. تقرير `--verbose` الكامل للفحص نفسه هو [`demo.svg`](assets/readme/demo.svg) (`npm run docs:demo`).</sub>
@@ -312,8 +312,8 @@ e2e/login.spec.ts
   role/text: 1 · testid: 0 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 
 e2e/checkout.spec.ts
-  [█████████████████░░░]  86 / 100
-  role/text: 3 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
+  [██████████████████░░]  88 / 100
+  role/text: 4 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 ```
 
 هذا يقيس **المتانة، لا الصحة**. ينجح `.btn.btn-primary > div:nth-child(2)` اليوم ويظل ينجح إلى أن يلمس أحدٌ الترميز. الدرجة المنخفضة لا تدّعي أبدًا أن الاختبار معطوب، بل فقط أنه يعتمد على ترميز لم يعد أحد بالحفاظ عليه.

package/README.bn.md

@@ -81,7 +81,7 @@ Mjölnir স্যুট, CI workflow, এবং আপনার কাছে
 [`examples/demo-repo`](examples/demo-repo)-এর একটি প্রকৃত স্ক্যান, CI workflow সহ একটি ছোট Playwright স্যুট। এখানেই এর পয়েন্ট গেছে:
 
 <p align="center">
-  <img src="assets/readme/terminal-hero.svg" alt="Mjölnir-এর deduction breakdown: WORTHINESS 75/100 NEEDS WORK, বিভাগ অনুযায়ী স্কোর, severity অনুযায়ী deduction box, এবং একটি FIX THIS FIRST তালিকা" width="520" />
+  <img src="assets/readme/terminal-hero.svg" alt="Mjölnir-এর deduction breakdown: WORTHINESS 80/100 WORTHY, বিভাগ অনুযায়ী স্কোর, severity অনুযায়ী deduction box, এবং একটি FIX THIS FIRST তালিকা" width="520" />
 </p>
 
 <sub>`npm run docs:hero` দ্বারা একটি প্রকৃত স্ক্যান থেকে তৈরি এবং CI-তে বিচ্যুতির বিরুদ্ধে লক করা। একই স্ক্যানের সম্পূর্ণ `--verbose` রিপোর্ট হলো [`demo.svg`](assets/readme/demo.svg) (`npm run docs:demo`)।</sub>
@@ -312,8 +312,8 @@ e2e/login.spec.ts
   role/text: 1 · testid: 0 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 
 e2e/checkout.spec.ts
-  [█████████████████░░░]  86 / 100
-  role/text: 3 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
+  [██████████████████░░]  88 / 100
+  role/text: 4 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 ```
 
 এটি **resilience পরিমাপ করে, correctness নয়**। `.btn.btn-primary > div:nth-child(2)` আজ পাস করে এবং কেউ markup স্পর্শ না করা পর্যন্ত পাস হতে থাকে। একটি কম স্কোর কখনো দাবি করে না যে টেস্টটি ভাঙা, শুধু বলে যে এটি এমন markup-এর উপর নির্ভরশীল যা রাখার প্রতিশ্রুতি কেউ দেয়নি।

package/README.br.md

@@ -81,7 +81,7 @@ O Mjölnir lê a suíte, os workflows de CI e, se você tiver, o relatório de u
 Um scan real de [`examples/demo-repo`](examples/demo-repo), uma pequena suíte Playwright com um workflow de CI. Foi para cá que os pontos dela foram:
 
 <p align="center">
-  <img src="assets/readme/terminal-hero.svg" alt="O detalhamento das deduções do Mjölnir: WORTHINESS 75/100 NEEDS WORK, a pontuação por categoria, o quadro de deduções por severidade e uma lista FIX THIS FIRST" width="520" />
+  <img src="assets/readme/terminal-hero.svg" alt="O detalhamento das deduções do Mjölnir: WORTHINESS 80/100 WORTHY, a pontuação por categoria, o quadro de deduções por severidade e uma lista FIX THIS FIRST" width="520" />
 </p>
 
 <sub>Gerado por `npm run docs:hero` a partir de um scan real e travado contra desvios na CI. O relatório `--verbose` completo do mesmo scan é [`demo.svg`](assets/readme/demo.svg) (`npm run docs:demo`).</sub>
@@ -312,8 +312,8 @@ e2e/login.spec.ts
   role/text: 1 · testid: 0 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 
 e2e/checkout.spec.ts
-  [█████████████████░░░]  86 / 100
-  role/text: 3 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
+  [██████████████████░░]  88 / 100
+  role/text: 4 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 ```
 
 Isso mede **resiliência, não correção**. `.btn.btn-primary > div:nth-child(2)` passa hoje e continua passando até alguém mexer no markup. Uma pontuação baixa nunca afirma que o teste está quebrado, só que ele depende de um markup que ninguém prometeu manter.

package/README.bs.md

@@ -81,7 +81,7 @@ Mjölnir čita skup testova, CI workflowe i, ako ga imate, izvještaj stvarnog p
 Stvarno skeniranje [`examples/demo-repo`](examples/demo-repo), malog Playwright skupa testova s CI workflowom. Evo gdje su otišli njegovi bodovi:
 
 <p align="center">
-  <img src="assets/readme/terminal-hero.svg" alt="Mjölnirov pregled odbitaka: WORTHINESS 75/100 NEEDS WORK, ocjena po kategoriji, okvir odbitaka po ozbiljnosti i lista FIX THIS FIRST" width="520" />
+  <img src="assets/readme/terminal-hero.svg" alt="Mjölnirov pregled odbitaka: WORTHINESS 80/100 WORTHY, ocjena po kategoriji, okvir odbitaka po ozbiljnosti i lista FIX THIS FIRST" width="520" />
 </p>
 
 <sub>Generisano naredbom `npm run docs:hero` iz stvarnog skeniranja i zaključano protiv odstupanja u CI-ju. Puni `--verbose` izvještaj istog skeniranja je [`demo.svg`](assets/readme/demo.svg) (`npm run docs:demo`).</sub>
@@ -312,8 +312,8 @@ e2e/login.spec.ts
   role/text: 1 · testid: 0 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 
 e2e/checkout.spec.ts
-  [█████████████████░░░]  86 / 100
-  role/text: 3 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
+  [██████████████████░░]  88 / 100
+  role/text: 4 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 ```
 
 Ovo mjeri **otpornost, a ne ispravnost**. `.btn.btn-primary > div:nth-child(2)` prolazi danas i nastavlja prolaziti dok neko ne dirne markup. Niska ocjena nikad ne tvrdi da je test pokvaren, samo da zavisi od markupa koji niko nije obećao sačuvati.

package/README.da.md

@@ -81,7 +81,7 @@ Mjölnir læser testsuiten, CI-workflowene og, hvis du har en, rapporten fra en
 Et rigtigt scan af [`examples/demo-repo`](examples/demo-repo), en lille Playwright-suite med et CI-workflow. Her er, hvor dens point forsvandt hen:
 
 <p align="center">
-  <img src="assets/readme/terminal-hero.svg" alt="Mjölnirs opgørelse af fradrag: WORTHINESS 75/100 NEEDS WORK, scoren pr. kategori, fradragsboksen pr. alvorlighed og en FIX THIS FIRST-liste" width="520" />
+  <img src="assets/readme/terminal-hero.svg" alt="Mjölnirs opgørelse af fradrag: WORTHINESS 80/100 WORTHY, scoren pr. kategori, fradragsboksen pr. alvorlighed og en FIX THIS FIRST-liste" width="520" />
 </p>
 
 <sub>Genereret af `npm run docs:hero` ud fra et rigtigt scan og låst mod afvigelser i CI. Den fulde `--verbose`-rapport fra samme scan er [`demo.svg`](assets/readme/demo.svg) (`npm run docs:demo`).</sub>
@@ -312,8 +312,8 @@ e2e/login.spec.ts
   role/text: 1 · testid: 0 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 
 e2e/checkout.spec.ts
-  [█████████████████░░░]  86 / 100
-  role/text: 3 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
+  [██████████████████░░]  88 / 100
+  role/text: 4 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 ```
 
 Det måler **robusthed, ikke korrekthed**. `.btn.btn-primary > div:nth-child(2)` består i dag og bliver ved med at bestå, indtil nogen rører ved markuppen. En lav score påstår aldrig, at testen er i stykker, kun at den afhænger af markup, som ingen har lovet at bevare.

package/README.de.md

@@ -81,7 +81,7 @@ Mjölnir liest die Testsuite, die CI-Workflows und, falls vorhanden, den Report
 Ein echter Scan von [`examples/demo-repo`](examples/demo-repo), einer kleinen Playwright-Suite mit CI-Workflow. Hier sind seine Punkte geblieben:
 
 <p align="center">
-  <img src="assets/readme/terminal-hero.svg" alt="Mjölnirs Abzugsaufschlüsselung: WORTHINESS 75/100 NEEDS WORK, der Score nach Kategorie, die Abzugsbox nach Schweregrad und eine FIX THIS FIRST-Liste" width="520" />
+  <img src="assets/readme/terminal-hero.svg" alt="Mjölnirs Abzugsaufschlüsselung: WORTHINESS 80/100 WORTHY, der Score nach Kategorie, die Abzugsbox nach Schweregrad und eine FIX THIS FIRST-Liste" width="520" />
 </p>
 
 <sub>Erzeugt mit `npm run docs:hero` aus einem echten Scan und in der CI gegen Abweichungen gesichert. Der vollständige `--verbose`-Report desselben Scans ist [`demo.svg`](assets/readme/demo.svg) (`npm run docs:demo`).</sub>
@@ -312,8 +312,8 @@ e2e/login.spec.ts
   role/text: 1 · testid: 0 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 
 e2e/checkout.spec.ts
-  [█████████████████░░░]  86 / 100
-  role/text: 3 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
+  [██████████████████░░]  88 / 100
+  role/text: 4 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 ```
 
 Das misst **Robustheit, nicht Korrektheit**. `.btn.btn-primary > div:nth-child(2)` besteht heute und besteht weiter, bis jemand das Markup anfasst. Ein niedriger Score behauptet nie, der Test sei kaputt, nur dass er von Markup abhängt, dessen Erhalt niemand versprochen hat.

package/README.es.md

@@ -81,7 +81,7 @@ Mjölnir lee la suite, los workflows de CI y, si lo tienes, el informe de una ej
 Un escaneo real de [`examples/demo-repo`](examples/demo-repo), una pequeña suite de Playwright con un workflow de CI. Aquí es adonde fueron sus puntos:
 
 <p align="center">
-  <img src="assets/readme/terminal-hero.svg" alt="El desglose de deducciones de Mjölnir: WORTHINESS 75/100 NEEDS WORK, la puntuación por categoría, el cuadro de deducciones por severidad y una lista FIX THIS FIRST" width="520" />
+  <img src="assets/readme/terminal-hero.svg" alt="El desglose de deducciones de Mjölnir: WORTHINESS 80/100 WORTHY, la puntuación por categoría, el cuadro de deducciones por severidad y una lista FIX THIS FIRST" width="520" />
 </p>
 
 <sub>Generado con `npm run docs:hero` a partir de un escaneo real y bloqueado contra desviaciones en CI. El informe `--verbose` completo del mismo escaneo es [`demo.svg`](assets/readme/demo.svg) (`npm run docs:demo`).</sub>
@@ -312,8 +312,8 @@ e2e/login.spec.ts
   role/text: 1 · testid: 0 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 
 e2e/checkout.spec.ts
-  [█████████████████░░░]  86 / 100
-  role/text: 3 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
+  [██████████████████░░]  88 / 100
+  role/text: 4 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 ```
 
 Esto mide **resiliencia, no corrección**. `.btn.btn-primary > div:nth-child(2)` pasa hoy y sigue pasando hasta que alguien toca el marcado. Una puntuación baja nunca afirma que el test esté roto, solo que depende de un marcado que nadie prometió mantener.

package/README.fr.md

@@ -81,7 +81,7 @@ Mjölnir lit la suite, les workflows CI et, si vous en avez un, le rapport d'une
 Un vrai scan de [`examples/demo-repo`](examples/demo-repo), une petite suite Playwright avec un workflow CI. Voici où sont partis ses points :
 
 <p align="center">
-  <img src="assets/readme/terminal-hero.svg" alt="Le détail des déductions de Mjölnir : WORTHINESS 75/100 NEEDS WORK, le score par catégorie, l'encadré des déductions par sévérité et une liste FIX THIS FIRST" width="520" />
+  <img src="assets/readme/terminal-hero.svg" alt="Le détail des déductions de Mjölnir : WORTHINESS 80/100 WORTHY, le score par catégorie, l'encadré des déductions par sévérité et une liste FIX THIS FIRST" width="520" />
 </p>
 
 <sub>Généré par `npm run docs:hero` à partir d'un vrai scan et verrouillé contre toute dérive en CI. Le rapport `--verbose` complet du même scan est [`demo.svg`](assets/readme/demo.svg) (`npm run docs:demo`).</sub>
@@ -312,8 +312,8 @@ e2e/login.spec.ts
   role/text: 1 · testid: 0 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 
 e2e/checkout.spec.ts
-  [█████████████████░░░]  86 / 100
-  role/text: 3 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
+  [██████████████████░░]  88 / 100
+  role/text: 4 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 ```
 
 Cela mesure la **robustesse, pas l'exactitude**. `.btn.btn-primary > div:nth-child(2)` passe aujourd'hui et continue de passer jusqu'à ce que quelqu'un touche au balisage. Un score bas n'affirme jamais que le test est cassé, seulement qu'il dépend d'un balisage que personne n'a promis de conserver.

package/README.gr.md

@@ -81,7 +81,7 @@ npx mjolnir-qa@latest
 Μια πραγματική σάρωση του [`examples/demo-repo`](examples/demo-repo), μιας μικρής σουίτας Playwright με CI workflow. Εδώ πήγαν οι πόντοι της:
 
 <p align="center">
-  <img src="assets/readme/terminal-hero.svg" alt="Η ανάλυση αφαιρέσεων του Mjölnir: WORTHINESS 75/100 NEEDS WORK, η βαθμολογία ανά κατηγορία, το πλαίσιο αφαιρέσεων ανά σοβαρότητα και μια λίστα FIX THIS FIRST" width="520" />
+  <img src="assets/readme/terminal-hero.svg" alt="Η ανάλυση αφαιρέσεων του Mjölnir: WORTHINESS 80/100 WORTHY, η βαθμολογία ανά κατηγορία, το πλαίσιο αφαιρέσεων ανά σοβαρότητα και μια λίστα FIX THIS FIRST" width="520" />
 </p>
 
 <sub>Δημιουργείται με `npm run docs:hero` από πραγματική σάρωση και κλειδώνεται έναντι αποκλίσεων στο CI. Η πλήρης αναφορά `--verbose` της ίδιας σάρωσης είναι το [`demo.svg`](assets/readme/demo.svg) (`npm run docs:demo`).</sub>
@@ -312,8 +312,8 @@ e2e/login.spec.ts
   role/text: 1 · testid: 0 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 
 e2e/checkout.spec.ts
-  [█████████████████░░░]  86 / 100
-  role/text: 3 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
+  [██████████████████░░]  88 / 100
+  role/text: 4 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 ```
 
 Αυτό μετρά **ανθεκτικότητα, όχι ορθότητα**. Το `.btn.btn-primary > div:nth-child(2)` περνά σήμερα και θα συνεχίσει να περνά μέχρι κάποιος να αγγίξει το markup. Μια χαμηλή βαθμολογία δεν ισχυρίζεται ποτέ ότι το τεστ είναι χαλασμένο, μόνο ότι εξαρτάται από markup που κανείς δεν υποσχέθηκε να διατηρήσει.

package/README.he.md

@@ -81,7 +81,7 @@ Mjölnir קורא את חבילת הבדיקות, את ה-workflows של ה-CI,
 סריקה אמיתית של [`examples/demo-repo`](examples/demo-repo), חבילת Playwright קטנה עם workflow של CI. לכאן הלכו הנקודות שלה:
 
 <p align="center">
-  <img src="assets/readme/terminal-hero.svg" alt="פירוט הניכויים של Mjölnir: WORTHINESS 75/100 NEEDS WORK, הציון לפי קטגוריה, תיבת הניכויים לפי חומרה ורשימת FIX THIS FIRST" width="520" />
+  <img src="assets/readme/terminal-hero.svg" alt="פירוט הניכויים של Mjölnir: WORTHINESS 80/100 WORTHY, הציון לפי קטגוריה, תיבת הניכויים לפי חומרה ורשימת FIX THIS FIRST" width="520" />
 </p>
 
 <sub>נוצר על ידי `npm run docs:hero` מסריקה אמיתית ונעול מפני סטייה ב-CI. דוח ה-`--verbose` המלא של אותה סריקה הוא [`demo.svg`](assets/readme/demo.svg) (`npm run docs:demo`).</sub>
@@ -312,8 +312,8 @@ e2e/login.spec.ts
   role/text: 1 · testid: 0 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 
 e2e/checkout.spec.ts
-  [█████████████████░░░]  86 / 100
-  role/text: 3 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
+  [██████████████████░░]  88 / 100
+  role/text: 4 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 ```
 
 זה מודד **עמידות, לא נכונות**. `.btn.btn-primary > div:nth-child(2)` עובר היום וימשיך לעבור עד שמישהו ייגע ב-markup. ציון נמוך אף פעם לא טוען שהבדיקה שבורה, רק שהיא תלויה ב-markup שאף אחד לא הבטיח לשמור.

package/README.it.md

@@ -81,7 +81,7 @@ Mjölnir legge la suite, i workflow CI e, se ce l'hai, il report di un'esecuzion
 Una scansione reale di [`examples/demo-repo`](examples/demo-repo), una piccola suite Playwright con un workflow CI. Ecco dove sono finiti i suoi punti:
 
 <p align="center">
-  <img src="assets/readme/terminal-hero.svg" alt="Il dettaglio delle detrazioni di Mjölnir: WORTHINESS 75/100 NEEDS WORK, il punteggio per categoria, il riquadro delle detrazioni per gravità e una lista FIX THIS FIRST" width="520" />
+  <img src="assets/readme/terminal-hero.svg" alt="Il dettaglio delle detrazioni di Mjölnir: WORTHINESS 80/100 WORTHY, il punteggio per categoria, il riquadro delle detrazioni per gravità e una lista FIX THIS FIRST" width="520" />
 </p>
 
 <sub>Generato da `npm run docs:hero` a partire da una scansione reale e bloccato contro le derive in CI. Il report `--verbose` completo della stessa scansione è [`demo.svg`](assets/readme/demo.svg) (`npm run docs:demo`).</sub>
@@ -312,8 +312,8 @@ e2e/login.spec.ts
   role/text: 1 · testid: 0 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 
 e2e/checkout.spec.ts
-  [█████████████████░░░]  86 / 100
-  role/text: 3 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
+  [██████████████████░░]  88 / 100
+  role/text: 4 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 ```
 
 Questo misura la **resilienza, non la correttezza**. `.btn.btn-primary > div:nth-child(2)` passa oggi e continua a passare finché qualcuno non tocca il markup. Un punteggio basso non afferma mai che il test è rotto, solo che dipende da un markup che nessuno ha promesso di mantenere.

package/README.ja.md

@@ -81,7 +81,7 @@ Mjölnir は、テストスイート、CI workflow、そして手元にあれば
 CI workflow を持つ小さな Playwright スイート、[`examples/demo-repo`](examples/demo-repo) の実際のスキャンです。点数がどこで失われたかはこちら：
 
 <p align="center">
-  <img src="assets/readme/terminal-hero.svg" alt="Mjölnir の減点内訳：WORTHINESS 75/100 NEEDS WORK、カテゴリ別スコア、重大度別の減点ボックス、そして FIX THIS FIRST リスト" width="520" />
+  <img src="assets/readme/terminal-hero.svg" alt="Mjölnir の減点内訳：WORTHINESS 80/100 WORTHY、カテゴリ別スコア、重大度別の減点ボックス、そして FIX THIS FIRST リスト" width="520" />
 </p>
 
 <sub>`npm run docs:hero` により実際のスキャンから生成され、CI でずれがないよう固定されています。同じスキャンの完全な `--verbose` レポートは [`demo.svg`](assets/readme/demo.svg)（`npm run docs:demo`）です。</sub>
@@ -312,8 +312,8 @@ e2e/login.spec.ts
   role/text: 1 · testid: 0 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 
 e2e/checkout.spec.ts
-  [█████████████████░░░]  86 / 100
-  role/text: 3 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
+  [██████████████████░░]  88 / 100
+  role/text: 4 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 ```
 
 これが測るのは**正しさではなく耐久性**です。`.btn.btn-primary > div:nth-child(2)` は今日は通り、誰かがマークアップに触れるまで通り続けます。低いスコアはテストが壊れていると主張するものではなく、誰も維持を約束していないマークアップに依存していることを示すだけです。

package/README.ko.md

@@ -81,7 +81,7 @@ Mjölnir는 테스트 스위트와 CI workflow, 그리고 있다면 실제 실
 CI workflow가 있는 작은 Playwright 스위트인 [`examples/demo-repo`](examples/demo-repo)를 실제로 스캔한 결과입니다. 점수는 여기서 깎였습니다.
 
 <p align="center">
-  <img src="assets/readme/terminal-hero.svg" alt="Mjölnir의 감점 내역: WORTHINESS 75/100 NEEDS WORK, 카테고리별 점수, 심각도별 감점 상자, 그리고 FIX THIS FIRST 목록" width="520" />
+  <img src="assets/readme/terminal-hero.svg" alt="Mjölnir의 감점 내역: WORTHINESS 80/100 WORTHY, 카테고리별 점수, 심각도별 감점 상자, 그리고 FIX THIS FIRST 목록" width="520" />
 </p>
 
 <sub>`npm run docs:hero`가 실제 스캔으로 생성하며 CI에서 변경되지 않도록 고정됩니다. 같은 스캔의 전체 `--verbose` 리포트는 [`demo.svg`](assets/readme/demo.svg)입니다 (`npm run docs:demo`).</sub>
@@ -312,8 +312,8 @@ e2e/login.spec.ts
   role/text: 1 · testid: 0 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 
 e2e/checkout.spec.ts
-  [█████████████████░░░]  86 / 100
-  role/text: 3 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
+  [██████████████████░░]  88 / 100
+  role/text: 4 · testid: 1 · plain-css: 0 · css-chains: 1 ⚠ · xpath: 0
 ```
 
 이 점수는 **정확성이 아니라 복원력**을 측정합니다. `.btn.btn-primary > div:nth-child(2)`는 오늘 통과하고, 누군가 마크업을 건드리기 전까지 계속 통과합니다. 낮은 점수는 테스트가 망가졌다고 주장하지 않으며, 아무도 유지하겠다고 약속하지 않은 마크업에 의존한다는 뜻일 뿐입니다.