mjolnir-qa 2.1.0 → 4.0.0

package/dist/cli.mjs

@@ -1,17 +1,297 @@
 #!/usr/bin/env node
-import { $ as massCeiling, A as box, At as isAdvisoryFinding, B as headlineFor, C as buildFooter, Ct as buildEvidenceGraph, D as plainContext, Dt as RULE_CATEGORIES, E as panel, Et as QA_IMPACT_LABELS, F as scoreGauge, G as buildDependencyGraph, H as EVIDENCE, I as shouldColorize, J as classifyProvenance, K as getReachableFiles, L as shouldUseAscii, M as padTo, N as palette, O as sectionHeader, Ot as SEVERITY_ORDER$1, P as sanitizeData, Q as deductionFor, R as wrapText, S as FLAKE_GLYPH, St as ENGINE_VERSION, T as okIcon, Tt as DEDUCTIONS, U as TINT, V as BADGE_BAND, W as TRUST, X as capForTier, Y as computeAgenticProfile, Z as computeDimensions, _t as ConfigValidationError, at as SEARCHED_FOR, b as renderSuppressions, bt as isRecord$2, ct as parseWorkflow, dt as parseTsFile, et as RETIRED_RULE_IDS, ft as detectFrameworks, gt as isLintFixtureDir, h as scan_pipeline_exports, ht as globToRegExp, it as SCAN_ADAPTERS, j as measure, jt as isValidCategory, k as severityIcon, kt as deriveEvidenceLevel, lt as parseYamlGuarded, m as runScan$1, mt as createIgnoreMatcher, n as KNOWN_RULE_IDS$1, nt as getRule, ot as isAzurePipelineFixture, pt as DEFAULT_IGNORE_MATCHER, q as correlateFindings, rt as resolveGitPath, st as parseAzurePipeline, tt as RULES, ut as computeCodeText, v as loadLocalRules, vt as isSuppressionActive, w as nextStep, wt as MEASURED_FP, x as runForensics, xt as parseJsonFile, y as loadSuppressions, yt as loadConfig, z as deriveScoreState } from "./scan-pipeline-MQGUSey3.mjs";
-import { accessSync, appendFileSync, chmodSync, closeSync, constants, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { $ as BADGE_BAND, A as plainContext, At as isLintFixtureDir, B as shouldUseAscii, Bt as DEDUCTIONS, C as runForensics, Ct as computeCodeText, D as nextStep, Dt as LIMITS, E as buildFooter, Et as DEFAULT_IGNORE_MATCHER, F as padTo, Ft as isRecord$3, G as countOrNull, Gt as deriveEvidenceLevel, H as atomicTempPath, Ht as RULE_CATEGORIES, I as palette, It as parseJsonFile, J as evidenceTag, K as deriveScoreState, Kt as isAdvisoryFinding, L as sanitizeData, Lt as ENGINE_VERSION, M as severityIcon, Mt as isSuppressionActive, N as box, Nt as loadConfig, O as okIcon, Ot as createIgnoreMatcher, P as measure, Pt as readFileBounded, Q as TRUST_RUNGS, R as scoreGauge, Rt as buildEvidenceGraph, S as renderSuppressions, St as parseYamlGuarded, T as FLAKE_GLYPH, Tt as detectFrameworks, U as sweepStaleTempFiles, Ut as SEVERITY_ORDER$1, V as wrapText, Vt as QA_IMPACT_LABELS, W as writeFileAtomic, Wt as TRUST_ORDER, X as testsAnalyzedCell, Y as headlineFor, Z as verdictFor, _t as SCAN_ADAPTERS, at as correlateFindings, b as loadLocalRules, bt as parseAzurePipeline, ct as capForTier, dt as massCeiling, et as SCORE, ft as RETIRED_RULE_IDS, gt as runGit, h as scan_pipeline_exports, ht as resolveGitPath, it as getReachableFiles, j as sectionHeader, jt as ConfigValidationError, k as panel, kt as globToRegExp, lt as computeDimensions, m as runScan$1, mt as getRule, n as KNOWN_RULE_IDS$1, nt as TINT, ot as classifyProvenance, pt as RULES, q as evidenceLevelOf, qt as isValidCategory, rt as buildDependencyGraph, st as computeAgenticProfile, tt as STATUS, ut as deductionFor, v as pluginsGateOpen, vt as SEARCHED_FOR, w as sanitizeErrorText, wt as parseTsFile, x as loadSuppressions, xt as parseWorkflow, y as renderGateNotice, yt as isAzurePipelineFixture, z as shouldColorize, zt as MEASURED_FP } from "./scan-pipeline-CCJdEKNa.mjs";
+import { accessSync, appendFileSync, chmodSync, constants, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import process$1 from "node:process";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { createHash, randomBytes } from "node:crypto";
+import { createHash } from "node:crypto";
+import { execFileSync } from "node:child_process";
 import ts, { ts as ts$1 } from "ts-morph";
 import { parse } from "yaml";
-import { execFileSync } from "node:child_process";
 import { createInterface } from "node:readline";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { tmpdir } from "node:os";
 import { isDeepStrictEqual } from "node:util";
+//#region src/claim-evidence.ts
+/**
+* The one place a rendered surface decides whether it may claim "clean".
+*
+* Trust Constitution laws 1, 2 and 11:
+*   1. Unknown is not Pass.
+*   2. Unsupported is not Pass.
+*  11. Partial is never clean; a complete empty result may be clean, an
+*      incomplete empty result is INCONCLUSIVE.
+*
+* The prototype commands each grew their own version of this decision, and
+* each of them got it subtly wrong — a hardcoded zero that read as a
+* measurement, a fabricated pass on an empty run, a partial scan that exited
+* clean. One function, one decision, so a surface cannot be more confident
+* than the evidence it was given.
+*/
+/**
+* The single determination. Callers may not compute their own.
+*/
+function decideClaim(evidence) {
+	if (!evidence.supported) return {
+		state: "INCONCLUSIVE",
+		exitCode: 2,
+		reason: evidence.unsupportedReason ? `UNSUPPORTED: ${evidence.unsupportedReason}` : "UNSUPPORTED: this surface cannot make a claim about the target."
+	};
+	if (evidence.partial) return {
+		state: "INCONCLUSIVE",
+		exitCode: 2,
+		reason: "PARTIAL: the analysis did not cover the whole surface, so no clean or blocking claim is made."
+	};
+	if (evidence.blockingFindings > 0) return {
+		state: "BLOCKED",
+		exitCode: 1,
+		reason: `BLOCKED: ${evidence.blockingFindings} finding(s) at the configured gate.`
+	};
+	return {
+		state: "READY",
+		exitCode: 0,
+		reason: "READY: complete analysis, no findings at the configured gate."
+	};
+}
+/**
+* Fail-closed for a surface that has no measurement of its own. A prototype
+* command that cannot measure must say so rather than render a plausible
+* number, and must not exit clean while doing it.
+*/
+function unmeasuredClaim(surface, why) {
+	return {
+		state: "INCONCLUSIVE",
+		exitCode: 2,
+		reason: `UNMEASURED: ${surface} cannot measure this. ${why}`
+	};
+}
+/**
+* The one exit-code matrix (plan V5-002).
+*
+* Every command that finishes an analysis routes its exit code through this
+* function. The previous arrangement had each surface compute its own, and
+* the gaps were not subtle:
+*
+*   - `--score` returned `exitForFindings(...)` with no `partial` check at
+*     all, so `--score` on a truncated scan with zero findings exited 0. That
+*     is the flag CI badge and baseline tooling use.
+*   - `exitForFindings` knew nothing about partial, so any caller that forgot
+*     the check silently produced a clean result.
+*
+* The order is the contract: an incomplete analysis is INCONCLUSIVE before
+* findings are considered at all. There is no gate setting that turns a
+* partial scan into a pass — `--blocking none` suppresses *findings*, not the
+* fact that the analysis did not finish.
+*/
+function scanExitCode(input) {
+	if (input.partial) return 2;
+	if (input.gate === "advisory") return 0;
+	const gateSeverities = input.gate === "warning" ? ["error", "warning"] : ["error"];
+	return input.findings.some((f) => gateSeverities.includes(f.severity) && input.isAdvisory?.(f) !== true) ? 1 : 0;
+}
+//#endregion
+//#region src/frameworks/framework-inventory.ts
+const FRAMEWORK_INVENTORY = [
+	{
+		frameworkId: "playwright",
+		entityType: "E2E_FRAMEWORK",
+		language: "TypeScript/JavaScript",
+		executorAdapterIds: ["typescript"],
+		maturity: "F4",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F5",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: [
+			"1.44",
+			"1.45",
+			"1.46",
+			"1.47",
+			"1.48"
+		],
+		keyGapForNextLevel: "GAP-PW-006 parallelism/worker safety analysis"
+	},
+	{
+		frameworkId: "jest",
+		entityType: "TEST_FRAMEWORK",
+		language: "TypeScript/JavaScript",
+		executorAdapterIds: ["typescript"],
+		maturity: "F3",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F4",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: ["29", "30"],
+		keyGapForNextLevel: "GAP-JEST-004 lifecycle modeling"
+	},
+	{
+		frameworkId: "vitest",
+		entityType: "TEST_FRAMEWORK",
+		language: "TypeScript/JavaScript",
+		executorAdapterIds: ["typescript"],
+		maturity: "F3",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F4",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: [
+			"1.6",
+			"2.0",
+			"2.1"
+		],
+		keyGapForNextLevel: "GAP-VIT-004 lifecycle modeling"
+	},
+	{
+		frameworkId: "pytest",
+		entityType: "TEST_FRAMEWORK",
+		language: "Python",
+		executorAdapterIds: ["python"],
+		maturity: "F2",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F3",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: [
+			"7.4",
+			"8.0",
+			"8.1",
+			"8.2",
+			"8.3"
+		],
+		keyGapForNextLevel: "GAP-PY-004 lifecycle modeling"
+	},
+	{
+		frameworkId: "junit",
+		entityType: "TEST_FRAMEWORK",
+		language: "Java",
+		executorAdapterIds: ["java"],
+		maturity: "F2",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F3",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: ["5.10", "5.11"],
+		keyGapForNextLevel: "GAP-JU-004 lifecycle modeling"
+	},
+	{
+		frameworkId: "nunit",
+		entityType: "TEST_FRAMEWORK",
+		language: "C#",
+		executorAdapterIds: ["csharp"],
+		maturity: "F2",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F3",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: ["3.14", "4.2"],
+		keyGapForNextLevel: "GAP-NU-004 lifecycle modeling"
+	},
+	{
+		frameworkId: "xunit",
+		entityType: "TEST_FRAMEWORK",
+		language: "C#",
+		executorAdapterIds: ["csharp"],
+		maturity: "F2",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F3",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: ["2.9"],
+		keyGapForNextLevel: "GAP-XU-004 lifecycle modeling"
+	},
+	{
+		frameworkId: "cypress",
+		entityType: "E2E_FRAMEWORK",
+		language: "TypeScript/JavaScript",
+		executorAdapterIds: ["typescript"],
+		maturity: "F2",
+		supportStatus: "EXPERIMENTAL",
+		targetMaturity: "F3",
+		targetSupportStatus: "OFFICIAL_PARTIAL",
+		validatedVersions: ["13"],
+		keyGapForNextLevel: "GAP-CY-004 lifecycle modeling"
+	},
+	{
+		frameworkId: "selenium",
+		entityType: "AUTOMATION_LIBRARY",
+		language: "Java/TypeScript/Python",
+		executorAdapterIds: [
+			"typescript",
+			"python",
+			"java"
+		],
+		maturity: "F1",
+		supportStatus: "EXPERIMENTAL",
+		targetMaturity: "F2",
+		targetSupportStatus: "OFFICIAL_PARTIAL",
+		validatedVersions: [
+			"4.20",
+			"4.21",
+			"4.22",
+			"4.23",
+			"4.24",
+			"4.25"
+		],
+		keyGapForNextLevel: "GAP-SE-002 AST-based usage analysis"
+	},
+	{
+		frameworkId: "testng",
+		entityType: "TEST_FRAMEWORK",
+		language: "Java",
+		executorAdapterIds: ["java"],
+		maturity: "F1",
+		supportStatus: "EXPERIMENTAL",
+		targetMaturity: "F2",
+		targetSupportStatus: "OFFICIAL_PARTIAL",
+		validatedVersions: ["7.10", "7.11"],
+		keyGapForNextLevel: "GAP-TN-002 AST-based usage analysis"
+	},
+	{
+		frameworkId: "github-actions",
+		entityType: "CI_PROVIDER",
+		language: "YAML",
+		executorAdapterIds: ["github-actions"],
+		maturity: "F3",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F4",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: ["v4"],
+		keyGapForNextLevel: "GAP-GHA-004 advanced matrix strategy modeling"
+	},
+	{
+		frameworkId: "azure-devops",
+		entityType: "CI_PROVIDER",
+		language: "YAML",
+		executorAdapterIds: ["azure-pipelines"],
+		maturity: "F3",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F4",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: ["2024"],
+		keyGapForNextLevel: "GAP-AZ-004 stage dependency graph modeling"
+	},
+	{
+		frameworkId: "jenkins",
+		entityType: "CI_PROVIDER",
+		language: "Groovy/YAML",
+		executorAdapterIds: ["jenkins"],
+		maturity: "F3",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F4",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: ["2.440", "2.450"],
+		keyGapForNextLevel: "GAP-JK-004 declarative pipeline advanced features"
+	},
+	{
+		frameworkId: "gitlab-ci",
+		entityType: "CI_PROVIDER",
+		language: "YAML",
+		executorAdapterIds: [],
+		maturity: "F0",
+		supportStatus: "UNSUPPORTED",
+		targetMaturity: "F1",
+		targetSupportStatus: "DISCOVERED",
+		validatedVersions: [],
+		keyGapForNextLevel: "GAP-GL-001 basic pipeline discovery"
+	}
+];
+function getFrameworkById(frameworkId) {
+	return FRAMEWORK_INVENTORY.find((f) => f.frameworkId === frameworkId);
+}
+//#endregion
 //#region src/commands/help.ts
 /** Ordered registry — grouped by the same categories the overview uses. */
 const HELP_ENTRIES = [
@@ -247,6 +527,80 @@ const HELP_ENTRIES = [
 		summary: "run as a read-only MCP server over stdio (scan / explain / diff / verify / forensics / triage / pw-report)",
 		usage: "mjolnir mcp",
 		examples: ["mjolnir mcp"]
+	},
+	{
+		verb: "release-report",
+		summary: "release readiness verdict: GO, CONDITIONAL GO, or NO-GO",
+		usage: "mjolnir release-report [path] [--since <ref>] [--history <json>]",
+		examples: ["mjolnir release-report . --since HEAD~1"]
+	},
+	{
+		verb: "report",
+		summary: "generate a Playwright-compatible report from scan results",
+		usage: "mjolnir report [path] [--output <file>]",
+		examples: ["mjolnir report . --output playwright-report.json"]
+	},
+	{
+		verb: "trend",
+		summary: "record, show, or diff local quality trend snapshots",
+		usage: "mjolnir trend <record|show|diff> [path] [--limit <N>]",
+		examples: ["mjolnir trend record .", "mjolnir trend show ."]
+	},
+	{
+		verb: "exec-report",
+		summary: "generate executive quality KPIs, risk, and recommendations (advisory)",
+		usage: "mjolnir exec-report [path]",
+		examples: ["mjolnir exec-report ."]
+	},
+	{
+		verb: "policy",
+		summary: "initialize, validate, or check team quality policy gates",
+		usage: "mjolnir policy <init|validate|check> [path] [--policy <file>]",
+		examples: ["mjolnir policy init .", "mjolnir policy check . --policy mjolnir.policy.json"]
+	},
+	{
+		verb: "quarantine",
+		summary: "review deterministic quarantine proposals (read-only prototype)",
+		usage: "mjolnir quarantine <list|review|stats> [path]",
+		examples: ["mjolnir quarantine list .", "mjolnir quarantine stats"]
+	},
+	{
+		verb: "analyze",
+		summary: "run bounded cross-file analysis with explicit findings",
+		usage: "mjolnir analyze [path] --cross-file",
+		examples: ["mjolnir analyze . --cross-file"]
+	},
+	{
+		verb: "ci-adapter",
+		summary: "generate GitHub Actions, GitLab CI, or Jenkins templates",
+		usage: "mjolnir ci-adapter <github|gitlab|jenkins> [target]",
+		examples: ["mjolnir ci-adapter github ."]
+	},
+	{
+		verb: "dashboard",
+		summary: "generate a self-contained quality dashboard HTML artifact",
+		usage: "mjolnir dashboard [path] [--output <file>]",
+		examples: ["mjolnir dashboard . --output dashboard.html"]
+	},
+	{
+		verb: "enterprise",
+		summary: "capability manifest for deployment review — records what this product does NOT provide (no server, no SSO, no hosted tier, no compliance packet)",
+		usage: "mjolnir enterprise config [output-dir]",
+		examples: ["mjolnir enterprise config ./enterprise-output"],
+		next: "sso and compliance subcommands were removed in 4.0 — they wrote artifacts describing capabilities Mjölnir does not have. Read the manifest's `notProvided` list instead."
+	},
+	{
+		verb: "business-case",
+		summary: "measured false-positive rates per finding; a cost figure only with --incident-cost",
+		usage: "mjolnir business-case [path] [--incident-cost <n>] [--strict]",
+		examples: ["mjolnir business-case .", "mjolnir business-case . --incident-cost 25000"],
+		next: "Mjölnir will not estimate the cost of a false-green incident for you — that number has to come from your own incident history."
+	},
+	{
+		verb: "maturity",
+		summary: "presence of named QA artifacts (a signal, not a maturity score)",
+		usage: "mjolnir maturity <assess|levels> [path]",
+		examples: ["mjolnir maturity assess .", "mjolnir maturity levels"]
 	}
 ];
 /** Scan-flag entries documented per-flag via the overview. */
@@ -400,7 +754,9 @@ const GROUPS = [
 			"baseline",
 			"diff",
 			"verify",
-			"ci-integrity"
+			"ci-integrity",
+			"ci-adapter",
+			"policy"
 		]
 	},
 	{
@@ -433,7 +789,17 @@ const GROUPS = [
 			"trust-trend",
 			"evidence-graph",
 			"framework-maturity",
-			"suppression-gate"
+			"suppression-gate",
+			"business-case",
+			"release-report",
+			"report",
+			"trend",
+			"exec-report",
+			"quarantine",
+			"analyze",
+			"dashboard",
+			"enterprise",
+			"maturity"
 		]
 	},
 	{
@@ -554,19 +920,146 @@ function renderRootHelp(schemaVersion = 1, options = {}) {
 		}
 		lines.push("");
 	}
-	lines.push("Copy-paste starts:");
-	lines.push("  $ mjolnir                         score this repo's test suite");
-	lines.push("  $ mjolnir --scope changed         CI gate: only what the branch touched");
-	lines.push("  $ mjolnir ci install              write the PR workflow");
-	lines.push("  $ mjolnir forensics test-results  where the flakes hide");
-	lines.push("");
-	lines.push("Per-command help: mjolnir help <verb>   (e.g. mjolnir help fix)");
-	lines.push("");
-	lines.push(`Exit codes: ${EXIT_CODE_TABLE.map(([c]) => c).join(" · ")}`);
-	for (const [code, meaning] of EXIT_CODE_TABLE) lines.push(`  ${code.padEnd(3)} ${meaning}`);
-	lines.push("");
-	lines.push(`Docs: ${DOCS_URL}   (JSON schemaVersion ${schemaVersion}, additive-only)`);
-	return lines.join("\n");
+	lines.push("Copy-paste starts:");
+	lines.push("  $ mjolnir                         score this repo's test suite");
+	lines.push("  $ mjolnir --scope changed         CI gate: only what the branch touched");
+	lines.push("  $ mjolnir ci install              write the PR workflow");
+	lines.push("  $ mjolnir forensics test-results  where the flakes hide");
+	lines.push("");
+	lines.push("Per-command help: mjolnir help <verb>   (e.g. mjolnir help fix)");
+	lines.push("");
+	lines.push(`Exit codes: ${EXIT_CODE_TABLE.map(([c]) => c).join(" · ")}`);
+	for (const [code, meaning] of EXIT_CODE_TABLE) lines.push(`  ${code.padEnd(3)} ${meaning}`);
+	lines.push("");
+	lines.push(`Docs: ${DOCS_URL}   (JSON schemaVersion ${schemaVersion}, additive-only)`);
+	return lines.join("\n");
+}
+//#endregion
+//#region src/integrations/sentry.ts
+/**
+* Sentry crash reporting — opt-in, and inert unless a DSN is configured.
+*
+* Why opt-in: Mjölnir ships as an `npx` CLI over other people's private
+* repositories. A tool that reads a codebase must never phone home on its
+* own, so the ONLY switch is an explicit `SENTRY_DSN` in the environment.
+* Absent that, every function here returns immediately and `@sentry/node` is
+* never imported — zero network, zero added startup cost on a path whose
+* whole selling point is scan speed.
+*
+* Why an optional peer dependency: `@sentry/node` is ~1.5 MB unpacked and
+* nothing in a code scanner needs it. Making it a hard `dependency` would
+* tax every install for a feature most users never turn on, so it is an
+* optional peer: installs on request (`npm i @sentry/node`), absent by
+* default, and a missing module is handled as "reporting unavailable"
+* rather than as a crash.
+*
+* Capture points are deliberately the two EXISTING top-level catch blocks
+* (cli.ts entry, mcp/stdio.ts) rather than `process.on("uncaughtException")`
+* / `("unhandledRejection")` handlers. Registering those would silently
+* change the CLI's frozen exit-code contract (§24.1) and could keep a
+* process alive after a fatal error. One capture point per surface is
+* enough to answer "did Mjölnir itself break, and where".
+*
+* What is deliberately NOT sent: no user data (`sendDefaultPii: false`), no
+* traced request/span data (`tracesSampleRate: 0` — a batch CLI has no
+* request to trace), no console breadcrumbs, and no scan findings or file
+* contents. Events carry the error, its stack, the release, and the surface
+* that raised it.
+*/
+/** The loaded SDK, or null while reporting is off/unavailable. */
+let sdk = null;
+/**
+* Flush budget for the process-exit paths. Long enough for one HTTPS
+* envelope on a slow link, short enough that a broken network cannot turn
+* a crashed CLI into a hung one. Sentry's own default is 2s.
+*/
+const FLUSH_TIMEOUT_MS = 2e3;
+/** Writes a diagnostic without touching stdout. */
+function warn(message) {
+	process.stderr.write(`mjolnir: sentry — ${message}\n`);
+}
+/**
+* The release name Sentry groups events under. Matches the npm package
+* name so a release created from a tag and a release reported by the SDK
+* are the same release, not two half-populated ones.
+*/
+const SENTRY_RELEASE = `mjolnir-qa@${ENGINE_VERSION}`;
+/**
+* Resolve the environment tag. Unset means "a developer's machine" unless
+* CI says otherwise: a `npx` run is not a production event, and filing
+* those under `production` would poison the issue stream with noise from
+* end users triaging their own repos.
+*/
+function resolveEnvironment() {
+	const fromEnv = process.env.SENTRY_ENVIRONMENT?.trim();
+	if (fromEnv) return fromEnv;
+	return process.env.CI ? "ci" : "local";
+}
+/**
+* Turn reporting on if — and only if — a DSN is configured. Safe to call
+* from every entry point: the second call is a no-op that returns the
+* already-decided answer, so a process that reaches two surfaces cannot
+* initialize the SDK twice.
+*
+* Returns true when reporting is live. Never throws: a monitoring
+* integration that can take down the tool it monitors has failed at its
+* one job.
+*/
+async function initSentry() {
+	if (sdk) return true;
+	const dsn = process.env.SENTRY_DSN?.trim();
+	if (!dsn) return false;
+	let loaded;
+	try {
+		loaded = await import("@sentry/node");
+	} catch {
+		warn("SENTRY_DSN is set but @sentry/node is not installed. Install it with: npm install @sentry/node");
+		return false;
+	}
+	try {
+		loaded.init({
+			dsn,
+			release: SENTRY_RELEASE,
+			environment: resolveEnvironment(),
+			tracesSampleRate: 0,
+			sendDefaultPii: false,
+			attachStacktrace: true
+		});
+	} catch (error) {
+		warn(`SDK init failed (${error instanceof Error ? error.message : String(error)}). Crash reporting stays off.`);
+		return false;
+	}
+	sdk = loaded;
+	return true;
+}
+/**
+* Report one fatal error. `surface` names the entry point that raised it
+* ("cli" or "mcp") so the issue stream can be split by how Mjölnir was
+* being used when it broke. A non-Error throw is reported as-is rather
+* than dropped: a hostile throw value is exactly the case worth seeing.
+*/
+function captureInternalError(error, surface) {
+	if (!sdk) return;
+	try {
+		sdk.captureException(error, { tags: { surface } });
+	} catch (captureError) {
+		warn(`capture failed (${captureError instanceof Error ? captureError.message : String(captureError)}).`);
+	}
+}
+/**
+* Deliver anything buffered before the process exits. Awaits the SDK's
+* own transport drain and returns whether the envelope was handed off;
+* the caller is on an exit path, so the answer is deliberately not
+* surfaced as a failure — a lost crash report must not change the exit
+* code a caller (or CI) is about to read.
+*/
+async function flushSentry(timeoutMs = FLUSH_TIMEOUT_MS) {
+	if (!sdk) return false;
+	try {
+		return await sdk.flush(timeoutMs);
+	} catch {
+		return false;
+	}
 }
 //#endregion
 //#region src/integrations/ci-install.ts
@@ -583,8 +1076,10 @@ function renderRootHelp(schemaVersion = 1, options = {}) {
 * `ciInstall` silently overwrote hand-customized workflows. The template now
 * mirrors the dogfooded `.github/workflows/mjolnir.yml` (pinned action SHAs,
 * `if: always()` on reporting steps, a real gate step that reads
-* `mjolnir.json`, partial scans never block) and `ciInstall` refuses to
-* replace a customized workflow without an explicit `--force`.
+* `mjolnir.json`, and `ciInstall` refuses to replace a customized workflow
+* without an explicit `--force`. A partial scan FAILS the generated gate: an
+* analysis that did not finish has not proven anything about the surface it
+* did not reach.
 */
 /**
 * The gate-check script embedded in generated workflows (and executed
@@ -609,8 +1104,8 @@ function gateScript(gate) {
 		"  process.exit(1);",
 		"}",
 		"if (r.partial === true) {",
-		"  process.stdout.write(\"Scan was PARTIAL - some files were not analyzed; gate not enforced.\\n\");",
-		"  process.exit(0);",
+		"  process.stderr.write(\"Scan was PARTIAL - some files were not analyzed, so the surface is unverified. Failing: an incomplete scan is not a pass.\\n\");",
+		"  process.exit(1);",
 		"}",
 		"const findings = Array.isArray(r.findings) ? r.findings : [];",
 		"const errors = findings.filter(function (f) { return f && f.severity === \"error\"; }).length;",
@@ -621,6 +1116,39 @@ function gateScript(gate) {
 	].join("\n");
 }
 /**
+* The npm version a generated workflow should install.
+*
+* A generated CI workflow that names a version npm does not have is not a
+* configuration file, it is a 404 on the first run. While the working
+* candidate is a release candidate, `CLI_VERSION` is not on the registry, so
+* the npx template used to emit a tarball URL that could not resolve.
+*
+* Resolution order:
+*  1. `publishedStable` from the nearest package.json — the record of the last
+*     published release, present in current builds.
+*  2. That package's own `version` — correct for an installed published
+*     package (3.0.0 shipped before `publishedStable` existed).
+*  3. `CLI_VERSION` — a development build, where naming the working version
+*     is the honest description of what is being generated.
+*/
+function publishedVersionForInstall(startDir = import.meta.dirname) {
+	let dir = resolve(startDir);
+	for (let depth = 0; depth < 12; depth++) {
+		const candidate = join(dir, "package.json");
+		if (existsSync(candidate)) try {
+			const parsed = JSON.parse(readFileSync(candidate, "utf8"));
+			if (parsed.name === "mjolnir-qa") {
+				if (typeof parsed.publishedStable === "string" && parsed.publishedStable) return parsed.publishedStable;
+				if (typeof parsed.version === "string" && parsed.version) return parsed.version;
+			}
+		} catch {}
+		const parent = dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return ENGINE_VERSION;
+}
+/**
 * Template v2 (Terminal + CI UX Overhaul plan, M4): the summary step
 * calls `mjolnir summary mjolnir.json` — annotations + step summary via
 * ONE emitter — instead of the v1 inline SUMMARY_SCRIPT. The gate
@@ -661,6 +1189,12 @@ function indentBlock(text, spaces) {
 	return text.split("\n").map((l) => l.length > 0 ? pad + l : l).join("\n");
 }
 /** The generated workflow for one gate level. Exported for template tests. */
+/**
+* The npm version both generated templates install. Resolved once at module
+* load from the running package's own manifest, so a generated workflow can
+* never name a version the registry does not have.
+*/
+const INSTALL_VERSION = publishedVersionForInstall();
 const TEMPLATE = (gate) => `name: Mjölnir
 
 on:
@@ -672,60 +1206,71 @@ concurrency:
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   scan:
     runs-on: ubuntu-latest
-    # A hung scan must not sit for the 6-hour default.
     timeout-minutes: 10
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          fetch-depth: 0   # needed for --scope changed merge-base
+          fetch-depth: 0
           persist-credentials: false
-      # Scan with the pinned version. No subcommand: npx resolves
-      # the package bin directly; passing mjolnir as an arg causes
-      # npm 10+ npx to invoke it twice (unknown subcommand).
       - name: Scan changed code (exit 1/2 is data — the gate step decides)
         continue-on-error: true
-        run: npx --yes https://registry.npmjs.org/mjolnir-qa/-/mjolnir-qa-${ENGINE_VERSION}.tgz . --scope changed --json > mjolnir.json
-      # Reporting, not gating: a crashed scan leaves mjolnir.json empty/missing
-      # and the summary step exits 2/10 — continue-on-error keeps the advisory
-      # job green, exactly like the v1 inline script did (the gate step decides).
+        run: npx --yes https://registry.npmjs.org/mjolnir-qa/-/mjolnir-qa-${INSTALL_VERSION}.tgz . --scope changed --json > mjolnir.json
       - name: Annotations + Job Summary
         if: always()
         continue-on-error: true
-        run: npx --yes https://registry.npmjs.org/mjolnir-qa/-/mjolnir-qa-${ENGINE_VERSION}.tgz summary mjolnir.json
+        run: npx --yes https://registry.npmjs.org/mjolnir-qa/-/mjolnir-qa-${INSTALL_VERSION}.tgz summary mjolnir.json
       - name: Render PR comment
         if: always()
         continue-on-error: true
-        run: npx --yes https://registry.npmjs.org/mjolnir-qa/-/mjolnir-qa-${ENGINE_VERSION}.tgz pr-comment . > mjolnir-comment.md
-      # Best-effort: on a pull_request event from a fork the GITHUB_TOKEN is
-      # read-only and this step will 403 for every external contributor. The
-      # Job Summary above is the fallback that always renders.
-      # (pull_request_target would fix the token but is a code-execution
-      # risk — deliberately NOT used.)
-      - name: Post or update PR comment
+        run: npx --yes https://registry.npmjs.org/mjolnir-qa/-/mjolnir-qa-${INSTALL_VERSION}.tgz pr-comment --from mjolnir.json > mjolnir-comment.md
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: always()
+        with:
+          name: mjolnir-report
+          path: mjolnir-comment.md
+          if-no-files-found: warn
+          retention-days: 30
+${gate === "advisory" ? `      - name: Gate (advisory)
+        if: always()
+        run: echo "Advisory mode — findings reported, never blocking."` : `      - name: Gate (${gate})
+        if: always()
+        run: |
+          node -e '
+${indentBlock(gateScript(gate), 10)}
+          '`}
+
+  publish:
+    needs: scan
+    if: always() && needs.scan.result != 'cancelled'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: mjolnir-report
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         if: always()
         continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs');
-            let body = '';
-            try { body = fs.readFileSync('mjolnir-comment.md', 'utf8'); } catch (e) {}
-            if (!body.trim()) {
-              console.log('mjolnir-comment.md is empty or missing — nothing to post.');
-              return;
-            }
-            const marker = '<!-- mjolnir-pr-comment -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find((c) => c.body?.startsWith(marker));
+            const body = fs.readFileSync('mjolnir-comment.md', 'utf8');
+            if (!body.trim()) return;
+            const marker = '<!-- mjolnir-report:v2 -->';
+            const comments = await github.paginate(
+              github.rest.issues.listComments,
+              { owner: context.repo.owner, repo: context.repo.repo, issue_number: context.issue.number, per_page: 100 },
+            );
+            const existing = comments.find((comment) => comment.body?.includes(marker));
             if (existing) {
               await github.rest.issues.updateComment({
                 owner: context.repo.owner,
@@ -741,20 +1286,9 @@ jobs:
                 body,
               });
             }
-${gate === "advisory" ? `      # Advisory mode: findings are reported in the Job Summary and the
-      # PR comment, never blocking. The scan step's exit code is visible
-      # as the step outcome, but continue-on-error keeps the job green.
-      - name: Gate (advisory)
-        if: always()
-        run: echo "Advisory mode — findings reported, never blocking."` : `      # Gate enforcement: the scan step's own exit code is deliberately
-      # neutralized (continue-on-error) so reporting steps always run; THIS
-      # step is what fails the job. A partial scan never blocks.
-      - name: Gate (${gate})
+${gate === "advisory" ? `      - name: Advisory note
         if: always()
-        run: |
-          node -e '
-${indentBlock(gateScript(gate), 10)}
-          '`}
+        run: echo "Advisory mode — findings are reported, never blocking."` : ""}
 `;
 /** Every gate variant, used to tell "our template" from "hand-customized". */
 const GATES = [
@@ -764,23 +1298,35 @@ const GATES = [
 ];
 /**
 * The action-ref the action-based template pins (P1: distribution).
-* `v1` is the major moving tag release.yml's action-tags job maintains on
-* every stable release — Marketplace convention. The generated workflow
-* pins the major, never @latest: a new release must not change gate
-* semantics without a commit of the consumer's.
+* The current `v3` major is maintained on every stable release by the
+* dedicated Action tag workflow. The generated workflow pins an immutable
+* Action SHA, never @latest.
 */
 const ACTION_REF = "Sergey-Bar/Mjolnir@4a588bc62d517bc85fc44c0eae64c6587d3bf70b";
 /**
 * The action-based workflow for one gate level (P1.3): the root
 * action.yml does checkout-independent scanning — setup-node, the scan
 * itself (writing mjolnir.json for the reporting steps), and the gate
-* via the action's `fail-on` input. The action owns the gate: with
-* fail-on error/warning its step exits 1 on findings at the gate, so the
-* workflow needs no separate gate step; partial scans never block (the
-* action downgrades exit 2 to a loud warning, per the frozen exit-code
-* contract). Reporting steps run `if: always()` exactly like the npx
-* template. Advisory mode adds an explicit advisory note as the last
-* step so the job summary says "never blocking" in plain words.
+* via the action's `fail-on` input. Reporting steps run `if: always()`
+* exactly like the npx template, so a run that found something still
+* produces a report.
+*
+* Three defects this template used to ship, all of which made a check that
+* could never go red:
+*
+*  1. The gate read `steps.mjolnir.outputs.exit`. The Action exposes
+*     `exit_code` — and exposing it as `exit-code` was itself the bug: a
+*     hyphenated output name parses as subtraction in an expression, so the
+*     read produced an empty string, neither branch fired, and the gate exited
+*     0 on findings. This is the same class as the Action output-id mismatch
+*     fixed in `action.yml`; the generated copy had to be fixed too, or every
+*     new user inherited it.
+*  2. Exit 2 (partial) was downgraded to a warning. An analysis that did not
+*     finish is not a pass — see the exit-code contract in docs/VERSIONING.md.
+*  3. `version:` was pinned to the engine's working version, which while the
+*     candidate is a release candidate is not on npm, so the generated
+*     workflow could not install what it asked for. The input is omitted now
+*     and the Action's own default (the published stable) applies.
 */
 const ACTION_TEMPLATE = (gate) => `name: Mjölnir
 
@@ -793,69 +1339,77 @@ concurrency:
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   scan:
     runs-on: ubuntu-latest
-    # A hung scan must not sit for the 6-hour default.
     timeout-minutes: 10
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          fetch-depth: 0   # needed for --scope changed merge-base
+          fetch-depth: 0
           persist-credentials: false
-      # The action scans with the published mjolnir-qa package
-      # pinned to this CLI release. The composite action is pinned via
-      # ACTION_REF. The fail-on input is the gate: it fails the
-      # job on findings at the gate and never on a partial scan
-      # (exit 2 downgrades to a warning — the frozen exit-code
-      # contract). Advisory mode reports, never blocks.
       - name: Mjölnir verification trust scan
         id: mjolnir
-        if: always()
-        continue-on-error: ${gate === "advisory" ? "true" : "false"}
+        continue-on-error: true
         uses: ${ACTION_REF}
         with:
           scope: changed
           format: json
           fail-on: ${gate === "advisory" ? "none" : gate}
-          version: ${ENGINE_VERSION}
-      # Reporting, not gating: runs even when the scan/gate failed, from
-      # the same mjolnir.json the action wrote.
-      - name: Annotations + Job Summary
+          pr-comment: "false"
+          trust-artifact: "false"
+          annotations: "true"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
-        continue-on-error: true
-        run: npx --yes https://registry.npmjs.org/mjolnir-qa/-/mjolnir-qa-${ENGINE_VERSION}.tgz summary mjolnir.json
-      - name: Render PR comment
+        with:
+          name: mjolnir-report
+          path: mjolnir-comment.md
+          if-no-files-found: warn
+          retention-days: 30
+      - name: Gate (${gate})
         if: always()
-        continue-on-error: true
-        run: npx --yes https://registry.npmjs.org/mjolnir-qa/-/mjolnir-qa-${ENGINE_VERSION}.tgz pr-comment . > mjolnir-comment.md
-      # Best-effort: on a pull_request event from a fork the GITHUB_TOKEN is
-      # read-only and this step will 403 for every external contributor. The
-      # Job Summary above is the fallback that always renders.
-      # (pull_request_target would fix the token but is a code-execution
-      # risk — deliberately NOT used.)
-      - name: Post or update PR comment
+        shell: bash
+        env:
+          MJ_SCAN_EXIT: \${{ steps.mjolnir.outputs.exit_code }}
+        run: |
+          set -euo pipefail
+          case "\${MJ_SCAN_EXIT:-}" in
+            0) echo "Mjölnir scan clean at the configured gate." ;;
+            1) echo "::error::Mjölnir gate failed: findings at the configured gate."; exit 1 ;;
+            2) echo "::error::Mjölnir scan was PARTIAL — the surface was not fully analyzed, so no clean claim is made."; exit 1 ;;
+            "") echo "::error::Mjölnir produced no exit code; the action step did not run."; exit 1 ;;
+            *) echo "::error::Mjölnir exited \${MJ_SCAN_EXIT} (usage/internal error)."; exit 1 ;;
+          esac
+
+  publish:
+    needs: scan
+    if: always() && needs.scan.result != 'cancelled'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: mjolnir-report
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         if: always()
         continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs');
-            let body = '';
-            try { body = fs.readFileSync('mjolnir-comment.md', 'utf8'); } catch (e) {}
-            if (!body.trim()) {
-              console.log('mjolnir-comment.md is empty or missing — nothing to post.');
-              return;
-            }
-            const marker = '<!-- mjolnir-pr-comment -->';
-            const listed = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = listed.data.find((c) => c.body?.startsWith(marker));
+            const body = fs.readFileSync('mjolnir-comment.md', 'utf8');
+            if (!body.trim()) return;
+            const marker = '<!-- mjolnir-report:v2 -->';
+            const comments = await github.paginate(
+              github.rest.issues.listComments,
+              { owner: context.repo.owner, repo: context.repo.repo, issue_number: context.issue.number, per_page: 100 },
+            );
+            const existing = comments.find((comment) => comment.body?.includes(marker));
             if (existing) {
               await github.rest.issues.updateComment({
                 owner: context.repo.owner,
@@ -871,17 +1425,9 @@ jobs:
                 body,
               });
             }
-${gate === "advisory" ? `      # Advisory mode: findings are reported in the Job Summary,
-      # never blocking — the action ran with fail-on: none and
-      # continue-on-error, so even a crashed scan cannot fail this job.
-      - name: Gate (advisory)
+${gate === "advisory" ? `      - name: Advisory note
         if: always()
-        run: echo "Advisory mode — findings reported, never blocking."` : `      # Gate enforcement: the action step above IS the gate — fail-on
-      # ${gate} exits 1 on findings at the gate and the step is
-      # continue-on-error: false, so its failure fails the job. A partial
-      # scan never blocks (the action downgrades exit 2 to a warning per
-      # the frozen exit-code contract). The reporting steps above ran
-      # first (if: always()), so a red gate never suppresses the report.`}
+        run: echo "Advisory mode — findings are reported, never blocking."` : ""}
 `;
 /** Multiset line diff — counts only, for the refusal message. */
 function summarizeContentDiff(existing, incoming) {
@@ -912,7 +1458,7 @@ function ciInstall(root, gate, options = {}) {
 			diffSummary: summarizeContentDiff(current, template)
 		};
 	}
-	writeFileSync(target, template);
+	writeFileAtomic(target, template);
 	return {
 		written: target,
 		existed,
@@ -940,6 +1486,10 @@ function digestView(f) {
 		trustLevel: f.trustLevel ?? null,
 		confidence: f.confidence,
 		findingType: f.findingType,
+		qaImpact: f.qaImpact,
+		findingId: f.findingId ?? null,
+		rootCauseId: f.rootCauseId ?? null,
+		deduplicationGroup: f.deduplicationGroup ?? null,
 		fixGroupId: f.fixGroupId ?? null
 	};
 }
@@ -960,8 +1510,12 @@ function canonicalScanJson(result) {
 			rules: result.analysisStatus.rules,
 			skippedFiles: result.analysisStatus.skippedFiles,
 			rulesCrashed: result.analysisStatus.rulesCrashed ?? 0,
-			truncationReasons: result.analysisStatus.truncationReasons ?? []
+			parseFallbacks: result.analysisStatus.parseFallbacks ?? 0,
+			truncationReasons: result.analysisStatus.truncationReasons ?? [],
+			reasons: result.analysisStatus.reasons ?? []
 		},
+		scopeIntegrity: result.scopeIntegrity ?? null,
+		runIdentity: result.runIdentity ?? null,
 		findings: result.findings.map(digestView)
 	});
 }
@@ -1018,9 +1572,13 @@ function buildMachineContract(result) {
 			rules: result.analysisStatus.rules,
 			skippedFiles: result.analysisStatus.skippedFiles,
 			rulesCrashed: result.analysisStatus.rulesCrashed ?? 0,
+			...result.analysisStatus.parseFallbacks !== void 0 ? { parseFallbacks: result.analysisStatus.parseFallbacks } : {},
 			truncationReasons: result.analysisStatus.truncationReasons ?? [],
+			...result.analysisStatus.reasons !== void 0 ? { reasons: result.analysisStatus.reasons } : {},
 			frameworkDetectionUnknown: result.frameworkDetectionUnknown,
-			durationMs: result.analysisStatus.durationMs
+			durationMs: result.analysisStatus.durationMs,
+			...result.scopeIntegrity !== void 0 ? { scopeIntegrity: result.scopeIntegrity } : {},
+			...result.runIdentity !== void 0 ? { runIdentity: result.runIdentity } : {}
 		},
 		...result.trustSummary !== void 0 ? { trustSummary: result.trustSummary } : {},
 		...result.agenticProfile !== void 0 ? { provenance: result.agenticProfile } : {},
@@ -1294,7 +1852,7 @@ function whatWouldChangeTheVerdict(r) {
 /** Structural validation of the loaded JSON (hostile-input safe). */
 function parseScanJson(raw) {
 	try {
-		return parseJsonFile(raw, "scan result", (v) => isRecord$2(v) && v.schemaVersion === 1 && Array.isArray(v.findings) && Boolean(v.analysisStatus) && typeof v.partial === "boolean");
+		return parseJsonFile(raw, "scan result", (v) => isRecord$3(v) && v.schemaVersion === 1 && Array.isArray(v.findings) && Boolean(v.analysisStatus) && typeof v.partial === "boolean");
 	} catch {
 		return;
 	}
@@ -1409,122 +1967,6 @@ function pctOf(v) {
 	return `${Math.round(v * 100)}%`;
 }
 //#endregion
-//#region src/lib/fs-atomic.ts
-/**
-* Atomic file writes (audit S9).
-*
-* Every durability-critical write in Mjölnir (baseline, stats, badge,
-* TRIAGE.md, scaffolded rule files) used to hand-roll
-* `writeFileSync(path, data)` — a crash mid-write left a TRUNCATED file
-* at the real path, and a subsequent read (diff, badge endpoint) served
-* confident nonsense from it.
-*
-* `writeFileAtomic` writes to a temp sibling, then RENAMES. On the same
-* volume rename is atomic: readers see either the complete old file or
-* the complete new file, never a half-written one. The temp name is
-* created with `wx` (exclusive) so concurrent writers cannot interleave,
-* stale temps are cleaned up on failure, and on Windows the rename is
-* retried briefly because a concurrent reader can hold the destination
-* open (EBUSY/EPERM).
-*/
-function atomicTempPath(path) {
-	return `${path}.mjolnir-${process.pid}-${Date.now()}-${randomBytes(4).toString("hex")}.tmp`;
-}
-/**
-* Atomically replace `path` with `data`.
-*/
-function writeFileAtomic(path, data, opts = {}) {
-	const dir = dirname(path);
-	if (opts.mkdirs !== false && !existsSync(dir)) mkdirSync(dir, { recursive: true });
-	const tmp = atomicTempPath(path);
-	let fd;
-	try {
-		fd = openSync(tmp, "wx", opts.mode ?? 420);
-		writeSync(fd, data, null, opts.encoding ?? "utf8");
-	} finally {
-		if (fd !== void 0) closeSync(fd);
-	}
-	try {
-		renameWithWindowsRetry(tmp, path);
-	} catch (err) {
-		try {
-			if (existsSync(tmp)) unlinkSync(tmp);
-		} catch {}
-		throw err;
-	}
-}
-/**
-* renameSync retry loop for Windows: a concurrent reader (another scan,
-* a badge endpoint, an editor) holding the destination open makes
-* rename fail with EBUSY/EPERM. A short bounded retry closes the race
-* without turning an atomic swap into a partial write.
-*
-* Internal contract test hook: the platform check keeps this loop off
-* the POSIX hot path; on win32 the EBUSY/EPERM arms are exercised by
-* the fs-atomic-retry spec (mocked renameSync).
-*/
-const RENAME_RETRIES = 8;
-const RENAME_RETRY_DELAY_MS = 25;
-/** Synchronous sleep that does not spin the CPU. */
-function sleepSync(ms) {
-	try {
-		Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-	} catch {
-		const until = Date.now() + ms;
-		while (Date.now() < until);
-	}
-}
-function renameWithWindowsRetry(from, to) {
-	for (let attempt = 0;; attempt++) try {
-		renameSync(from, to);
-		return;
-	} catch (err) {
-		const code = err?.code;
-		if (process.platform === "win32" && (code === "EBUSY" || code === "EPERM") && attempt < RENAME_RETRIES) {
-			sleepSync(RENAME_RETRY_DELAY_MS);
-			continue;
-		}
-		throw err;
-	}
-}
-const STALE_TEMP_AGE_MS = 864e5;
-const TEMP_PID_RE = /^.+\.mjolnir-([1-9]\d{0,9})-(\d{13})-[0-9a-f]{8}\.tmp$/;
-function sweepStaleTempFiles(dir) {
-	let swept = 0;
-	let entries;
-	try {
-		entries = readdirSync(dir);
-	} catch {
-		return 0;
-	}
-	const cutoff = Date.now() - STALE_TEMP_AGE_MS;
-	for (const entry of entries) {
-		const match = TEMP_PID_RE.exec(entry);
-		if (!match || Number(match[2]) > cutoff) continue;
-		const path = join(dir, entry);
-		try {
-			const stat = lstatSync(path);
-			if (!stat.isFile() || stat.mtimeMs > cutoff) continue;
-			if (pidAlive(Number(match[1]))) continue;
-			unlinkSync(path);
-			swept++;
-		} catch {
-			continue;
-		}
-	}
-	return swept;
-}
-function pidAlive(pid) {
-	if (!Number.isSafeInteger(pid) || pid <= 0 || pid > 2147483647) return true;
-	if (pid === process.pid) return true;
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch (err) {
-		return err?.code !== "ESRCH";
-	}
-}
-//#endregion
 //#region src/engine/finding-identity.ts
 /**
 * Finding Identity (ENGINE-002): deterministic, stable fingerprints for
@@ -2029,12 +2471,15 @@ function trustVerdictFor(v) {
 * today the honest command set is repeat/compare/inspect, not
 * "collect a trace", because trace.zip is not yet ingested.
 */
+function safeTriageText(value) {
+	return value.replace(/[;&|`$()\\\r\n]/g, " ").slice(0, 200);
+}
 function nextActionFor(v) {
 	switch (classifyVerdict(v)) {
-		case "RETRY-DEPENDENT": return `repeat execution of this test (3+ runs) to confirm the flake rate, then quarantine + ticket: ${v.file}`;
-		case "TIMEOUT": return `re-run in isolation to separate slowness from a hang: npx playwright test ${v.file} --timeout 60000`;
-		case "FAILING": return `reproduce locally: npx playwright test ${v.file} -g "${v.title.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}" — then fix and re-run`;
-		case "SKIPPED": return `inspect the skip condition in ${v.file} — a skip after a failure usually hides an environment problem`;
+		case "RETRY-DEPENDENT": return `repeat execution of this test (3+ runs) to confirm the flake rate, then quarantine + ticket: ${safeTriageText(v.file)}`;
+		case "TIMEOUT": return `re-run this test in isolation with a 60-second timeout to separate slowness from a hang: ${safeTriageText(v.file)}`;
+		case "FAILING": return `reproduce this test in isolation, then fix and re-run: ${safeTriageText(v.file)} — ${safeTriageText(v.title)}`;
+		case "SKIPPED": return `inspect the skip condition in ${safeTriageText(v.file)} — a skip after a failure usually hides an environment problem`;
 	}
 }
 /** Deterministic guided rows, worst first (same order law as triageRows). */
@@ -2068,7 +2513,7 @@ function renderTriageWorkflow(report) {
 	}
 	for (const r of rows) {
 		const flag = r.classification === "RETRY-DEPENDENT" ? "TRUE-FLAKE" : r.classification === "FAILING" ? "FAILING" : void 0;
-		lines.push(`[${r.classification}${flag ? ` · ${flag}` : ""}] ${r.test} (${r.file})`);
+		lines.push(`[${r.classification}${flag ? ` · ${flag}` : ""}] ${safeTriageText(r.test)} (${safeTriageText(r.file)})`);
 		for (const e of r.evidence) lines.push(`    evidence: ${e}`);
 		lines.push(`    trust:    ${r.trustVerdict}`);
 		lines.push(`    next:     ${r.nextAction}`);
@@ -2240,7 +2685,16 @@ function renderPwRunSummary(s) {
 */
 /** Hard caps (§21 threat model: parameter size + resource bounds). */
 const MAX_PARAM_BYTES = 65536;
+const MAX_DURATION_MS$1 = 36e5;
+const DEFAULT_MAX_DURATION_MS$1 = 6e5;
 const PROTOCOL_VERSION = "2025-06-18";
+const CONFIGURED_ROOT = process.env.MJOLNIR_WORKSPACE_ROOT ? resolve(process.env.MJOLNIR_WORKSPACE_ROOT) : null;
+function isPathAllowed(path) {
+	if (!CONFIGURED_ROOT) return true;
+	const candidate = resolve(path);
+	const rel = relative(CONFIGURED_ROOT, candidate);
+	return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
 /** JSON-RPC error codes (subset used here). */
 const MCP_ERRORS = {
 	PARSE: -32700,
@@ -2359,7 +2813,10 @@ function validateParams(name, args) {
 	if (Buffer$1.byteLength(JSON.stringify(args), "utf8") > MAX_PARAM_BYTES) return `parameters exceed ${MAX_PARAM_BYTES} bytes (threat model §21)`;
 	if (name === "scan") {
 		if (typeof args["path"] !== "string" || args["path"].length === 0) return "scan requires a non-empty string `path`";
-		if (args["maxDurationMs"] !== void 0 && typeof args["maxDurationMs"] !== "number") return "`maxDurationMs` must be a number";
+		if (args["maxDurationMs"] !== void 0) {
+			const duration = args["maxDurationMs"];
+			if (typeof duration !== "number" || !Number.isFinite(duration) || duration <= 0 || duration > MAX_DURATION_MS$1) return "`maxDurationMs` must be a finite positive number within the server budget";
+		}
 	}
 	if (name === "explain") {
 		if (typeof args["ruleId"] !== "string" || !/^QA-[A-Z]+-\d{3}$/.test(args["ruleId"])) return "explain requires `ruleId` matching /^QA-[A-Z]+-\\d{3}$/";
@@ -2404,6 +2861,24 @@ async function handleToolCall(call) {
 			message: paramError
 		}
 	};
+	const pathArgument = call.args["path"];
+	if (typeof pathArgument === "string" && !isPathAllowed(pathArgument)) return {
+		jsonrpc: "2.0",
+		id: call.id,
+		error: {
+			code: MCP_ERRORS.INVALID_PARAMS,
+			message: "path is outside the configured workspace root"
+		}
+	};
+	const fixturesRoot = call.args["fixturesRoot"];
+	if (typeof fixturesRoot === "string" && !isPathAllowed(fixturesRoot)) return {
+		jsonrpc: "2.0",
+		id: call.id,
+		error: {
+			code: MCP_ERRORS.INVALID_PARAMS,
+			message: "fixturesRoot is outside the configured workspace root"
+		}
+	};
 	try {
 		if (call.name === "scan") {
 			const target = resolve(call.args["path"]);
@@ -2415,7 +2890,7 @@ async function handleToolCall(call) {
 					message: `scan target does not exist: ${target}`
 				}
 			};
-			const maxDurationMs = typeof call.args["maxDurationMs"] === "number" ? call.args["maxDurationMs"] : Number.POSITIVE_INFINITY;
+			const maxDurationMs = typeof call.args["maxDurationMs"] === "number" ? call.args["maxDurationMs"] : DEFAULT_MAX_DURATION_MS$1;
 			const result = await serializeScan(() => runScan$1({
 				target,
 				json: true,
@@ -3034,16 +3509,6 @@ function renderTerminal(result, opts) {
 	appendFooter(lines, result, ui);
 	return lines.join("\n");
 }
-/**
-* Contract-stable three-band verdict (property-locked in
-* tests/scoring-precision.spec.ts). Delegates to the ScoreState model —
-* 100 keeps returning WORTHY here; the FORGED premium treatment lives
-* in the dedicated block, not in this public mapping.
-*/
-function verdictFor(score) {
-	const verdict = deriveScoreState(score).verdict;
-	return verdict === "FORGED" ? "WORTHY" : verdict;
-}
 /** Appends the score, gauge, verdict, and honesty metadata for the full scan. */
 function appendScoreSection(lines, result, p, width, ascii) {
 	const state = deriveScoreState(result.score);
@@ -3180,26 +3645,9 @@ function appendNextActions(lines, display, fullResult, ui) {
 	} else if (partial) lines.push(nextStep("mjolnir --verbose", ui));
 	lines.push("");
 }
-function evidenceTag$1(f) {
-	const level = f.evidenceLevel ?? deriveEvidenceLevel(f.findingType, f.confidence);
-	let tag = `${level} · ${level === "E2" ? "deterministic" : level === "E1" ? "heuristic" : "observation"}`;
-	if (f.measuredFpRate !== void 0) {
-		tag += ` · measured FP ${Math.round(f.measuredFpRate * 100)}%`;
-		if (f.measuredFpN !== void 0) tag += ` · n=${f.measuredFpN}`;
-	}
-	if (f.trustLevel !== void 0) tag += ` · trust ${f.trustLevel}`;
-	if (f.runtimeCorroboration !== void 0) {
-		const c = f.runtimeCorroboration;
-		let label = "file executed";
-		if (c.level === "defect") label = "defect corroborated";
-		else if (c.level === "test") label = "test executed";
-		tag += ` · runtime: ${label}`;
-	}
-	return `[${tag}]`;
-}
 /** Deterministic per-severity verification hint: what re-running should
-* show after the fix lands. Deduction is the honest, evidence-discounted
-* number this finding costs right now. */
+*  show after the fix lands. Deduction is the honest, evidence-discounted
+*  number this finding costs right now. */
 function verifyHint(f) {
 	const pts = deductionFor(f);
 	if (f.severity === "error") return pts > 0 ? `Re-run mjolnir after the change — the gate should stop failing and the score should recover by ${pts}.` : "Re-run mjolnir after the change — the finding should no longer appear.";
@@ -3212,7 +3660,7 @@ function toCard(f, tone) {
 		severity: f.severity,
 		loc: `${sanitizeData(f.ruleId)} · ${sanitizeData(f.file)}:${f.line}`,
 		problem: sanitizeData(problem),
-		evidence: evidenceTag$1(f),
+		evidence: evidenceTag(f),
 		impact: `${f.qaImpact} — ${sanitizeData(f.why)}`,
 		fix: sanitizeData(f.fix),
 		verify: verifyHint(f)
@@ -3332,7 +3780,7 @@ function appendFindings(lines, result, counts, verbose, ui, tone) {
 				continue;
 			}
 			const groupHead = `  ${severityIcon(maxSeverity(unit.findings), ui)} ${p.bold(sanitizeData(unit.ruleId))} ${p.dim(`× ${n} — same fix applies`)}`;
-			const groupEvidence = evidenceTag$1(first);
+			const groupEvidence = evidenceTag(first);
 			if (measure(`${groupHead} ${groupEvidence}`) <= width) lines.push(`${groupHead} ${p.dim(groupEvidence)}`);
 			else {
 				lines.push(groupHead);
@@ -3421,7 +3869,7 @@ function appendFooter(lines, result, ui) {
 		complete: result.analysisStatus.discovery !== "partial",
 		durationMs: result.analysisStatus.durationMs
 	}));
-	const advisory = result.findings.filter((f) => (f.evidenceLevel ?? deriveEvidenceLevel(f.findingType, f.confidence)) === "E0").length;
+	const advisory = result.findings.filter((f) => evidenceLevelOf(f) === "E0").length;
 	if (advisory > 0) pushWrapped(lines, p, `${advisory} advisory finding${advisory === 1 ? "" : "s"} (E0 — observation only, no score impact)`, width);
 	if (result.findings.length > 0) {
 		const firedRuleIds = new Set(result.findings.map((f) => f.ruleId));
@@ -3483,29 +3931,89 @@ function countBySeverity(result) {
 	}
 	return counts;
 }
-EVIDENCE.e0, EVIDENCE.e1, EVIDENCE.e2;
-const RUNG_MEANINGS = [
-	"observation only",
-	"heuristic static",
-	"deterministic static",
-	"the finding's file executed",
-	"the finding's test executed",
-	"the run verdict corroborates"
-];
-const RUNG_COLORS = [
-	TRUST.l0,
-	TRUST.l1,
-	TRUST.l2,
-	TRUST.l3,
-	TRUST.l4,
-	TRUST.l5
-];
-const TRUST_RUNGS = RUNG_MEANINGS.map((meaning, i) => ({
-	level: `L${i}`,
-	meaning,
-	runtime: i >= 3,
-	color: RUNG_COLORS[i]
-}));
+//#endregion
+//#region src/engine/trust-classification.ts
+/**
+* Completeness, decided once.
+*
+* Every branch here treats ABSENCE as "not proven complete" rather than as
+* "complete". That is the whole point: a missing `analysisStatus` is not a
+* clean bill of health, a zero ceiling reason is not a claim, and treating
+* either as completeness is how an unmeasured run gets to say "trust them".
+*/
+function isComplete(result, summary) {
+	if (result.partial) return false;
+	if (summary.ceilingReasons.length > 0) return false;
+	const status = result.analysisStatus;
+	if (status === void 0) return false;
+	if (status.discovery !== "complete" || status.rules !== "complete") return false;
+	if ((status.skippedFiles ?? 0) > 0) return false;
+	if ((status.rulesCrashed ?? 0) > 0) return false;
+	return (status.reasons ?? []).length === 0;
+}
+/**
+* The determination. Every surface calls this; none of them re-derives it.
+*/
+function classifyTrust(result, summary) {
+	const gaps = [];
+	const complete = isComplete(result, summary);
+	if (result.partial) gaps.push("the scan was partial");
+	const status = result.analysisStatus;
+	if (status === void 0) gaps.push("the report carries no analysisStatus, so completeness is unknown");
+	else {
+		if (status.discovery !== "complete") gaps.push("discovery was truncated");
+		if (status.rules !== "complete") gaps.push("rule evaluation was truncated");
+		if ((status.skippedFiles ?? 0) > 0) gaps.push(`${status.skippedFiles} file(s) were skipped`);
+		if ((status.rulesCrashed ?? 0) > 0) gaps.push(`${status.rulesCrashed} rule(s) crashed`);
+		for (const reason of status.reasons ?? []) if (!gaps.some((g) => g.includes(reason))) gaps.push(reason);
+	}
+	for (const ceiling of summary.ceilingReasons) gaps.push(`confidence ceiling: ${ceiling}`);
+	if (!complete) return {
+		claim: "INCOMPLETE",
+		order: 0,
+		licensesClean: false,
+		reason: "the analysis did not finish, so it proves nothing about the surface it did not reach",
+		gaps
+	};
+	const level = summary.level;
+	const rank = TRUST_ORDER.indexOf(level);
+	const confident = summary.confidence >= .75;
+	if (rank >= TRUST_ORDER.indexOf("L4")) return {
+		claim: "RUN_EVIDENCE_BACKS_FINDINGS",
+		order: 5,
+		licensesClean: result.findings.length > 0,
+		reason: confident ? "a real run corroborates these findings" : "a run exists but coverage is thin — verify the gaps",
+		gaps
+	};
+	if (rank >= TRUST_ORDER.indexOf("L3")) return {
+		claim: "RUNTIME_CORROBORATED",
+		order: 4,
+		licensesClean: result.findings.length > 0,
+		reason: confident ? "the relevant files executed — static and runtime signal agree" : "files executed, but evidence is thin — treat findings as leads",
+		gaps
+	};
+	if (level === "L0" || summary.evidenceCoverage === 0) return {
+		claim: "NO_EVIDENCE",
+		order: 1,
+		licensesClean: false,
+		reason: "static signal only, with no runtime evidence — an observation, not a verdict",
+		gaps
+	};
+	if (confident) return {
+		claim: "DETERMINISTIC_STATIC",
+		order: 3,
+		licensesClean: true,
+		reason: "deterministic static analysis, complete but uncorroborated by a run",
+		gaps
+	};
+	return {
+		claim: "THIN_STATIC_SIGNAL",
+		order: 2,
+		licensesClean: true,
+		reason: "static analysis is complete but low-confidence — treat findings as leads",
+		gaps
+	};
+}
 //#endregion
 //#region src/lib/format.ts
 /**
@@ -3517,11 +4025,6 @@ function pct$1(v) {
 	return `${Math.round(v * 100)}%`;
 }
 //#endregion
-//#region src/reporter/evidence-tag.ts
-function evidenceTag(f) {
-	return f.runtimeCorroboration ? f.runtimeCorroboration.level === "defect" ? "run corroborated" : "run executed" : (f.evidenceLevel ?? "E2") === "E2" ? "deterministic" : "pattern";
-}
-//#endregion
 //#region src/reporter/trust-report.ts
 /**
 * The rung labels, built from `src/brand/symbols.ts` rather than typed
@@ -3540,22 +4043,34 @@ function evidenceTag(f) {
 */
 const TRUST_LABELS = Object.fromEntries(TRUST_RUNGS.map((r) => [r.level, `${r.level} · ${r.meaning}${r.runtime ? " · runtime" : ""}`]));
 /**
-* The human verdict line derived from the measurement. Deterministic
-* mapping from (level, confidence) bands — a measurement-derived label,
-* never a new verdict enum (plan §3/§36: no new global enums).
-*/
-function trustHeadline(s) {
-	if (s.level === "L5" || s.level === "L4") return s.confidence >= .75 ? "Run evidence backs these findings — trust them." : "Run evidence exists, but the scan was incomplete — verify the gaps.";
-	if (s.level === "L3") return s.confidence >= .75 ? "The relevant files executed — solid static + runtime signal." : "Files executed, evidence is thin — treat findings as leads.";
-	if (s.confidence >= .75) return "Deterministic static analysis — trustworthy, uncorroborated by a run.";
-	return "Static signal only, incomplete analysis — treat as leads, not verdicts.";
+* The human verdict line, rendered from the ONE determination.
+*
+* This used to be a band mapping over (level, confidence) living here, in the
+* reporter — engine knowledge in a presentation layer, which is how a second
+* surface ends up disagreeing with the first. The decision now lives in
+* `src/engine/trust-classification.ts` and every surface renders the same
+* answer; this function only chooses words.
+*/
+function trustHeadline(s, classification) {
+	const claim = classification?.claim;
+	if (claim !== void 0) switch (claim) {
+		case "RUN_EVIDENCE_BACKS_FINDINGS": return s.confidence >= .75 ? "Run evidence backs these findings — trust them." : "Run evidence exists, but the scan was incomplete — verify the gaps.";
+		case "RUNTIME_CORROBORATED": return s.confidence >= .75 ? "The relevant files executed — solid static + runtime signal." : "Files executed, evidence is thin — treat findings as leads.";
+		case "DETERMINISTIC_STATIC": return "Deterministic static analysis — trustworthy, uncorroborated by a run.";
+		case "THIN_STATIC_SIGNAL": return "Static signal only, incomplete analysis — treat as leads, not verdicts.";
+		case "NO_EVIDENCE": return "Static signal only, with no runtime evidence — treat as an observation, not a verdict.";
+		case "INCOMPLETE": return "The analysis did not finish — it proves nothing about the surface it did not reach.";
+	}
+	return "Trust could not be established for this run.";
 }
 /** WHY THIS VERDICT — evidence-backed reasons, each from a real field. */
 function trustReasons(result, s) {
 	const reasons = [];
 	const corroborated = result.findings.filter((f) => f.runtimeCorroboration !== void 0).length;
-	if (result.findings.length === 0) reasons.push(result.partial ? "No findings so far, but the scan did not finish — the gaps are not proof of cleanliness." : "No findings fired on the analyzed surface — the scan found nothing to report.");
-	else reasons.push(`${result.findings.length} finding(s) fired; ${corroborated} corroborated by a real run report.`);
+	if (result.findings.length === 0) {
+		const incomplete = result.partial || result.analysisStatus.discovery !== "complete" || result.analysisStatus.rules !== "complete" || s.level === "L0" && s.evidenceCoverage === 0;
+		reasons.push(incomplete ? "No findings so far, but the scan or evidence is incomplete — the gaps are not proof of cleanliness." : "No findings fired on the analyzed surface — the scan found nothing to report.");
+	} else reasons.push(`${result.findings.length} finding(s) fired; ${corroborated} corroborated by a real run report.`);
 	if (s.confidenceCeiling !== void 0) reasons.push(`confidence capped at ${pct$1(s.confidenceCeiling)} by: ${s.ceilingReasons.join(", ")}.`);
 	if (s.provisionalRuleIds.length > 0) reasons.push(`${s.provisionalRuleIds.length} fired rule(s) unmeasured (author-estimated FP) — disclosed, not counted.`);
 	else if (s.measuredFpOfFiredRules !== void 0) reasons.push(`every fired rule carries a measured false-positive rate (evidence-weighted ${pct$1(s.measuredFpOfFiredRules)}).`);
@@ -3580,7 +4095,7 @@ function topTrustRisks(findings, n = 3) {
 }
 /** NEXT ACTION — one concrete command, deterministic. */
 function nextAction(result) {
-	if (result.partial) return "re-run with a higher --max-duration to close the truncated surface";
+	if (result.partial || result.analysisStatus.discovery !== "complete" || result.analysisStatus.rules !== "complete" || (result.analysisStatus.rulesCrashed ?? 0) > 0) return "re-run with a higher --max-duration to close the truncated surface";
 	const risks = topTrustRisks(result.findings, 1);
 	if (risks.length === 0) return result.testDeclarationCount === 0 ? "add tests — a repo without test declarations has nothing to verify" : "no findings on the analyzed surface — install advisory CI (`mjolnir ci install`) and re-scan the changed scope";
 	return `mjolnir explain ${risks[0]?.ruleId ?? ""} — then fix the top risk first`;
@@ -3606,9 +4121,10 @@ function renderTrustReport(result, opts) {
 		provisionalRuleIds: [],
 		ceilingReasons: []
 	};
+	const classification = classifyTrust(result, s);
 	lines.push(sectionHeader("TRUST VERDICT", ui));
 	lines.push(`  ${p.accent(TRUST_LABELS[s.level] ?? s.level)}`);
-	lines.push(`  ${trustHeadline(s)}`);
+	lines.push(`  ${trustHeadline(s, classification)}`);
 	lines.push("");
 	lines.push(sectionHeader("CONFIDENCE", ui));
 	lines.push(`  confidence          ${pct$1(s.confidence)}${s.confidenceCeiling !== void 0 ? `  (ceiling ${pct$1(s.confidenceCeiling)})` : ""}`);
@@ -3617,7 +4133,7 @@ function renderTrustReport(result, opts) {
 	if (s.measuredFpOfFiredRules !== void 0) lines.push(`  measured FP (fired) ${pct$1(s.measuredFpOfFiredRules)} — evidence-weighted`);
 	else if (s.provisionalRuleIds.length > 0) lines.push(`  measured FP (fired) PROVISIONAL — unmeasured rules fired: ${s.provisionalRuleIds.slice(0, 3).join(", ")}${s.provisionalRuleIds.length > 3 ? `, +${s.provisionalRuleIds.length - 3} more` : ""}`);
 	else lines.push("  measured FP (fired) none fired — nothing to weight");
-	lines.push(`  tests analyzed      ${result.testDeclarationCount ?? 0} declaration(s) in ${result.testFileCount ?? 0} file(s)`);
+	lines.push(`  tests analyzed      ${testsAnalyzedCell(result.testDeclarationCount, result.testFileCount)}`);
 	lines.push("");
 	lines.push(sectionHeader("WHY THIS VERDICT", ui));
 	for (const r of trustReasons(result, s)) lines.push(`  - ${r}`);
@@ -3795,9 +4311,13 @@ function escapeLabel(text) {
 function classDef(name, tint) {
 	return `  classDef ${name} fill:${tint.fill},stroke:${tint.stroke},color:${tint.text};`;
 }
+/** Band → the Mermaid class name that paints it. BW-104: this used to
+*  re-declare the 80/50 boundaries, so the diagram could colour a
+*  dimension the terminal called UNWORTHY. It now asks the one model. */
 function dimensionStyleClass(dim) {
-	if (dim.score >= 80) return "healthy";
-	if (dim.score >= 50) return "warn";
+	const band = deriveScoreState(dim.score).band;
+	if (band === "forged" || band === "trusted") return "healthy";
+	if (band === "warning") return "warn";
 	return "critical";
 }
 const SEVERITY_ORDER = [
@@ -3993,6 +4513,312 @@ function currentCommit(root, opts = {}) {
 	}
 }
 //#endregion
+//#region src/commands/report-io.ts
+/**
+* Shared saved-report loading (agent-handoff plan §9.0).
+*
+* `summary`, `handoff` and `why` all consume a saved `--json` report.
+* One loader, one validation, one error shape — previously
+* validateReportJson was private to summary.ts; extracting it keeps
+* the three commands byte-identical in their loading behavior without
+* duplication. The exit-code mapping stays in the callers (they own
+* their io), but the error MESSAGES are identical because they come
+* from here.
+*/
+const MAX_REPORT_BYTES = 33554432;
+const MAX_FINDINGS = 1e4;
+const CONFIDENCE_VALUES = /* @__PURE__ */ new Set([
+	"high",
+	"medium",
+	"low"
+]);
+const FINDING_TYPE_VALUES = /* @__PURE__ */ new Set([
+	"deterministic-defect",
+	"heuristic-risk",
+	"observation"
+]);
+const QA_IMPACT_VALUES = /* @__PURE__ */ new Set([
+	"BLOCKS-RELEASE",
+	"FLAKY-RISK",
+	"FALSE-GREEN",
+	"HYGIENE"
+]);
+const EVIDENCE_VALUES = /* @__PURE__ */ new Set([
+	"E0",
+	"E1",
+	"E2"
+]);
+const TRUST_VALUES = new Set(TRUST_ORDER);
+/** Human message for any thrown value — never "undefined"/"[object Object]". */
+function errorText$1(err) {
+	if (err instanceof Error) return err.message;
+	if (typeof err === "string") return err;
+	if (typeof err === "object" && err !== null) return JSON.stringify(err);
+	return String(err);
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function fail(message) {
+	throw new Error(message);
+}
+function requireRecord(value, label) {
+	if (!isRecord$2(value)) fail(`${label} must be an object`);
+	return value;
+}
+function requireString(value, label) {
+	if (typeof value !== "string" || value.length === 0) fail(`${label} must be a non-empty string`);
+	return value;
+}
+function requireBoolean(value, label) {
+	if (typeof value !== "boolean") fail(`${label} must be a boolean`);
+	return value;
+}
+function requireFiniteNumber(value, label) {
+	if (typeof value !== "number" || !Number.isFinite(value)) fail(`${label} must be a finite number`);
+	return value;
+}
+function requireInteger(value, label, minimum = 0) {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < minimum) fail(`${label} must be an integer >= ${minimum}`);
+	return value;
+}
+function validateDimension(value, index) {
+	const dimension = requireRecord(value, `dimensions[${index}]`);
+	const category = requireString(dimension.category, `dimensions[${index}].category`);
+	if (!RULE_CATEGORIES.includes(category)) fail(`dimensions[${index}].category is unknown`);
+	const score = requireFiniteNumber(dimension.score, `dimensions[${index}].score`);
+	if (score < 0 || score > 100) fail(`dimensions[${index}].score must be between 0 and 100`);
+	requireInteger(dimension.errors, `dimensions[${index}].errors`);
+	requireInteger(dimension.warnings, `dimensions[${index}].warnings`);
+	requireInteger(dimension.infos, `dimensions[${index}].infos`);
+}
+function validateFinding(value, index) {
+	const finding = requireRecord(value, `findings[${index}]`);
+	requireString(finding.ruleId, `findings[${index}].ruleId`);
+	const category = requireString(finding.category, `findings[${index}].category`);
+	if (!RULE_CATEGORIES.includes(category)) fail(`findings[${index}].category is unknown`);
+	const severity = requireString(finding.severity, `findings[${index}].severity`);
+	if (!SEVERITY_ORDER$1.includes(severity)) fail(`findings[${index}].severity is unknown`);
+	const confidence = requireString(finding.confidence, `findings[${index}].confidence`);
+	if (!CONFIDENCE_VALUES.has(confidence)) fail(`findings[${index}].confidence is unknown`);
+	const findingType = requireString(finding.findingType, `findings[${index}].findingType`);
+	if (!FINDING_TYPE_VALUES.has(findingType)) fail(`findings[${index}].findingType is unknown`);
+	const qaImpact = requireString(finding.qaImpact, `findings[${index}].qaImpact`);
+	if (!QA_IMPACT_VALUES.has(qaImpact)) fail(`findings[${index}].qaImpact is unknown`);
+	requireString(finding.file, `findings[${index}].file`);
+	requireInteger(finding.line, `findings[${index}].line`, 1);
+	requireInteger(finding.column, `findings[${index}].column`, 1);
+	requireString(finding.message, `findings[${index}].message`);
+	requireString(finding.why, `findings[${index}].why`);
+	requireString(finding.fix, `findings[${index}].fix`);
+	if (finding.evidenceLevel !== void 0 && (typeof finding.evidenceLevel !== "string" || !EVIDENCE_VALUES.has(finding.evidenceLevel))) fail(`findings[${index}].evidenceLevel is unknown`);
+	if (finding.trustLevel !== void 0 && (typeof finding.trustLevel !== "string" || !TRUST_VALUES.has(finding.trustLevel))) fail(`findings[${index}].trustLevel is unknown`);
+	if (finding.detectorRevision !== void 0) requireInteger(finding.detectorRevision, `findings[${index}].detectorRevision`, 1);
+	if (finding.measuredFpRate !== void 0) {
+		const rate = requireFiniteNumber(finding.measuredFpRate, `findings[${index}].measuredFpRate`);
+		if (rate < 0 || rate > 1) fail(`findings[${index}].measuredFpRate must be between 0 and 1`);
+	}
+	if (finding.measuredFpN !== void 0) requireInteger(finding.measuredFpN, `findings[${index}].measuredFpN`);
+}
+function validateAnalysisStatus(value) {
+	const status = requireRecord(value, "analysisStatus");
+	if (status.discovery !== "complete" && status.discovery !== "partial") fail("analysisStatus.discovery must be \"complete\" or \"partial\"");
+	if (status.rules !== "complete" && status.rules !== "partial") fail("analysisStatus.rules must be \"complete\" or \"partial\"");
+	requireInteger(status.skippedFiles, "analysisStatus.skippedFiles");
+	requireFiniteNumber(status.durationMs, "analysisStatus.durationMs");
+	if (status.rulesCrashed !== void 0) requireInteger(status.rulesCrashed, "analysisStatus.rulesCrashed");
+	if (status.parseFallbacks !== void 0) requireInteger(status.parseFallbacks, "analysisStatus.parseFallbacks");
+	if (status.truncationReasons !== void 0) {
+		if (!Array.isArray(status.truncationReasons)) fail("analysisStatus.truncationReasons must be an array");
+		status.truncationReasons.forEach((reason, index) => requireString(reason, `analysisStatus.truncationReasons[${index}]`));
+	}
+	if (status.reasons !== void 0) {
+		if (!Array.isArray(status.reasons)) fail("analysisStatus.reasons must be an array");
+		status.reasons.forEach((reason, index) => requireString(reason, `analysisStatus.reasons[${index}]`));
+	}
+}
+function validateScopeIntegrity(value) {
+	const scope = requireRecord(value, "scopeIntegrity");
+	requireInteger(scope.discovered, "scopeIntegrity.discovered");
+	requireInteger(scope.analyzed, "scopeIntegrity.analyzed");
+	requireInteger(scope.ignored, "scopeIntegrity.ignored");
+	requireInteger(scope.unrecognized, "scopeIntegrity.unrecognized");
+	requireInteger(scope.parseFailed, "scopeIntegrity.parseFailed");
+	requireInteger(scope.truncated, "scopeIntegrity.truncated");
+	if (scope.scopeVerdict !== "PROVEN" && scope.scopeVerdict !== "PARTIAL") fail("scopeIntegrity.scopeVerdict must be \"PROVEN\" or \"PARTIAL\"");
+	if (scope.reasons !== void 0) {
+		if (!Array.isArray(scope.reasons)) fail("scopeIntegrity.reasons must be an array");
+		scope.reasons.forEach((reason, index) => requireString(reason, `scopeIntegrity.reasons[${index}]`));
+	}
+}
+/**
+* Parse-and-validate a saved report. Throws Error with a
+* human-explanatory message on invalid JSON, shape, or contract values.
+*/
+function validateReportJson(text) {
+	if (Buffer.byteLength(text, "utf8") > MAX_REPORT_BYTES) fail(`report exceeds the ${MAX_REPORT_BYTES}-byte limit`);
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch (err) {
+		throw new Error(`not valid JSON (${errorText$1(err)})`, { cause: err });
+	}
+	const doc = requireRecord(parsed, "the report is not an object");
+	if (doc.schemaVersion !== 1) fail(`unsupported schemaVersion ${JSON.stringify(doc.schemaVersion)} — expected schemaVersion 1`);
+	requireBoolean(doc.partial, "partial");
+	if (doc.score !== null) {
+		const score = requireFiniteNumber(doc.score, "score");
+		if (score < 0 || score > 100) fail("score must be null or between 0 and 100");
+	}
+	if (doc.reason !== void 0 && doc.reason !== "no-tests-found") fail("reason must be \"no-tests-found\" when present");
+	if (doc.frameworks === void 0) fail("missing a \"frameworks\" array — is this a complete Mjölnir --json report?");
+	if (!Array.isArray(doc.frameworks) || doc.frameworks.some((value) => typeof value !== "string")) fail("frameworks must be an array of strings");
+	requireBoolean(doc.frameworkDetectionUnknown, "frameworkDetectionUnknown");
+	if (!Array.isArray(doc.dimensions)) fail("dimensions must be an array");
+	doc.dimensions.forEach(validateDimension);
+	if (!Array.isArray(doc.findings)) fail("missing a \"findings\" array — is this a Mjölnir --json report?");
+	if (doc.findings.length > MAX_FINDINGS) fail(`findings exceeds the ${MAX_FINDINGS}-finding limit`);
+	doc.findings.forEach(validateFinding);
+	validateAnalysisStatus(doc.analysisStatus);
+	if (doc.scopeIntegrity !== void 0) validateScopeIntegrity(doc.scopeIntegrity);
+	const status = requireRecord(doc.analysisStatus, "analysisStatus");
+	const partialMarkers = status["discovery"] !== "complete" || status["rules"] !== "complete" || Number(status["skippedFiles"]) > 0 || Number(status["rulesCrashed"] ?? 0) > 0 || Array.isArray(status["reasons"]) && status["reasons"].length > 0;
+	if (doc.partial === false && partialMarkers) fail("partial=false conflicts with analysisStatus");
+	if (doc.partial === true && typeof doc.score === "number" && doc.score === 100) fail("partial reports cannot have a perfect score");
+	if ((isRecord$2(doc.scopeIntegrity) ? doc.scopeIntegrity : void 0)?.["scopeVerdict"] === "PARTIAL" && doc.partial === false) fail("partial=false conflicts with scopeIntegrity");
+	return parsed;
+}
+/** Load + validate a saved report from disk. Throws on any problem. */
+function loadSavedReport(reportPath) {
+	const stat = statSync(reportPath);
+	if (!stat.isFile()) fail(`report path is not a file: ${reportPath}`);
+	if (stat.size > MAX_REPORT_BYTES) fail(`report exceeds the ${MAX_REPORT_BYTES}-byte limit`);
+	return validateReportJson(readFileSync(reportPath, "utf8"));
+}
+/** True when the report file exists (callers own the not-found message). */
+function reportExists(reportPath) {
+	return existsSync(reportPath);
+}
+function identityOf(result) {
+	const identity = result.runIdentity;
+	return isRecord$2(identity) ? identity : void 0;
+}
+/**
+* Classify a loaded report. Pure — it reads the report and the caller's
+* expectation, touches nothing else.
+*
+* `expected` is optional on purpose: a caller with no expectation still gets an
+* honest classification, it just cannot detect a cross-identity read.
+*/
+function classifySavedReport(result, expected) {
+	const identity = identityOf(result);
+	if (identity === void 0) return {
+		state: "OPEN",
+		reason: "report carries no run identity — it predates machine-anchored identity, or was written by hand. Usable as history, not as proof."
+	};
+	const scanId = identity["scanId"];
+	if (typeof scanId !== "string" || scanId.length === 0) return {
+		state: "OPEN",
+		reason: "run identity has no scanId — the identity is unusable."
+	};
+	const commit = typeof identity["commit"] === "string" ? identity["commit"] : void 0;
+	const candidate = identity["candidate"];
+	const candidateManifestId = isRecord$2(candidate) && typeof candidate["manifestId"] === "string" ? candidate["manifestId"] : void 0;
+	if (expected !== void 0) {
+		if (expected.scanId !== void 0 && expected.scanId !== scanId) return {
+			state: "OPEN",
+			reason: `report was produced by a different run (${scanId}) than the current one (${expected.scanId})`
+		};
+		if (expected.commit !== void 0 && expected.commit !== commit) return {
+			state: "OPEN",
+			reason: `report was produced against commit ${commit ?? "unknown"}, not ${expected.commit}`
+		};
+		if (expected.candidateManifestId !== void 0 && expected.candidateManifestId !== candidateManifestId) return {
+			state: "OPEN",
+			reason: `report is bound to candidate ${candidateManifestId ?? "none"}, not ${expected.candidateManifestId}`
+		};
+	}
+	return {
+		state: "VERIFIED",
+		scanId,
+		...commit !== void 0 ? { commit } : {},
+		...candidateManifestId !== void 0 ? { candidateManifestId } : {}
+	};
+}
+/**
+* Load a saved report AND classify it.
+*
+* `loadSavedReport` stays for callers that genuinely only need the parse; the
+* trust-aware path is here so that no consumer reaches a report's contents
+* without having been told how much they may believe.
+*/
+function loadSavedReportStrict(reportPath, expected) {
+	const result = loadSavedReport(reportPath);
+	return {
+		result,
+		trust: classifySavedReport(result, expected),
+		path: reportPath
+	};
+}
+//#endregion
+//#region src/integrations/github/evidence-sanitization.ts
+const MAX_MARKDOWN_TEXT_LENGTH = 500;
+/**
+* Characters that have special meaning in Markdown and must be escaped
+* to render as literal text.
+*/
+const MARKDOWN_SPECIAL_RE = /[[\]*_`~\\|{}()<>#!]/g;
+/**
+* HTML tags and entities that could enable injection.
+*/
+const HTML_INJECTION_RE = /<[^>]*>/g;
+const HTML_ENTITY_RE = /&\w+;|&#\d+;|&#x[\da-f]+;/gi;
+/**
+* Patterns that could form malformed or malicious links.
+*/
+const MALFORMED_LINK_PATTERNS = [/\]\s*\(\s*(?:javascript|data|vbscript)\s*:/gi, /\]\s*\(\s*[^)]{0,200}<[^)]{0,200}>/g];
+const RTL_OVERRIDE_RE = /[\u200f\u202e\u2067\u2066\u2069\u2068]/g;
+/**
+* Escape Markdown special characters in text so they render as literals.
+*/
+function escapeMarkdownChars(text) {
+	return text.replace(MARKDOWN_SPECIAL_RE, "\\$&");
+}
+/**
+* Strip HTML tags and entities to prevent injection.
+*/
+function stripHtml(text) {
+	return text.replace(HTML_ENTITY_RE, "").replace(HTML_INJECTION_RE, "");
+}
+/**
+* Neutralize potential malformed link patterns.
+*/
+function neutralizeMalformedLinks(text) {
+	let result = text;
+	for (const pattern of MALFORMED_LINK_PATTERNS) result = result.replace(pattern, (match) => `[sanitized: ${match.slice(0, 40)}]`);
+	return result;
+}
+/**
+* Strip RTL override characters that could confuse display.
+*/
+function stripRtlOverrides(text) {
+	return text.replace(RTL_OVERRIDE_RE, "");
+}
+/**
+* Sanitize arbitrary text for safe inclusion in Markdown.
+* Escapes special chars, strips HTML, prevents link injection,
+* strips RTL overrides, and caps length.
+*/
+function sanitizeForMarkdown(text) {
+	let result = text;
+	result = stripHtml(result);
+	result = stripRtlOverrides(result);
+	result = neutralizeMalformedLinks(result);
+	result = escapeMarkdownChars(result);
+	if (result.length > MAX_MARKDOWN_TEXT_LENGTH) result = result.slice(0, MAX_MARKDOWN_TEXT_LENGTH) + "\\.\\.\\.";
+	return result;
+}
+//#endregion
 //#region src/commands/trust-report.ts
 /**
 * `mjolnir trust-report` — the Trust Artifact (Mega MVP Master Plan
@@ -4033,7 +4859,23 @@ function fallbackSummary(result) {
 }
 /** HTML-escape a text interpolation (the artifact is hostile-input-safe). */
 function esc(text) {
-	return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;");
+	return [...text].filter((character) => {
+		const code = character.codePointAt(0) ?? 0;
+		return !(code <= 31 || code >= 127 && code <= 159 || code === 8207 || code === 8238 || code >= 8294 && code <= 8297);
+	}).join("").slice(0, 1e3).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;");
+}
+function publicText(text) {
+	return sanitizeForMarkdown(sanitizeErrorText(text, { maxLength: 1e3 }));
+}
+function publicJsonText(text) {
+	return sanitizeErrorText(text, { maxLength: 1e3 });
+}
+function writeArtifact(path, content) {
+	try {
+		writeFileAtomic(path, content, { encoding: "utf8" });
+	} catch (err) {
+		throw new Error(`failed to write artifact ${path}: ${errorMessage(err)}`, { cause: err });
+	}
 }
 function buildArtifactIdentity(result, commit) {
 	const revisions = /* @__PURE__ */ new Map();
@@ -4061,13 +4903,13 @@ function buildArtifactIdentity(result, commit) {
 }
 /** The MD identity section lines (§9 R9). */
 function identityLinesMd(identity) {
-	const revs = identity.detectorRevisions.map((r) => `\`${r.ruleId}@${r.detectorRevision}\``).join(" · ");
+	const revs = identity.detectorRevisions.map((r) => `\`${sanitizeForMarkdown(r.ruleId)}@${r.detectorRevision}\``).join(" · ");
 	const levels = Object.entries(identity.evidenceInventory.byEvidenceLevel).map(([level, n]) => `${level}:${n}`).join(" · ");
 	return [
 		`## Artifact integrity`,
 		"",
-		`- **scanId**: ${identity.scanId ?? "unbound (pre-R9 producer — regenerate)"}`,
-		`- **Commit**: ${identity.commit ?? "unknown (not bound)"}`,
+		`- **scanId**: ${identity.scanId ? sanitizeForMarkdown(identity.scanId) : "unbound (pre-R9 producer — regenerate)"}`,
+		`- **Commit**: ${identity.commit ? sanitizeForMarkdown(identity.commit) : "unknown (not bound)"}`,
 		`- **Rule(rev) inventory**: ${revs === "" ? "none fired" : revs}`,
 		`- **Evidence inventory**: ${identity.evidenceInventory.totalFindings} finding(s), ${identity.evidenceInventory.corroborated} runtime-corroborated, by level ${levels === "" ? "none" : levels}.`,
 		""
@@ -4079,7 +4921,7 @@ function renderTrustReportMarkdown(result, label, commit) {
 	const lines = [];
 	lines.push(`<!-- mjolnir-trust-report:v1 -->`);
 	lines.push("");
-	lines.push(`# Mjölnir Trust Report — ${label}`);
+	lines.push(`# Mjölnir Trust Report — ${publicText(label)}`);
 	lines.push("");
 	lines.push(`> Tests tell you what passed. Mjölnir tells you what you can trust.`);
 	lines.push("");
@@ -4097,10 +4939,10 @@ function renderTrustReportMarkdown(result, label, commit) {
 	lines.push(`| Inconclusive | ${pct$1(s.inconclusiveRate)} |`);
 	lines.push(`| Measured FP (fired) | ${s.measuredFpOfFiredRules !== void 0 ? pct$1(s.measuredFpOfFiredRules) : s.provisionalRuleIds.length > 0 ? `PROVISIONAL (${s.provisionalRuleIds.length} unmeasured)` : "n/a"} |`);
 	lines.push(`| Score | ${result.score ?? "unknown"} |`);
-	lines.push(`| Tests analyzed | ${result.testDeclarationCount ?? 0} in ${result.testFileCount ?? 0} files |`);
+	lines.push(`| Tests analyzed | ${testsAnalyzedCell(result.testDeclarationCount, result.testFileCount)} |`);
 	lines.push("");
 	if (s.ceilingReasons.length > 0) {
-		lines.push(`Incompleteness factors: ${s.ceilingReasons.join(", ")}.`);
+		lines.push(`Incompleteness factors: ${s.ceilingReasons.map(publicText).join(", ")}.`);
 		lines.push("");
 	}
 	lines.push(`## Top trust risks`);
@@ -4112,7 +4954,7 @@ function renderTrustReportMarkdown(result, label, commit) {
 		lines.push(`| ---- | -------- | -------- | ------- |`);
 		for (const f of risks) {
 			const ev = evidenceTag(f);
-			lines.push(`| ${f.ruleId} | ${f.file}:${f.line} | ${ev} | ${f.message.replaceAll("|", "\\|")} |`);
+			lines.push(`| ${publicText(f.ruleId)} | ${publicText(f.file)}:${f.line} | ${ev} | ${publicText(f.message)} |`);
 		}
 	}
 	lines.push("");
@@ -4126,7 +4968,7 @@ function renderTrustReportMarkdown(result, label, commit) {
 	lines.push("");
 	lines.push(`## Next action`);
 	lines.push("");
-	lines.push(nextAction(result));
+	lines.push(publicText(nextAction(result)));
 	lines.push("");
 	lines.push(...identityLinesMd(buildArtifactIdentity(result, commit)));
 	lines.push(`---`);
@@ -4138,6 +4980,7 @@ function renderTrustReportMarkdown(result, label, commit) {
 /** Deterministic JSON artifact (agent-consumable twin of the MD). */
 function renderTrustReportJson(result, commit) {
 	const s = fallbackSummary(result);
+	const completionVerdict = result.partial || result.analysisStatus.discovery !== "complete" || result.analysisStatus.rules !== "complete" || (result.analysisStatus.rulesCrashed ?? 0) > 0 ? "INCOMPLETE" : result.score === null ? "UNKNOWN" : "COMPLETE";
 	return JSON.stringify({
 		schemaVersion: 1,
 		artifact: "mjolnir-trust-report",
@@ -4154,9 +4997,13 @@ function renderTrustReportJson(result, commit) {
 			ceilingReasons: s.ceilingReasons
 		},
 		score: result.score,
+		partial: result.partial,
+		analysisStatus: result.analysisStatus,
+		scopeIntegrity: result.scopeIntegrity ?? null,
+		verdict: completionVerdict,
 		tests: {
-			files: result.testFileCount ?? 0,
-			declarations: result.testDeclarationCount ?? 0
+			files: countOrNull(result.testFileCount),
+			declarations: countOrNull(result.testDeclarationCount)
 		},
 		findings: {
 			total: result.findings.length,
@@ -4166,14 +5013,14 @@ function renderTrustReportJson(result, commit) {
 			advisory: result.findings.filter((f) => isAdvisoryFinding(f)).length
 		},
 		topTrustRisks: topTrustRisks(result.findings, 10).map((f) => ({
-			ruleId: f.ruleId,
-			file: f.file,
+			ruleId: publicJsonText(f.ruleId),
+			file: publicJsonText(f.file),
 			line: f.line,
 			severity: f.severity,
-			evidence: f.runtimeCorroboration === void 0 ? f.evidenceLevel ?? "E2" : f.runtimeCorroboration.level,
-			message: f.message
+			evidence: f.runtimeCorroboration === void 0 ? evidenceLevelOf(f) : f.runtimeCorroboration.level,
+			message: publicJsonText(f.message)
 		})),
-		nextAction: nextAction(result)
+		nextAction: publicJsonText(nextAction(result))
 	}, null, 2) + "\n";
 }
 /**
@@ -4191,20 +5038,18 @@ function renderTrustReportHtml(result, label, commit) {
 	const warnings = result.findings.filter((f) => f.severity === "warning").length;
 	const infos = result.findings.filter((f) => f.severity === "info").length;
 	const advisory = result.findings.filter((f) => isAdvisoryFinding(f)).length;
-	const confidenceRows = [];
 	const measuredFpCell = s.measuredFpOfFiredRules !== void 0 ? pct$1(s.measuredFpOfFiredRules) : s.provisionalRuleIds.length > 0 ? `PROVISIONAL (${s.provisionalRuleIds.length} unmeasured)` : "n/a";
-	confidenceRows.push(`Confidence|${pct$1(s.confidence)}${s.confidenceCeiling !== void 0 ? ` (ceiling ${pct$1(s.confidenceCeiling)})` : ""}`);
-	confidenceRows.push(`Evidence coverage|${pct$1(s.evidenceCoverage)}`);
-	confidenceRows.push(`Inconclusive|${pct$1(s.inconclusiveRate)}`);
-	confidenceRows.push(`Measured FP (fired)|${measuredFpCell}`);
-	confidenceRows.push(`Score|${result.score ?? "unknown"}`);
-	confidenceRows.push(`Tests analyzed|${result.testDeclarationCount ?? 0} in ${result.testFileCount ?? 0} files`);
-	const confidenceRowsHtml = confidenceRows.map((row) => {
-		const [k, v] = row.split("|");
-		return `<tr><td>${esc(k ?? "")}</td><td>${esc(v ?? "")}</td></tr>`;
-	}).join("\n          ");
+	const confidenceRowsHtml = [
+		["Confidence", `${pct$1(s.confidence)}${s.confidenceCeiling !== void 0 ? ` (ceiling ${pct$1(s.confidenceCeiling)})` : ""}`],
+		["Evidence coverage", pct$1(s.evidenceCoverage)],
+		["Inconclusive", pct$1(s.inconclusiveRate)],
+		["Measured FP (fired)", measuredFpCell],
+		["Score", result.score === null ? "unknown" : String(result.score)],
+		["Tests analyzed", testsAnalyzedCell(result.testDeclarationCount, result.testFileCount)]
+	].map(([k, v]) => `<tr><th scope="row">${esc(k)}</th><td>${esc(v)}</td></tr>`).join("\n          ");
 	const risksTable = risks.length === 0 ? `<p>None — no non-advisory findings fired.</p>` : `<table>
-          <thead><tr><th>Rule</th><th>Location</th><th>Evidence</th><th>Message</th></tr></thead>
+          <caption>The ${risks.length} highest-risk non-advisory findings. Evidence shows what each finding actually rests on.</caption>
+          <thead><tr><th scope="col">Rule</th><th scope="col">Location</th><th scope="col">Evidence</th><th scope="col">Message</th></tr></thead>
           <tbody>
           ${risks.map((f) => {
 		const ev = evidenceTag(f);
@@ -4243,6 +5088,8 @@ function renderTrustReportHtml(result, label, commit) {
 		`<section id="confidence">`,
 		`<h2>Confidence</h2>`,
 		`<table>`,
+		`          <caption>Mjölnir confidence measurements. A value of “unknown — not measured” means the scan did not produce that measurement; it is not zero.</caption>`,
+		`          <thead><tr><th scope="col">Measurement</th><th scope="col">Value</th></tr></thead>`,
 		`          <tbody>`,
 		`          ${confidenceRowsHtml}`,
 		`          </tbody>`,
@@ -4290,38 +5137,35 @@ async function runTrustReportCommand(argv, io) {
 			io.err("error: --commit requires the run's HEAD sha");
 			return 10;
 		}
-		let raw;
-		try {
-			raw = readFileSync(resolve(fromPath), "utf8");
-		} catch (err) {
-			io.err(`error: cannot read ${fromPath}: ${errorMessage(err)}`);
-			return 10;
-		}
-		let parsed;
+		let loaded;
 		try {
-			parsed = JSON.parse(raw);
+			loaded = loadSavedReportStrict(resolve(fromPath));
 		} catch (err) {
 			io.err(`error: cannot read ${fromPath}: ${errorMessage(err)}`);
 			return 10;
 		}
-		if (typeof parsed !== "object" || parsed === null || parsed.schemaVersion !== 1) {
-			io.err(`error: ${fromPath} is not a canonical mjolnir scan result (schemaVersion 1)`);
+		const scan = loaded.result;
+		if (loaded.trust.state !== "VERIFIED") io.err(`warning: ${loaded.trust.reason} The trust report below describes an OPEN artifact.`);
+		if (commitArg && scan.runIdentity?.commit && scan.runIdentity.commit !== commitArg) {
+			io.err(`error: report commit ${scan.runIdentity.commit} does not match --commit ${commitArg}`);
 			return 10;
 		}
-		const { contract: _contract, ...rest } = parsed;
-		const scan = rest;
+		if (commitArg && scan.runIdentity) scan.runIdentity = {
+			...scan.runIdentity,
+			commit: commitArg
+		};
 		const md = renderTrustReportMarkdown(scan, fromPath, commitArg ?? null);
 		if (argv.includes("--stdout")) {
 			io.out(md);
-			return 0;
+			return loaded.trust.state === "VERIFIED" ? 0 : 2;
 		}
 		try {
 			const outPath = resolve(dirname(fromPath), TRUST_REPORT_MD);
 			const html = renderTrustReportHtml(scan, fromPath, commitArg ?? null);
 			const json = renderTrustReportJson(scan, commitArg ?? null);
-			writeFileSync(outPath, md);
-			writeFileSync(resolve(dirname(fromPath), TRUST_REPORT_HTML), html);
-			writeFileSync(resolve(dirname(fromPath), TRUST_REPORT_JSON), json);
+			writeArtifact(outPath, md);
+			writeArtifact(resolve(dirname(fromPath), TRUST_REPORT_HTML), html);
+			writeArtifact(resolve(dirname(fromPath), TRUST_REPORT_JSON), json);
 			io.out(`trust report written: ${outPath} (plus ${TRUST_REPORT_HTML}, ${TRUST_REPORT_JSON} — same identity binding)`);
 			return 0;
 		} catch (err) {
@@ -4340,17 +5184,21 @@ async function runTrustReportCommand(argv, io) {
 			target,
 			json: true,
 			verbose: false,
-			maxDurationMs: Number.POSITIVE_INFINITY,
+			maxDurationMs: 6e5,
 			scopeChanged: false,
 			format: "json"
 		});
 		const commit = currentCommit(target, { nullable: true });
+		if (commit && result.runIdentity) result.runIdentity = {
+			...result.runIdentity,
+			commit
+		};
 		const md = renderTrustReportMarkdown(result, targetArg, commit);
 		const json = renderTrustReportJson(result, commit);
 		const html = renderTrustReportHtml(result, targetArg, commit);
-		writeFileSync(join(target, TRUST_REPORT_MD), md);
-		writeFileSync(join(target, TRUST_REPORT_JSON), json);
-		writeFileSync(join(target, TRUST_REPORT_HTML), html);
+		writeArtifact(join(target, TRUST_REPORT_MD), md);
+		writeArtifact(join(target, TRUST_REPORT_JSON), json);
+		writeArtifact(join(target, TRUST_REPORT_HTML), html);
 		io.out(`trust report written: ${TRUST_REPORT_MD}, ${TRUST_REPORT_JSON}, ${TRUST_REPORT_HTML} (deterministic — same scan, same bytes)`);
 		return 0;
 	} catch (err) {
@@ -4391,10 +5239,10 @@ function findingLineMd(f) {
 	return `${icon} **${escMd(f.ruleId)}** \`${safePath}:${f.line}\` — ${escMd(f.message)} ${escMd(`[${evidenceTagLine(f)}]`)}\n  Fix: ${fixBody}`;
 }
 /** Score cell with color-coded emoji and optional delta. */
-function renderScoreBadge(score, delta) {
+function renderScoreBadge(score, delta, verdictOverride) {
 	if (score === null) return "### Score\n*n/a*";
 	deriveScoreState(score);
-	let text = `**${score}**/100 ${verdictFor(score)}`;
+	let text = `**${score}**/100 ${verdictOverride ?? verdictFor(score)}`;
 	if (delta !== void 0 && delta !== 0) text += ` (${delta > 0 ? "+" : ""}${delta})`;
 	return `### Score\n${text}`;
 }
@@ -4422,7 +5270,7 @@ function renderConfidenceTable(result, summary) {
 	lines.push(`| Evidence coverage | ${pct$1(summary.evidenceCoverage)} |`);
 	lines.push(`| Inconclusive | ${pct$1(summary.inconclusiveRate)} |`);
 	lines.push(`| Measured FP (fired) | ${summary.measuredFpOfFiredRules !== void 0 ? pct$1(summary.measuredFpOfFiredRules) : summary.provisionalRuleIds.length > 0 ? `PROVISIONAL (${summary.provisionalRuleIds.length} unmeasured)` : "n/a"} |`);
-	lines.push(`| Tests analyzed | ${result.testDeclarationCount ?? 0} in ${result.testFileCount ?? 0} files |`);
+	lines.push(`| Tests analyzed | ${testsAnalyzedCell(result.testDeclarationCount, result.testFileCount)} |`);
 	lines.push("");
 	lines.push("</details>");
 	return lines;
@@ -4462,6 +5310,10 @@ function renderArtifactIntegrity(identity) {
 	lines.push("</details>");
 	return lines;
 }
+function isIncompleteResult(result) {
+	const status = result.analysisStatus;
+	return result.partial || status === void 0 || status.discovery !== "complete" || status.rules !== "complete" || (status.rulesCrashed ?? 0) > 0 || result.scopeIntegrity?.scopeVerdict === "PARTIAL";
+}
 /**
 * Render the unified "Mjölnir Verification Report" PR comment.
 *
@@ -4479,7 +5331,8 @@ function renderUnifiedReport(result, options = {}) {
 		provisionalRuleIds: [],
 		ceilingReasons: []
 	};
-	lines.push("## <img width=\"16\" src=\"https://raw.githubusercontent.com/Sergey-Bar/Mjolnir/main/assets/mjolnir-icon.svg\"/> Mjölnir Verification Report");
+	const incomplete = isIncompleteResult(result) || !result.trustSummary || summary.level === "L0" && summary.evidenceCoverage === 0;
+	lines.push("## <img width=\"16\" alt=\"Mjölnir\" src=\"https://raw.githubusercontent.com/Sergey-Bar/Mjolnir/main/assets/mjolnir-icon.svg\"/> Mjölnir Verification Report");
 	lines.push("");
 	lines.push("> Tests tell you what passed. Mjölnir tells you what you can trust.");
 	lines.push("");
@@ -4487,6 +5340,11 @@ function renderUnifiedReport(result, options = {}) {
 		lines.push("_Scope: only the lines this PR changed._");
 		lines.push("");
 	}
+	if (incomplete) {
+		const reasons = result.analysisStatus?.reasons ?? [];
+		lines.push(`> **Analysis status: INCOMPLETE.** ${reasons.length > 0 ? reasons.map((reason) => escMd(reason)).join(", ") : "The scan did not complete a trustworthy analysis."}`);
+		lines.push("");
+	}
 	const diff = options.diff;
 	const usingDiff = diff?.hasBaseline === true;
 	const findings = usingDiff ? diff.newFindings : result.findings;
@@ -4494,7 +5352,7 @@ function renderUnifiedReport(result, options = {}) {
 	const warningCount = findings.filter((f) => f.severity === "warning").length;
 	const baseScore = diff?.baselineScore;
 	const delta = baseScore !== void 0 && result.score !== null ? result.score - baseScore : void 0;
-	lines.push("<table>");
+	lines.push("<table role=\"presentation\">");
 	lines.push("<tr>");
 	lines.push("<td width=\"130\">");
 	lines.push("");
@@ -4503,7 +5361,7 @@ function renderUnifiedReport(result, options = {}) {
 	lines.push("</td>");
 	lines.push("<td width=\"130\">");
 	lines.push("");
-	lines.push(renderScoreBadge(result.score, delta));
+	lines.push(renderScoreBadge(result.score, delta, incomplete ? "INCOMPLETE" : void 0));
 	lines.push("");
 	lines.push("</td>");
 	lines.push("<td width=\"130\">");
@@ -4521,7 +5379,7 @@ function renderUnifiedReport(result, options = {}) {
 	lines.push("");
 	const state = deriveScoreState(result.score);
 	const headlineFindings = usingDiff ? findings.length : result.findings.length;
-	lines.push(`**Headline:** ${headlineFor(state, headlineFindings)}`);
+	lines.push(incomplete ? "**Headline:** Analysis is incomplete; this report is not a clean or worthy verdict." : `**Headline:** ${headlineFor(state, headlineFindings)}`);
 	lines.push("");
 	lines.push("---");
 	lines.push("");
@@ -4534,7 +5392,7 @@ function renderUnifiedReport(result, options = {}) {
 		lines.push("");
 	}
 	if (findings.length === 0) {
-		lines.push("✅ No new findings in this PR's changes.");
+		lines.push(incomplete ? "⚠️ No findings were observed, but the analysis is incomplete; this is not proof of cleanliness." : usingDiff ? "✅ No new findings in this PR's changes." : "✅ No new findings in the analyzed surface.");
 		lines.push("");
 	} else {
 		const errors = findings.filter((f) => f.severity === "error");
@@ -4599,7 +5457,7 @@ function renderUnifiedReport(result, options = {}) {
 	lines.push("```");
 	lines.push("");
 	const repoLink = options.repoUrl ? ` — ${options.repoUrl}` : "";
-	lines.push(`<sub>Posted by GitHub Actions${repoLink} — blocks merging when the CI gate reports findings at the configured severity.</sub>`);
+	lines.push(incomplete ? `<sub>Posted by GitHub Actions${repoLink} — analysis incomplete; no release verdict is claimed.</sub>` : `<sub>Posted by GitHub Actions${repoLink} — blocks merging when the CI gate reports findings at the configured severity.</sub>`);
 	return lines.join("\n");
 }
 //#endregion
@@ -4626,57 +5484,6 @@ function renderPrComment(result, options = {}) {
 	});
 }
 //#endregion
-//#region src/commands/report-io.ts
-/**
-* Shared saved-report loading (agent-handoff plan §9.0).
-*
-* `summary`, `handoff` and `why` all consume a saved `--json` report.
-* One loader, one validation, one error shape — previously
-* validateReportJson was private to summary.ts; extracting it keeps
-* the three commands byte-identical in their loading behavior without
-* duplication. The exit-code mapping stays in the callers (they own
-* their io), but the error MESSAGES are identical because they come
-* from here.
-*/
-/** Human message for any thrown value — never "undefined"/"[object Object]". */
-function errorText$1(err) {
-	if (err instanceof Error) return err.message;
-	if (typeof err === "string") return err;
-	if (typeof err === "object" && err !== null) return JSON.stringify(err);
-	return String(err);
-}
-/**
-* Parse-and-validate a saved report. Throws Error with a
-* human-explanatory message on: invalid JSON, non-object document,
-* wrong schemaVersion, missing findings array, missing frameworks
-* array (certification F1: a schema-1 report is MORE than
-* `{schemaVersion, findings}` — summary/handoff/why read
-* `result.frameworks`, so a schema-incomplete stub must be rejected
-* HERE, by the one shared loader, not crash downstream).
-*/
-function validateReportJson(text) {
-	let parsed;
-	try {
-		parsed = JSON.parse(text);
-	} catch (err) {
-		throw new Error(`not valid JSON (${errorText$1(err)})`, { cause: err });
-	}
-	if (typeof parsed !== "object" || parsed === null) throw new Error("the file is a JSON value but not an object");
-	const doc = parsed;
-	if (doc.schemaVersion !== 1) throw new Error(`unsupported schemaVersion ${JSON.stringify(doc.schemaVersion)} — expected 1`);
-	if (!Array.isArray(doc.findings)) throw new Error("missing a \"findings\" array — is this a Mjölnir --json report?");
-	if (!Array.isArray(doc.frameworks)) throw new Error("missing a \"frameworks\" array — is this a complete Mjölnir --json report?");
-	return parsed;
-}
-/** Load + validate a saved report from disk. Throws on any problem. */
-function loadSavedReport(reportPath) {
-	return validateReportJson(readFileSync(reportPath, "utf8"));
-}
-/** True when the report file exists (callers own the not-found message). */
-function reportExists(reportPath) {
-	return existsSync(reportPath);
-}
-//#endregion
 //#region src/commands/why.ts
 /**
 * `mjolnir why <file>:<line>` — occurrence-level evidence/explanation
@@ -4739,7 +5546,7 @@ function evidenceLines(f, ui) {
 	}
 	return lines;
 }
-const SUPPRESSION_HINT = "Suppression (only with cause): an `ignore` entry in mjolnir.config.json — reason REQUIRED, expires after 90 days. Prefer fixing the root cause.";
+const SUPPRESSION_HINT = "Suppression (only with cause): an `ignore` entry in mjolnir.config.json — reason REQUIRED; only an explicit ISO `expires` date is bounded. Prefer fixing the root cause.";
 /** Render the why answer. Pure over (match, ui). */
 function renderWhy(match, ui = plainContext()) {
 	const { p } = ui;
@@ -5108,22 +5915,11 @@ function buildBadge(result, commit) {
 * (the falsifiable claim: "verified at commit X on date Y").
 */
 function renderBadgeSnippet(result, repoUrl = "https://github.com/Sergey-Bar/Mjolnir") {
-	let commit = "unknown";
-	try {
-		commit = execFileSync("git", [
-			"rev-parse",
-			"--short",
-			"HEAD"
-		], {
-			cwd: process.cwd(),
-			encoding: "utf8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		}).trim();
-	} catch {}
+	const commit = runGit(process.cwd(), [
+		"rev-parse",
+		"--short",
+		"HEAD"
+	])?.trim() ?? "unknown";
 	const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
 	const errors = result.findings.filter((f) => f.severity === "error").length;
 	return [
@@ -5378,7 +6174,7 @@ function createRuleScaffold(input, rootDir) {
 	};
 	mkdirSync(join(rootDir, "src", "rules", parsed.dir), { recursive: true });
 	const files = [];
-	writeFileAtomic(absRule, `/**
+	const ruleSrc = `/**
  * ${input.id} — ${input.title}.
  *
  * TODO(implement): replace the placeholder below. The rule currently
@@ -5404,7 +6200,8 @@ export const ${camel(parsed.lower)} = defineRule({
     return findings;
   },
 });
-`);
+`;
+	writeFileAtomic(absRule, ruleSrc);
 	files.push(ruleRel);
 	for (const direction of ["must-fire", "must-not-fire"]) {
 		const dirRel = join("tests", "fixtures", input.id, direction);
@@ -5505,14 +6302,19 @@ function buildHandover(scan, forensics) {
 		heading: "⚠ CI trust warnings (green ≠ verified)",
 		items: ciTrust.slice(0, 4).map((f) => `${f.file}:${f.line} — ${f.message}`)
 	});
-	if (new Set(scan.findings.map((f) => f.file)).size === 0 && scan.score !== null && scan.score >= 90 || scan.findings.length === 0) sections.push({
+	if (new Set(scan.findings.map((f) => f.file)).size === 0 && scan.score !== null && deriveScoreState(scan.score).band === "trusted" || scan.findings.length === 0) sections.push({
 		heading: "🟢 Solid foundation",
 		items: ["No tracked anti-patterns found in scanned specs — good place to start contributing."]
 	});
-	const totalIssues = fakeGreen.length + flaky.length + ciTrust.length + (forensics?.flakyTests ?? 0);
+	const flakyFromRuntime = forensics === null ? null : forensics.flakyTests;
+	const totalIssues = fakeGreen.length + flaky.length + ciTrust.length + (flakyFromRuntime ?? 0);
+	if (flakyFromRuntime === null) sections.push({
+		heading: "⚠ Not measured — no runtime evidence",
+		items: ["No run report was ingested, so flakiness, retries and real pass/fail outcomes are UNKNOWN here. Run `mjolnir forensics <results-dir>` (or point this at a test-results directory) before treating this suite as green.", "Everything above is static analysis only (trust L0–L2): it can show a pattern, never confirm a test ran."]
+	});
 	return {
 		sections,
-		summaryLine: totalIssues === 0 ? "Welcome aboard — the suite is in good shape." : `${totalIssues} thing${totalIssues === 1 ? "" : "s"} to know about before your first release sign-off.`
+		summaryLine: totalIssues > 0 ? `${totalIssues} thing${totalIssues === 1 ? "" : "s"} to know about before your first release sign-off.` : flakyFromRuntime === null ? "Static analysis found nothing — but no runtime evidence was ingested, so this is NOT a statement that the suite is in good shape." : "Welcome aboard — the suite is in good shape."
 	};
 }
 function renderHandover(map) {
@@ -5550,13 +6352,15 @@ function renderHandover(map) {
 * tests/privacy-network-isolation.spec.ts, which scans this file too).
 */
 const ui$13 = plainContext();
-/** The S1-resolved absolute git binary, or the bare name to fail on. */
+/** The S1-resolved absolute git binary, or null when none is available. */
 function gitExe() {
-	return resolveGitPath() ?? "git";
+	return resolveGitPath();
 }
 function git(root, args) {
+	const executable = gitExe();
+	if (!executable) return null;
 	try {
-		return execFileSync(gitExe(), [
+		return execFileSync(executable, [
 			"-C",
 			root,
 			...args
@@ -5575,8 +6379,10 @@ function git(root, args) {
 }
 /** Like git(), but returns the raw bytes — no utf8 decode round-trip. */
 function gitBuffer(root, args) {
+	const executable = gitExe();
+	if (!executable) return null;
 	try {
-		return execFileSync(gitExe(), [
+		return execFileSync(executable, [
 			"-C",
 			root,
 			...args
@@ -5610,7 +6416,16 @@ async function computeImpact(root, options) {
 		"HEAD",
 		options.baseBranch ?? "main"
 	])?.trim() ?? void 0;
-	else baseRef = git(root, ["rev-parse", baseRef])?.trim() ?? baseRef;
+	else {
+		baseRef = git(root, ["rev-parse", baseRef])?.trim();
+		if (!baseRef) return {
+			hasComparison: false,
+			unknownReason: "base-ref-invalid",
+			resolved: [],
+			introduced: [],
+			unknownFacts
+		};
+	}
 	if (!baseRef) return {
 		hasComparison: false,
 		unknownReason: "no-prior-commit",
@@ -5618,7 +6433,15 @@ async function computeImpact(root, options) {
 		introduced: [],
 		unknownFacts
 	};
-	const headRef = git(root, ["rev-parse", "HEAD"])?.trim() ?? "HEAD";
+	const headRef = git(root, ["rev-parse", "HEAD"])?.trim();
+	if (!headRef) return {
+		hasComparison: false,
+		unknownReason: "head-ref-invalid",
+		baseRef,
+		resolved: [],
+		introduced: [],
+		unknownFacts
+	};
 	if (baseRef === headRef) return {
 		hasComparison: false,
 		unknownReason: options.since ? "base-equals-head" : "no-prior-commit",
@@ -5669,7 +6492,7 @@ async function computeImpact(root, options) {
 			if (blob === null) continue;
 			const dest = join(tmpDir, relPath);
 			mkdirSync(dirname(dest), { recursive: true });
-			writeFileSync(dest, blob);
+			writeFileAtomic(dest, blob);
 		}
 		if (truncated) {
 			baseTreeTruncated = {
@@ -5979,7 +6802,7 @@ function tryReadPackageJson(rootDir) {
 	const p = join(rootDir, "package.json");
 	if (!existsSync(p)) return null;
 	try {
-		return parseJsonFile(readFileSync(p, "utf8"), p, isRecord$2);
+		return parseJsonFile(readFileSync(p, "utf8"), p, isRecord$3);
 	} catch {
 		return null;
 	}
@@ -6843,7 +7666,8 @@ async function runScanCommand(argv, io = {
 			onProgress: (e) => progress.onEvent(e),
 			onGateNotice: (notice) => io.err(notice),
 			...args.debug ? { onRuleCrash: (ruleId, file, error) => {
-				crashLog.push(`${ruleId} crashed on ${file}: ${error instanceof Error ? error.message : String(error)}`);
+				const detail = error instanceof Error ? [error.message, error.stack].filter((value) => Boolean(value)).join("\n") : String(error);
+				crashLog.push(`${ruleId} crashed on ${file}: ${detail}`);
 			} } : {}
 		});
 		progress.done();
@@ -6856,7 +7680,12 @@ async function runScanCommand(argv, io = {
 			if (args.json) io.err("--score overrides --json; stdout is the bare score.");
 			const { config: scoreConfig } = loadConfig(target, { knownRuleIds: KNOWN_RULE_IDS$1 });
 			io.out(result.score === null ? "unknown" : String(result.score));
-			return exitForFindings(result.findings, args.blocking === "none" ? "advisory" : args.blocking ?? scoreConfig.gate ?? "error");
+			return scanExitCode({
+				partial: result.partial,
+				findings: result.findings,
+				gate: args.blocking === "none" ? "advisory" : args.blocking ?? scoreConfig.gate ?? "error",
+				isAdvisory: isAdvisoryFinding
+			});
 		}
 		renderScanOutput(result, args, target, io);
 		if (args.format === "terminal") {
@@ -6873,7 +7702,12 @@ async function runScanCommand(argv, io = {
 		if (result.partial) return 2;
 		const { config, warnings } = loadConfig(target, { knownRuleIds: KNOWN_RULE_IDS$1 });
 		for (const w of warnings) io.err(w);
-		return exitForFindings(result.findings, args.blocking === "none" ? "advisory" : args.blocking ?? config.gate ?? "error");
+		return scanExitCode({
+			partial: false,
+			findings: result.findings,
+			gate: args.blocking === "none" ? "advisory" : args.blocking ?? config.gate ?? "error",
+			isAdvisory: isAdvisoryFinding
+		});
 	} catch (err) {
 		if (err instanceof ConfigValidationError) {
 			io.err(err.message);
@@ -7217,6 +8051,33 @@ async function runPrCommentCommand(argv, io = {
 	out,
 	err
 }) {
+	const fromIdx = argv.indexOf("--from");
+	if (fromIdx !== -1) {
+		const fromPath = argv[fromIdx + 1];
+		if (!fromPath || fromPath.startsWith("-")) {
+			io.err("error: --from requires a saved report path");
+			return 10;
+		}
+		try {
+			const saved = loadSavedReport(resolve(fromPath));
+			const option = (flag) => {
+				const index = argv.indexOf(flag);
+				return index >= 0 ? argv[index + 1] : void 0;
+			};
+			const version = option("--version");
+			const commit = option("--commit");
+			const repoUrl = option("--repo-url");
+			io.out(renderPrComment(saved, {
+				...version ? { version } : {},
+				...commit ? { commit } : {},
+				...repoUrl ? { repoUrl } : {}
+			}));
+			return 0;
+		} catch (err) {
+			io.err(`error: cannot read ${fromPath}: ${errorText$1(err)}`);
+			return 10;
+		}
+	}
 	const args = parseArgsOrUsage(argv, io);
 	if (!args) return 10;
 	try {
@@ -7376,7 +8237,12 @@ async function runRulesCommand(argv, io = {
 		return 0;
 	}
 	const root = process$1.cwd();
-	const external = withExternal ? await loadLocalRules(root) : void 0;
+	const gateOpen = pluginsGateOpen(argv.includes("--enable-plugins"));
+	const external = withExternal ? await loadLocalRules(root, gateOpen) : void 0;
+	if (external?.skipped.length) io.err(renderGateNotice(external.skipped.map((name) => ({
+		kind: "js-module",
+		name
+	}))));
 	let catalog = [...buildCatalog(), ...external ? buildCatalog(external.rules, { provenance: "external" }) : []];
 	for (const w of external?.errors ?? []) io.err(`mjolnir: ${w}`);
 	if (argv.includes("--unmeasured")) catalog = catalog.filter((e) => e.measuredFpRate === void 0);
@@ -7701,7 +8567,7 @@ function computeDetectorHashes(rules, rulesDir, retiredIds = []) {
 	return manifest;
 }
 function loadManifest(path) {
-	return parseJsonFile(readFileSync(path, "utf8"), path, (v) => isRecord$2(v));
+	return parseJsonFile(readFileSync(path, "utf8"), path, (v) => isRecord$3(v));
 }
 //#endregion
 //#region src/commands/doctor.ts
@@ -7878,7 +8744,7 @@ function checkTierEnforcement(verdictsDir, rules = RULES) {
 			const lines = readFileSync(join(verdictsDir, f), "utf8").split("\n").filter((l) => l.trim().length > 0);
 			for (const line of lines) try {
 				const parsed = JSON.parse(line);
-				if (!isRecord$2(parsed)) continue;
+				if (!isRecord$3(parsed)) continue;
 				const entry = parsed;
 				if (entry.verdict === "TP" || entry.verdict === "FP") {
 					if (typeof entry.ruleId === "string") live.set(entry.ruleId, (live.get(entry.ruleId) ?? 0) + 1);
@@ -7986,7 +8852,7 @@ function checkFixtureIntegrity(fixturesRoot, rules = RULES) {
 	const allowlistPath = join(fixturesRoot, "typecheck-allowlist.json");
 	if (existsSync(allowlistPath)) try {
 		const raw = JSON.parse(readFileSync(allowlistPath, "utf8"));
-		if (!isRecord$2(raw)) {
+		if (!isRecord$3(raw)) {
 			ok = false;
 			details.push("typecheck-allowlist.json is not an object");
 		} else if (Array.isArray(raw.entries)) details.push(`Layer A typecheck allowlist: ${raw.entries.length} justified entr(ies)`);
@@ -8100,7 +8966,7 @@ function checkMeasurementConsistency(verdictsDir, sidecarPath, rules = RULES, me
 			let row;
 			try {
 				const parsed = JSON.parse(trimmed);
-				if (!isRecord$2(parsed)) {
+				if (!isRecord$3(parsed)) {
 					failures.push(`${f}: unparseable verdict row (corpus integrity)`);
 					continue;
 				}
@@ -8117,7 +8983,7 @@ function checkMeasurementConsistency(verdictsDir, sidecarPath, rules = RULES, me
 	let sidecar = {};
 	if (existsSync(sidecarPath)) try {
 		const parsed = JSON.parse(readFileSync(sidecarPath, "utf8"));
-		if (!isRecord$2(parsed)) failures.push("sidecar is not a valid object — regenerate the measurement artifacts");
+		if (!isRecord$3(parsed)) failures.push("sidecar is not a valid object — regenerate the measurement artifacts");
 		else sidecar = parsed;
 	} catch (e) {
 		failures.push(`sidecar unreadable/malformed: ${errorText(e)} — regenerate the measurement artifacts`);
@@ -8365,9 +9231,14 @@ function truncateMessage(message, max = 250) {
 * `--path-prefix <dir>` re-scopes for subdirectory scans.
 */
 const DETAILS_PER_SEVERITY_CAP = 25;
-function scoreBar$1(score, width = 20) {
-	const filled = Math.round(score / 100 * width);
-	return `${"█".repeat(filled)}${"░".repeat(Math.max(0, width - filled))}`;
+/**
+* The score bar. BW-105: the canonical gauge with the inert palette — the
+* job summary is a Markdown file, so it takes the gauge's geometry (bar +
+* head tick) and none of its SGR escapes, while the band is carried in
+* words on the line above.
+*/
+function scoreBar$1(score) {
+	return scoreGauge(score, palette(false), 20);
 }
 /** Markdown step summary. Pure over (result, options) — testable. */
 function renderStepSummary(result, options = {}) {
@@ -8577,9 +9448,19 @@ function fpLine(f) {
 	if (f.measuredFpRate === void 0) return "Measured FP rate: none — this rule ships on assumption (no measured false-positive rate).";
 	return `Measured FP rate: ${Math.round(f.measuredFpRate * 100)}%${f.measuredFpN !== void 0 ? ` over ${f.measuredFpN} classified verdicts` : ""}.`;
 }
-function scoreBar(score, width = 20) {
-	const filled = Math.round(score / 100 * width);
-	return `${"█".repeat(filled)}${"░".repeat(Math.max(0, width - filled))}`;
+/**
+* The score bar. BW-105: this used to be a private, COLOURLESS copy of
+* `scoreGauge` — 20 blocks of `█`/`░` with no head tick, so 99 and 100
+* rendered identically and a reader could not read a band off the bar.
+*
+* It delegates to the canonical gauge with the inert palette: the head-tick
+* geometry is the gauge's own, and NO SGR escapes reach a Markdown file
+* (which would render as literal `[38;2;…m` on GitHub). The band itself is
+* carried in words on the line above — `VERDICT (band)` — which is R11
+* anyway: a colour is never the only signal.
+*/
+function scoreBar(score) {
+	return scoreGauge(score, palette(false), 20);
 }
 function scopeNote(options) {
 	const parts = [];
@@ -8715,7 +9596,7 @@ function renderHandoff(result, options = {}, version = ENGINE_VERSION) {
 	});
 	lines.push("## How to use this document");
 	lines.push("");
-	lines.push("- Validate each occurrence according to its evidence level before editing.", "- Apply the smallest behavior-preserving fix.", "- Re-run the verification procedure below; correlate by fingerprint.", "- Never suppress a finding merely to obtain a green scan (suppressions live in `mjolnir.config.json`, require a reason, and expire after 90 days).");
+	lines.push("- Validate each occurrence according to its evidence level before editing.", "- Apply the smallest behavior-preserving fix.", "- Re-run the verification procedure below; correlate by fingerprint.", "- Never suppress a finding merely to obtain a green scan (suppressions live in `mjolnir.config.json` and require a reason; only an explicit ISO `expires` date is bounded).");
 	lines.push("");
 	lines.push(scopeNote(options) ? scopeNote(options).trim() : "");
 	if (!scopeNote(options)) lines.pop();
@@ -8873,10 +9754,10 @@ function agentBrief(surface, cwdNote) {
 		`Run \`${cwdNote}npx mjolnir-qa@${ENGINE_VERSION} . --scope changed\` before finishing any task that touched test code.`,
 		"",
 		"- Exit 0 = clean. Exit 1 = new findings on changed lines: fix them (smallest behavior-preserving change) or justify them to the user.",
-		`- npx mjolnir-qa@${ENGINE_VERSION} why <file>:<line> explains any finding (evidence level, measured FP rate, fix).`,
+		`- npx mjolnir-qa@${ENGINE_VERSION} why <file>:<line> explains any finding (evidence level, measured FP rate or explicit unmeasured state, fix).`,
 		`- npx mjolnir-qa@${ENGINE_VERSION} handoff renders a full remediation plan from a saved --json report.`,
 		`- Agent loop: establish the before-state once with npx mjolnir-qa@${ENGINE_VERSION} baseline (commits .mjolnir/baseline.json); after fixing, npx mjolnir-qa@${ENGINE_VERSION} verify prints the before/after digest — resolved (per §15 lifecycle) / new / unchanged by ruleId+location, and the score delta. Exit 0 clean, 1 new errors, 2 partial or no baseline.`,
-		"- NEVER suppress a finding merely to obtain a green scan (suppressions live in mjolnir.config.json, require a reason, and expire after 90 days).",
+		"- NEVER suppress a finding merely to obtain a green scan (suppressions live in mjolnir.config.json and require a reason; only an explicit ISO `expires` date is bounded).",
 		"- After fixing: re-run the scan, report files changed, report checks not run, report unresolved findings honestly.",
 		"",
 		"## Agent safety contract (non-negotiable)",
@@ -9023,7 +9904,7 @@ function executeInstall(entries) {
 		if (e.action === "refuse" || e.action === "no-op") continue;
 		const dir = join(e.file, "..");
 		mkdirSync(dir, { recursive: true });
-		writeFileSync(e.file, e.content);
+		writeFileAtomic(e.file, e.content);
 		written++;
 	}
 	return written;
@@ -9101,19 +9982,12 @@ function hookBlock(version) {
 function resolveHookTarget(cwd) {
 	const huskyDir = join(cwd, ".husky");
 	if (existsSync(huskyDir)) return join(huskyDir, "pre-commit");
-	try {
-		const hooksPath = execFileSync("git", [
-			"-C",
-			cwd,
-			"config",
-			"core.hooksPath"
-		], { stdio: [
-			"ignore",
-			"pipe",
-			"ignore"
-		] }).toString().trim();
-		return join(cwd, hooksPath, "pre-commit");
-	} catch {}
+	const hooksPath = runGit(cwd, ["config", "core.hooksPath"])?.trim();
+	if (hooksPath) {
+		const candidate = resolve(cwd, hooksPath);
+		const relativePath = relative(cwd, candidate);
+		if (relativePath === "" || !relativePath.startsWith("..") && !isAbsolute(relativePath)) return join(candidate, "pre-commit");
+	}
 	return join(cwd, ".git", "hooks", "pre-commit");
 }
 /**
@@ -9150,22 +10024,22 @@ function executeHookInstall(entry) {
 	switch (entry.action) {
 		case "create":
 			mkdirSync(join(entry.file, ".."), { recursive: true });
-			writeFileSync(entry.file, `#!/bin/sh\n${hookBlock(ENGINE_VERSION)}\n`);
+			writeFileAtomic(entry.file, `#!/bin/sh\n${hookBlock(ENGINE_VERSION)}\n`);
 			return true;
 		case "append": {
 			const existing = readFileSync(entry.file, "utf8");
 			const sep = existing.endsWith("\n") ? "" : "\n";
-			writeFileSync(entry.file, `${existing}${sep}\n${hookBlock(ENGINE_VERSION)}\n`);
+			writeFileAtomic(entry.file, `${existing}${sep}\n${hookBlock(ENGINE_VERSION)}\n`);
 			return true;
 		}
 		case "update": {
 			const existing = readFileSync(entry.file, "utf8");
 			const openIdx = existing.indexOf(HOOK_MARKER_OPEN);
 			const closeIdx = existing.indexOf(HOOK_MARKER_CLOSE);
-			if (openIdx !== -1 && closeIdx !== -1) writeFileSync(entry.file, existing.slice(0, openIdx) + hookBlock(ENGINE_VERSION) + existing.slice(closeIdx + 29));
+			if (openIdx !== -1 && closeIdx !== -1) writeFileAtomic(entry.file, existing.slice(0, openIdx) + hookBlock(ENGINE_VERSION) + existing.slice(closeIdx + 29));
 			else {
 				const sep = existing.endsWith("\n") ? "" : "\n";
-				writeFileSync(entry.file, `${existing}${sep}\n${hookBlock(ENGINE_VERSION)}\n`);
+				writeFileAtomic(entry.file, `${existing}${sep}\n${hookBlock(ENGINE_VERSION)}\n`);
 			}
 			return true;
 		}
@@ -9619,7 +10493,7 @@ function checkArtifactIntegrity(root) {
 			what: "the artifact embeds its identity binding (scanId/commit/rule(rev)/evidence inventory)"
 		},
 		{
-			ok: report.includes("TRUST_REPORT_HTML") && report.includes("renderTrustReportHtml") && /writeFileSync\(join\(target,\s*TRUST_REPORT_HTML\)/.test(report),
+			ok: report.includes("TRUST_REPORT_HTML") && report.includes("renderTrustReportHtml") && /write(?:FileSync|Artifact)\(join\(target,\s*TRUST_REPORT_HTML\)/.test(report),
 			what: "the HTML artifact ships and the command writes all three formats"
 		},
 		{
@@ -9642,6 +10516,15 @@ function checkArtifactIntegrity(root) {
 		details: bad
 	};
 }
+function isReleaseVersion(value) {
+	const isNumeric = (part) => /^\d+$/.test(part) && (part === "0" || !part.startsWith("0"));
+	const [core, prerelease, ...extra] = value.split("-");
+	const [major, minor, patch, ...coreExtra] = (core ?? "").split(".");
+	if (extra.length > 0 || major === void 0 || minor === void 0 || patch === void 0 || coreExtra.length > 0 || !isNumeric(major) || !isNumeric(minor) || !isNumeric(patch)) return false;
+	if (prerelease === void 0) return true;
+	const [kind, number, ...rcExtra] = prerelease.split(".");
+	return kind === "rc" && number !== void 0 && isNumeric(number) && rcExtra.length === 0;
+}
 function checkReleaseVersionConsistency(root) {
 	const pkgPath = join(root, "package.json");
 	const clPath = join(root, "CHANGELOG.md");
@@ -9651,9 +10534,14 @@ function checkReleaseVersionConsistency(root) {
 		details: ["package.json or CHANGELOG.md missing"]
 	};
 	const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
-	const cl = readFileSync(clPath, "utf8");
-	const head = /^##\s+\[?(\d+\.\d+\.\d+)\]?/m.exec(cl)?.[1];
-	if (!pkg.version || head === void 0) return {
+	const head = readFileSync(clPath, "utf8").split(/\r?\n/).reduce((found, line) => {
+		if (found !== void 0 || !line.startsWith("## [")) return found;
+		const headingEnd = line.indexOf("]", 4);
+		if (headingEnd < 5) return void 0;
+		const candidate = line.slice(4, headingEnd).trim();
+		return isReleaseVersion(candidate) ? candidate : void 0;
+	}, void 0);
+	if (!pkg.version || !isReleaseVersion(pkg.version) || head === void 0 || !isReleaseVersion(head)) return {
 		evidence: "INCONCLUSIVE",
 		determination: "INCONCLUSIVE",
 		details: ["unparsable version surfaces"]
@@ -9873,98 +10761,90 @@ function runReleaseTrustCommand(argv, io = {
 //#endregion
 //#region src/commands/business-case.ts
 /**
-* `mjolnir business-case` — ROI estimate per finding (extended).
-*
-* Projects the business impact of untrustworthy verification by
-* combining:
-*   - Measured false-positive rate per rule (from the FP audit
-*     corpus)
-*   - Industry-specific cost of a false-green release per incident
-*   - Historical incident data from git log (optional)
-*   - Projected savings over 6/12 months (optional)
-*
-* Static analysis — no test execution, no telemetry, deterministic
-* output.
-*/
-const DEFAULT_INCIDENT_COST = 25e3;
-/** Industry cost multipliers for false-green incidents. */
-const INDUSTRY_COSTS = {
-	default: DEFAULT_INCIDENT_COST,
-	fintech: 5e4,
-	healthcare: 1e5,
-	ecommerce: 15e3,
-	saas: 3e4,
-	enterprise: 4e4,
-	gaming: 2e4,
-	education: 1e4
-};
-const INDUSTRY_DESCRIPTIONS = {
-	default: "general",
-	fintech: "financial services (regulatory fines, PCI/HIPAA)",
-	healthcare: "healthcare (HIPAA, patient safety)",
-	ecommerce: "e-commerce (cart abandonment, lost sales)",
-	saas: "SaaS (churn, reputation)",
-	enterprise: "enterprise (contract penalties, SLA breaches)",
-	gaming: "gaming (player trust, reviews)",
-	education: "education (student data, accreditation)"
-};
-/** Calculate expected savings per finding. */
+* `mjolnir business-case` — measured false-positive rates, and the
+* arithmetic a reader can audit.
+*
+* What changed, and why: this command multiplied a MEASURED false-positive
+* rate by a table of invented incident costs (fintech $50 000, healthcare
+* $100 000, …) with no source, and printed the product as "Expected
+* Savings" and "Total potential savings". A dollar figure with no
+* provenance is worse than no dollar figure: someone puts it in a
+* business case and defends it in a room. It also had a `--history` flag
+* whose own help text promised "estimates from actual scan improvements"
+* and which did nothing but print a pointer elsewhere, and a `--projected`
+* flag that divided the total by six and called the result a monthly rate.
+*
+* So the invented cost table is gone. The one number this command can
+* defend is the measured false-positive rate and how many findings carry
+* it. A dollar conversion happens only when the reader supplies the cost
+* of an incident themselves (`--incident-cost`), because then the number
+* has a source: theirs.
+*
+* Scheduled for removal in 5.0 — see docs/RELEASE-TRAINS.md.
+*/
+/**
+* Evidence weight per level, applied to a user-supplied incident cost.
+* E0 is an observation and never counts — there is nothing to save against
+* a claim nobody made.
+*/
 function expectedSavings(fpRate, evidenceLevel, incidentCost) {
 	if (fpRate === null || fpRate === void 0) return null;
 	const confidence = evidenceLevel === "E2" ? 1 : evidenceLevel === "E1" ? .5 : 0;
 	if (confidence === 0) return null;
 	return Math.round(incidentCost * (1 - fpRate) * confidence);
 }
-function renderSummary(savingsPerFinding, incidentCost, industry, totalSavings) {
+function renderSummary(savingsPerFinding, incidentCost, totalSavings) {
+	const measured = savingsPerFinding.filter((s) => s.fpRate !== null).length;
 	const lines = [
-		"Mjölnir Business Case — Estimated ROI per finding",
-		"=================================================",
+		"Mjölnir — measured false-positive rates on the findings that fired",
+		"=".repeat(58),
 		"",
-		`Industry profile: ${industry} (${INDUSTRY_DESCRIPTIONS[industry] ?? "general"})`,
-		`Assumed cost per false-green incident: $${incidentCost}`,
-		`Sample: ${savingsPerFinding.filter((s) => s.fpRate !== null).length} of ${savingsPerFinding.length} rules have measured FP rates`,
+		`Measured: ${measured} of ${savingsPerFinding.length} findings carry a corpus-measured FP rate.`,
+		...incidentCost === null ? [
+			"",
+			"NO DOLLAR FIGURES ARE SHOWN. Converting a false-positive rate into money",
+			"requires the cost of one false-green incident in YOUR organisation, which",
+			"this tool does not know and will not invent. Pass --incident-cost <n> to",
+			"see the arithmetic; the number is then yours, not Mjölnir's."
+		] : [
+			"",
+			`Incident cost used: $${incidentCost.toLocaleString()} (your figure, from --incident-cost).`,
+			`Findings that fired: ${savingsPerFinding.length}.`
+		],
 		"",
-		"| Rule ID | FP Rate | Evidence | Expected Savings |",
-		"| ------- | ------- | -------- | --------------- |"
+		"| Rule ID | FP Rate | n | Evidence | Expected cost |",
+		"| ------- | ------- | - | -------- | ------------- |"
 	];
-	for (const { ruleId, fpRate, evidenceLevel, expectedSavings: savings } of savingsPerFinding) {
-		const fpDisplay = fpRate !== null ? `${Math.round(fpRate * 100)}%` : "unmeasured";
-		const savingsDisplay = savings !== null ? `$${savings}` : "n/a";
-		lines.push(`| ${ruleId} | ${fpDisplay} | ${evidenceLevel} | ${savingsDisplay} |`);
-	}
-	lines.push("");
-	lines.push("Interpretation:");
-	lines.push("---------------");
-	lines.push("- E2 findings (deterministic proof) carry full business risk — eliminate first");
-	lines.push("- E1 findings (pattern evidence) carry half the assessed risk");
-	lines.push("- Unmeasured rules (n < 10) have no quantified FP rate — add corpus classification");
-	lines.push(`- Total potential savings across all findings: $${totalSavings.toLocaleString()}`);
+	for (const { ruleId, fpRate, fpN, evidenceLevel, expectedSavings: savings } of savingsPerFinding) {
+		const fpDisplay = fpRate !== null ? `${Math.round(fpRate * 100)}%` : "not measured";
+		const nDisplay = fpN !== null ? String(fpN) : "—";
+		const savingsDisplay = incidentCost === null || savings === null ? "—" : `$${savings.toLocaleString()}`;
+		lines.push(`| ${ruleId} | ${fpDisplay} | ${nDisplay} | ${evidenceLevel} | ${savingsDisplay} |`);
+	}
+	lines.push("");
+	lines.push("How to read this:");
+	lines.push("--------------------");
+	lines.push("- E2 is deterministic proof and counts in full; E1 is pattern evidence and counts half;");
+	lines.push("  E0 is an observation and never counts. The evidence column is why the weight differs.");
+	lines.push("- A rule with no measured FP rate is NOT assumed safe. It is unmeasured, and it says so.");
+	if (totalSavings !== null) lines.push(`- Total expected cost across these findings: $${totalSavings.toLocaleString()}`);
 	return lines.join("\n");
 }
-function renderProjection(monthlySavings, months, incidentCost) {
-	const totalProjected = monthlySavings * months;
-	const incidentsPrevented = Math.round(totalProjected / incidentCost);
-	return [
-		"",
-		"SAVINGS PROJECTION",
-		"==================",
-		"",
-		`Monthly savings estimate:  $${monthlySavings.toLocaleString()}`,
-		`Projection period:        ${months} months`,
-		`Projected total savings:  $${totalProjected.toLocaleString()}`,
-		`Incidents prevented:      ~${incidentsPrevented} (at $${incidentCost.toLocaleString()}/incident)`,
-		""
-	].join("\n");
-}
 /**
 * Entry point for `mjolnir business-case`.
 *
 * Flags:
-*   --industry <type>    Industry cost profile (default/fintech/healthcare/...)
-*   --history <months>   Use git history for the last N months (estimates from
-*                        actual scan improvements, not projections)
-*   --projected <months> Show projected savings over N months
+*   --incident-cost <n>  The cost of ONE false-green incident in your
+*                        organisation. Until you supply it, no dollar
+*                        figure is printed at all.
 *   --strict             Include quarantine-tier findings
+*
+* `--history` and `--projected` are GONE. Both promised arithmetic this
+* tool cannot do: `--history` claimed to estimate from actual scan
+* improvements while reading no history at all, and `--projected` divided
+* the total by six and called the quotient a monthly rate. A flag that
+* does not do what its help says is worse than no flag, because the help
+* is the promise.
 */
 async function runBusinessCaseCommand(argv, io = {
 	out,
@@ -9972,25 +10852,29 @@ async function runBusinessCaseCommand(argv, io = {
 }) {
 	try {
 		const target = argv.find((a) => !a.startsWith("-")) ?? ".";
-		const industryIdx = argv.indexOf("--industry");
-		const industry = industryIdx !== -1 ? argv[industryIdx + 1] ?? "default" : "default";
-		const historyIdx = argv.indexOf("--history");
-		const historyMonths = historyIdx !== -1 ? Number.parseInt(argv[historyIdx + 1] ?? "", 10) : 0;
-		const projectedIdx = argv.indexOf("--projected");
-		const projectedMonths = projectedIdx !== -1 ? Number.parseInt(argv[projectedIdx + 1] ?? "", 10) : 0;
 		const strict = argv.includes("--strict");
-		const historyProvided = historyIdx !== -1;
-		const projectedProvided = projectedIdx !== -1;
-		if (historyProvided && historyMonths < 0) {
-			(io.err ?? err)("--history requires a positive number of months");
-			return 20;
+		for (const gone of [
+			"--industry",
+			"--history",
+			"--projected"
+		]) if (argv.includes(gone)) {
+			(io.err ?? err)(`${gone} is no longer accepted. ` + (gone === "--industry" ? "Incident costs are not industry defaults; pass --incident-cost <n> with a figure from your own incident history." : gone === "--history" ? "It read no history. Use `mjolnir impact --since <date>` for evidence-backed change data." : "A projection is an arithmetic identity, not an estimate. Use `mjolnir trend` for measured history."));
+			return 10;
 		}
-		if (projectedProvided && projectedMonths <= 0) {
-			(io.err ?? err)("--projected requires a positive number of months");
-			return 20;
+		const costIdx = argv.indexOf("--incident-cost");
+		let incidentCost = null;
+		if (costIdx !== -1) {
+			const raw = argv[costIdx + 1];
+			const parsed = Number.parseInt(raw ?? "", 10);
+			if (raw === void 0 || raw.startsWith("-") || !Number.isFinite(parsed) || parsed <= 0) {
+				(io.err ?? err)("--incident-cost requires a positive number: the cost of one false-green incident.");
+				return 10;
+			}
+			incidentCost = parsed;
 		}
-		const incidentCost = INDUSTRY_COSTS[industry] ?? DEFAULT_INCIDENT_COST;
 		io.out(`Scanning ${target} ...`);
+		const invalid = validateScanTarget(target, io.err ?? err);
+		if (invalid !== null) return invalid;
 		const savingsPerFinding = (await runScan({
 			target,
 			json: false,
@@ -9999,29 +10883,18 @@ async function runBusinessCaseCommand(argv, io = {
 			scopeChanged: false,
 			format: "terminal",
 			strict
-		})).findings.map((f) => {
-			const fpRate = f.measuredFpRate ?? null;
-			const evidenceLevel = f.evidenceLevel ?? "E0";
-			const savings = expectedSavings(fpRate, evidenceLevel, incidentCost);
-			return {
-				ruleId: f.ruleId,
-				fpRate,
-				evidenceLevel,
-				expectedSavings: savings
-			};
-		});
-		const totalExpectedSavings = savingsPerFinding.reduce((sum, f) => sum + (f.expectedSavings ?? 0), 0);
-		io.out(renderSummary(savingsPerFinding, incidentCost, industry, totalExpectedSavings));
-		if (projectedMonths > 0) {
-			const monthlySavings = Math.round(totalExpectedSavings / 6);
-			io.out(renderProjection(monthlySavings, projectedMonths, incidentCost));
-		}
-		if (historyMonths > 0) io.out(`\nHistorical analysis (last ${historyMonths} months):\n  NOTE: Historical incident costing requires CI log access.
-  Run \`mjolnir impact --since \${historyMonths}.months.ago\` for
-  evidence-backed impact data from git history.
-  Run \`mjolnir release-report --since v\${historyMonths}.0.0\` for
-  release-quality trajectory.`);
-		io.out("\nThese are projections based on measured FP rates from the OSS corpus.");
+		})).findings.map((f) => ({
+			ruleId: f.ruleId,
+			fpRate: f.measuredFpRate ?? null,
+			fpN: f.measuredFpN ?? null,
+			evidenceLevel: evidenceLevelOf(f),
+			expectedSavings: incidentCost === null ? null : expectedSavings(f.measuredFpRate ?? null, evidenceLevelOf(f), incidentCost)
+		}));
+		const totalExpectedSavings = incidentCost === null ? null : savingsPerFinding.reduce((sum, f) => sum + (f.expectedSavings ?? 0), 0);
+		io.out(renderSummary(savingsPerFinding, incidentCost, totalExpectedSavings));
+		io.out("");
+		io.out("The FP rates above are measured on the OSS corpus. The dollar column, if you");
+		io.out("asked for one, uses YOUR incident cost — Mjölnir does not estimate it.");
 		io.out("Run with --strict to also surface quarantine-tier findings.");
 		return 0;
 	} catch (e) {
@@ -10038,10 +10911,18 @@ async function runBusinessCaseCommand(argv, io = {
 * posture and renders a management-ready verdict:
 *   GO · CONDITIONAL GO · NO-GO
 *
-* One command, screenshot-into-the-release-channel ready.
+* What changed, and why: this report hardcoded `hygieneFixed: 0`,
+* `hygieneIntroduced: 0`, `newTestsAdded: 0`, `newTestsWithoutAssertions: 0`
+* and `flakyAtLastRelease: 0`, and printed them as measured figures beside a
+* ✓/↑ trend mark — so a report that measured nothing looked like a report
+* that measured an absence. It also added 0.5/0.2/0.1 engineer-hours per
+* finding to produce a "test-debt cost estimate" nobody had estimated, and it
+* ignored the scan's `partial` flag, so a truncated scan could reach GO.
 *
-* Exit codes (frozen contract): 0 GO · 1 CONDITIONAL GO ·
-* 2 NO-GO · 10 usage · 20 internal.
+* Unmeasured values are now `null` and print as "not measured". Trend marks
+* require two real measurements. GO requires a complete scan. The release
+* decision itself moves to the canonical proof in v5 (V5-070); until then this
+* is a summary, and says so.
 */
 const ui$7 = plainContext();
 /** Rules that count as CI integrity issues for release verdicts. */
@@ -10050,34 +10931,40 @@ const CI_INTEGRITY_RULES = /* @__PURE__ */ new Set([
 	"QA-CI-002",
 	"QA-CI-008"
 ]);
+const NOT_MEASURED = "not measured";
+function show(value) {
+	return value === null ? NOT_MEASURED : String(value);
+}
 function renderVerdictBlock(v) {
 	const lines = [];
 	lines.push(sectionHeader(`RELEASE READINESS — since ${v.since}`, ui$7));
 	lines.push("");
 	lines.push(`Score: ${v.score !== null ? v.score + "/100" : "unknown"}`);
+	lines.push(`Analysis complete: ${v.partial ? "no (PARTIAL)" : "yes"}`);
+	if (v.partial) lines.push("A partial scan cannot support a GO verdict: the unanalyzed surface is exactly where an unknown finding would live.");
 	lines.push("");
 	lines.push("Test hygiene since last release:");
-	lines.push(`  Issues fixed:        ${v.hygieneFixed}`);
-	lines.push(`  Issues introduced:   ${v.hygieneIntroduced}`);
+	lines.push(`  Issues fixed:        ${show(v.hygieneFixed)}`);
+	lines.push(`  Issues introduced:   ${show(v.hygieneIntroduced)}`);
 	lines.push("");
 	lines.push("New tests added:");
-	lines.push(`  Total:                ${v.newTestsAdded}`);
-	lines.push(`  Without assertions:   ${v.newTestsWithoutAssertions}`);
+	lines.push(`  Total:                ${show(v.newTestsAdded)}`);
+	lines.push(`  Without assertions:   ${show(v.newTestsWithoutAssertions)}`);
 	lines.push("");
 	lines.push("Skipped during the cycle:");
-	lines.push(`  ${v.skippedDuringCycle}  ← what we are NOT verifying`);
+	lines.push(`  ${v.skippedDuringCycle}${v.skippedDuringCycle > 0 ? "  ← what we are NOT verifying" : ""}`);
 	lines.push("");
 	lines.push("Flaky tests:");
 	lines.push(`  At release:      ${v.flakyAtRelease}`);
-	const improvement = v.flakyAtRelease <= v.flakyAtLastRelease ? " ✓" : " ↑";
-	lines.push(`  At last release: ${v.flakyAtLastRelease}${improvement}`);
+	const improvement = v.flakyAtLastRelease === null ? "" : v.flakyAtRelease <= v.flakyAtLastRelease ? " ✓" : " ↑";
+	lines.push(`  At last release: ${show(v.flakyAtLastRelease)}${improvement}`);
 	lines.push("");
 	lines.push("CI integrity:");
 	const coeMark = v.continueOnErrorActive === 0 ? " ✓" : " ⚠";
 	lines.push(`  continue-on-error still active: ${v.continueOnErrorActive}${coeMark}`);
 	lines.push(`  Total CI integrity issues:      ${v.ciIntegrityIssues}`);
 	lines.push("");
-	lines.push(`Test-debt cost estimate: ~${v.testDebtHours.toFixed(1)} engineer-hours/qtr`);
+	lines.push(`Test-debt cost estimate: ${v.testDebtHours === null ? NOT_MEASURED : `~${v.testDebtHours.toFixed(1)} engineer-hours/qtr`}`);
 	lines.push("");
 	lines.push(`Blocking findings (error):   ${v.blockingFindings}`);
 	lines.push(`Warning findings (warning):  ${v.advisoryFindings}`);
@@ -10097,7 +10984,7 @@ function renderVerdictBlock(v) {
 		if (v.continueOnErrorActive > 0) lines.push(`  → ${v.continueOnErrorActive} continue-on-error still active — review before ship`);
 		if (v.skippedDuringCycle > 0) lines.push(`  → ${v.skippedDuringCycle} skipped test(s) — verify coverage gaps`);
 		if (v.blockingFindings === 0 && v.advisoryFindings > 0) lines.push(`  → ${v.advisoryFindings} advisory finding(s) — review before ship`);
-	} else lines.push("All gates clear. Release with confidence.");
+	} else lines.push("No gate in this report fired. This is a summary of one static scan, not a release authorization: the canonical release proof is the authority, and it requires candidate-bound evidence this command does not have.");
 	lines.push("");
 	lines.push("Screenshot this report into the release channel.");
 	return lines.join("\n");
@@ -10113,6 +11000,13 @@ function determineVerdict(result, history) {
 			reasons
 		};
 	}
+	if (result.partial) {
+		reasons.push("scan was PARTIAL — the unanalyzed surface is unverified");
+		return {
+			verdict: "NO-GO",
+			reasons
+		};
+	}
 	const flakyCount = history.flakyAtRelease ?? 0;
 	const ciIssues = history.continueOnErrorActive ?? 0;
 	const skipped = history.skippedDuringCycle ?? 0;
@@ -10135,24 +11029,20 @@ function buildReleaseReport(result, since, history = {}) {
 	const { verdict } = determineVerdict(result, history);
 	const errorFindings = result.findings.filter((f) => f.severity === "error");
 	const warningFindings = result.findings.filter((f) => f.severity === "warning");
-	let testDebtHours = 0;
-	for (const f of result.findings) if (CI_INTEGRITY_RULES.has(f.ruleId)) testDebtHours += .5;
-	else if (f.severity === "error") testDebtHours += .5;
-	else if (f.severity === "warning") testDebtHours += .2;
-	else testDebtHours += .1;
 	return {
 		verdict,
 		since,
-		hygieneFixed: 0,
-		hygieneIntroduced: 0,
-		newTestsAdded: 0,
-		newTestsWithoutAssertions: 0,
+		partial: result.partial,
+		hygieneFixed: null,
+		hygieneIntroduced: null,
+		newTestsAdded: null,
+		newTestsWithoutAssertions: null,
 		skippedDuringCycle: history.skippedDuringCycle ?? 0,
 		flakyAtRelease: history.flakyAtRelease ?? 0,
-		flakyAtLastRelease: 0,
+		flakyAtLastRelease: null,
 		ciIntegrityIssues: warningFindings.length,
 		continueOnErrorActive: errorFindings.filter((f) => CI_INTEGRITY_RULES.has(f.ruleId)).length,
-		testDebtHours,
+		testDebtHours: history.testDebtHours ?? null,
 		blockingFindings: errorFindings.length,
 		advisoryFindings: warningFindings.length,
 		score: result.score,
@@ -10194,18 +11084,18 @@ async function runReleaseReportCommand(argv, io) {
 			target,
 			json: false,
 			verbose: false,
-			maxDurationMs: Number.POSITIVE_INFINITY,
+			maxDurationMs: 6e5,
 			scopeChanged: false,
 			format: "terminal",
 			strict: false
 		}), since, history);
 		io.out(renderReleaseReport(report));
-		switch (report.verdict) {
-			case "GO": return 0;
-			case "CONDITIONAL GO": return 1;
-			case "NO-GO": return 1;
-			default: return 20;
+		if (report.verdict === "GO") {
+			io.err("mjolnir release-report: this is a static-scan summary, not release authorization. Run the release gate (npm run candidate:decision:release) before shipping.");
+			return 0;
 		}
+		if (report.verdict === "CONDITIONAL GO" || report.verdict === "NO-GO") return 1;
+		return 20;
 	} catch (e) {
 		internalErrorMessage(e, io.err, false);
 		return 20;
@@ -10214,56 +11104,42 @@ async function runReleaseReportCommand(argv, io) {
 //#endregion
 //#region src/commands/report-playwright.ts
 /**
-* `mjolnir report playwright` — Playwright Reporter Package (SDET-2).
+* `mjolnir report` — Mjölnir findings in the Playwright report shape.
 *
-* Generates a Playwright-compatible JSON report from Mjölnir scan results,
-* enabling Playwright's own UI and tooling to visualize Mjölnir findings.
+* What this command does NOT do, and why: a Playwright report describes tests
+* that were EXECUTED, with per-test outcomes and durations. A static scan
+* executed nothing. Presenting findings as Playwright `suites`/`tests` with a
+* `passed` status manufactured a runtime result that never happened — and on a
+* clean scan it published "0 tests, all passed", which a Playwright consumer
+* reads as a green test run.
 *
-* The report follows the Playwright JSON report schema's structure:
-* each finding becomes a "test" entry with Mjölnir's verdict as outcome.
+* So the execution block is empty and says so, and the findings live in the
+* `mjolnir` extension block where they are honestly labelled as static
+* analysis. The file is a findings report in a familiar shape, not a test run.
 */
 const ui$6 = plainContext();
-function findingOutcome(f) {
-	if (f.severity === "error") return "failed";
-	if (f.severity === "warning") return "expectedFailure";
-	return "passed";
-}
 function buildPlaywrightReport(result) {
 	const now = /* @__PURE__ */ new Date();
-	const findingsByFile = /* @__PURE__ */ new Map();
-	for (const f of result.findings) {
-		const existing = findingsByFile.get(f.file) ?? [];
-		existing.push(f);
-		findingsByFile.set(f.file, existing);
-	}
-	const suites = Array.from(findingsByFile.entries()).map(([file, findings]) => ({
-		title: file,
-		file,
-		tests: findings.map((f) => ({
-			title: `${f.ruleId}: ${f.message}`,
-			path: file,
-			outcome: findingOutcome(f),
-			duration: 0,
-			annotations: [{
-				type: f.severity === "error" ? "error" : "warning",
-				message: `${f.ruleId} — ${f.message}${f.fix ? `\nFix: ${f.fix}` : ""}`
-			}]
-		}))
-	}));
-	const allTests = suites.flatMap((s) => s.tests);
+	const partial = result.partial === true;
+	const hasError = result.findings.some((f) => f.severity === "error");
+	const status = partial ? "interrupted" : hasError ? "failed" : "passed";
 	return {
 		version: 1,
 		startTime: now.toISOString(),
 		endTime: now.toISOString(),
 		duration: 0,
-		status: result.findings.some((f) => f.severity === "error") ? "failed" : "passed",
-		totalTests: allTests.length,
-		passedTests: allTests.filter((t) => t.outcome === "passed").length,
-		failedTests: allTests.filter((t) => t.outcome === "failed").length,
-		suites,
+		status,
+		totalTests: 0,
+		passedTests: 0,
+		failedTests: 0,
+		suites: [],
 		mjolnir: {
+			execution: "STATIC_ANALYSIS",
+			status,
+			partial,
 			score: result.score,
 			framework: result.frameworks[0] ?? "unknown",
+			frameworkDetectionUnknown: result.frameworkDetectionUnknown === true,
 			findings: result.findings.map((f) => {
 				const entry = {
 					ruleId: f.ruleId,
@@ -10288,12 +11164,19 @@ async function runReportPlaywrightCommand(argv, io) {
 		io.err(`mjolnir report playwright: target does not exist: ${target}`);
 		return 10;
 	}
+	const root = resolve(target);
+	const requestedOutput = resolve(outputPath);
+	const outputRelative = relative(root, requestedOutput);
+	if (isAbsolute(outputRelative) || outputRelative.startsWith("..")) {
+		io.err("mjolnir report playwright: output must stay within the target root");
+		return 10;
+	}
 	try {
 		const result = await runScan$1({
 			target,
 			json: true,
 			verbose: false,
-			maxDurationMs: Number.POSITIVE_INFINITY,
+			maxDurationMs: 6e5,
 			scopeChanged: false,
 			format: "json",
 			strict: false
@@ -10301,15 +11184,21 @@ async function runReportPlaywrightCommand(argv, io) {
 		const report = buildPlaywrightReport(result);
 		const outDir = resolve(".");
 		if (!existsSync(outDir)) mkdirSync(outDir, { recursive: true });
-		const fullPath = join(outDir, outputPath);
-		writeFileSync(fullPath, JSON.stringify(report, null, 2) + "\n");
-		const header = sectionHeader("PLAYWRIGHT REPORT", ui$6);
+		const fullPath = requestedOutput;
+		writeFileAtomic(fullPath, JSON.stringify(report, null, 2) + "\n", { encoding: "utf8" });
+		const decision = decideClaim({
+			partial: result.partial,
+			blockingFindings: result.findings.filter((f) => f.severity === "error").length,
+			supported: true
+		});
+		const header = sectionHeader("PLAYWRIGHT-SHAPED FINDINGS REPORT", ui$6);
 		io.out(`${header}\n`);
 		io.out(`Score: ${result.score !== null ? result.score + "/100" : "unknown"}`);
 		io.out(`Findings: ${result.findings.length} (${result.findings.filter((f) => f.severity === "error").length} error, ${result.findings.filter((f) => f.severity === "warning").length} warning)`);
 		io.out(`Report written: ${fullPath}`);
-		io.out(`Tests: ${report.totalTests} total, ${report.passedTests} passed, ${report.failedTests} failed`);
-		return result.findings.some((f) => f.severity === "error") ? 1 : 0;
+		io.out("Executed tests: 0 — this is static analysis, not a test run. The Playwright suite block is empty by design.");
+		io.out(`Determination: ${decision.state} — ${decision.reason}`);
+		return decision.exitCode;
 	} catch (e) {
 		internalErrorMessage(e, io.err, false);
 		return 20;
@@ -10449,32 +11338,49 @@ async function runTrendCommand(argv, io) {
 //#endregion
 //#region src/commands/exec-report.ts
 /**
-* `mjolnir exec-report` — Executive Quality Report (QM-3).
+* `mjolnir exec-report` — a short, measured summary of one scan.
 *
-* Generates a board-ready quality report with KPIs, trend summary,
-* risk assessment, and strategic recommendations.
+* What changed, and why: this command used to render an executive "Risk Level:
+* LOW", KPI deltas ("↑ healthy") with no previous run to compare against,
+* and assurances ("Score 85/100 is excellent — maintain current quality gate")
+* that no measurement supports. It also ignored the `partial` flag entirely,
+* so a truncated scan could print "No findings — clean scan." and exit 0.
 *
-* Output is human-readable terminal format suitable for copying into
-* executive presentations or email briefings.
+* It now reports only what the scan measured, names the surface each number
+* came from, and defers the verdict to the one determination function
+* (`decideClaim`) so a partial scan can never read as clean. Whether a
+* business is "low risk" is a decision this tool does not make for anyone.
 */
 const ui$4 = plainContext();
-function assessRisk(findings) {
-	const errors = findings.filter((f) => f.severity === "error").length;
-	const warnings = findings.filter((f) => f.severity === "warning").length;
-	if (errors > 5 || warnings > 20) return "high";
-	if (errors > 0 || warnings > 5) return "medium";
-	return "low";
-}
-function buildRecommendations(findings, score) {
-	const recs = [];
-	const errors = findings.filter((f) => f.severity === "error").length;
-	const warnings = findings.filter((f) => f.severity === "warning").length;
-	if (errors > 0) recs.push(`Fix ${errors} error finding(s) blocking release confidence`);
-	if (warnings > 0) recs.push(`Review ${warnings} warning finding(s) before next release`);
-	if (score !== null && score < 70) recs.push(`Score ${score}/100 is below the 70 threshold — prioritize rule coverage`);
-	if (score !== null && score >= 90) recs.push(`Score ${score}/100 is excellent — maintain current quality gate`);
-	if (recs.length === 0) recs.push("No critical issues — maintain current quality practices");
-	return recs;
+function buildExecutiveKpis(result) {
+	const errors = result.findings.filter((f) => f.severity === "error").length;
+	const warnings = result.findings.filter((f) => f.severity === "warning").length;
+	return [
+		{
+			label: "Worthiness score",
+			value: result.score !== null ? `${result.score}/100` : "not measured",
+			source: "scan result score",
+			direction: "higher-is-better"
+		},
+		{
+			label: "Error findings",
+			value: String(errors),
+			source: "scan result findings",
+			direction: "lower-is-better"
+		},
+		{
+			label: "Warning findings",
+			value: String(warnings),
+			source: "scan result findings",
+			direction: "lower-is-better"
+		},
+		{
+			label: "Analysis complete",
+			value: result.partial ? "no (partial)" : "yes",
+			source: "scan result partial flag",
+			direction: null
+		}
+	];
 }
 async function runExecReportCommand(argv, io) {
 	const target = argv.find((a) => !a.startsWith("-")) ?? ".";
@@ -10487,60 +11393,34 @@ async function runExecReportCommand(argv, io) {
 			target,
 			json: true,
 			verbose: false,
-			maxDurationMs: Number.POSITIVE_INFINITY,
+			maxDurationMs: 6e5,
 			scopeChanged: false,
 			format: "json",
 			strict: false
 		});
-		const risk = assessRisk(result.findings);
-		const recommendations = buildRecommendations(result.findings, result.score);
-		const kpis = [
-			{
-				label: "Worthiness Score",
-				value: result.score !== null ? `${result.score}/100` : "N/A",
-				delta: result.score !== null && result.score >= 80 ? "↑ healthy" : result.score !== null ? "↓ needs work" : "—",
-				status: result.score !== null && result.score >= 80 ? "good" : result.score !== null && result.score >= 60 ? "warning" : "critical"
-			},
-			{
-				label: "Total Findings",
-				value: String(result.findings.length),
-				delta: "",
-				status: result.findings.length <= 5 ? "good" : result.findings.length <= 20 ? "warning" : "critical"
-			},
-			{
-				label: "Errors",
-				value: String(result.findings.filter((f) => f.severity === "error").length),
-				delta: "",
-				status: result.findings.filter((f) => f.severity === "error").length === 0 ? "good" : "critical"
-			},
-			{
-				label: "Warnings",
-				value: String(result.findings.filter((f) => f.severity === "warning").length),
-				delta: "",
-				status: result.findings.filter((f) => f.severity === "warning").length <= 5 ? "good" : "warning"
-			}
-		];
-		const header = sectionHeader("EXECUTIVE QUALITY REPORT", ui$4);
+		const decision = decideClaim({
+			partial: result.partial,
+			blockingFindings: result.findings.filter((f) => f.severity === "error").length,
+			supported: true
+		});
+		const kpis = buildExecutiveKpis(result);
+		const header = sectionHeader("SCAN SUMMARY", ui$4);
 		io.out(`${header}\n`);
-		io.out(`Generated: ${(/* @__PURE__ */ new Date()).toISOString()}`);
 		io.out(`Target: ${target}`);
-		io.out(`Risk Level: ${risk.toUpperCase()}`);
+		io.out(`Determination: ${decision.state} — ${decision.reason}`);
 		io.out("");
-		io.out("--- Key Performance Indicators ---");
-		for (const kpi of kpis) {
-			const icon = kpi.status === "good" ? "✅" : kpi.status === "warning" ? "⚠️ " : "🔴";
-			io.out(`  ${icon} ${kpi.label}: ${kpi.value} ${kpi.delta}`);
-		}
+		io.out("--- Measured values ---");
+		for (const kpi of kpis) io.out(`  ${kpi.label}: ${kpi.value}  (source: ${kpi.source})`);
 		io.out("");
-		io.out("--- Top Findings ---");
+		io.out("--- Top findings ---");
 		const top = result.findings.slice(0, 5);
 		for (const f of top) io.out(`  [${f.severity.toUpperCase()}] ${f.ruleId}: ${f.message} (${f.file}:${f.line})`);
-		if (result.findings.length === 0) io.out("  No findings — clean scan.");
+		if (result.findings.length === 0) io.out(result.partial ? "  No findings in the analyzed portion of the surface. The scan was PARTIAL, so this is not a clean result." : "  No findings in a complete scan of this surface.");
+		if (result.findings.length > top.length) io.out(`  …and ${result.findings.length - top.length} more.`);
 		io.out("");
-		io.out("--- Recommendations ---");
-		for (const r of recommendations) io.out(`  • ${r}`);
+		io.out("Not reported here: business risk, ROI, or release readiness. Those are decisions, and this tool has no evidence for them.");
 		io.out("");
-		return result.findings.some((f) => f.severity === "error") ? 1 : 0;
+		return decision.exitCode;
 	} catch (e) {
 		internalErrorMessage(e, io.err, false);
 		return 20;
@@ -10598,7 +11478,7 @@ async function runPolicyCommand(argv, io) {
 		const policy = defaultPolicy();
 		const dir = target === ".mjolnir" ? target : ".";
 		if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-		writeFileSync(policyPath, JSON.stringify(policy, null, 2) + "\n");
+		writeFileAtomic(policyPath, JSON.stringify(policy, null, 2) + "\n");
 		io.out(`Policy written to ${policyPath}`);
 		io.out(`Use 'mjolnir policy validate ${policyPath}' to validate.`);
 		io.out(`Use 'mjolnir policy check <target> --policy ${policyPath}' to check results.`);
@@ -10674,83 +11554,158 @@ async function runPolicyCommand(argv, io) {
 //#endregion
 //#region src/commands/quarantine.ts
 /**
-* `mjolnir quarantine` — Quarantine Workflow Management (TL-3).
+* `mjolnir quarantine` — quarantined-test workflow.
 *
-* Manages quarantined tests: list proposed quarantines, review them,
-* accept/defer/reject, and track quarantine state over time.
+* What changed, and why: this command derived a quarantine "proposal" from a
+* STATIC scan by inventing an attempt count from severity (`attempts: 3` for an
+* error, `2` for a warning), then printed "Quarantines updated." after an
+* action that changed nothing, and printed hardcoded zeros as if they were
+* measured statistics. A quarantine decision is a claim about a flaky test's
+* runtime behaviour; a static scan has no runtime behaviour to claim, so it
+* cannot produce one.
 *
-* Subcommands:
-*   list      — show all proposed quarantines from a forensics report
-*   review    — review a specific quarantine proposal
-*   stats     — show quarantine statistics
+* It now refuses to invent. Proposals require runtime evidence (attempts and
+* an observed failure) from a saved forensics report; without one it says so
+* and points at `mjolnir forensics`. There is no quarantine store yet — the
+* ledger this belongs in is the suppression ledger (see
+* docs/RELEASE-TRAINS.md, V5-090) — so nothing claims to be updated.
 *
-* Reads forensics output to propose quarantines deterministically:
-*   propose when attempts >= 2 AND everFailed, priority by attempts then duration.
+* Scheduled for removal in 5.0.
 */
 const ui$3 = plainContext();
-function buildQuarantineProposals(findings) {
-	return findings.filter((f) => f.severity === "error" || f.severity === "warning").map((f, i) => ({
-		id: `Q-${String(i + 1).padStart(3, "0")}`,
-		ruleId: f.ruleId,
-		file: f.file,
-		line: f.line,
-		message: f.message,
-		attempts: f.severity === "error" ? 3 : 2,
+const CANDIDATE_KEYS = [
+	"flaky",
+	"flakyTests",
+	"tests",
+	"retries",
+	"failures",
+	"results"
+];
+function asRecord(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	return value;
+}
+/**
+* Extract runtime failure evidence from a saved forensics report. A record
+* without an observed attempt count is not evidence and is dropped rather than
+* defaulted.
+*/
+function runtimeFailuresFromReport(parsed) {
+	const root = asRecord(parsed);
+	if (!root) return [];
+	const candidates = [];
+	for (const key of CANDIDATE_KEYS) {
+		const value = root[key];
+		if (Array.isArray(value)) candidates.push(...value);
+	}
+	const evidence = [];
+	for (const candidate of candidates) {
+		const record = asRecord(candidate);
+		if (!record) continue;
+		const attempts = typeof record.attempts === "number" ? record.attempts : typeof record.failureCount === "number" ? record.failureCount : void 0;
+		if (attempts === void 0) continue;
+		const file = typeof record.file === "string" ? record.file : void 0;
+		if (!file) continue;
+		evidence.push({
+			ruleId: typeof record.title === "string" ? record.title : "UNKNOWN",
+			file,
+			line: typeof record.line === "number" ? record.line : 0,
+			message: typeof record.message === "string" ? record.message : "no message recorded",
+			attempts,
+			everFailed: record.everFailed === true || attempts > 0
+		});
+	}
+	return evidence;
+}
+function buildQuarantineProposals(evidence) {
+	return evidence.filter((item) => item.attempts >= 2 && item.everFailed).sort((a, b) => b.attempts - a.attempts || a.file.localeCompare(b.file) || a.line - b.line).map((item, index) => ({
+		id: `Q-${String(index + 1).padStart(3, "0")}`,
+		ruleId: item.ruleId,
+		file: item.file,
+		line: item.line,
+		message: item.message,
+		attempts: item.attempts,
+		everFailed: item.everFailed,
 		status: "proposed",
-		reason: f.severity === "error" ? "High-severity finding — quarantine recommended" : "Warning — review before quarantine"
+		reason: `${item.attempts} observed attempt(s) with a recorded failure — runtime evidence, not inferred from severity`
 	}));
 }
-async function runQuarantineCommand(argv, io) {
+function readReport(path) {
+	const root = resolve(path);
+	if (!existsSync(root)) return {
+		ok: false,
+		reason: `no such file: ${path}`
+	};
+	try {
+		return {
+			ok: true,
+			value: JSON.parse(readFileSync(root, "utf8"))
+		};
+	} catch (e) {
+		return {
+			ok: false,
+			reason: e instanceof Error ? e.message : "unreadable report"
+		};
+	}
+}
+function runQuarantineCommand(argv, io) {
 	const subcommand = argv[0] ?? "list";
-	const target = argv.slice(1).find((a) => !a.startsWith("-")) ?? ".";
+	const rest = argv.slice(1);
+	const target = rest.find((a) => !a.startsWith("-")) ?? ".";
+	const reportIdx = rest.indexOf("--from");
 	if (subcommand === "list") {
-		const findings = await runScan$1({
-			target,
-			json: true,
-			verbose: false,
-			maxDurationMs: Number.POSITIVE_INFINITY,
-			scopeChanged: false,
-			format: "json",
-			strict: false
-		}).catch((e) => {
-			internalErrorMessage(e, io.err, false);
-			return null;
-		});
-		if (!findings) return 20;
-		const proposals = buildQuarantineProposals(findings.findings);
-		if (proposals.length === 0) {
-			io.out("No quarantine proposals. All findings are within acceptable thresholds.");
-			return 0;
+		if (reportIdx === -1 || !rest[reportIdx + 1]) {
+			io.out(sectionHeader("QUARANTINE PROPOSALS", ui$3));
+			io.out("");
+			io.out("No runtime report supplied, so no proposals can be produced.");
+			io.out("A quarantine proposal asserts that a test actually failed more than once. A static scan has no runtime behaviour to observe, so Mjölnir will not invent one.");
+			io.out("");
+			io.out("Produce one: mjolnir forensics <results-dir> && mjolnir quarantine list --from <report.json>");
+			return unmeasuredClaim("quarantine list", "proposals require observed runtime failures, and no forensics report was supplied.").exitCode;
+		}
+		const reportPath = rest[reportIdx + 1];
+		const reportRoot = resolve(target);
+		const requested = resolve(reportPath);
+		const rel = relative(reportRoot, requested);
+		if (isAbsolute(rel) || rel.startsWith("..")) {
+			io.err("mjolnir quarantine: --from report must stay within the target root");
+			return 10;
 		}
+		const report = readReport(reportPath);
+		if (!report.ok) {
+			io.err(`mjolnir quarantine: cannot read report: ${report.reason}`);
+			return 10;
+		}
+		const evidence = runtimeFailuresFromReport(report.value);
+		const proposals = buildQuarantineProposals(evidence);
 		io.out(sectionHeader("QUARANTINE PROPOSALS", ui$3));
 		io.out("");
-		io.out(`| ID | Rule | File | Severity | Status |`);
-		io.out(`| -- | ---- | ---- | -------- | ------ |`);
-		for (const p of proposals) io.out(`| ${p.id} | ${p.ruleId} | ${p.file} | proposed | proposed |`);
+		if (proposals.length === 0) {
+			io.out(`0 proposal(s) from ${evidence.length} runtime record(s). Nothing in this report shows a test failing more than once.`);
+			return unmeasuredClaim("quarantine list", "no runtime record met the observed-failure threshold; an empty proposal list is not a clean test suite.").exitCode;
+		}
+		io.out("| ID | Attempts | Test | File | Status |");
+		io.out("| -- | -------- | ---- | ---- | ------ |");
+		for (const p of proposals) io.out(`| ${p.id} | ${p.attempts} | ${p.ruleId} | ${p.file}:${p.line} | ${p.status} |`);
 		io.out("");
-		io.out(`${proposals.length} proposal(s). Use 'mjolnir quarantine review' to manage.`);
-		return findings.findings.some((f) => f.severity === "error") ? 1 : 0;
+		io.out(`${proposals.length} proposal(s) from observed runtime failures. Accepting one is a human decision this command does not make.`);
+		return unmeasuredClaim("quarantine list", "proposals are a human decision queue, not an enforced gate.").exitCode;
 	}
 	if (subcommand === "review") {
-		const proposals = buildQuarantineProposals([]);
-		const action = argv.find((a) => a === "--accept" || a === "--defer" || a === "--reject");
 		io.out(sectionHeader("QUARANTINE REVIEW", ui$3));
 		io.out("");
-		io.out("Pending reviews:");
-		for (const p of proposals) io.out(`  ${p.id}: ${p.ruleId} — ${p.message} (${p.file}:${p.line})`);
-		if (action) {
-			io.out(`Action: ${action}`);
-			io.out("Quarantines updated.");
-		} else io.out("Use --accept, --defer, or --reject to manage.");
-		return 0;
+		io.out("No quarantine store exists, so there is nothing to review and nothing was changed.");
+		io.out("Quarantine state lives in the suppression ledger: edit .mjolnir/suppressions.json, where every entry is versioned, justified, and subject to expiry.");
+		return unmeasuredClaim("quarantine review", "the command is a placeholder; the ledger is the source of truth.").exitCode;
 	}
 	if (subcommand === "stats") {
 		io.out(sectionHeader("QUARANTINE STATS", ui$3));
 		io.out("");
-		io.out("Total: 0 | Proposed: 0 | Accepted: 0 | Deferred: 0 | Rejected: 0");
+		io.out("No quarantine store exists, so no statistics can be reported.");
+		io.out("Printing zeros here would look like a measured absence of flakiness. It is not one.");
 		io.out("");
-		io.out("No quarantine activity recorded yet.");
-		return 0;
+		io.out("Run `mjolnir trust-trend` for measured history, or read .mjolnir/suppressions.json for the current suppression ledger.");
+		return unmeasuredClaim("quarantine stats", "no store exists to measure; zeros would be a fabricated statistic.").exitCode;
 	}
 	io.err(`Unknown quarantine subcommand: ${subcommand}`);
 	return 10;
@@ -10787,20 +11742,44 @@ function runAnalyzeCommand(argv, io) {
 		const findings = [];
 		const fileImports = /* @__PURE__ */ new Map();
 		const fileContents = /* @__PURE__ */ new Map();
-		function walk(dir) {
+		let limited = false;
+		const deadline = Date.now() + 6e5;
+		function walk(dir, depth = 0) {
+			if (limited || depth > LIMITS.maxDepth || Date.now() >= deadline) {
+				limited = true;
+				return;
+			}
 			for (const name of readdirSync(dir)) {
 				const path = join(dir, name);
 				if (name === "node_modules" || name === ".git") continue;
-				if (statSync(path).isDirectory()) walk(path);
-				else if (name.endsWith(".ts") || name.endsWith(".tsx") || name.endsWith(".js") || name.endsWith(".jsx")) try {
-					const content = readFileSync(path, "utf8");
+				let stat;
+				try {
+					stat = lstatSync(path);
+				} catch {
+					continue;
+				}
+				if (stat.isSymbolicLink()) continue;
+				if (stat.isDirectory()) {
+					walk(path, depth + 1);
+					if (limited) return;
+				} else if (name.endsWith(".ts") || name.endsWith(".tsx") || name.endsWith(".js") || name.endsWith(".jsx")) {
+					if (fileContents.size >= LIMITS.maxFilesPerAdapter) {
+						limited = true;
+						return;
+					}
+					const read = readFileBounded(path, LIMITS.maxFileBytes);
+					if (!read.ok) {
+						limited = true;
+						continue;
+					}
+					const content = read.data.toString("utf8");
 					const rel = relative(process.cwd(), path);
 					fileContents.set(rel, content);
 					const imports = collectImports(content);
 					const importCounts = /* @__PURE__ */ new Map();
 					for (const imp of imports) importCounts.set(imp, (importCounts.get(imp) ?? 0) + 1);
 					fileImports.set(rel, importCounts);
-				} catch {}
+				}
 			}
 		}
 		walk(target);
@@ -10854,6 +11833,10 @@ function runAnalyzeCommand(argv, io) {
 			}
 			io.out("");
 		}
+		if (limited) {
+			io.err("mjolnir analyze: resource limit reached; cross-file analysis is partial");
+			return 2;
+		}
 		return 0;
 	} catch (e) {
 		internalErrorMessage(e, io.err, false);
@@ -10946,7 +11929,7 @@ function runCiAdapterCommand(argv, io) {
 		default: return 10;
 	}
 	try {
-		writeFileSync(join(target, filename), output);
+		writeFileAtomic(join(target, filename), output);
 	} catch (error) {
 		io.err(`Unable to write CI template: ${error instanceof Error ? error.message : String(error)}`);
 		return 20;
@@ -10966,13 +11949,32 @@ function runCiAdapterCommand(argv, io) {
 * file with inline CSS and JavaScript, suitable for embedding
 * in team wikis or sharing via static hosting.
 */
+/** Band → CSS colour, read from the brand tokens so the dashboard cannot
+*  name a colour of its own. `trusted` is aurora-cyan, not green: green is
+*  reserved for non-score success (the terminal's `Palette.ok`). */
+const BAND_HEX = {
+	critical: SCORE.critical,
+	warning: SCORE.warning,
+	trusted: SCORE.trusted,
+	forged: SCORE.forged,
+	unmeasured: SCORE.unmeasured
+};
+const FINDINGS_SHOWN_LIMIT = 100;
+function escapeHtml(text) {
+	return sanitizeErrorText(text, { maxLength: 1e3 }).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&#39;");
+}
 function generateDashboardHtml(data) {
-	const scoreColor = data.score === null ? "#888" : data.score >= 80 ? "#22c55e" : data.score >= 60 ? "#eab308" : "#ef4444";
-	const rows = data.findings.map((f) => `<tr><td>${f.ruleId}</td><td><span style="color:${f.severity === "error" ? "#ef4444" : f.severity === "warning" ? "#eab308" : "#22c55e"}">${f.severity}</span></td><td>${f.file}</td><td>${f.message}</td></tr>`).join("");
+	const scoreColor = BAND_HEX[deriveScoreState(data.score).band];
+	const severityColor = (severity) => severity === "error" ? STATUS.error : severity === "warning" ? STATUS.warning : STATUS.ok;
+	const rows = data.findings.map((f) => `<tr><td>${escapeHtml(f.ruleId)}</td><td><span style="color:${severityColor(f.severity)}">${escapeHtml(f.severity)}</span></td><td>${escapeHtml(f.file)}</td><td>${escapeHtml(f.message)}</td></tr>`).join("");
+	const banner = data.partial ? `<p style="color:${STATUS.warning};font-weight:600">PARTIAL ANALYSIS — the whole surface was not analyzed. These numbers describe the analyzed portion only.</p>` : "";
+	const truncation = data.findingsShown < data.totalFindings ? `<p>Showing ${data.findingsShown} of ${data.totalFindings} findings (display limit).</p>` : "";
+	const frameworkValue = data.frameworkCount === null ? "unknown" : String(data.frameworkCount);
 	return `<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta charset="UTF-8">
+${data.generatedAt === null ? "" : `<meta name="mjolnir-generated-at" content="${escapeHtml(data.generatedAt)}">\n`}<meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Quality Dashboard</title>
 <style>
   body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; max-width: 960px; margin: 0 auto; padding: 2rem; background: #0a0a0a; color: #e5e5e5; }
@@ -10989,16 +11991,15 @@ function generateDashboardHtml(data) {
 </head>
 <body>
 <h1>🔍 Quality Dashboard</h1>
-<p>Generated: ${data.generatedAt}</p>
-<div class="score">${data.score !== null ? data.score + "/100" : "N/A"}</div>
+${banner}${data.generatedAt === null ? `<p>Deterministic build — no generation timestamp is recorded, so this file is byte-identical for an unchanged repository.</p>` : ""}<div class="score">${data.score !== null ? data.score + "/100" : "N/A"}</div>
 <div class="kpi-grid">
   <div class="kpi"><div class="value">${data.totalFindings}</div><div class="label">Findings</div></div>
-  <div class="kpi"><div class="value" style="color:#ef4444">${data.errorCount}</div><div class="label">Errors</div></div>
-  <div class="kpi"><div class="value" style="color:#eab308">${data.warningCount}</div><div class="label">Warnings</div></div>
-  <div class="kpi"><div class="value">${data.frameworkCount}</div><div class="label">Frameworks</div></div>
+  <div class="kpi"><div class="value" style="color:${STATUS.error}">${data.errorCount}</div><div class="label">Errors</div></div>
+  <div class="kpi"><div class="value" style="color:${STATUS.warning}">${data.warningCount}</div><div class="label">Warnings</div></div>
+  <div class="kpi"><div class="value">${frameworkValue}</div><div class="label">Frameworks</div></div>
 </div>
 <h2>Findings</h2>
-<table><thead><tr><th>Rule</th><th>Severity</th><th>File</th><th>Message</th></tr></thead><tbody>${rows}</tbody></table>
+${truncation}<table><caption>Findings on the analyzed surface, newest severity first. Capped at ${FINDINGS_SHOWN_LIMIT} rows.</caption><thead><tr><th scope="col">Rule</th><th scope="col">Severity</th><th scope="col">File</th><th scope="col">Message</th></tr></thead><tbody>${rows}</tbody></table>
 </body>
 </html>`;
 }
@@ -11006,41 +12007,60 @@ async function runDashboardCommand(argv, io) {
 	const target = argv.find((a) => !a.startsWith("-")) ?? ".";
 	const outputIdx = argv.indexOf("--output");
 	const outputPath = outputIdx !== -1 ? argv[outputIdx + 1] ?? "dashboard.html" : "dashboard.html";
+	const deterministic = argv.includes("--deterministic");
 	if (!existsSync(target)) {
 		io.err(`mjolnir dashboard: target does not exist: ${target}`);
 		return 10;
 	}
+	const root = resolve(target);
+	const resolvedOutput = resolve(outputPath);
+	const outputRelative = relative(root, resolvedOutput);
+	if (isAbsolute(outputRelative) || outputRelative.startsWith("..")) {
+		io.err("mjolnir dashboard: output must stay within the target root");
+		return 10;
+	}
 	try {
-		const { runScan } = await import("./scan-pipeline-C_Rs4u8N.mjs");
+		const { runScan } = await import("./scan-pipeline-Bg-46cLS.mjs");
 		const result = await runScan({
 			target,
 			json: true,
 			verbose: false,
-			maxDurationMs: Number.POSITIVE_INFINITY,
+			maxDurationMs: 6e5,
 			scopeChanged: false,
 			format: "json",
 			strict: false
 		});
+		const shown = result.findings.slice(0, FINDINGS_SHOWN_LIMIT);
 		const data = {
 			score: result.score,
 			totalFindings: result.findings.length,
 			errorCount: result.findings.filter((f) => f.severity === "error").length,
 			warningCount: result.findings.filter((f) => f.severity === "warning").length,
-			frameworkCount: result.frameworks.length,
-			findings: result.findings.slice(0, 100).map((f) => ({
+			frameworkCount: result.frameworkDetectionUnknown ? null : result.frameworks.length,
+			partial: result.partial,
+			findingsShown: shown.length,
+			findings: shown.map((f) => ({
 				ruleId: f.ruleId,
 				severity: f.severity,
 				file: f.file,
 				message: f.message
 			})),
-			generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			generatedAt: deterministic ? null : (/* @__PURE__ */ new Date()).toISOString()
 		};
 		const html = generateDashboardHtml(data);
-		writeFileSync(outputPath, html);
-		io.out(`Dashboard written to ${outputPath}`);
+		writeFileAtomic(resolvedOutput, html, { encoding: "utf8" });
+		io.out(`Dashboard written to ${resolvedOutput}`);
 		io.out(`Score: ${data.score !== null ? data.score + "/100" : "N/A"}`);
 		io.out(`Findings: ${data.totalFindings} (${data.errorCount} errors, ${data.warningCount} warnings)`);
-		return data.errorCount > 0 ? 1 : 0;
+		if (data.frameworkCount === null) io.out("Frameworks: unknown — detection did not complete");
+		if (data.findingsShown < data.totalFindings) io.out(`Table shows ${data.findingsShown} of ${data.totalFindings} findings (display limit).`);
+		const decision = decideClaim({
+			partial: data.partial,
+			blockingFindings: data.errorCount,
+			supported: true
+		});
+		io.out(`Determination: ${decision.state} — ${decision.reason}`);
+		return decision.exitCode;
 	} catch (e) {
 		internalErrorMessage(e, io.err, false);
 		return 20;
@@ -11049,18 +12069,34 @@ async function runDashboardCommand(argv, io) {
 //#endregion
 //#region src/commands/enterprise.ts
 /**
-* `mjolnir enterprise` — Enterprise Deployment (QM-4).
+* `mjolnir enterprise` — refuses, and says what exists instead.
+*
+* What changed, and why: this command wrote three kinds of artifact that
+* Mjölnir cannot back.
+*
+* 1. A deployment config declaring `"authentication": "sso-saml"`. There
+*    is no server, no session, and no SAML implementation in this product.
+*    The config described a deployment that does not exist.
+* 2. An SSO setup guide instructing the reader to add an `sso` block to
+*    `mjolnir.config.json`. Nothing reads that key. The guide was
+*    confident, plausible, and inert.
+* 3. Three compliance templates — SOC 2, HIPAA, PCI-DSS — mapping
+*    controls to "SSO/SAML integration", a "built-in scan audit trail"
+*    and a "privacy scan". None of those is a Mjölnir feature: a scan
+*    reads a repository and prints. A compliance template is a document
+*    an organisation shows an auditor, so mapping controls to
+*    capabilities that do not exist is not a cosmetic bug.
 *
-* Generates enterprise deployment artifacts:
-*   - Self-hosted deployment config
-*   - SSO/SAML setup guide
-*   - Compliance templates (SOC 2, HIPAA, PCI-DSS)
-*   - Custom policy templates
+* So the command no longer writes files. What it can honestly offer is
+* `enterprise/threat-model.json` and `enterprise/data-flows.json`, which
+* ARE real, ARE validated in CI by `npm run enterprise:threat-model`,
+* and describe the product that exists: a zero-network local CLI.
 *
-* Subcommands:
-*   config      — generate deployment config
-*   sso         — generate SSO setup guide
-*   compliance  — generate compliance template
+* The `config` subcommand still emits a fact file, because a manifest of
+* what the tool is and is not is genuinely useful to an operator
+* evaluating it — as long as it records absence instead of inventing it.
+*
+* Scheduled for removal in 5.0 — see docs/RELEASE-TRAINS.md.
 */
 const ui$1 = plainContext();
 function runEnterpriseCommand(argv, io) {
@@ -11069,119 +12105,108 @@ function runEnterpriseCommand(argv, io) {
 	if (!existsSync(outputDir)) mkdirSync(outputDir, { recursive: true });
 	if (subcommand === "config") {
 		const config = {
-			service: "mjolnir-qa",
-			version: "2.0.0",
-			deployment: {
-				type: "self-hosted",
-				protocol: "https",
-				port: 443,
-				authentication: "sso-saml",
-				sessionTimeout: "8h",
-				maxFileSize: "100MB"
-			},
-			features: {
-				rules: true,
-				plugins: true,
-				cache: true,
-				reporter: true,
-				mcp: true
-			},
-			logging: {
-				level: "info",
-				retention: "90d",
-				audit: true
-			}
+			product: "mjolnir-qa",
+			version: ENGINE_VERSION,
+			shape: "zero-runtime-dependency local CLI",
+			network: "none — no telemetry, no hosted service, no sync",
+			runtimeDependencies: 0,
+			verified: [
+				"local-only execution (tests/contract/privacy-network-isolation.spec.ts)",
+				"versioned threat + data-flow model (npm run enterprise:threat-model)",
+				"deterministic machine contract, drift-locked (contractVersion 1)"
+			],
+			notProvided: [
+				"SSO / SAML / OIDC — no server, no session, no identity provider integration",
+				"hosted control plane, multi-tenant sync, or audit-log service",
+				"compliance certification or auditor-facing control mapping",
+				"air-gapped installation or offline recovery drill (see GAP-M26-015)"
+			],
+			unsupportedRequests: "docs/M26-SUPPORT-MATRIX.json records each of these as an explicit BLOCKED cell rather than a plan."
 		};
-		const path = join(outputDir, "deployment-config.json");
-		writeFileSync(path, JSON.stringify(config, null, 2) + "\n");
-		io.out(sectionHeader("ENTERPRISE CONFIG", ui$1));
-		io.out(`Config written: ${path}`);
-		io.out(`Type: ${config.deployment.type}`);
-		io.out(`Auth: ${config.deployment.authentication}`);
-		return 0;
-	}
-	if (subcommand === "sso") {
-		const guide = `# SSO/SAML Setup Guide
-
-## Service Provider (SP) Configuration
-- Entity ID: https://your-domain.com/mjolnir
-- ACS URL: https://your-domain.com/mjolnir/auth/sso/callback
-- Binding: HTTP-POST
-
-## Identity Provider (IdP) Configuration
-- Metadata URL: https://your-idp.com/sso/metadata
-- Required Attributes:
-  - email (mapped to user identity)
-  - role (mapped to access level)
-  - department (mapped to team)
-
-## Mjölnir Configuration
-Add to mjolnir.config.json:
-\`\`\`json
-{
-  "sso": {
-    "enabled": true,
-    "provider": "saml",
-    "entryPoint": "https://your-idp.com/sso",
-    "attributeMapping": {
-      "email": "user",
-      "role": "accessLevel",
-      "department": "team"
-    }
-  }
-}
-\`\`\`
-`;
-		const path = join(outputDir, "sso-setup.md");
-		writeFileSync(path, guide);
-		io.out(`SSO guide written: ${path}`);
+		const path = join(outputDir, "capability-manifest.json");
+		writeFileAtomic(path, JSON.stringify(config, null, 2) + "\n");
+		io.out(sectionHeader("ENTERPRISE CAPABILITY MANIFEST", ui$1));
+		io.out(`Written: ${path}`);
+		io.out(`Version: ${ENGINE_VERSION} · runtime dependencies: 0 · network: none`);
+		io.out("");
+		io.out("This product is a local CLI. It provides no server, no SSO, no hosted");
+		io.out("control plane and no compliance certification. The manifest's");
+		io.out("`notProvided` list is the honest answer to a deployment questionnaire.");
 		return 0;
 	}
-	if (subcommand === "compliance") {
-		for (const framework of [
-			"SOC2",
-			"HIPAA",
-			"PCI-DSS"
-		]) {
-			const template = `# ${framework} Compliance Template for Mjölnir
-
-## Control Mapping
-| Control | Mjölnir Feature | Evidence |
-| --------- | --------------- | -------- |
-| Access Control | SSO/SAML integration | sso-setup.md |
-| Audit Logging | Built-in scan audit trail | --json output |
-| Data Protection | Local-first, zero-network | privacy scan |
-| Change Management | quarantined rules, policy gates | policy check |
-| Monitoring | dashboard, exec-report | HTML/terminal output |
-`;
-			const path = join(outputDir, `${framework.toLowerCase()}-compliance.md`);
-			writeFileSync(path, template);
-			io.out(`Compliance template: ${path}`);
-		}
-		return 0;
+	if (subcommand === "sso" || subcommand === "compliance") {
+		io.err(subcommand === "sso" ? "mjolnir enterprise sso: not available, and no artifact will be written.\n  Mjölnir is a local CLI with no server, no session and no identity-provider\n  integration. The previous SSO guide told readers to add an `sso` block to\n  mjolnir.config.json — a key nothing reads.\n  What exists: the threat + data-flow model, validated by\n  `npm run enterprise:threat-model`. See `mjolnir enterprise config`." : "mjolnir enterprise compliance: not available, and no artifact will be written.\n  Mjölnir cannot produce an auditor-facing control mapping. The previous\n  templates mapped controls to capabilities this product does not have\n  (SSO/SAML integration, a scan \"audit trail\", a \"privacy scan\"), which is\n  not a formatting bug — it is a false statement in a document meant for\n  an auditor.\n  What exists: enterprise/threat-model.json and enterprise/data-flows.json,\n  validated in CI, describing the product that actually ships.");
+		return 10;
 	}
 	io.err(`Unknown enterprise subcommand: ${subcommand}`);
+	io.err("Available: config");
 	return 10;
 }
 //#endregion
 //#region src/commands/maturity.ts
 /**
-* `mjolnir maturity` — Quality Maturity Model (QM-6).
+* `mjolnir maturity` — organizational QA-maturity signals.
 *
-* Assesses the organization's QA maturity across dimensions:
-*   Test hygiene — rule coverage, assertion quality
-*   CI integrity — gate coverage, feedback speed
-*   Runtime verification — forensics adoption, flake management
-*   Process maturity — triage cadence, suppression governance
+* What changed, and why: this command used to emit an "Overall: Optimizing
+* (87/100)" style assessment derived from whether three files happened to
+* exist, with hardcoded dimension scores (75/70/65/30) and a `ruleCount = 79`
+* fallback invented when a catalog could not be read. A file-existence proxy
+* is not a maturity measurement, and a number with no provenance is worse than
+* no number: it is a decision someone else will make on.
 *
-* Output: maturity level (Initial → Managed → Defined → Quantitatively Managed → Optimizing)
-* with specific improvement recommendations.
-*
-* Subcommands:
-*   assess   — run the maturity assessment
-*   levels   — show all maturity levels
+* It now reports what it can actually observe — the presence of specific,
+* named QA artifacts — and states that the artifact is a signal, not a score.
+* There is no overall score, because Mjölnir cannot measure organizational
+* maturity. Scheduled for removal in 5.0; see docs/RELEASE-TRAINS.md.
 */
 const ui = plainContext();
+const SIGNALS = [
+	{
+		id: "policy",
+		question: "Is a Mjölnir policy file committed?",
+		path: ".mjolnir/mjolnir.policy.json",
+		says: "a policy file exists in this checkout",
+		doesNotSay: "that the policy is enforced, current, or correct"
+	},
+	{
+		id: "suppressions",
+		question: "Is a suppression ledger committed?",
+		path: ".mjolnir/suppressions.json",
+		says: "suppressions are tracked as data",
+		doesNotSay: "that the suppressions are justified or still needed"
+	},
+	{
+		id: "history",
+		question: "Are previous runs recorded?",
+		path: ".mjolnir/stats.json",
+		says: "run history exists in this checkout",
+		doesNotSay: "that the history is complete, or that anyone reviewed it"
+	},
+	{
+		id: "baseline",
+		question: "Is a scan baseline committed?",
+		path: ".mjolnir/baseline.json",
+		says: "a baseline exists to diff against",
+		doesNotSay: "that the baseline was taken from a clean, complete scan"
+	},
+	{
+		id: "rule-catalog",
+		question: "Is the generated rule catalog committed?",
+		path: "docs/rules/catalog.md",
+		says: "generated rule documentation is in the repository",
+		doesNotSay: "how many rules are enabled, measured, or certified"
+	}
+];
+function assessMaturitySignals(root) {
+	return SIGNALS.map((signal) => ({
+		id: signal.id,
+		question: signal.question,
+		path: signal.path,
+		present: existsSync(join(root, signal.path)),
+		says: signal.says,
+		doesNotSay: signal.doesNotSay
+	}));
+}
 const MATURITY_LEVELS = [
 	"Initial",
 	"Managed",
@@ -11189,51 +12214,16 @@ const MATURITY_LEVELS = [
 	"Quantitatively Managed",
 	"Optimizing"
 ];
-function assessDimension(name, score, findings = []) {
-	if (score >= 90) return {
-		name,
-		level: "Optimizing",
-		score,
-		findings
-	};
-	if (score >= 75) return {
-		name,
-		level: "Quantitatively Managed",
-		score,
-		findings
-	};
-	if (score >= 60) return {
-		name,
-		level: "Defined",
-		score,
-		findings
-	};
-	if (score >= 40) return {
-		name,
-		level: "Managed",
-		score,
-		findings
-	};
-	return {
-		name,
-		level: "Initial",
-		score,
-		findings
-	};
-}
 function runMaturityCommand(argv, io) {
 	const subcommand = argv[0] ?? "assess";
 	const target = argv.slice(1).find((a) => !a.startsWith("-")) ?? ".";
 	if (subcommand === "levels") {
 		io.out(sectionHeader("MATURITY LEVELS", ui));
 		io.out("");
-		for (let i = 0; i < MATURITY_LEVELS.length; i++) {
-			const level = MATURITY_LEVELS[i];
-			io.out(`${i + 1}. ${level}`);
-		}
+		for (let i = 0; i < MATURITY_LEVELS.length; i++) io.out(`${i + 1}. ${MATURITY_LEVELS[i]}`);
 		io.out("");
-		io.out("Score ranges: Initial (0-39), Managed (40-59), Defined (60-74), Quantitatively Managed (75-89), Optimizing (90-100)");
-		return 0;
+		io.out("These are vocabulary only. Mjölnir does not place a repository on this scale: it observes named artifacts and reports which are present.");
+		return unmeasuredClaim("maturity levels", "A maturity level is a judgement, not a measurement.").exitCode;
 	}
 	if (subcommand === "assess") {
 		if (!existsSync(target)) {
@@ -11241,65 +12231,19 @@ function runMaturityCommand(argv, io) {
 			return 10;
 		}
 		try {
-			let ruleCount = 0;
-			const catalogPath = join(target, "docs", "rules", "catalog.md");
-			if (existsSync(catalogPath)) try {
-				ruleCount = (readFileSync(catalogPath, "utf8").match(/QA-/g) ?? []).length;
-			} catch {
-				ruleCount = 79;
-			}
-			else ruleCount = 79;
-			let hasPolicy = false;
-			const policyPath = join(target, ".mjolnir", "mjolnir.policy.json");
-			if (existsSync(policyPath)) try {
-				hasPolicy = true;
-			} catch {
-				hasPolicy = false;
-			}
-			let hasHistory = false;
-			const statsPath = join(target, ".mjolnir", "stats.json");
-			if (existsSync(statsPath)) try {
-				hasHistory = true;
-			} catch {
-				hasHistory = false;
-			}
-			let hasTrends = false;
-			const trendPath = join(target, ".mjolnir", "trend.jsonl");
-			if (existsSync(trendPath)) try {
-				hasTrends = true;
-			} catch {
-				hasTrends = false;
-			}
-			const dimensions = [
-				assessDimension("Test Hygiene", Math.min(100, Math.round(ruleCount / 100 * 100)), [`${ruleCount} rules loaded`, ruleCount >= 50 ? "Good rule coverage" : "Increase rule coverage"]),
-				assessDimension("CI Integrity", hasPolicy ? 75 : 30, [hasPolicy ? "Policy-as-code active" : "Implement policy-as-code", "Gate configuration verified"]),
-				assessDimension("Runtime Verification", hasTrends ? 70 : 25, [hasTrends ? "Trend tracking active" : "Start quality trend tracking", hasHistory ? "Historical data available" : "No historical data yet"]),
-				assessDimension("Process Maturity", hasHistory ? 65 : 20, [hasHistory ? "Fix tracking active" : "Start tracking fixes", "Triage cadence needs definition"])
-			];
-			const avgScore = Math.round(dimensions.reduce((sum, d) => sum + d.score, 0) / dimensions.length);
-			const overall = avgScore >= 90 ? "Optimizing" : avgScore >= 75 ? "Quantitatively Managed" : avgScore >= 60 ? "Defined" : avgScore >= 40 ? "Managed" : "Initial";
-			const assessment = {
-				timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-				overall,
-				overallScore: avgScore,
-				dimensions
-			};
-			io.out(sectionHeader("MATURITY ASSESSMENT", ui));
-			io.out(`Generated: ${assessment.timestamp}`);
-			io.out(`Overall: ${assessment.overall} (${assessment.overallScore}/100)`);
+			const signals = assessMaturitySignals(target);
+			const present = signals.filter((signal) => signal.present).length;
+			io.out(sectionHeader("QA ARTIFACT SIGNALS", ui));
+			io.out(`Target: ${target} · ${present}/${signals.length} named artifacts present`);
+			io.out("No overall score: Mjölnir cannot measure organizational maturity.");
 			io.out("");
-			for (const d of dimensions) {
-				const icon = d.score >= 75 ? "🟢" : d.score >= 50 ? "🟡" : "🔴";
-				io.out(`${icon} ${d.name}: ${d.level} (${d.score}/100)`);
-				for (const f of d.findings) io.out(`  - ${f}`);
-				io.out("");
-			}
-			const improvement = dimensions.filter((d) => d.score < 75).map((d) => `Improve ${d.name} to reach Quantitatively Managed`);
-			if (improvement.length > 0) {
-				io.out("--- Improvement Areas ---");
-				for (const i of improvement) io.out(`• ${i}`);
+			for (const signal of signals) {
+				io.out(`${signal.present ? "[present]" : "[absent]"}  ${signal.question}`);
+				io.out(`    path: ${signal.path}`);
+				io.out(`    presence says: ${signal.says}`);
+				io.out(`    presence does NOT say: ${signal.doesNotSay}`);
 			}
-			return 0;
+			return unmeasuredClaim("maturity", "These are artifact-presence signals, not a maturity assessment, so no clean result is reported.").exitCode;
 		} catch (e) {
 			internalErrorMessage(e, io.err, false);
 			return 20;
@@ -11426,7 +12370,7 @@ function analyzeCrossFileSignals(files, findings, root) {
 	}));
 	const correlationConclusions = correlateFindings(findings).map((c) => `${c.conclusionType}: ${c.corroboration}`).join("; ");
 	const graph = buildDependencyGraph(root);
-	const reachableFiles = getReachableFiles(orderedFiles.map((f) => f.path), graph);
+	const reachability = getReachableFiles(orderedFiles.map((f) => f.path), graph);
 	return {
 		signals: [
 			...duplicateTestNames,
@@ -11438,7 +12382,7 @@ function analyzeCrossFileSignals(files, findings, root) {
 		circularDependencies,
 		correlationConclusions,
 		dependencyGraphSize: graph.size,
-		reachableFilesCount: reachableFiles.length
+		reachability
 	};
 }
 function detectSharedImports(files) {
@@ -11518,7 +12462,9 @@ function renderCrossFileAnalysis(result) {
 	lines.push(`Shared imports: ${result.sharedImports.length}`);
 	lines.push(`Circular dependencies: ${result.circularDependencies.length}`);
 	lines.push(`Dependency graph size: ${result.dependencyGraphSize}`);
-	lines.push(`Reachable files: ${result.reachableFilesCount}`);
+	const { reachability } = result;
+	if (reachability.resolvedAny) lines.push(`Reachable files: ${reachability.reachable.length} (resolved from the dependency graph)`);
+	else lines.push(`Reachable files: not resolved — the graph is keyed by package manifest and none of the ${reachability.unresolvedStarts.length} starting file(s) could be placed. This number is not evidence of a traversal.`);
 	lines.push("");
 	if (result.signals.length > 0) {
 		lines.push("Signals:");
@@ -11683,190 +12629,6 @@ function renderEvidenceGraphResult(result) {
 	return lines.join("\n").trimEnd();
 }
 //#endregion
-//#region src/frameworks/framework-inventory.ts
-const FRAMEWORK_INVENTORY = [
-	{
-		frameworkId: "playwright",
-		entityType: "E2E_FRAMEWORK",
-		language: "TypeScript/JavaScript",
-		maturity: "F4",
-		supportStatus: "OFFICIAL_PARTIAL",
-		targetMaturity: "F5",
-		targetSupportStatus: "OFFICIAL_FULL",
-		validatedVersions: [
-			"1.44",
-			"1.45",
-			"1.46",
-			"1.47",
-			"1.48"
-		],
-		keyGapForNextLevel: "GAP-PW-006 parallelism/worker safety analysis"
-	},
-	{
-		frameworkId: "jest",
-		entityType: "TEST_FRAMEWORK",
-		language: "TypeScript/JavaScript",
-		maturity: "F3",
-		supportStatus: "OFFICIAL_PARTIAL",
-		targetMaturity: "F4",
-		targetSupportStatus: "OFFICIAL_FULL",
-		validatedVersions: ["29", "30"],
-		keyGapForNextLevel: "GAP-JEST-004 lifecycle modeling"
-	},
-	{
-		frameworkId: "vitest",
-		entityType: "TEST_FRAMEWORK",
-		language: "TypeScript/JavaScript",
-		maturity: "F3",
-		supportStatus: "OFFICIAL_PARTIAL",
-		targetMaturity: "F4",
-		targetSupportStatus: "OFFICIAL_FULL",
-		validatedVersions: [
-			"1.6",
-			"2.0",
-			"2.1"
-		],
-		keyGapForNextLevel: "GAP-VIT-004 lifecycle modeling"
-	},
-	{
-		frameworkId: "pytest",
-		entityType: "TEST_FRAMEWORK",
-		language: "Python",
-		maturity: "F2",
-		supportStatus: "OFFICIAL_PARTIAL",
-		targetMaturity: "F3",
-		targetSupportStatus: "OFFICIAL_FULL",
-		validatedVersions: [
-			"7.4",
-			"8.0",
-			"8.1",
-			"8.2",
-			"8.3"
-		],
-		keyGapForNextLevel: "GAP-PY-004 lifecycle modeling"
-	},
-	{
-		frameworkId: "junit",
-		entityType: "TEST_FRAMEWORK",
-		language: "Java",
-		maturity: "F2",
-		supportStatus: "OFFICIAL_PARTIAL",
-		targetMaturity: "F3",
-		targetSupportStatus: "OFFICIAL_FULL",
-		validatedVersions: ["5.10", "5.11"],
-		keyGapForNextLevel: "GAP-JU-004 lifecycle modeling"
-	},
-	{
-		frameworkId: "nunit",
-		entityType: "TEST_FRAMEWORK",
-		language: "C#",
-		maturity: "F2",
-		supportStatus: "OFFICIAL_PARTIAL",
-		targetMaturity: "F3",
-		targetSupportStatus: "OFFICIAL_FULL",
-		validatedVersions: ["3.14", "4.2"],
-		keyGapForNextLevel: "GAP-NU-004 lifecycle modeling"
-	},
-	{
-		frameworkId: "xunit",
-		entityType: "TEST_FRAMEWORK",
-		language: "C#",
-		maturity: "F2",
-		supportStatus: "OFFICIAL_PARTIAL",
-		targetMaturity: "F3",
-		targetSupportStatus: "OFFICIAL_FULL",
-		validatedVersions: ["2.9"],
-		keyGapForNextLevel: "GAP-XU-004 lifecycle modeling"
-	},
-	{
-		frameworkId: "cypress",
-		entityType: "E2E_FRAMEWORK",
-		language: "TypeScript/JavaScript",
-		maturity: "F2",
-		supportStatus: "EXPERIMENTAL",
-		targetMaturity: "F3",
-		targetSupportStatus: "OFFICIAL_PARTIAL",
-		validatedVersions: ["13"],
-		keyGapForNextLevel: "GAP-CY-004 lifecycle modeling"
-	},
-	{
-		frameworkId: "selenium",
-		entityType: "AUTOMATION_LIBRARY",
-		language: "Java/TypeScript/Python",
-		maturity: "F1",
-		supportStatus: "EXPERIMENTAL",
-		targetMaturity: "F2",
-		targetSupportStatus: "OFFICIAL_PARTIAL",
-		validatedVersions: [
-			"4.20",
-			"4.21",
-			"4.22",
-			"4.23",
-			"4.24",
-			"4.25"
-		],
-		keyGapForNextLevel: "GAP-SE-002 AST-based usage analysis"
-	},
-	{
-		frameworkId: "testng",
-		entityType: "TEST_FRAMEWORK",
-		language: "Java",
-		maturity: "F1",
-		supportStatus: "EXPERIMENTAL",
-		targetMaturity: "F2",
-		targetSupportStatus: "OFFICIAL_PARTIAL",
-		validatedVersions: ["7.10", "7.11"],
-		keyGapForNextLevel: "GAP-TN-002 AST-based usage analysis"
-	},
-	{
-		frameworkId: "github-actions",
-		entityType: "CI_PROVIDER",
-		language: "YAML",
-		maturity: "F3",
-		supportStatus: "OFFICIAL_PARTIAL",
-		targetMaturity: "F4",
-		targetSupportStatus: "OFFICIAL_FULL",
-		validatedVersions: ["v4"],
-		keyGapForNextLevel: "GAP-GHA-004 advanced matrix strategy modeling"
-	},
-	{
-		frameworkId: "azure-devops",
-		entityType: "CI_PROVIDER",
-		language: "YAML",
-		maturity: "F3",
-		supportStatus: "OFFICIAL_PARTIAL",
-		targetMaturity: "F4",
-		targetSupportStatus: "OFFICIAL_FULL",
-		validatedVersions: ["2024"],
-		keyGapForNextLevel: "GAP-AZ-004 stage dependency graph modeling"
-	},
-	{
-		frameworkId: "jenkins",
-		entityType: "CI_PROVIDER",
-		language: "Groovy/YAML",
-		maturity: "F3",
-		supportStatus: "OFFICIAL_PARTIAL",
-		targetMaturity: "F4",
-		targetSupportStatus: "OFFICIAL_FULL",
-		validatedVersions: ["2.440", "2.450"],
-		keyGapForNextLevel: "GAP-JK-004 declarative pipeline advanced features"
-	},
-	{
-		frameworkId: "gitlab-ci",
-		entityType: "CI_PROVIDER",
-		language: "YAML",
-		maturity: "F0",
-		supportStatus: "UNSUPPORTED",
-		targetMaturity: "F1",
-		targetSupportStatus: "DISCOVERED",
-		validatedVersions: [],
-		keyGapForNextLevel: "GAP-GL-001 basic pipeline discovery"
-	}
-];
-function getFrameworkById(frameworkId) {
-	return FRAMEWORK_INVENTORY.find((f) => f.frameworkId === frameworkId);
-}
-//#endregion
 //#region src/frameworks/scorecard.ts
 const SCORECARD_DIMENSIONS = [
 	"discovery",
@@ -14281,7 +15043,7 @@ function loadPolicy(path) {
 	}
 	let record;
 	try {
-		record = parseJsonFile(text, path, isRecord$2);
+		record = parseJsonFile(text, path, isRecord$3);
 	} catch (error) {
 		throw new ConfigValidationError(`invalid suppression policy: ${path}`, { cause: error });
 	}
@@ -14300,7 +15062,7 @@ function loadPolicy(path) {
 	};
 }
 function isTrustSnapshot(value) {
-	return isRecord$2(value) && typeof value.scanId === "string" && typeof value.timestamp === "string" && (typeof value.score === "number" || value.score === null) && typeof value.findings === "number" && typeof value.errors === "number" && typeof value.warnings === "number" && typeof value.infos === "number" && typeof value.advisory === "number" && typeof value.trustLevel === "string" && typeof value.confidence === "number" && typeof value.evidenceCoverage === "number" && typeof value.inconclusiveRate === "number" && typeof value.partial === "boolean" && typeof value.frameworkCount === "number" && typeof value.ruleCount === "number";
+	return isRecord$3(value) && typeof value.scanId === "string" && typeof value.timestamp === "string" && (typeof value.score === "number" || value.score === null) && typeof value.findings === "number" && typeof value.errors === "number" && typeof value.warnings === "number" && typeof value.infos === "number" && typeof value.advisory === "number" && typeof value.trustLevel === "string" && typeof value.confidence === "number" && typeof value.evidenceCoverage === "number" && typeof value.inconclusiveRate === "number" && typeof value.partial === "boolean" && typeof value.frameworkCount === "number" && typeof value.ruleCount === "number";
 }
 function loadTrustHistory(path) {
 	if (!existsSync(path)) return [];
@@ -14326,53 +15088,46 @@ function isStringArray(value) {
 	return Array.isArray(value) && value.every((entry) => typeof entry === "string");
 }
 function isValidAnalysisStatus(value) {
-	if (!isRecord$2(value)) return false;
+	if (!isRecord$3(value)) return false;
 	return (value.discovery === "complete" || value.discovery === "partial") && (value.rules === "complete" || value.rules === "partial") && isNonNegativeInteger(value.skippedFiles) && isFiniteNumber(value.durationMs) && value.durationMs >= 0 && (value.truncationReasons === void 0 || isStringArray(value.truncationReasons)) && (value.rulesCrashed === void 0 || isNonNegativeInteger(value.rulesCrashed));
 }
 function isValidDimension(value) {
-	return isRecord$2(value) && typeof value.category === "string" && isFiniteNumber(value.score) && value.score >= 0 && value.score <= 100 && isNonNegativeInteger(value.errors) && isNonNegativeInteger(value.warnings) && isNonNegativeInteger(value.infos);
+	return isRecord$3(value) && typeof value.category === "string" && isFiniteNumber(value.score) && value.score >= 0 && value.score <= 100 && isNonNegativeInteger(value.errors) && isNonNegativeInteger(value.warnings) && isNonNegativeInteger(value.infos);
 }
 function isValidFinding(value) {
-	if (!isRecord$2(value)) return false;
+	if (!isRecord$3(value)) return false;
 	return typeof value.ruleId === "string" && value.ruleId.length > 0 && typeof value.category === "string" && typeof value.file === "string" && value.file.length > 0 && isPositiveInteger(value.line) && isPositiveInteger(value.column) && typeof value.message === "string" && value.message.length > 0 && typeof value.severity === "string" && typeof value.confidence === "string" && typeof value.findingType === "string" && typeof value.qaImpact === "string" && typeof value.why === "string" && typeof value.fix === "string";
 }
 function isValidTrustSummary(value) {
-	if (!isRecord$2(value)) return false;
-	return [
-		"L0",
-		"L1",
-		"L2",
-		"L3",
-		"L4",
-		"L5"
-	].includes(String(value.level)) && isFiniteNumber(value.confidence) && value.confidence >= 0 && value.confidence <= 1 && isFiniteNumber(value.evidenceCoverage) && value.evidenceCoverage >= 0 && value.evidenceCoverage <= 1 && isFiniteNumber(value.inconclusiveRate) && value.inconclusiveRate >= 0 && value.inconclusiveRate <= 1 && (value.measuredFpOfFiredRules === void 0 || isFiniteNumber(value.measuredFpOfFiredRules) && value.measuredFpOfFiredRules >= 0 && value.measuredFpOfFiredRules <= 1) && isStringArray(value.provisionalRuleIds) && (value.confidenceCeiling === void 0 || isFiniteNumber(value.confidenceCeiling) && value.confidenceCeiling >= 0 && value.confidenceCeiling <= 1) && isStringArray(value.ceilingReasons);
+	if (!isRecord$3(value)) return false;
+	return TRUST_ORDER.includes(String(value.level)) && isFiniteNumber(value.confidence) && value.confidence >= 0 && value.confidence <= 1 && isFiniteNumber(value.evidenceCoverage) && value.evidenceCoverage >= 0 && value.evidenceCoverage <= 1 && isFiniteNumber(value.inconclusiveRate) && value.inconclusiveRate >= 0 && value.inconclusiveRate <= 1 && (value.measuredFpOfFiredRules === void 0 || isFiniteNumber(value.measuredFpOfFiredRules) && value.measuredFpOfFiredRules >= 0 && value.measuredFpOfFiredRules <= 1) && isStringArray(value.provisionalRuleIds) && (value.confidenceCeiling === void 0 || isFiniteNumber(value.confidenceCeiling) && value.confidenceCeiling >= 0 && value.confidenceCeiling <= 1) && isStringArray(value.ceilingReasons);
 }
 function isValidProvenance(value) {
-	if (!isRecord$2(value)) return false;
+	if (!isRecord$3(value)) return false;
 	return isNonNegativeInteger(value.testFiles) && isNonNegativeInteger(value.generatedMarkedFiles) && isNonNegativeInteger(value.codegenLikeFiles) && isFiniteNumber(value.shareMarkedGenerated) && value.shareMarkedGenerated >= 0 && value.shareMarkedGenerated <= 1 && isNonNegativeInteger(value.findingsInGeneratedFiles) && isNonNegativeInteger(value.findingsInUnmarkedFiles) && typeof value.note === "string";
 }
 function isValidForensicVerdicts(value) {
-	if (!isRecord$2(value) || !isRecord$2(value.byVerdict)) return false;
+	if (!isRecord$3(value) || !isRecord$3(value.byVerdict)) return false;
 	return isNonNegativeInteger(value.classifications) && isNonNegativeInteger(value.inconclusive) && Object.values(value.byVerdict).every((count) => isNonNegativeInteger(count));
 }
 function isValidSummary(value) {
-	if (!isRecord$2(value)) return false;
+	if (!isRecord$3(value)) return false;
 	return typeof value.digest === "string" && value.digest.length > 0 && isNonNegativeInteger(value.findings) && (value.score === null || isFiniteNumber(value.score) && value.score >= 0 && value.score <= 100) && isNonNegativeInteger(value.errors) && isNonNegativeInteger(value.warnings) && isNonNegativeInteger(value.infos) && isNonNegativeInteger(value.advisory);
 }
 function isValidAnnotation(value) {
-	if (!isRecord$2(value)) return false;
+	if (!isRecord$3(value)) return false;
 	return typeof value.path === "string" && value.path.length > 0 && isPositiveInteger(value.start_line) && (value.annotation_level === "failure" || value.annotation_level === "warning" || value.annotation_level === "notice") && typeof value.message === "string" && typeof value.ruleId === "string" && value.ruleId.length > 0 && (value.detectorRevision === void 0 || isPositiveInteger(value.detectorRevision)) && typeof value.advisory === "boolean";
 }
 function isValidCompleteness(value) {
-	if (!isRecord$2(value)) return false;
+	if (!isRecord$3(value)) return false;
 	return typeof value.partial === "boolean" && (value.discovery === "complete" || value.discovery === "partial") && (value.rules === "complete" || value.rules === "partial") && isNonNegativeInteger(value.skippedFiles) && isNonNegativeInteger(value.rulesCrashed) && isStringArray(value.truncationReasons) && typeof value.frameworkDetectionUnknown === "boolean" && isFiniteNumber(value.durationMs) && value.durationMs >= 0;
 }
 function isValidContract(value) {
-	if (!isRecord$2(value)) return false;
+	if (!isRecord$3(value)) return false;
 	return Number.isSafeInteger(value.contractVersion) && isValidSummary(value.summary) && Array.isArray(value.annotations) && value.annotations.length <= 50 && value.annotations.every((annotation) => isValidAnnotation(annotation)) && typeof value.annotationsTruncated === "boolean" && isValidCompleteness(value.completeness) && (value.trustSummary === void 0 || isValidTrustSummary(value.trustSummary)) && (value.provenance === void 0 || isValidProvenance(value.provenance)) && (value.forensicVerdicts === void 0 || isValidForensicVerdicts(value.forensicVerdicts));
 }
 function isScanResultDocument(value) {
-	if (!isRecord$2(value) || value.schemaVersion !== 1) return false;
+	if (!isRecord$3(value) || value.schemaVersion !== 1) return false;
 	return (value.score === null || isFiniteNumber(value.score) && value.score >= 0 && value.score <= 100) && typeof value.partial === "boolean" && isStringArray(value.frameworks) && Array.isArray(value.dimensions) && value.dimensions.every((dimension) => isValidDimension(dimension)) && Array.isArray(value.findings) && value.findings.every((finding) => isValidFinding(finding)) && isValidAnalysisStatus(value.analysisStatus) && (value.agenticProfile === void 0 || isValidProvenance(value.agenticProfile)) && (value.trustSummary === void 0 || isValidTrustSummary(value.trustSummary)) && (value.forensicVerdicts === void 0 || isValidForensicVerdicts(value.forensicVerdicts)) && isValidContract(value.contract);
 }
 function emitVerification(verification, json, io) {
@@ -14628,12 +15383,14 @@ async function runCIIntegrityCommand(argv, io = {
 * keeps every existing consumer stable.
 */
 const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isValidFindingRecord, discoverAndParseRuntimeReport, KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID, EVIDENCE_OVERRIDES, SUITE_INVALIDATING_RULE_IDS } = scan_pipeline_exports;
+const DEFAULT_MAX_DURATION_MS = 6e5;
+const MAX_DURATION_MS = 36e5;
 function parseArgs(argv, onError) {
 	const args = {
 		target: ".",
 		json: false,
 		verbose: false,
-		maxDurationMs: Number.POSITIVE_INFINITY,
+		maxDurationMs: DEFAULT_MAX_DURATION_MS,
 		scopeChanged: false,
 		format: "terminal"
 	};
@@ -14679,7 +15436,7 @@ function parseArgs(argv, onError) {
 			args.base = ref;
 		} else if (a === "--max-duration") {
 			const v = Number(argv[++i]);
-			if (!Number.isFinite(v) || v <= 0) return reject({
+			if (!Number.isFinite(v) || v <= 0 || v * 1e3 > 36e5) return reject({
 				flag: "--max-duration",
 				token: argv[i]
 			});
@@ -14841,14 +15598,22 @@ function validateScanTarget(target, err) {
 	return null;
 }
 /**
-* Exit-code decision for a finished scan under the given gate level
-* (audit H-7): the previously-dead config.gate field now selects which
-* severities block. Advisory (E0) findings never gate at any level.
+* Exit-code decision for findings only (audit H-7): the previously-dead
+* config.gate field selects which severities block. Advisory (E0) findings
+* never gate at any level.
+*
+* This is a findings-only view of the one exit matrix in `claim-evidence`.
+* Callers that have just finished an ANALYSIS must use `scanExitCode`
+* instead — this function cannot see `partial`, and a truncated scan with
+* zero findings is exactly the case that turns a bug into a green build.
 */
 function exitForFindings(findings, gate) {
-	if (gate === "advisory") return 0;
-	const gateSeverities = gate === "warning" ? ["error", "warning"] : ["error"];
-	return findings.some((f) => gateSeverities.includes(f.severity) && !isAdvisoryFinding(f)) ? 1 : 0;
+	return scanExitCode({
+		partial: false,
+		findings,
+		gate,
+		isAdvisory: isAdvisoryFinding
+	});
 }
 /** Testable `ci install` handler. Returns the process exit code. */
 function runCiInstall(argv, io = {
@@ -15040,11 +15805,19 @@ function isEntryPoint() {
 		return import.meta.url === pathToFileURL(argv1).href;
 	}
 }
-if (isEntryPoint()) try {
-	process$1.exitCode = await main();
-} catch (err) {
-	internalErrorMessage(err, (s) => process$1.stderr.write(s + "\n"), false);
-	process$1.exitCode = 20;
+if (isEntryPoint()) {
+	await initSentry();
+	try {
+		process$1.exitCode = await main();
+	} catch (err) {
+		captureInternalError(err, "cli");
+		internalErrorMessage(err, (s) => process$1.stderr.write(s + "\n"), false);
+		process$1.exitCode = 20;
+	} finally {
+		await flushSentry();
+	}
 }
 //#endregion
-export { ENGINE_VERSION as CLI_VERSION, EVIDENCE_OVERRIDES, KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID, SUITE_INVALIDATING_RULE_IDS, buildUniversalRules, discoverAndParseRuntimeReport, err, exitForFindings, fallbackWorkspace, internalErrorMessage, isEntryPoint, isValidFindingRecord, levenshtein, main, nearestFlags, out, parseArgs, parseArgsOrUsage, pathMatchesGlob, printUsage, renderScanOutput, runAnalyzeCommand, runBadgeCommand, runBaselineCommand, runBusinessCaseCommand, runCIIntegrityCommand, runCiAdapterCommand, runCiInstall, runContractVerifyCommand, runCreateRuleCommand, runCrossFileCommand, runDashboardCommand, runDebtCommand, runDiffCommand, runDoctorCommand, runDoctorPlaywright, runEnterpriseCommand, runEvidenceGraphCommand, runExecReportCommand, runExplainCommand, runFixCommand, runForensicsCommand, runFrameworkMaturityCommand, runHandoffCommand, runHandoverCommand, runHelpCommand, runImpactCommand, runInitCommand, runInstallCommand, runMaturityCommand, runMutationCommand, runPolicyCommand, runPrCommentCommand, runPwReportCommand, runQuarantineCommand, runReleaseReportCommand, runReleaseTrustCommand, runReportPlaywrightCommand, runRulesCommand, runScan, runScanCommand, runStatsCommand, runSummaryCommand, runSuppressionGateCommand, runSuppressions, runTrendCommand, runTriageCommand, runTrustReportCommand, runTrustTrendCommand, runVerifyCommand, runWhyCommand, usageErrorMessage, validateScanTarget };
+export { ENGINE_VERSION as CLI_VERSION, DEFAULT_MAX_DURATION_MS, EVIDENCE_OVERRIDES, KNOWN_RULE_IDS, MAX_DURATION_MS, OVERLAP_META_BY_RULE_ID, SUITE_INVALIDATING_RULE_IDS, buildUniversalRules, discoverAndParseRuntimeReport, err, exitForFindings, fallbackWorkspace, internalErrorMessage, isEntryPoint, isValidFindingRecord, levenshtein, main, nearestFlags, out, parseArgs, parseArgsOrUsage, pathMatchesGlob, printUsage, renderScanOutput, runAnalyzeCommand, runBadgeCommand, runBaselineCommand, runBusinessCaseCommand, runCIIntegrityCommand, runCiAdapterCommand, runCiInstall, runContractVerifyCommand, runCreateRuleCommand, runCrossFileCommand, runDashboardCommand, runDebtCommand, runDiffCommand, runDoctorCommand, runDoctorPlaywright, runEnterpriseCommand, runEvidenceGraphCommand, runExecReportCommand, runExplainCommand, runFixCommand, runForensicsCommand, runFrameworkMaturityCommand, runHandoffCommand, runHandoverCommand, runHelpCommand, runImpactCommand, runInitCommand, runInstallCommand, runMaturityCommand, runMutationCommand, runPolicyCommand, runPrCommentCommand, runPwReportCommand, runQuarantineCommand, runReleaseReportCommand, runReleaseTrustCommand, runReportPlaywrightCommand, runRulesCommand, runScan, runScanCommand, runStatsCommand, runSummaryCommand, runSuppressionGateCommand, runSuppressions, runTrendCommand, runTriageCommand, runTrustReportCommand, runTrustTrendCommand, runVerifyCommand, runWhyCommand, usageErrorMessage, validateScanTarget };
+
+//# sourceMappingURL=cli.mjs.map