mjolnir-qa 2.1.0 → 4.0.0

package/dist/{scan-pipeline-MQGUSey3.mjs → scan-pipeline-CCJdEKNa.mjs}

@@ -1,14 +1,14 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import { createRequire } from "node:module";
-import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { closeSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, statSync, unlinkSync, writeSync } from "node:fs";
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { createHash } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
+import { execFileSync } from "node:child_process";
 import * as ts$2 from "ts-morph";
 import ts, { Project, SyntaxKind, ts as ts$1 } from "ts-morph";
 import { Language, Parser } from "web-tree-sitter";
 import { parse } from "yaml";
-import { execFileSync } from "node:child_process";
 import { inflateRawSync } from "node:zlib";
 //#region src/types.ts
 /** Severity ladder. Order matters for sorting and gating. */
@@ -60,6 +60,32 @@ function isValidCategory(value) {
 	return value !== void 0 && RULE_CATEGORIES.includes(value);
 }
 /**
+* Trust levels (Verification Trust Evolution Plan §16): the OVERALL
+* trust a consumer can place in one finding, combining the static
+* evidence ladder (E0–E2) with RUNTIME corroboration from a real run
+* report. Exposed honestly, never overclaimed:
+*   L0 — observation only (E0, no runtime evidence).
+*   L1 — heuristic static evidence (E1), no runtime evidence.
+*   L2 — deterministic static evidence (E2), no runtime evidence.
+*   L3 — RUNTIME: the file containing this finding appeared in a real
+*        run report (tests in that file executed).
+*   L4 — RUNTIME: the specific test containing this finding was
+*        identified in the report and executed (its outcome is known).
+*   L5 — RUNTIME: the run verdict directly corroborates the DEFECT
+*        class (e.g. a flake-risk finding whose test actually flaked,
+*        retried, or timed out in the report).
+* INVARIANT (structurally enforced): L3–L5 require runtime
+* corroboration — a static-only finding can never claim L4/L5.
+*/
+const TRUST_ORDER = [
+	"L0",
+	"L1",
+	"L2",
+	"L3",
+	"L4",
+	"L5"
+];
+/**
 * Honest default evidence level for a finding (Honesty Core Phase 1).
 * Derivation is deterministic and conservative:
 *   observation → E0 (never proof)
@@ -97,6 +123,38 @@ const DEDUCTIONS = {
 	info: 1
 };
 //#endregion
+//#region src/engine/completion.ts
+function deriveCompletion(input) {
+	const truncationReasons = [...new Set(input.truncationReasons)].sort();
+	const reasons = /* @__PURE__ */ new Set();
+	if (input.discoveryTruncated) reasons.add("discovery-truncated");
+	if (input.rulesPartial) reasons.add("rules-partial");
+	if (input.skippedFiles > 0) reasons.add(`skipped-files:${input.skippedFiles}`);
+	if (input.rulesCrashed > 0) reasons.add(`rules-crashed:${input.rulesCrashed}`);
+	if (input.scopeIgnored > 0) reasons.add(`scope-ignored:${input.scopeIgnored}`);
+	if (input.scopeUnrecognized > 0) reasons.add(`scope-unrecognized:${input.scopeUnrecognized}`);
+	if (input.parseFailed > 0) reasons.add(`parse-failed:${input.parseFailed}`);
+	if (input.parseFallbacks && input.parseFallbacks > 0) reasons.add(`parse-fallbacks:${input.parseFallbacks}`);
+	if (input.scopeDegraded) reasons.add(`scope-degraded:${input.scopeDegraded}`);
+	if (input.runtimeIncomplete) reasons.add("runtime-incomplete");
+	if (input.identityIncomplete) reasons.add("identity-incomplete");
+	for (const reason of truncationReasons) reasons.add(`truncated:${reason}`);
+	const discoveryPartial = input.discoveryTruncated || input.scopeIgnored > 0 || input.scopeUnrecognized > 0 || input.scopeDegraded !== void 0;
+	const rulesPartial = input.rulesPartial || input.rulesCrashed > 0 || input.parseFailed > 0;
+	return {
+		partial: discoveryPartial || rulesPartial || input.skippedFiles > 0 || input.runtimeIncomplete === true || input.identityIncomplete === true || truncationReasons.length > 0,
+		analysisStatus: {
+			discovery: discoveryPartial ? "partial" : "complete",
+			rules: rulesPartial ? "partial" : "complete",
+			skippedFiles: input.skippedFiles,
+			rulesCrashed: input.rulesCrashed,
+			parseFallbacks: input.parseFallbacks ?? 0,
+			...truncationReasons.length > 0 ? { truncationReasons } : {},
+			reasons: [...reasons].sort()
+		}
+	};
+}
+//#endregion
 //#region src/engine/runtime-corroboration.ts
 /**
 * Stamp runtime corroboration + trust levels onto findings (mutates in
@@ -710,21 +768,13 @@ const MEASURED_FP = {
 * empty scan is an observation, not a proof).
 */
 function summaryTrustLevel(findings) {
-	const order = [
-		"L0",
-		"L1",
-		"L2",
-		"L3",
-		"L4",
-		"L5"
-	];
 	let best = 0;
 	for (const f of findings) {
 		const t = f.trustLevel ?? "L2";
-		const idx = order.indexOf(t);
+		const idx = TRUST_ORDER.indexOf(t);
 		if (idx > best) best = idx;
 	}
-	return order[best];
+	return TRUST_ORDER[best];
 }
 /**
 * A finding's trust rung (0–5) on the canonical ladder. Corroborated
@@ -735,14 +785,7 @@ function summaryTrustLevel(findings) {
 */
 function trustRung(f) {
 	const t = f.trustLevel ?? deriveTrustLevel(f);
-	return [
-		"L0",
-		"L1",
-		"L2",
-		"L3",
-		"L4",
-		"L5"
-	].indexOf(t);
+	return TRUST_ORDER.indexOf(t);
 }
 /**
 * Hard incompleteness ceilings (plan §6: partial/crash/truncation;
@@ -863,7 +906,10 @@ function sha256$1(text) {
 	return createHash("sha256").update(text).digest("hex");
 }
 function canonical(value) {
-	return JSON.stringify(value);
+	if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+	if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+	const record = value;
+	return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonical(record[key])}`).join(",")}}`;
 }
 function buildRunIdentity(input) {
 	const inputFingerprint = sha256$1([...input.files].map((f) => f.hash ? `${f.path}:${f.hash}` : `${f.path}:${f.size}`).sort().join("\n"));
@@ -876,6 +922,17 @@ function buildRunIdentity(input) {
 		engineVersion: input.engineVersion
 	};
 	if (input.reportDigest) verdictInputs.reportDigest = input.reportDigest;
+	if (input.commit !== void 0) verdictInputs.commit = input.commit;
+	if (input.tree !== void 0) verdictInputs.tree = input.tree;
+	if (input.lockfile !== void 0) verdictInputs.lockfile = input.lockfile;
+	if (input.candidate !== void 0) verdictInputs.candidate = {
+		manifestId: input.candidate.manifestId,
+		state: input.candidate.state,
+		candidateSha: input.candidate.candidateSha,
+		baseSha: input.candidate.baseSha,
+		packageSha256: input.candidate.packageSha256,
+		lockfileSha256: input.candidate.lockfileSha256
+	};
 	if (input.trustModelVersion !== void 0) verdictInputs.trustModelVersion = input.trustModelVersion;
 	if (input.scoringModelVersion !== void 0) verdictInputs.scoringModelVersion = input.scoringModelVersion;
 	if (input.frameworkSupportMatrixVersion !== void 0) verdictInputs.frameworkSupportMatrixVersion = input.frameworkSupportMatrixVersion;
@@ -883,15 +940,31 @@ function buildRunIdentity(input) {
 	if (input.suppressionFingerprint !== void 0) verdictInputs.suppressionFingerprint = input.suppressionFingerprint;
 	if (input.policyFingerprint !== void 0) verdictInputs.policyFingerprint = input.policyFingerprint;
 	if (input.historicalEvidenceFingerprint !== void 0) verdictInputs.historicalEvidenceFingerprint = input.historicalEvidenceFingerprint;
+	const scanId = sha256$1(canonical(verdictInputs));
+	const boundLinks = [
+		"input",
+		"rules",
+		"config",
+		"engine"
+	];
+	if (input.commit !== void 0) boundLinks.push("commit");
+	if (input.tree !== void 0) boundLinks.push("tree");
+	if (input.lockfile !== void 0) boundLinks.push("lockfile");
+	if (input.candidate !== void 0) boundLinks.push("candidate");
 	return {
-		scanId: sha256$1(canonical(verdictInputs)),
+		scanId,
 		inputFingerprint,
 		rulesDigest,
 		configFingerprint,
 		engineVersion: input.engineVersion,
+		boundLinks,
 		...input.trustModelVersion !== void 0 ? { trustModelVersion: input.trustModelVersion } : {},
 		...input.scoringModelVersion !== void 0 ? { scoringModelVersion: input.scoringModelVersion } : {},
-		...input.frameworkSupportMatrixVersion !== void 0 ? { frameworkSupportMatrixVersion: input.frameworkSupportMatrixVersion } : {}
+		...input.frameworkSupportMatrixVersion !== void 0 ? { frameworkSupportMatrixVersion: input.frameworkSupportMatrixVersion } : {},
+		...input.commit !== void 0 ? { commit: input.commit } : {},
+		...input.tree !== void 0 ? { tree: input.tree } : {},
+		...input.lockfile !== void 0 ? { lockfile: input.lockfile } : {},
+		...input.candidate !== void 0 ? { candidate: input.candidate } : {}
 	};
 }
 /**
@@ -932,9 +1005,218 @@ function buildEvidenceGraph(parts) {
 				...parts.reproduction !== void 0 ? { ref: parts.reproduction } : {}
 			}
 		],
-		...parts.runId !== void 0 ? { runId: parts.runId } : {}
+		...parts.runId !== void 0 ? { runId: parts.runId } : {},
+		...parts.candidate !== void 0 ? { candidate: {
+			manifestId: parts.candidate.manifestId,
+			candidateSha: parts.candidate.candidateSha
+		} } : {}
+	};
+}
+//#endregion
+//#region src/engine/file-executor.ts
+function cacheHitOutcome(job) {
+	return {
+		path: job.path,
+		status: "CACHE_HIT",
+		findings: [...job.cacheHit ?? []],
+		parseFallback: false
+	};
+}
+/**
+* Drive a list of jobs through an executor and return outcomes in INPUT order.
+*
+* This is the function the pipeline calls. It is executor-agnostic on purpose:
+* swapping in a pooled executor must not require touching the caller, and the
+* ordering guarantee has to live here or it would live in each executor and
+* drift between them.
+*/
+async function executeFiles(jobs, executor, context = {}) {
+	const outcomes = new Array(jobs.length);
+	if (executor.concurrency <= 1 || jobs.length <= 1) {
+		for (let i = 0; i < jobs.length; i++) {
+			const job = jobs[i];
+			context.onProgress?.({
+				done: i,
+				total: jobs.length,
+				path: job.path
+			});
+			outcomes[i] = await runOne(job, executor, context);
+		}
+		context.onProgress?.({
+			done: jobs.length,
+			total: jobs.length,
+			path: jobs[jobs.length - 1]?.path ?? ""
+		});
+		return outcomes;
+	}
+	let next = 0;
+	let completed = 0;
+	const inFlight = /* @__PURE__ */ new Set();
+	const limit = Math.max(1, Math.floor(executor.concurrency));
+	const worker = async () => {
+		for (;;) {
+			const index = next++;
+			if (index >= jobs.length) return;
+			const job = jobs[index];
+			outcomes[index] = await runOne(job, executor, context);
+			completed++;
+			context.onProgress?.({
+				done: completed,
+				total: jobs.length,
+				path: job.path
+			});
+		}
+	};
+	for (let i = 0; i < Math.min(limit, jobs.length); i++) {
+		const promise = worker().then(() => void 0);
+		inFlight.add(promise);
+	}
+	await Promise.all(inFlight);
+	return outcomes;
+}
+async function runOne(job, executor, context) {
+	if (job.cacheHit !== void 0) return cacheHitOutcome(job);
+	try {
+		return await executor.execute(job, context);
+	} catch (error) {
+		return {
+			path: job.path,
+			status: "FAILED",
+			findings: [],
+			parseFallback: false,
+			error: error instanceof Error ? error : new Error(String(error))
+		};
+	}
+}
+/**
+* The strategy the pipeline uses today.
+*
+* `runOne` is supplied by the pipeline because parsing and rule execution
+* need the adapter and the active rule set, which are pipeline concerns. The
+* executor's job is the BOUNDARY and the bookkeeping, not the analysis — so
+* this factory exists to bind those two without the executor importing the
+* pipeline (which would be a cycle).
+*/
+function createExecutor(name, concurrency, runOne) {
+	return {
+		name,
+		concurrency,
+		execute: runOne
+	};
+}
+//#endregion
+//#region src/engine/candidate-binding.ts
+/**
+* Candidate binding (plan V5-010).
+*
+* Reads a candidate trust manifest and produces the immutable
+* `CandidateBinding` that a run identity is bound to. It also computes the
+* repository facts (commit, tree, lockfile digest) that the identity was
+* missing until this module existed.
+*
+* The law here is ABSENCE over invention. A manifest that is missing,
+* unreadable, or internally contradictory yields NO binding — not a partial
+* one. A consumer that can see "not bound" can refuse to trust the run; a
+* consumer handed a half-filled binding cannot tell what is missing, and will
+* trust the parts that are there.
+*/
+const CANDIDATE_MANIFEST_PATH = "candidate-trust-manifest.json";
+const SHA40 = /^[a-f0-9]{40}$/;
+const SHA256 = /^[a-f0-9]{64}$/;
+const STATES = ["WORKING_CANDIDATE", "RELEASE_CANDIDATE"];
+const AUTHORIZATION = ["NOT_AUTHORIZED", "AUTHORIZED"];
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function sha256File(path) {
+	try {
+		return createHash("sha256").update(readFileSync(path)).digest("hex");
+	} catch {
+		return;
+	}
+}
+function gitLine(root, args) {
+	try {
+		const trimmed = execFileSync("git", args, {
+			cwd: root,
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			],
+			windowsHide: true
+		}).trim();
+		return trimmed.length > 0 ? trimmed : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* The commit and tree the working tree is at. Both absent outside a
+* repository or with no commits — never substituted with a placeholder.
+*/
+function bindRepository(root) {
+	const commit = gitLine(root, ["rev-parse", "HEAD"]);
+	const tree = gitLine(root, ["rev-parse", "HEAD^{tree}"]);
+	const lockfile = sha256File(join(root, "package-lock.json"));
+	return {
+		...commit !== void 0 ? { commit } : {},
+		...tree !== void 0 ? { tree } : {},
+		...lockfile !== void 0 ? { lockfile } : {}
+	};
+}
+/**
+* Parse a candidate manifest into a binding, or return null when it cannot
+* honestly be bound.
+*
+* Null is returned for: no manifest, unreadable JSON, a missing or malformed
+* required field, or a state/authorization combination that cannot legally
+* exist (a WORKING_CANDIDATE carrying a commit, for example — the same
+* contradiction the release decision evaluator treats as BLOCKED).
+*/
+function parseCandidateBinding(raw) {
+	if (!isRecord$1(raw)) return null;
+	const identity = raw.identity;
+	if (!isRecord$1(identity)) return null;
+	const state = identity.state;
+	const candidateSha = identity.candidateSha;
+	const baseSha = identity.baseSha;
+	const packageSha256 = identity.packageSha256;
+	const lockfileSha256 = identity.lockfileSha256;
+	if (typeof state !== "string" || !STATES.includes(state)) return null;
+	if (typeof baseSha !== "string" || !SHA40.test(baseSha)) return null;
+	if (typeof packageSha256 !== "string" || !SHA256.test(packageSha256)) return null;
+	if (typeof lockfileSha256 !== "string" || !SHA256.test(lockfileSha256)) return null;
+	if (candidateSha !== null && (typeof candidateSha !== "string" || !SHA40.test(candidateSha))) return null;
+	const manifestId = raw.manifestId;
+	if (typeof manifestId !== "string" || manifestId.length === 0) return null;
+	const owner = typeof raw.owner === "string" ? raw.owner : "UNASSIGNED";
+	const authorization = raw.releaseAuthorizationState;
+	if (typeof authorization !== "string" || !AUTHORIZATION.includes(authorization)) return null;
+	if (state === "WORKING_CANDIDATE") {
+		if (candidateSha !== null) return null;
+		if (authorization !== "NOT_AUTHORIZED") return null;
+	} else if (candidateSha === null) return null;
+	return {
+		manifestId,
+		state,
+		candidateSha,
+		baseSha,
+		packageSha256,
+		lockfileSha256,
+		owner,
+		releaseAuthorizationState: authorization
 	};
 }
+/** Read and bind the manifest from a checkout, or null. */
+function readCandidateBinding(root, manifestPath = CANDIDATE_MANIFEST_PATH) {
+	try {
+		return parseCandidateBinding(JSON.parse(readFileSync(join(root, manifestPath), "utf8")));
+	} catch {
+		return null;
+	}
+}
 //#endregion
 //#region src/engine/version.ts
 /**
@@ -945,7 +1227,7 @@ function buildEvidenceGraph(parts) {
 * scripts/sync-sarif-version.cjs and guarded by the version-consistency
 * spec. cli.ts re-exports this as CLI_VERSION.
 */
-const ENGINE_VERSION = "2.1.0";
+const ENGINE_VERSION = "4.0.0";
 //#endregion
 //#region src/engine/contract-versions.ts
 /**
@@ -1106,7 +1388,9 @@ function basename$1(p) {
 * Internal files (cache, hashes) use `isRecord`; user-facing files
 * (config, plugins) use stricter checks that throw descriptive errors.
 */
+const MAX_JSON_BYTES = 16777216;
 function parseJsonFile(text, source, validate) {
+	if (Buffer.byteLength(text, "utf8") > MAX_JSON_BYTES) throw new Error(`JSON source exceeds the ${MAX_JSON_BYTES}-byte limit: ${source}`);
 	let parsed;
 	try {
 		parsed = JSON.parse(text);
@@ -1125,6 +1409,59 @@ function isRecord(v) {
 	return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 //#endregion
+//#region src/lib/fs-bounded.ts
+function closeQuiet(fd) {
+	try {
+		closeSync(fd);
+	} catch {
+		return;
+	}
+}
+function readFileBounded(path, maxBytes) {
+	let fd;
+	try {
+		const pathStat = lstatSync(path);
+		if (pathStat.isSymbolicLink()) return {
+			ok: false,
+			reason: "symlink"
+		};
+		if (!pathStat.isFile()) return {
+			ok: false,
+			reason: "unreadable"
+		};
+		fd = openSync(path, 0);
+		const fdStat = fstatSync(fd);
+		if (!fdStat.isFile() || fdStat.size > maxBytes) return {
+			ok: false,
+			reason: fdStat.size > maxBytes ? "too-large" : "unreadable"
+		};
+		const chunks = [];
+		let total = 0;
+		const buffer = Buffer.allocUnsafe(Math.min(65536, maxBytes));
+		while (true) {
+			const read = readSync(fd, buffer, 0, buffer.length, null);
+			if (read === 0) break;
+			total += read;
+			if (total > maxBytes) return {
+				ok: false,
+				reason: "too-large"
+			};
+			chunks.push(Buffer.from(buffer.subarray(0, read)));
+		}
+		return {
+			ok: true,
+			data: Buffer.concat(chunks)
+		};
+	} catch {
+		return {
+			ok: false,
+			reason: "unreadable"
+		};
+	} finally {
+		if (fd !== void 0) closeQuiet(fd);
+	}
+}
+//#endregion
 //#region src/config/config-schema.ts
 const VALID_GATES = /* @__PURE__ */ new Set([
 	"advisory",
@@ -1223,7 +1560,11 @@ const CONFIG_NAMES = ["mjolnir.config.json", ".mjolnir.json"];
 function findConfigPath(root) {
 	for (const name of CONFIG_NAMES) {
 		const p = join(root, name);
-		if (existsSync(p)) return p;
+		try {
+			if (existsSync(p) && !lstatSync(p).isSymbolicLink()) return p;
+		} catch {
+			continue;
+		}
 	}
 	return null;
 }
@@ -1243,7 +1584,10 @@ function loadConfig(root, options = {}) {
 		const p = join(root, name);
 		if (!existsSync(p)) continue;
 		try {
-			const parsed = parseJsonFile(readFileSync(p, "utf8"), p, (v) => isRecord(v));
+			if (!existsSync(p) || lstatSync(p).isSymbolicLink()) continue;
+			const read = readFileBounded(p, 1048576);
+			if (!read.ok) throw new Error("config source could not be read safely");
+			const parsed = parseJsonFile(read.data.toString("utf8"), p, (v) => isRecord(v));
 			return {
 				config: parsed,
 				path: p,
@@ -1291,20 +1635,9 @@ function validate(cfg, knownRuleIds) {
 	return warnings;
 }
 /**
-* Bug-audit QA-2026-08-30 QA-6: the 90-day policy in the README was only
-* applied at WRITE time by the `ignore` command — a hand-written entry
-* without `expires` stayed active forever, silently bypassing the
-* documented window.
-*
-* Audit S4 (remediation plan): the config-file MTIME is no longer an
-* expiry anchor. Anchoring the 90-day default at mtime meant ANY edit to
-* mjolnir.config.json — a reformat, an unrelated key, a `touch` — reset
-* the 90-day window for EVERY hand-authored entry: suppressions could be
-* extended indefinitely without touching their own fields. The expiry is
-* now the entry's explicit `expires` date alone; an entry without one
-* stays active and is honestly labeled "(no expiry set)" in the
-* suppressions report. Hand-authored entries should declare `expires` at
-* creation (README §Configuration documents the shape).
+* Expiry is evaluated only from an explicit ISO `expires` date. A missing
+* date remains active and is reported as having no expiry. Config-file mtime
+* is never an expiry anchor.
 */
 function isSuppressionActive(ign, now = /* @__PURE__ */ new Date()) {
 	if (!ign.expires) return true;
@@ -1542,8 +1875,9 @@ function sharedWalk(options) {
 			}
 			const full = join(dir, entry.name);
 			const rel = relative(options.root, full).replaceAll("\\", "/");
+			if (entry.isDirectory() && options.skipDirs.includes(entry.name)) continue;
 			if (options.ignoreMatcher.isIgnored(rel)) {
-				options.onIgnored?.();
+				if (!rel.startsWith(".mjolnir/")) options.onIgnored?.(rel);
 				continue;
 			}
 			if (entry.isSymbolicLink()) {
@@ -1551,7 +1885,6 @@ function sharedWalk(options) {
 				continue;
 			}
 			if (entry.isDirectory()) {
-				if (options.skipDirs.includes(entry.name)) continue;
 				if (rel.split("/").length > LIMITS$1.maxDepth) {
 					options.onSkipped("max-depth");
 					continue;
@@ -1569,7 +1902,7 @@ function sharedWalk(options) {
 			} catch {
 				options.onSkipped("stat-failed");
 			}
-			else if (entry.isFile()) options.onUnrecognized?.();
+			else if (entry.isFile()) options.onUnrecognized?.(rel);
 		}
 	};
 	walk(options.root);
@@ -1587,7 +1920,33 @@ function sharedWalk(options) {
 *
 * When nothing is detectable we report `unknown` and the scanner analyzes
 * all test-looking files — stated honestly in output rather than guessed.
+*
+* ## One ID space (plan V5-024)
+*
+* This detector used to declare its own `TestFramework` union of three
+* literals while `src/frameworks/framework-inventory.ts` catalogued fourteen
+* framework ids. Two vocabularies for one concept is how a support matrix
+* starts disagreeing with what the tool actually detects: a framework can be
+* catalogued as OFFICIAL_PARTIAL and never once be emitted by the code that
+* claims to detect it.
+*
+* So the ids here are `FrameworkId`s — the inventory's own vocabulary — and
+* `DETECTABLE_TEST_FRAMEWORKS` is the subset this detector can actually
+* resolve from a checkout. That subset is the HONEST limit of detection, and
+* `detectableVsCatalogued()` reports the remainder rather than letting a
+* three-item list read as the whole catalog.
 */
+/**
+* The catalogued frameworks whose detection is implemented today.
+*
+* Every entry must exist in the inventory — enforced by the parity spec, not
+* by comment.
+*/
+const DETECTABLE_TEST_FRAMEWORKS = [
+	"jest",
+	"vitest",
+	"playwright"
+];
 const CONFIG_FILES = {
 	jest: [
 		"jest.config.ts",
@@ -1606,7 +1965,7 @@ const CONFIG_FILES = {
 };
 function detectFrameworks(ws) {
 	const found = /* @__PURE__ */ new Set();
-	for (const fw of Object.keys(CONFIG_FILES)) if (CONFIG_FILES[fw].some((f) => existsSync(join(ws.root, f)))) found.add(fw);
+	for (const fw of DETECTABLE_TEST_FRAMEWORKS) if (CONFIG_FILES[fw].some((f) => existsSync(join(ws.root, f)))) found.add(fw);
 	if (!found.has("jest") && ws.packageJson["jest"] !== void 0) found.add("jest");
 	const deps = {
 		...ws.packageJson["dependencies"],
@@ -1628,11 +1987,7 @@ function detectFrameworks(ws) {
 		};
 	}
 	return {
-		frameworks: [
-			"jest",
-			"vitest",
-			"playwright"
-		].filter((f) => found.has(f)),
+		frameworks: DETECTABLE_TEST_FRAMEWORKS.filter((f) => found.has(f)),
 		unknown: false
 	};
 }
@@ -1649,6 +2004,13 @@ function detectFrameworks(ws) {
 * byte-identical — a score shift is a regression, not an improvement.
 */
 let project = null;
+/**
+* The shared ts-morph project.
+*
+* Exported so an adapter's `dispose()` can evict the file it parsed: ts-morph
+* caches by file path, so without eviction a long scan holds every parsed
+* SourceFile until the process exits (plan V5-021).
+*/
 function getProject() {
 	if (!project) project = new Project({
 		useInMemoryFileSystem: true,
@@ -2175,7 +2537,36 @@ function frameworkFilterApplies(rule, file) {
 * "cypress", `@jest/globals` → "jest", `vitest` → "vitest". Config
 * gating is rule-declared (`configFiles`), not hard-coded here.
 */
-const TEST_FILE_RE = /\.(?:test|spec)\.(?:js|jsx|ts|tsx|mjs|cjs)$|\.cy\.(?:js|jsx|ts|tsx)$/;
+/**
+* `.test.` / `.spec.` filenames, plus the Cypress `.cy.` convention.
+*
+* `mts` and `cts` are TypeScript's Node-native ESM/CJS extensions. They were
+* missing here, and the omission was invisible in the worst way — not a wrong
+* answer, but an ABSENCE.
+*
+* Reproduced: a repo containing two byte-identical tests, one at
+* `tests/control.spec.ts` and one at `tests/slow.spec.mts`, each with a
+* `QA-TEST-004` hard sleep:
+*
+*   discovered: 1, analyzed: 1, unrecognized: 1, scopeVerdict: "PARTIAL"
+*
+* The `.ts` test produced the finding. The `.mts` test produced nothing at
+* all — it was never scanned, so every rule that could have caught it was
+* silent on it, with no finding, no low-evidence note, and no indication that
+* a test file had been skipped. A test scanner that cannot see a whole file
+* extension has a false green that is invisible by construction: the reader
+* has nothing to distrust, because there is nothing there.
+*
+* The corroboration that this was an oversight rather than a decision sits
+* four lines below: PW_CONFIG_RE already accepted `cts`. The config regex knew
+* about the Node-native extensions; the test-file regex did not.
+*
+* `discovery/scan-adapters.ts:isUnrecognizedSourceCandidate` already counted
+* these paths as uncovered surface, so the scope accounting had been reporting
+* the hole the whole time — it was being read as a known limitation rather than
+* as a defect.
+*/
+const TEST_FILE_RE = /\.(?:test|spec)\.(?:js|jsx|ts|tsx|mjs|cjs|mts|cts)$|\.cy\.(?:js|jsx|ts|tsx)$/;
 /**
 * Fallback config list for `configOnly` rules that do not declare
 * `configFiles` (the legacy playwright.config.* gating, preserved
@@ -2282,11 +2673,42 @@ const typescriptAdapter = {
 			fixtureDirMemo: /* @__PURE__ */ new Map()
 		});
 	},
+	/**
+	* The ONE AST seam (plan V5-021).
+	*
+	* This adapter used to parse inside `runRules`, on the synchronous path,
+	* while Java and C# exposed the async `parseAst` hook. Two seams meant two
+	* sets of consequences, both of them bad:
+	*
+	*   - the pipeline computes `wantsAst` as `adapter.parseAst !== undefined`,
+	*     so a TypeScript file never took the AST path through the pipeline at
+	*     all, and its parse failures were invisible to the pipeline's
+	*     fallback counters;
+	*   - nothing called `dispose()` for the ts-morph path, so a scan held
+	*     every parsed SourceFile for its whole lifetime.
+	*
+	* Parsing now happens here, once, through the same contract every other
+	* adapter uses. `dispose()` drops this file's SourceFile from the shared
+	* project; ts-morph caches per file path, so removing it is what keeps
+	* memory proportional to one file rather than to the whole scan.
+	*/
+	parseAst(file) {
+		const sourceFile = parseTsFile(file);
+		if (sourceFile === void 0) return void 0;
+		return {
+			ast: sourceFile,
+			dispose: () => {
+				try {
+					getProject().removeSourceFile(sourceFile);
+				} catch {}
+			}
+		};
+	},
 	runRules(rules, file, emit, onCrash, budget) {
-		const withAst = {
+		const withAst = file.ast === void 0 ? {
 			...file,
 			ast: parseTsFile(file)
-		};
+		} : file;
 		const withTags = {
 			...withAst,
 			frameworkTags: frameworkTagsFromImports(withAst.text)
@@ -3671,7 +4093,7 @@ const SCAN_ADAPTERS = [
 * the adapter that claims it; per-adapter caps still apply.
 */
 function discoverAllTestFiles(ctx, languageAdapters, buckets, fixtureDirMemo) {
-	const walkSkips = languageAdapters.reduce((common, a) => common.filter((name) => a.dirSkips.includes(name)), languageAdapters[0]?.dirSkips ?? []);
+	const walkSkips = [.../* @__PURE__ */ new Set([...languageAdapters.reduce((common, a) => common.filter((name) => a.dirSkips.includes(name)), languageAdapters[0]?.dirSkips ?? []), ".mjolnir"])];
 	sharedWalk({
 		root: ctx.workspace.root,
 		deadline: ctx.deadline,
@@ -3697,10 +4119,63 @@ function discoverAllTestFiles(ctx, languageAdapters, buckets, fixtureDirMemo) {
 		},
 		isFull: () => languageAdapters.every((a) => (buckets.get(a.id)?.length ?? 0) >= ctx.maxFiles),
 		fixtureDirMemo,
-		onIgnored: ctx.onIgnored,
-		onUnrecognized: ctx.onUnrecognized
+		onIgnored: (path) => {
+			if (isScopeRelevantIgnored(path)) ctx.onIgnored?.(path);
+		},
+		onUnrecognized: (path) => {
+			if (typeof path === "string" && isUnrecognizedSourceCandidate(path)) ctx.onUnrecognized?.(path);
+		}
 	});
 }
+/**
+* Would ignoring this file have removed it from the scanned surface?
+*
+* The bug this fixes, reproduced: a repo containing a real test file plus
+* `vendor.min.js` and `pnpm-lock.yaml` reported
+*
+*   discovered: 1, analyzed: 1, ignored: 2, scopeVerdict: "PARTIAL"
+*
+* Every discovered test file HAD been analyzed. The surface was complete. But
+* DEFAULT_IGNORES matches minified bundles and lockfiles, and the ignored
+* counter accepted any path with a source extension — so a minified bundle and
+* a lockfile downgraded a finished scan to "unverified".
+*
+* That is not a conservative bias, it is a broken signal. The terminal tells
+* the reader "some files were not analyzed, so the surface is unverified" —
+* which was false. And because minified bundles and lockfiles exist in
+* essentially every real repository, a PROVEN scan was unreachable in
+* practice, so the corpus regression guard failed 23 of 37 repositories on
+* exactly this. A gate that cannot pass teaches people to ignore it.
+*
+* The asymmetry is the tell. `isUnrecognizedSourceCandidate` below applies a
+* test-relevance test before counting a file; this one did not. Both count
+* against the same verdict, so both must ask the same question.
+*
+* An ignored file that IS a test file still downgrades the verdict. That is
+* the case the honesty law exists for, and this does not touch it.
+*/
+function isScopeRelevantIgnored(path) {
+	const name = path.replaceAll("\\", "/").split("/").pop() ?? path;
+	if (!/\.(?:[cm]?[jt]sx?|py|java|cs|ya?ml|min\.js)$/i.test(name)) return false;
+	return isKnownTestFile(path);
+}
+function isUnrecognizedSourceCandidate(path) {
+	const normalized = path.replaceAll("\\", "/");
+	const name = normalized.split("/").pop() ?? normalized;
+	if (normalized.includes(".github/workflows/") || name === "azure-pipelines.yml" || name === "Jenkinsfile") return false;
+	const extensionIndex = name.lastIndexOf(".");
+	const stem = extensionIndex > 0 ? name.slice(0, extensionIndex) : name;
+	if (name === "mjolnir.config.json" || name === ".mjolnir.json" || name === "package.json" || name === "package-lock.json" || name === "pnpm-lock.yaml" || name === "yarn.lock" || [
+		"playwright",
+		"vitest",
+		"vite",
+		"eslint",
+		"tsconfig",
+		"jsconfig"
+	].some((prefix) => stem === prefix || stem.startsWith(`${prefix}.`))) return false;
+	const testLike = /(?:^|\/)__tests__\//i.test(normalized) || /\.(?:spec|test)\.[cm]?[jt]sx?$/i.test(name);
+	return /\.(?:[cm]?[jt]sx?|py|java|cs|ya?ml)$/i.test(name) && testLike;
+}
 /** Whether ANY shipped adapter would discover this path as a test file. */
 function isKnownTestFile(path) {
 	return SCAN_ADAPTERS.some((a) => a.isTestFile(path));
@@ -3764,17 +4239,14 @@ const SEARCHED_FOR = [
 * The fix: resolve git ONCE per process to an ABSOLUTE path by walking
 * the PATH directly (never consulting the CWD), verify the candidate is
 * an existing file, and pass that path to execFileSync. Resolution is
-* memoized; a failure to find a real git anywhere on PATH degrades to
-* the plain name (previous behavior) with the resolution error recorded
-* — degraded git data already means full-file attribution, never a
-* crash.
+* memoized; a failure to find a real git anywhere on PATH is recorded
+* and callers degrade without invoking a bare name.
 */
 let resolvedGit = void 0;
 /**
 * The absolute path of the git binary Mjölnir will invoke, or null when
-* PATH carries no executable `git` at all (S1 degradation: callers fall
-* back to the bare name and their own try/catch — same honest degrade
-* as before, minus the CWD-hijack surface).
+* PATH carries no executable `git` at all. Callers must degrade without
+* invoking a bare name.
 */
 function resolveGitPath() {
 	if (resolvedGit !== void 0) return resolvedGit;
@@ -3807,7 +4279,8 @@ function resolveGitPath() {
 * the previous inline `git()` helpers, with the hijack surface closed.
 */
 function runGit(root, args) {
-	const exe = resolveGitPath() ?? "git";
+	const exe = resolveGitPath();
+	if (!exe) return null;
 	try {
 		return execFileSync(exe, [
 			"-C",
@@ -3943,7 +4416,7 @@ function computeChangedScope(root, baseBranch) {
 				"--",
 				...chunk
 			]);
-			if (output === null) continue;
+			if (output === null) return null;
 			const sections = output.split("\ndiff --git ");
 			for (const section of sections) {
 				const body = section.startsWith("diff --git ") ? section : `diff --git ${section}`;
@@ -3971,6 +4444,11 @@ function computeChangedScope(root, baseBranch) {
 		"--unified=0",
 		"HEAD"
 	], changedFiles);
+	if (committedDiffs === null || workingDiffs === null) return {
+		changed: {},
+		degraded: true,
+		reason: "diff-failed"
+	};
 	for (const file of changedFiles) {
 		const committedDiff = committedDiffs.get(file);
 		const workingDiff = workingDiffs.get(file);
@@ -3996,8 +4474,11 @@ const LIMITS_MAX_LINES = 1e6;
 function allLinesOf(root, file) {
 	const full = join(root, file);
 	try {
-		if (statSync(full).size > LIMITS$1.maxFileBytes) return null;
-		const lineCount = readFileSync(full, "utf8").split("\n").length;
+		const stat = lstatSync(full);
+		if (stat.isSymbolicLink() || !stat.isFile()) return null;
+		const read = readFileBounded(full, LIMITS$1.maxFileBytes);
+		if (!read.ok) return null;
+		const lineCount = read.data.toString("utf8").split("\n").length;
 		return Array.from({ length: lineCount }, (_, i) => i + 1);
 	} catch {
 		return null;
@@ -7563,7 +8044,6 @@ const pyBareTruthinessAssert = defineRule({
 		const re = /^[ \t]*assert\s+([A-Za-z_][\w.]*(?:\([^()]*\))?)[ \t]*$/gm;
 		const predicateRe = /^(?:(?:any|all|isinstance)\s*\(|[\w.]*\.(?:startswith|endswith|exists|isdir|isfile|islink|ismount|check|isdigit|isalpha|isalnum|isnumeric|isdecimal|isspace|islower|isupper|istitle|isidentifier|isprintable|isascii)\s*\(|re\.(?:match|search|fullmatch)\s*\()/;
 		const isGuardFollowedByRealUse = (text, matchIndex, target) => {
-			const root = target.split(".")[0];
 			const lineEnd = text.indexOf("\n", matchIndex);
 			if (lineEnd === -1) return false;
 			const lines = text.slice(lineEnd + 1).split("\n");
@@ -7573,8 +8053,11 @@ const pyBareTruthinessAssert = defineRule({
 				if (/^\s*def\s/.test(l) && window.length > 0) break;
 				window.push(l);
 			}
-			const usesRoot = new RegExp(`\\b${root}\\b`);
-			return window.some((l) => usesRoot.test(l));
+			const root = target.match(/^[a-z_]\w*/i)?.[0];
+			if (!root) return false;
+			return window.some((line) => {
+				return (line.match(/[a-z_]\w*/gi) ?? []).some((token) => token === root);
+			});
 		};
 		let m;
 		while ((m = re.exec(text)) !== null) {
@@ -11577,6 +12060,22 @@ function normalizeOne(report, artifact, v) {
 function buildEvidenceRecords(report, artifact) {
 	return report.verdicts.map((v) => normalizeOne(report, artifact, v)).sort(compareEvidenceRecords);
 }
+function countEvidence(records) {
+	const counts = {
+		total: records.length,
+		failed: 0,
+		flaky: 0,
+		skipped: 0,
+		timedOut: 0
+	};
+	for (const r of records) {
+		if (r.status.failed) counts.failed++;
+		if (r.status.passedOnRetry) counts.flaky++;
+		if (r.status.skipped) counts.skipped++;
+		if (r.status.timedOut) counts.timedOut++;
+	}
+	return counts;
+}
 //#endregion
 //#region src/engine/provenance.ts
 const GENERATED_HEADER_RE = /^\s*(?:\/\/|#|\/\*)\s*(?:auto[- ]?generated|generated by|do not edit)/i;
@@ -11864,6 +12363,11 @@ var DependencyGraph = class {
 	get size() {
 		return this.nodes.size;
 	}
+	/** Whether the graph knows this exact key. Reachability must not
+	*  treat "not in the graph" as "nothing to traverse" without saying so. */
+	has(path) {
+		return this.nodes.has(path);
+	}
 };
 function parsePackageJson(filePath) {
 	if (!existsSync(filePath)) return void 0;
@@ -11951,20 +12455,40 @@ function parseManifest(filePath) {
 	if (filePath.endsWith("pom.xml")) return parsePomXml(filePath);
 }
 /**
-* Given a set of starting files (e.g. test files), return all files
-* transitively reachable through the dependency graph.
+* Given a set of starting files (e.g. test files), return the files
+* transitively reachable through the dependency graph, plus an honest
+* account of what could not be resolved.
+*
+* KNOWN LIMITATION (BW-022, still open): the graph is keyed by manifest path
+* and this query is given source paths, so today `unresolvedStarts` is
+* normally every input. The traversal itself is correct for a graph whose
+* keys are the paths being queried — which is what the unit tests build, and
+* which is why they passed while production did nothing. Fixing the seam
+* means giving a file a resolvable owning manifest and deciding impact's
+* direction (dependents, not dependencies), which is a design change, not a
+* patch. Until then this function reports that it resolved nothing instead
+* of implying otherwise.
 */
 function getReachableFiles(fromFiles, graph) {
 	const reachable = /* @__PURE__ */ new Set();
+	const unresolvedStarts = [];
 	const stack = [...fromFiles];
 	while (stack.length > 0) {
 		const current = stack.pop();
 		if (current === void 0) continue;
 		if (reachable.has(current)) continue;
-		reachable.add(current);
+		if (graph.has(current)) reachable.add(current);
+		else if (fromFiles.includes(current)) {
+			unresolvedStarts.push(current);
+			continue;
+		}
 		for (const dep of graph.getDependencies(current)) if (!reachable.has(dep)) stack.push(dep);
 	}
-	return [...reachable].sort();
+	return {
+		reachable: [...reachable].sort(),
+		unresolvedStarts: unresolvedStarts.sort(),
+		resolvedAny: unresolvedStarts.length < fromFiles.length
+	};
 }
 //#endregion
 //#region src/engine/incremental-analysis.ts
@@ -12004,607 +12528,934 @@ function isIncrementalSafe(changedFiles) {
 	};
 }
 //#endregion
-//#region src/engine/monorepo-analysis.ts
-const WORTHY_THRESHOLD = 80;
-const NEEDS_WORK_THRESHOLD = 50;
-function verdictOf(score) {
-	if (score === null) return "fail";
-	if (score >= WORTHY_THRESHOLD) return "pass";
-	if (score >= NEEDS_WORK_THRESHOLD) return "warn";
-	return "fail";
-}
-function hasBlocker(findings) {
-	return findings.some((f) => f.severity === "error");
-}
+//#region src/brand/tokens.ts
 /**
-* Aggregate per-package results into an overall verdict.
+* The single source of brand truth.
 *
-* Worst-package propagation: if ANY package has a blocker (error-severity
-* finding) or a failing score, the overall result fails regardless of
-* strategy. This is the safety net — a single poisoned package must not
-* hide behind averaging.
+* Every colour, typeface and motion constant Mjölnir shows a human —
+* terminal, README SVGs, demo video, website, docs, badges — resolves to
+* a value in this file. Nothing else may define one.
+*
+* WHY THIS EXISTS. Before it, the palette existed in six independent
+* copies: `site/.vitepress/theme/styles/vars.css`, `NORSE` in
+* `src/reporter/theme.ts`, `scripts/readme-svg.ts`,
+* `scripts/video/terminal-page.ts`, `scripts/generate-readme-architecture.ts`
+* and the table in `assets/brand/README.md`. Exactly one pair of those
+* was guarded (site-doctor Check 8, doc ↔ vars.css). The unguarded edges
+* are where the shipped surfaces drifted apart: the terminal and the site
+* disagreed on six semantic roles, the architecture diagram invented its
+* own neutral ramp, and the README badges still carried a palette retired
+* two releases earlier. `scripts/brand-doctor.mjs` now checks every edge
+* against this file.
+*
+* PURITY. Pure data. No I/O, no rendering, no environment access, no
+* imports, no logic. Consumers convert (hex → ANSI triplet, hex → CSS)
+* themselves. Same reason `presentation.ts` is pure: it makes the whole
+* thing golden-testable and safe to ship inside the npm package, where
+* it costs a few hundred bytes and replaces values the package already
+* carried anyway.
+*
+* DERIVATION. The palette is the one derived from the logo in PR #20
+* (brushed steel and forge gold under an aurora, over midnight iron).
+* Where the terminal disagreed with it, the terminal converges — see
+* `PENDING_TERMINAL` below. Full rationale: `assets/brand/README.md`.
+*
+* ACCESSIBILITY. Every foreground token in `BRAND` meets WCAG AA
+* (≥ 4.5:1) against every surface token it is allowed to sit on. That is
+* not a claim, it is `brand-doctor` rule 8, which computes the ratios.
+* The weakest legal pairing is `steelDim` on `ink800` at 5.00:1.
 */
-function analyzeMonorepo(packages, config) {
-	const results = packages.map((p) => ({
-		...p,
-		verdict: hasBlocker(p.findings) ? "fail" : verdictOf(p.score)
-	}));
-	if (results.length === 0) return {
-		packages: results,
-		overallScore: null,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy
-	};
-	const blockerPkg = results.find((r) => r.verdict === "fail" || hasBlocker(r.findings));
-	if (blockerPkg) return {
-		packages: results,
-		overallScore: blockerPkg.score,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy,
-		blockerPackage: blockerPkg.packageName
-	};
-	switch (config.weightingStrategy) {
-		case "worst-package": return worstPackageAggregation(results, config);
-		case "average": return averageAggregation(results, config);
-		case "configurable": return configurableAggregation(results, config);
-	}
-}
-function worstPackageAggregation(results, config) {
-	const firstResult = results[0];
-	if (firstResult === void 0) return {
-		packages: results,
-		overallScore: null,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy
-	};
-	let worst = firstResult;
-	for (const r of results) if ((r.score ?? 0) < (worst.score ?? 0)) worst = r;
-	return {
-		packages: results,
-		overallScore: worst.score,
-		overallVerdict: worst.verdict,
-		strategy: config.weightingStrategy,
-		...worst.verdict === "fail" ? { blockerPackage: worst.packageName } : {}
-	};
-}
-function averageAggregation(results, config) {
-	const scored = results.filter((r) => r.score !== null);
-	if (scored.length === 0) return {
-		packages: results,
-		overallScore: null,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy
-	};
-	const avg = scored.reduce((sum, r) => sum + (r.score ?? 0), 0) / scored.length;
-	return {
-		packages: results,
-		overallScore: Math.round(avg),
-		overallVerdict: verdictOf(Math.round(avg)),
-		strategy: config.weightingStrategy
-	};
-}
-function configurableAggregation(results, config) {
-	const weights = config.packageWeights ?? {};
-	let totalWeight = 0;
-	let weightedSum = 0;
-	for (const r of results) {
-		const w = weights[r.packageName] ?? 1;
-		totalWeight += w;
-		weightedSum += (r.score ?? 0) * w;
+/**
+* The two brand hues plus the neutral they sit on.
+*
+* GOLD IS SCARCE. It means forged / certified / earned / decisive — the
+* primary mark, the FORGED state, one call to action. It is not a paint
+* bucket: gold as default text, default border or default heading is a
+* brand-doctor finding, not a style choice.
+*
+* AURORA is verification energy — the secondary, and the hue that marks
+* the runtime half of the trust ladder.
+*/
+const BRAND = {
+	gold: "#C19A34",
+	goldBright: "#E6BD57",
+	goldHot: "#F4DC9C",
+	/** Pressed / deepest gold — the only step dark enough to carry white. */
+	goldDeep: "#A5811C",
+	aurora: "#37ABBD",
+	auroraBright: "#45C1D4",
+	auroraCyan: "#5CBDE0",
+	/** The aurora's outer curtains: atmosphere and section identity only,
+	* never a verdict or a status. */
+	auroraGreen: "#5FD6A4",
+	auroraViolet: "#9D8CF5",
+	steel: "#C8CBCF",
+	steelDim: "#8B939D"
+};
+/**
+* Midnight iron. One ramp, four steps, darkest first.
+*
+* `terminal` and `terminalBar` share one tone deliberately: the window's
+* only seam is a hairline ring and an inset shadow, never a second fill.
+* `chromeDot` is the three window dots — see the note on
+* `PENDING_TERMINAL.chromeDots` for why they are no longer red/amber/green.
+*/
+const SURFACE = {
+	ink950: "#0A1119",
+	ink900: "#0C1420",
+	ink850: "#111A29",
+	ink800: "#18243A",
+	/** Raised panel (cards, elevated surfaces). */
+	panel: "#141F33",
+	/** Soft fill (inline code, quiet chips). */
+	soft: "#1A2740",
+	/** Terminal body — the deepest tone, so a terminal reads as recessed. */
+	terminal: "#0A1119",
+	/** Terminal title bar — the same tone; the seam is shadow, not colour. */
+	terminalBar: "#0A1119",
+	/** The three window dots. One neutral, not a traffic light. */
+	chromeDot: "#18243A"
+};
+const TEXT = {
+	primary: "#EAEEF5",
+	secondary: "#ABB6C6",
+	muted: "#8B939D",
+	/** Ink for text set ON gold (buttons, the FORGED chip). 7.17:1 on `gold`. */
+	onGold: "#0A1119"
+};
+/**
+* Non-score status. `ok` is the one green in the system and it is NOT a
+* score colour — it survives only for contexts with no worthiness
+* meaning ("autofix applied", "analysis complete"). A green score would
+* say "your software is fine", which is the exact claim this product
+* refuses to make.
+*/
+const STATUS = {
+	ok: "#4FB477",
+	info: "#5CC4E0",
+	warning: "#E6BD57",
+	error: "#EC6B66"
+};
+/**
+* The four ScoreState bands plus the unmeasured state. Band thresholds
+* and runes live in `src/reporter/presentation.ts`, which stays free of
+* colour — it emits a palette KEY and each surface resolves it here.
+*
+* `unmeasured` is steel-dim on purpose. UNKNOWN is a legitimate answer,
+* not a failure: colouring it red would make "we did not measure this"
+* look like "this is broken", which is precisely the dishonesty the
+* north-star law exists to prevent.
+*/
+const SCORE = {
+	critical: "#EC6B66",
+	warning: "#E6BD57",
+	trusted: "#5CC4E0",
+	forged: "#F4DC9C",
+	unmeasured: "#8B939D"
+};
+/**
+* E0 → E1 → E2 is a certainty ramp, and it is deliberately HUE-FREE.
+*
+* Evidence level says how sure we are, not whether the news is good. A
+* deterministic proof (E2) is a defect we are certain about — painting
+* it gold or green would read as an achievement. So certainty is carried
+* by brightness alone, and the *shape* does the real work:
+*
+*     E0  open ring        observation, no weight
+*     E1  half-filled      pattern evidence, half weight
+*     E2  sealed           deterministic proof, full weight
+*
+* Colour never carries this alone (R11): the geometry is the signal and
+* survives `--ascii`, `NO_COLOR` and monochrome print.
+*/
+const EVIDENCE = {
+	e0: "#8B939D",
+	e1: "#ABB6C6",
+	e2: "#EAEEF5"
+};
+/**
+* L0–L5, and the most important boundary in the product.
+*
+* L0–L2 are STATIC: the neutral steel ramp, brightening to the static
+* ceiling at L2. L3–L5 require a real run, and the hue changes to aurora
+* exactly there. The boundary is a hue break, not a gradient step,
+* because it is a change of kind and not of degree — a static-only
+* finding can never climb past L2, however confident it is.
+*
+* Every surface that draws the ladder must draw that break.
+*/
+const TRUST = {
+	l0: "#8B939D",
+	l1: "#ABB6C6",
+	l2: "#C8CBCF",
+	l3: "#37ABBD",
+	l4: "#45C1D4",
+	l5: "#5CC4E0"
+};
+const TINT = {
+	gold: {
+		fill: "#F6EBCC",
+		stroke: "#7A5F16",
+		text: "#4A3A0E"
+	},
+	aurora: {
+		fill: "#D9F0F4",
+		stroke: "#1F6F7C",
+		text: "#10353C"
+	},
+	error: {
+		fill: "#FADEDD",
+		stroke: "#A83A35",
+		text: "#4E1B19"
+	},
+	/** The unmeasured / unknown state. Neutral, never the error tint. */
+	neutral: {
+		fill: "#E4E7EB",
+		stroke: "#5C646E",
+		text: "#262B31"
+	},
+	ok: {
+		fill: "#DCF0E4",
+		stroke: "#276B45",
+		text: "#163A26"
 	}
-	if (totalWeight === 0) return {
-		packages: results,
-		overallScore: null,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy
-	};
-	const score = Math.round(weightedSum / totalWeight);
-	return {
-		packages: results,
-		overallScore: score,
-		overallVerdict: verdictOf(score),
-		strategy: config.weightingStrategy
-	};
-}
+};
+/**
+* The score bands as the badge Mjölnir itself generates renders them.
+*
+* These are DEEPER than the score tokens on purpose, and it is not a
+* style preference: shields.io sets the message text in white and gives
+* you no say in it. `score.forged` (#F4DC9C) under white text measures
+* 1.35:1 — an unreadable badge, shipped to look on-brand. The brand's
+* own deep steps put every band between 4.9 and 6.3:1.
+*
+* What they replace was worse than off-brand, it was wrong:
+*
+*   band        was              rendered as        white-on   now       white-on
+*   ────────────────────────────────────────────────────────────────────────────
+*   0-49        `red`            #dd4343            4.24       #A83A35   6.32
+*   50-79       `yellow`         #d8b800            1.95       #7A5F16   6.04
+*   80-99       `important`      #ea7233  ORANGE    3.02       #1F6F7C   5.80
+*   100         `success`        #44bb00  GREEN     2.51       #8A6D1E   4.90
+*   unmeasured  `lightgrey`      #939393            3.07       #5C646E   5.99
+*
+* Two of those were defects, not preferences. `success` is green, and
+* green is not a score colour here — a 100 badge said "your software is
+* fine", which is the one claim this product refuses to make. And
+* `important` is ORANGE, not the blue-family colour the code's own
+* comment claimed for eight releases: every WORTHY badge ever rendered
+* showed the trusted band in a warning colour. Nobody had resolved a
+* shields name to a value and looked.
+*
+* Values are hex without `#`, the form shields.io's endpoint takes.
+* `A83A35`, `7A5F16`, `1F6F7C` and `5C646E` are the `TINT` strokes —
+* the same deep steps the mermaid diagrams use, for the same reason.
+* `8A6D1E` is the gold the brand document already named as the light
+* FORGED gradient's start.
+*/
+const BADGE_BAND = {
+	critical: "A83A35",
+	warning: "7A5F16",
+	trusted: "1F6F7C",
+	forged: "8A6D1E",
+	unmeasured: "5C646E"
+};
+SURFACE.ink950, SURFACE.ink900, SURFACE.ink850, SURFACE.ink800, BRAND.steel, BRAND.steelDim, BRAND.gold, BRAND.goldBright, BRAND.goldHot, BRAND.aurora, BRAND.auroraBright, BRAND.auroraCyan, BRAND.auroraGreen, BRAND.auroraViolet;
+SCORE.trusted, SCORE.forged, SCORE.warning, SCORE.critical, STATUS.info, TEXT.onGold, STATUS.ok, EVIDENCE.e0, EVIDENCE.e1, EVIDENCE.e2, TRUST.l0, TRUST.l1, TRUST.l2, TRUST.l3, TRUST.l4, TRUST.l5;
+EVIDENCE.e0, EVIDENCE.e1, EVIDENCE.e2;
+const RUNG_MEANINGS = [
+	"observation only",
+	"heuristic static",
+	"deterministic static",
+	"the finding's file executed",
+	"the finding's test executed",
+	"the run verdict corroborates"
+];
+const RUNG_COLORS = [
+	TRUST.l0,
+	TRUST.l1,
+	TRUST.l2,
+	TRUST.l3,
+	TRUST.l4,
+	TRUST.l5
+];
+const TRUST_RUNGS = RUNG_MEANINGS.map((meaning, i) => ({
+	level: `L${i}`,
+	meaning,
+	runtime: i >= 3,
+	color: RUNG_COLORS[i]
+}));
 //#endregion
-//#region src/engine/scan-cache.ts
+//#region src/reporter/presentation.ts
 /**
-* Local incremental scan cache (Beta-to-Stable 1.0 plan, M5.2 / A-2).
+* presentation.ts — the one place a presentation DECISION is made.
 *
-* Content-addressed, local-only verdict cache: `--cache` reuses the
-* per-file rule outputs of a previous scan when the file's bytes AND the
-* active rule set are unchanged, and invalidates everything else. The
-* key is `sha256(fileText) + rulesDigest` + the file's own identity
-* (repo-relative path + adapter id + parse mode — audit C1/W9), where
-* the rules digest folds
-* in every active rule's id + `detectorRevision ?? 1` (the existing
-* stale-measurement machinery — Verification Trust Evolution Plan §07 —
-* reused as the cache invalidation signal, per A-2) plus a source hash
-* of each external plugin/local rule's `run` function, so a plugin that
-* changes code without bumping its revision still misses.
+* BITTERSWEET `BW-030a`. Before this module the same decision was written
+* down four different times and every surface drifted:
 *
-* Privacy posture: the cache lives under `<repo>/.mjolnir/cache/`, is
-* gitignored, never leaves the machine, and this module performs zero
-* network I/O — fs and crypto only (asserted by the privacy spec).
+*   - score bands: `score-state.ts` (50/80), `dashboard.ts` (50/60),
+*     `handover.ts` (50/90), `mermaid.ts` (50/80), `monorepo-analysis.ts`
+*     (50/80);
+*   - the evidence descriptor: `terminal.ts` returned the full
+*     `[E2 · deterministic · measured FP 8% · n=14 · trust L3]` while
+*     `evidence-tag.ts` — which called itself the "single definition
+*     site" — returned four bare words and defaulted a missing level to
+*     `E2`, the STRONGEST one;
+*   - the score bar: `theme.ts:scoreGauge` plus four private reimplementations.
 *
-* Only raw rule-loop outputs are cached. Everything after the loop
-* (severity overrides, suppressions, overlap dedup, evidence stamping,
-* tier policy, runtime corroboration, scoring) re-runs on every scan,
-* so a cached scan is byte-equivalent to a fresh one by construction.
+* THE ONE RULE OF THIS MODULE: it owns decisions, never data and never
+* I/O. It reads a `Finding` / a score number / a `Palette` and returns
+* the word, band, threshold or descriptor to print. It opens no file,
+* touches no clock, spawns no process and formats no HTML document. If a
+* second responsibility appears here, split it in the same change.
+*
+* Pure: the same input always yields the same output, so every decision
+* is golden-testable and two runs of the same scan cannot disagree.
+*
+* Layout note — the threshold LITERALS stay physically here rather than in
+* a registry object so that `site/scripts/gen-report.mjs`, which parses
+* `score >= N` branches out of this file to build the site's band ruler,
+* keeps parsing one canonical file. `SCORE_THRESHOLDS` is derived from
+* those literals; it is the nameable form, not a second copy of them.
 */
-const CACHE_VERSION = 2;
-/** Entry cap: a monorepo-scale suite stays far below this; bounded file. */
-const MAX_ENTRIES$1 = 4096;
 /**
-* Audit M5: total byte budget. The old cap counted only ENTRIES, so
-* 4096 files × ~100KB of findings each could still produce a
-* multi-hundred-MB writeFileSync on persist. The budget bounds the
-* serialized size; the newest entries win (real LRU-by-use).
+* What a surface prints when a number was never measured.
+*
+* The bug this replaces: `testDeclarationCount ?? 0` rendered
+* "0 tests analyzed in 0 files" for a producer that simply did not
+* measure. A zero is a CLAIM — it says the count was taken and found
+* nothing. Absent means nobody looked. `dashboard.ts` already modelled
+* this correctly for frameworks (`frameworkCount: null` → "unknown");
+* its sibling `trust-report.ts` did not, so the same repo produced two
+* artifacts that disagreed about whether a measurement existed.
 */
-const MAX_TOTAL_BYTES = 33554432;
-/** sha256 hex of a string — the only hash this module needs. */
-function sha256(text) {
-	return createHash("sha256").update(text).digest("hex");
+const UNMEASURED = "unknown — not measured";
+/**
+* Render a count for a human surface: the number when it was measured,
+* `unknown — not measured` when it was not. Never `0` for an absent
+* measurement.
+*/
+function countOrUnknown(value, unit) {
+	if (value === void 0) return UNMEASURED;
+	return unit === void 0 ? String(value) : `${value} ${unit}`;
 }
 /**
-* Digest of the active rule set: id + effective detectorRevision for
-* every rule (sorted for determinism), plus a content hash of all rule
-* source files. The directory-tree hash catches changes to ANY file
-* under src/rules/ — same-file helpers, cross-module imports, shared
-* utilities — without needing to trace the import graph. This is the
-* only reliable way to detect helper function changes in a bundled
-* ESM codebase where String(fn) doesn't reveal transitive dependencies.
+* The machine-surface counterpart: an unmeasured count is `null`, which
+* JSON has a word for, rather than `0`, which does not. Used by the
+* trust-report JSON artifact; the scan machine contract
+* (`engine/machine-contract.ts`) is drift-locked and untouched.
 */
-function computeRulesDigest(rules) {
-	const parts = rules.map((r) => `${r.id}:${r.detectorRevision ?? 1}`).sort();
-	const rulesDirHash = hashRulesSourceTree(rules);
-	return sha256(parts.join("|") + "\0" + rulesDirHash);
+function countOrNull(value) {
+	return value ?? null;
 }
 /**
-* Hash all .ts files under src/rules/ (when the first rule's modulePath
-* reveals the project root). Falls back to per-rule function source
-* hashing when the directory cannot be resolved.
+* The "Tests analyzed" cell, shared by every human surface that shows it.
+*
+* Three renderers had this line written out separately, identically, and
+* all three rendered `testDeclarationCount ?? 0` — "0 tests analyzed in 0
+* files" — for a producer that never measured a declaration at all. Two
+* of them are the *sibling* artifacts for the same scan (the PR comment
+* and the trust report), so the same run told a reviewer both "0 tests
+* analyzed" and "no tests found".
+*
+* Declared-but-file-count-absent (and the reverse) are reported honestly
+* rather than filled in from each other.
 */
-function hashRulesSourceTree(rules) {
-	const firstPath = rules.find((r) => r.modulePath)?.modulePath;
-	if (!firstPath) return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
-	const idx = firstPath.replace(/\\/g, "/").indexOf("/src/rules/");
-	if (idx < 0) return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
-	const rulesDir = firstPath.replace(/\\/g, "/").slice(0, idx + 11);
-	try {
-		const hash = createHash("sha256");
-		hashDir(rulesDir, hash, 0);
-		return hash.digest("hex").slice(0, 16);
-	} catch {
-		return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
-	}
+function testsAnalyzedCell(declarations, files) {
+	if (declarations === void 0 && files === void 0) return UNMEASURED;
+	const declText = countOrUnknown(declarations);
+	if (files === void 0) return `${declText} in unknown files`;
+	return `${declText} in ${files} ${files === 1 ? "file" : "files"}`;
 }
-function hashDir(dir, hash, depth) {
-	if (depth > 8) return;
-	let entries;
-	try {
-		entries = readdirSync(dir, { withFileTypes: true });
-	} catch {
-		return;
-	}
-	entries.sort((a, b) => a.name.localeCompare(b.name));
-	for (const entry of entries) {
-		if (entry.name === "node_modules" || entry.name === ".git") continue;
-		const full = join(dir, entry.name);
-		if (entry.isDirectory()) hashDir(full, hash, depth + 1);
-		else if (entry.isFile() && /\.tsx?$/.test(entry.name)) try {
-			hash.update(entry.name);
-			hash.update(readFileSync(full));
-		} catch {}
-	}
+const HEADLINES = {
+	critical: "The hammer is cracked — {n} findings break its edge.",
+	warning: "The hammer holds — but {n} findings weigh it down.",
+	trusted: "Held in worthy hands — {n} findings remain.",
+	forged: "Static score 100 — no findings on the analyzed surface.",
+	unmeasured: "No tests found — the hammer cannot be weighed."
+};
+const RUNES = {
+	critical: "ᚲ",
+	warning: "ᚦ",
+	trusted: "ᛏ",
+	forged: "ᛟ",
+	unmeasured: "ᛁ"
+};
+/**
+* The named form of the band boundaries. `report:honesty` /
+* `thresholds:parity` assert that no surface outside this module
+* re-invents a boundary; a consumer that genuinely needs one names it
+* here rather than typing the number.
+*/
+const SCORE_THRESHOLDS = {
+	/** Below this is `critical`. */
+	criticalBelow: 50,
+	/** At or above this is `trusted`. */
+	trustedAtOrAbove: 80,
+	/** The one score that is `forged`. */
+	forgedAt: 100
+};
+/**
+* Band mapping — the one mapping, every consumer: <50 critical,
+* 50–79 warning, 80–99 trusted, 100 forged, null unmeasured.
+*/
+function deriveScoreState(score) {
+	if (score === null) return {
+		score: null,
+		band: "unmeasured",
+		verdict: "UNWORTHY",
+		color: "dim",
+		powerLevel: 0,
+		headline: HEADLINES.unmeasured,
+		rune: RUNES.unmeasured
+	};
+	if (score >= SCORE_THRESHOLDS.forgedAt) return {
+		score,
+		band: "forged",
+		verdict: "FORGED",
+		color: "forged",
+		powerLevel: score,
+		headline: HEADLINES.forged,
+		rune: RUNES.forged
+	};
+	if (score >= 80) return {
+		score,
+		band: "trusted",
+		verdict: "WORTHY",
+		color: "trusted",
+		powerLevel: score,
+		headline: HEADLINES.trusted,
+		rune: RUNES.trusted
+	};
+	if (score >= 50) return {
+		score,
+		band: "warning",
+		verdict: "NEEDS WORK",
+		color: "warning",
+		powerLevel: score,
+		headline: HEADLINES.warning,
+		rune: RUNES.warning
+	};
+	return {
+		score,
+		band: "critical",
+		verdict: "UNWORTHY",
+		color: "error",
+		powerLevel: score,
+		headline: HEADLINES.critical,
+		rune: RUNES.critical
+	};
+}
+/** Substitute a findings count into a headline template. Pure text
+* helper so every surface formats identically. */
+function headlineFor(state, findings) {
+	return state.headline.replace("{n}", String(findings));
 }
 /**
-* Content-addressed key for one file's rule-loop verdicts.
+* Contract-stable three-band verdict (property-locked in
+* tests/scoring-precision.spec.ts). Delegates to the ScoreState model —
+* 100 keeps returning WORTHY here; the FORGED premium treatment lives
+* in the dedicated block, not in this public mapping.
 *
-* Audit C1: the key MUST identify the verdict's producer, not just the
-* bytes — two files with byte-identical text (a copied spec, a generated
-* snapshot) previously shared one entry, and the first file's cached
-* findings were re-emitted for the second with the wrong `file` stamp.
-* The key therefore folds in the repo-relative path AND the adapter id,
-* plus a parse-mode token (audit W9): a file whose analysis degraded to
-* the regex fallback (or skipped the AST path) must not collide with a
-* fully-AST-analyzed verdict for the same bytes — the fallback output
-* belongs only to the fallback mode.
+* The `FORGED → WORTHY` collapse is a DOCUMENTED PROJECTION that
+* preserves the three-band public contract, not a divergence to be
+* "fixed": a consumer reading the verdict word must not be able to tell
+* a 100 from a 99, because the 100 carries no runtime evidence and the
+* score alone never earned it.
 */
-function fileCacheKey(rulesDigest, fileText, identity) {
-	const parseMode = identity.parseMode ?? "ast";
-	return sha256(`${CACHE_VERSION}\u0000${rulesDigest}\u0000${identity.relPath}\u0000${identity.adapterId}\u0000${parseMode}\u0000${fileText}`);
+function verdictFor(score) {
+	const verdict = deriveScoreState(score).verdict;
+	return verdict === "FORGED" ? "WORTHY" : verdict;
 }
-/** No-op cache used when --cache is absent: zero stats, zero I/O. */
-const disabledScanCache = {
-	stats: {
-		hits: 0,
-		misses: 0,
-		file: ""
-	},
-	lookup: () => void 0,
-	store: () => {},
-	persist: () => {}
+const EVIDENCE_KIND = {
+	E0: "observation",
+	E1: "heuristic",
+	E2: "deterministic"
 };
 /**
-* Opens (and lazily creates) `<root>/.mjolnir/cache/scan-v<CACHE_VERSION>.json`. A
-* corrupt, hostile or future-versioned cache file degrades to a cold
-* cache — never fails the scan.
+* The effective evidence level of a finding.
+*
+* The `?? deriveEvidenceLevel(...)` fallback IS the fix for BW-101. The
+* deleted `evidence-tag.ts` defaulted a missing level to `E2` — the
+* strongest claim the product can make — which is the exact inverse of
+* its own principle: absent evidence is not proof, so it is derived
+* conservatively from the finding's own type and confidence.
 */
-function createScanCache(root) {
-	const dir = join(root, ".mjolnir", "cache");
-	const file = join(dir, `scan-v${CACHE_VERSION}.json`);
-	let entries = {};
-	let dirty = false;
-	const entryBytes = /* @__PURE__ */ new Map();
-	let totalBytes = 0;
-	try {
-		if (existsSync(file)) {
-			entries = parseJsonFile(readFileSync(file, "utf8"), file, (v) => isRecord(v) && v["version"] === CACHE_VERSION && isRecord(v["entries"])).entries;
-			for (const [k, v] of Object.entries(entries)) {
-				const size = JSON.stringify(v).length + k.length + 4;
-				entryBytes.set(k, size);
-				totalBytes += size;
-			}
-		}
-	} catch {
-		entries = {};
-		entryBytes.clear();
-		totalBytes = 0;
-	}
-	return {
-		stats: {
-			hits: 0,
-			misses: 0,
-			file
-		},
-		lookup(key) {
-			const entry = entries[key];
-			if (!entry) {
-				this.stats.misses++;
-				return;
-			}
-			this.stats.hits++;
-			delete entries[key];
-			entries[key] = entry;
-			return structuredClone(entry.findings);
-		},
-		store(key, findings, fileBudgetExceeded) {
-			if (fileBudgetExceeded) return;
-			const replacedBytes = entryBytes.get(key) ?? 0;
-			delete entries[key];
-			const entryJson = JSON.stringify(findings);
-			entries[key] = { findings: structuredClone(findings) };
-			const newBytes = entryJson.length + key.length + 4;
-			entryBytes.set(key, newBytes);
-			totalBytes = totalBytes - replacedBytes + newBytes;
-			let count = Object.keys(entries).length;
-			while ((count > MAX_ENTRIES$1 || totalBytes > MAX_TOTAL_BYTES) && count > 1) {
-				const oldest = Object.keys(entries)[0];
-				totalBytes -= entryBytes.get(oldest);
-				delete entries[oldest];
-				entryBytes.delete(oldest);
-				count--;
-			}
-			dirty = true;
-		},
-		persist() {
-			if (!dirty) return;
-			try {
-				mkdirSync(dir, { recursive: true });
-				writeFileSync(file, JSON.stringify({
-					version: CACHE_VERSION,
-					entries
-				}), "utf8");
-			} catch {}
-		}
-	};
+function evidenceLevelOf(f) {
+	return f.evidenceLevel ?? deriveEvidenceLevel(f.findingType, f.confidence);
+}
+/** What the runtime report actually vouched for, in the product's words. */
+function runtimeLabel(f) {
+	const c = f.runtimeCorroboration;
+	if (c === void 0) return null;
+	if (c.level === "defect") return "defect corroborated";
+	if (c.level === "test") return "test executed";
+	return "file executed";
 }
-//#endregion
-//#region src/brand/tokens.ts
 /**
-* The single source of brand truth.
-*
-* Every colour, typeface and motion constant Mjölnir shows a human —
-* terminal, README SVGs, demo video, website, docs, badges — resolves to
-* a value in this file. Nothing else may define one.
-*
-* WHY THIS EXISTS. Before it, the palette existed in six independent
-* copies: `site/.vitepress/theme/styles/vars.css`, `NORSE` in
-* `src/reporter/theme.ts`, `scripts/readme-svg.ts`,
-* `scripts/video/terminal-page.ts`, `scripts/generate-readme-architecture.ts`
-* and the table in `assets/brand/README.md`. Exactly one pair of those
-* was guarded (site-doctor Check 8, doc ↔ vars.css). The unguarded edges
-* are where the shipped surfaces drifted apart: the terminal and the site
-* disagreed on six semantic roles, the architecture diagram invented its
-* own neutral ramp, and the README badges still carried a palette retired
-* two releases earlier. `scripts/brand-doctor.mjs` now checks every edge
-* against this file.
-*
-* PURITY. Pure data. No I/O, no rendering, no environment access, no
-* imports, no logic. Consumers convert (hex → ANSI triplet, hex → CSS)
-* themselves. Same reason `score-state.ts` is pure: it makes the whole
-* thing golden-testable and safe to ship inside the npm package, where
-* it costs a few hundred bytes and replaces values the package already
-* carried anyway.
+* The canonical evidence descriptor — `[E2 · deterministic · measured FP
+* 8% · n=14 · trust L3 · runtime: file executed]`.
 *
-* DERIVATION. The palette is the one derived from the logo in PR #20
-* (brushed steel and forge gold under an aurora, over midnight iron).
-* Where the terminal disagreed with it, the terminal converges — see
-* `PENDING_TERMINAL` below. Full rationale: `assets/brand/README.md`.
+* This is the version `terminal.ts` already shipped, promoted to the one
+* definition site. The HTML and markdown surfaces now gain the measured
+* false-positive rate, the sample size, the trust rung and what runtime
+* corroborated — they used to show four bare words that a reader could
+* mistake for the whole evidence story.
 *
-* ACCESSIBILITY. Every foreground token in `BRAND` meets WCAG AA
-* (≥ 4.5:1) against every surface token it is allowed to sit on. That is
-* not a claim, it is `brand-doctor` rule 8, which computes the ratios.
-* The weakest legal pairing is `steelDim` on `ink800` at 5.00:1.
+* Every clause is conditional on the finding actually carrying that
+* evidence. Nothing here is ever defaulted into existence.
 */
+function evidenceTag(f) {
+	const level = evidenceLevelOf(f);
+	let tag = `${level} · ${EVIDENCE_KIND[level]}`;
+	if (f.measuredFpRate !== void 0) {
+		tag += ` · measured FP ${Math.round(f.measuredFpRate * 100)}%`;
+		if (f.measuredFpN !== void 0) tag += ` · n=${f.measuredFpN}`;
+	}
+	if (f.trustLevel !== void 0) tag += ` · trust ${f.trustLevel}`;
+	const runtime = runtimeLabel(f);
+	if (runtime !== null) tag += ` · runtime: ${runtime}`;
+	return `[${tag}]`;
+}
+//#endregion
+//#region src/engine/monorepo-analysis.ts
 /**
-* The two brand hues plus the neutral they sit on.
-*
-* GOLD IS SCARCE. It means forged / certified / earned / decisive — the
-* primary mark, the FORGED state, one call to action. It is not a paint
-* bucket: gold as default text, default border or default heading is a
-* brand-doctor finding, not a style choice.
+* Package verdict, derived from the one ScoreState band model (BW-104).
+* These two constants used to be a private copy of the band boundaries;
+* the numeric vocabulary here is a different projection of the same bands
+* — "pass" is trusted or forged, "warn" is warning, "fail" is critical or
+* unmeasurable — so the boundaries are read, never retyped.
+*/
+function verdictOf(score) {
+	if (score === null) return "fail";
+	const band = deriveScoreState(score).band;
+	if (band === "forged" || band === "trusted") return "pass";
+	return band === "warning" ? "warn" : "fail";
+}
+function hasBlocker(findings) {
+	return findings.some((f) => f.severity === "error");
+}
+/**
+* Aggregate per-package results into an overall verdict.
 *
-* AURORA is verification energy — the secondary, and the hue that marks
-* the runtime half of the trust ladder.
+* Worst-package propagation: if ANY package has a blocker (error-severity
+* finding) or a failing score, the overall result fails regardless of
+* strategy. This is the safety net — a single poisoned package must not
+* hide behind averaging.
 */
-const BRAND = {
-	gold: "#C19A34",
-	goldBright: "#E6BD57",
-	goldHot: "#F4DC9C",
-	/** Pressed / deepest gold — the only step dark enough to carry white. */
-	goldDeep: "#A5811C",
-	aurora: "#37ABBD",
-	auroraBright: "#45C1D4",
-	auroraCyan: "#5CBDE0",
-	/** The aurora's outer curtains: atmosphere and section identity only,
-	* never a verdict or a status. */
-	auroraGreen: "#5FD6A4",
-	auroraViolet: "#9D8CF5",
-	steel: "#C8CBCF",
-	steelDim: "#8B939D"
-};
+function analyzeMonorepo(packages, config) {
+	const results = packages.map((p) => ({
+		...p,
+		verdict: hasBlocker(p.findings) ? "fail" : verdictOf(p.score)
+	}));
+	if (results.length === 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	const blockerPkg = results.find((r) => r.verdict === "fail" || hasBlocker(r.findings));
+	if (blockerPkg) return {
+		packages: results,
+		overallScore: blockerPkg.score,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy,
+		blockerPackage: blockerPkg.packageName
+	};
+	switch (config.weightingStrategy) {
+		case "worst-package": return worstPackageAggregation(results, config);
+		case "average": return averageAggregation(results, config);
+		case "configurable": return configurableAggregation(results, config);
+	}
+}
+function worstPackageAggregation(results, config) {
+	const firstResult = results[0];
+	if (firstResult === void 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	let worst = firstResult;
+	for (const r of results) if ((r.score ?? 0) < (worst.score ?? 0)) worst = r;
+	return {
+		packages: results,
+		overallScore: worst.score,
+		overallVerdict: worst.verdict,
+		strategy: config.weightingStrategy,
+		...worst.verdict === "fail" ? { blockerPackage: worst.packageName } : {}
+	};
+}
+function averageAggregation(results, config) {
+	const scored = results.filter((r) => r.score !== null);
+	if (scored.length === 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	const avg = scored.reduce((sum, r) => sum + (r.score ?? 0), 0) / scored.length;
+	return {
+		packages: results,
+		overallScore: Math.round(avg),
+		overallVerdict: verdictOf(Math.round(avg)),
+		strategy: config.weightingStrategy
+	};
+}
+function configurableAggregation(results, config) {
+	const weights = config.packageWeights ?? {};
+	let totalWeight = 0;
+	let weightedSum = 0;
+	for (const r of results) {
+		const w = weights[r.packageName] ?? 1;
+		totalWeight += w;
+		weightedSum += (r.score ?? 0) * w;
+	}
+	if (totalWeight === 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	const score = Math.round(weightedSum / totalWeight);
+	return {
+		packages: results,
+		overallScore: score,
+		overallVerdict: verdictOf(score),
+		strategy: config.weightingStrategy
+	};
+}
+//#endregion
+//#region src/lib/fs-atomic.ts
 /**
-* Midnight iron. One ramp, four steps, darkest first.
+* Atomic file writes (audit S9).
 *
-* `terminal` and `terminalBar` share one tone deliberately: the window's
-* only seam is a hairline ring and an inset shadow, never a second fill.
-* `chromeDot` is the three window dots — see the note on
-* `PENDING_TERMINAL.chromeDots` for why they are no longer red/amber/green.
+* Every durability-critical write in Mjölnir (baseline, stats, badge,
+* TRIAGE.md, scaffolded rule files) used to hand-roll
+* `writeFileSync(path, data)` — a crash mid-write left a TRUNCATED file
+* at the real path, and a subsequent read (diff, badge endpoint) served
+* confident nonsense from it.
+*
+* `writeFileAtomic` writes to a temp sibling, then RENAMES. On the same
+* volume rename is atomic: readers see either the complete old file or
+* the complete new file, never a half-written one. The temp name is
+* created with `wx` (exclusive) so concurrent writers cannot interleave,
+* stale temps are cleaned up on failure, and on Windows the rename is
+* retried briefly because a concurrent reader can hold the destination
+* open (EBUSY/EPERM).
 */
-const SURFACE = {
-	ink950: "#0A1119",
-	ink900: "#0C1420",
-	ink850: "#111A29",
-	ink800: "#18243A",
-	/** Raised panel (cards, elevated surfaces). */
-	panel: "#141F33",
-	/** Soft fill (inline code, quiet chips). */
-	soft: "#1A2740",
-	/** Terminal body — the deepest tone, so a terminal reads as recessed. */
-	terminal: "#0A1119",
-	/** Terminal title bar — the same tone; the seam is shadow, not colour. */
-	terminalBar: "#0A1119",
-	/** The three window dots. One neutral, not a traffic light. */
-	chromeDot: "#18243A"
-};
-const TEXT = {
-	primary: "#EAEEF5",
-	secondary: "#ABB6C6",
-	muted: "#8B939D",
-	/** Ink for text set ON gold (buttons, the FORGED chip). 7.17:1 on `gold`. */
-	onGold: "#0A1119"
-};
+function atomicTempPath(path) {
+	return `${path}.mjolnir-${process.pid}-${Date.now()}-${randomBytes(4).toString("hex")}.tmp`;
+}
 /**
-* Non-score status. `ok` is the one green in the system and it is NOT a
-* score colour — it survives only for contexts with no worthiness
-* meaning ("autofix applied", "analysis complete"). A green score would
-* say "your software is fine", which is the exact claim this product
-* refuses to make.
+* Atomically replace `path` with `data`.
+*
+* Accepts binary payloads as well as text: base-tree materialization in
+* `impact` writes git blobs, and a writer that only takes strings forces those
+* call sites back to the non-atomic path rather than keeping them contained.
 */
-const STATUS = {
-	ok: "#4FB477",
-	info: "#5CC4E0",
-	warning: "#E6BD57",
-	error: "#EC6B66"
-};
+function writeFileAtomic(path, data, opts = {}) {
+	const dir = dirname(path);
+	if (opts.mkdirs !== false && !existsSync(dir)) mkdirSync(dir, { recursive: true });
+	const tmp = atomicTempPath(path);
+	let fd;
+	try {
+		fd = openSync(tmp, "wx", opts.mode ?? 420);
+		if (typeof data === "string") writeSync(fd, data, null, opts.encoding ?? "utf8");
+		else writeSync(fd, data);
+	} finally {
+		if (fd !== void 0) closeSync(fd);
+	}
+	try {
+		renameWithWindowsRetry(tmp, path);
+	} catch (err) {
+		try {
+			if (existsSync(tmp)) unlinkSync(tmp);
+		} catch {}
+		throw err;
+	}
+}
 /**
-* The four ScoreState bands plus the unmeasured state. Band thresholds
-* and runes live in `src/reporter/score-state.ts`, which stays free of
-* colour — it emits a palette KEY and each surface resolves it here.
+* renameSync retry loop for Windows: a concurrent reader (another scan,
+* a badge endpoint, an editor) holding the destination open makes
+* rename fail with EBUSY/EPERM. A short bounded retry closes the race
+* without turning an atomic swap into a partial write.
 *
-* `unmeasured` is steel-dim on purpose. UNKNOWN is a legitimate answer,
-* not a failure: colouring it red would make "we did not measure this"
-* look like "this is broken", which is precisely the dishonesty the
-* north-star law exists to prevent.
+* Internal contract test hook: the platform check keeps this loop off
+* the POSIX hot path; on win32 the EBUSY/EPERM arms are exercised by
+* the fs-atomic-retry spec (mocked renameSync).
 */
-const SCORE = {
-	critical: "#EC6B66",
-	warning: "#E6BD57",
-	trusted: "#5CC4E0",
-	forged: "#F4DC9C",
-	unmeasured: "#8B939D"
-};
+const RENAME_RETRIES = 8;
+const RENAME_RETRY_DELAY_MS = 25;
+/** Synchronous sleep that does not spin the CPU. */
+function sleepSync(ms) {
+	try {
+		Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+	} catch {
+		const until = Date.now() + ms;
+		while (Date.now() < until);
+	}
+}
+function renameWithWindowsRetry(from, to) {
+	for (let attempt = 0;; attempt++) try {
+		renameSync(from, to);
+		return;
+	} catch (err) {
+		const code = err?.code;
+		if (process.platform === "win32" && (code === "EBUSY" || code === "EPERM") && attempt < RENAME_RETRIES) {
+			sleepSync(RENAME_RETRY_DELAY_MS);
+			continue;
+		}
+		throw err;
+	}
+}
+const STALE_TEMP_AGE_MS = 864e5;
+const TEMP_PID_RE = /^.+\.mjolnir-([1-9]\d{0,9})-(\d{13})-[0-9a-f]{8}\.tmp$/;
+function sweepStaleTempFiles(dir) {
+	let swept = 0;
+	let entries;
+	try {
+		entries = readdirSync(dir);
+	} catch {
+		return 0;
+	}
+	const cutoff = Date.now() - STALE_TEMP_AGE_MS;
+	for (const entry of entries) {
+		const match = TEMP_PID_RE.exec(entry);
+		if (!match || Number(match[2]) > cutoff) continue;
+		const path = join(dir, entry);
+		try {
+			const stat = lstatSync(path);
+			if (!stat.isFile() || stat.mtimeMs > cutoff) continue;
+			if (pidAlive(Number(match[1]))) continue;
+			unlinkSync(path);
+			swept++;
+		} catch {
+			continue;
+		}
+	}
+	return swept;
+}
+function pidAlive(pid) {
+	if (!Number.isSafeInteger(pid) || pid <= 0 || pid > 2147483647) return true;
+	if (pid === process.pid) return true;
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (err) {
+		return err?.code !== "ESRCH";
+	}
+}
+//#endregion
+//#region src/engine/scan-cache.ts
 /**
-* E0 → E1 → E2 is a certainty ramp, and it is deliberately HUE-FREE.
+* Local incremental scan cache (Beta-to-Stable 1.0 plan, M5.2 / A-2).
 *
-* Evidence level says how sure we are, not whether the news is good. A
-* deterministic proof (E2) is a defect we are certain about — painting
-* it gold or green would read as an achievement. So certainty is carried
-* by brightness alone, and the *shape* does the real work:
+* Content-addressed, local-only verdict cache: `--cache` reuses the
+* per-file rule outputs of a previous scan when the file's bytes AND the
+* active rule set are unchanged, and invalidates everything else. The
+* key is `sha256(fileText) + rulesDigest` + the file's own identity
+* (repo-relative path + adapter id + parse mode — audit C1/W9), where
+* the rules digest folds
+* in every active rule's id + `detectorRevision ?? 1` (the existing
+* stale-measurement machinery — Verification Trust Evolution Plan §07 —
+* reused as the cache invalidation signal, per A-2) plus a source hash
+* of each external plugin/local rule's `run` function, so a plugin that
+* changes code without bumping its revision still misses.
 *
-*     E0  open ring        observation, no weight
-*     E1  half-filled      pattern evidence, half weight
-*     E2  sealed           deterministic proof, full weight
+* Privacy posture: the cache lives under `<repo>/.mjolnir/cache/`, is
+* gitignored, never leaves the machine, and this module performs zero
+* network I/O — fs and crypto only (asserted by the privacy spec).
 *
-* Colour never carries this alone (R11): the geometry is the signal and
-* survives `--ascii`, `NO_COLOR` and monochrome print.
+* Only raw rule-loop outputs are cached. Everything after the loop
+* (severity overrides, suppressions, overlap dedup, evidence stamping,
+* tier policy, runtime corroboration, scoring) re-runs on every scan,
+* so a cached scan is byte-equivalent to a fresh one by construction.
 */
-const EVIDENCE = {
-	e0: "#8B939D",
-	e1: "#ABB6C6",
-	e2: "#EAEEF5"
-};
+const CACHE_VERSION = 2;
+/** Entry cap: a monorepo-scale suite stays far below this; bounded file. */
+const MAX_ENTRIES$1 = 4096;
 /**
-* L0–L5, and the most important boundary in the product.
-*
-* L0–L2 are STATIC: the neutral steel ramp, brightening to the static
-* ceiling at L2. L3–L5 require a real run, and the hue changes to aurora
-* exactly there. The boundary is a hue break, not a gradient step,
-* because it is a change of kind and not of degree — a static-only
-* finding can never climb past L2, however confident it is.
+* Audit M5: total byte budget. The old cap counted only ENTRIES, so
+* 4096 files × ~100KB of findings each could still produce a
+* multi-hundred-MB writeFileSync on persist. The budget bounds the
+* serialized size; the newest entries win (real LRU-by-use).
+*/
+const MAX_TOTAL_BYTES = 33554432;
+const MAX_FINDINGS_PER_ENTRY = 1e4;
+function isCachedFinding(value) {
+	if (!isRecord(value)) return false;
+	return typeof value["ruleId"] === "string" && typeof value["category"] === "string" && typeof value["severity"] === "string" && typeof value["confidence"] === "string" && typeof value["findingType"] === "string" && typeof value["file"] === "string" && Number.isSafeInteger(value["line"]) && Number.isSafeInteger(value["column"]) && typeof value["message"] === "string" && typeof value["why"] === "string" && typeof value["fix"] === "string";
+}
+function isCacheFile(value) {
+	if (!isRecord(value) || value["version"] !== CACHE_VERSION) return false;
+	const entries = value["entries"];
+	if (!isRecord(entries) || Object.keys(entries).length > MAX_ENTRIES$1) return false;
+	return Object.values(entries).every((entry) => isRecord(entry) && Array.isArray(entry["findings"]) && entry["findings"].length <= MAX_FINDINGS_PER_ENTRY && entry["findings"].every(isCachedFinding));
+}
+/** sha256 hex of a string — the only hash this module needs. */
+function sha256(text) {
+	return createHash("sha256").update(text).digest("hex");
+}
+/**
+* Digest of the active rule set: id + effective detectorRevision for
+* every rule (sorted for determinism), plus a content hash of all rule
+* source files. The directory-tree hash catches changes to ANY file
+* under src/rules/ — same-file helpers, cross-module imports, shared
+* utilities — without needing to trace the import graph. This is the
+* only reliable way to detect helper function changes in a bundled
+* ESM codebase where String(fn) doesn't reveal transitive dependencies.
+*/
+function computeRulesDigest(rules) {
+	const parts = rules.map((r) => `${r.id}:${r.detectorRevision ?? 1}`).sort();
+	const rulesDirHash = hashRulesSourceTree(rules);
+	return sha256(parts.join("|") + "\0" + rulesDirHash);
+}
+/**
+* Hash all .ts files under src/rules/ (when the first rule's modulePath
+* reveals the project root). Falls back to per-rule function source
+* hashing when the directory cannot be resolved.
+*/
+function hashRulesSourceTree(rules) {
+	const firstPath = rules.find((r) => r.modulePath)?.modulePath;
+	if (!firstPath) return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
+	const idx = firstPath.replace(/\\/g, "/").indexOf("/src/rules/");
+	if (idx < 0) return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
+	const rulesDir = firstPath.replace(/\\/g, "/").slice(0, idx + 11);
+	try {
+		const hash = createHash("sha256");
+		hashDir(rulesDir, hash, 0);
+		return hash.digest("hex").slice(0, 16);
+	} catch {
+		return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
+	}
+}
+function hashDir(dir, hash, depth) {
+	if (depth > 8) return;
+	let entries;
+	try {
+		entries = readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return;
+	}
+	entries.sort((a, b) => a.name.localeCompare(b.name));
+	for (const entry of entries) {
+		if (entry.name === "node_modules" || entry.name === ".git") continue;
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) hashDir(full, hash, depth + 1);
+		else if (entry.isFile() && /\.tsx?$/.test(entry.name)) try {
+			hash.update(entry.name);
+			hash.update(readFileSync(full));
+		} catch {}
+	}
+}
+/**
+* Content-addressed key for one file's rule-loop verdicts.
 *
-* Every surface that draws the ladder must draw that break.
+* Audit C1: the key MUST identify the verdict's producer, not just the
+* bytes — two files with byte-identical text (a copied spec, a generated
+* snapshot) previously shared one entry, and the first file's cached
+* findings were re-emitted for the second with the wrong `file` stamp.
+* The key therefore folds in the repo-relative path AND the adapter id,
+* plus a parse-mode token (audit W9): a file whose analysis degraded to
+* the regex fallback (or skipped the AST path) must not collide with a
+* fully-AST-analyzed verdict for the same bytes — the fallback output
+* belongs only to the fallback mode.
 */
-const TRUST = {
-	l0: "#8B939D",
-	l1: "#ABB6C6",
-	l2: "#C8CBCF",
-	l3: "#37ABBD",
-	l4: "#45C1D4",
-	l5: "#5CC4E0"
-};
-const TINT = {
-	gold: {
-		fill: "#F6EBCC",
-		stroke: "#7A5F16",
-		text: "#4A3A0E"
-	},
-	aurora: {
-		fill: "#D9F0F4",
-		stroke: "#1F6F7C",
-		text: "#10353C"
-	},
-	error: {
-		fill: "#FADEDD",
-		stroke: "#A83A35",
-		text: "#4E1B19"
-	},
-	/** The unmeasured / unknown state. Neutral, never the error tint. */
-	neutral: {
-		fill: "#E4E7EB",
-		stroke: "#5C646E",
-		text: "#262B31"
+function fileCacheKey(rulesDigest, fileText, identity) {
+	const parseMode = identity.parseMode ?? "ast";
+	return sha256(`${CACHE_VERSION}\u0000${rulesDigest}\u0000${identity.relPath}\u0000${identity.adapterId}\u0000${parseMode}\u0000${fileText}`);
+}
+/** No-op cache used when --cache is absent: zero stats, zero I/O. */
+const disabledScanCache = {
+	stats: {
+		hits: 0,
+		misses: 0,
+		file: ""
 	},
-	ok: {
-		fill: "#DCF0E4",
-		stroke: "#276B45",
-		text: "#163A26"
-	}
+	lookup: () => void 0,
+	store: () => {},
+	persist: () => {}
 };
 /**
-* The score bands as the badge Mjölnir itself generates renders them.
-*
-* These are DEEPER than the score tokens on purpose, and it is not a
-* style preference: shields.io sets the message text in white and gives
-* you no say in it. `score.forged` (#F4DC9C) under white text measures
-* 1.35:1 — an unreadable badge, shipped to look on-brand. The brand's
-* own deep steps put every band between 4.9 and 6.3:1.
-*
-* What they replace was worse than off-brand, it was wrong:
-*
-*   band        was              rendered as        white-on   now       white-on
-*   ────────────────────────────────────────────────────────────────────────────
-*   0-49        `red`            #dd4343            4.24       #A83A35   6.32
-*   50-79       `yellow`         #d8b800            1.95       #7A5F16   6.04
-*   80-99       `important`      #ea7233  ORANGE    3.02       #1F6F7C   5.80
-*   100         `success`        #44bb00  GREEN     2.51       #8A6D1E   4.90
-*   unmeasured  `lightgrey`      #939393            3.07       #5C646E   5.99
-*
-* Two of those were defects, not preferences. `success` is green, and
-* green is not a score colour here — a 100 badge said "your software is
-* fine", which is the one claim this product refuses to make. And
-* `important` is ORANGE, not the blue-family colour the code's own
-* comment claimed for eight releases: every WORTHY badge ever rendered
-* showed the trusted band in a warning colour. Nobody had resolved a
-* shields name to a value and looked.
-*
-* Values are hex without `#`, the form shields.io's endpoint takes.
-* `A83A35`, `7A5F16`, `1F6F7C` and `5C646E` are the `TINT` strokes —
-* the same deep steps the mermaid diagrams use, for the same reason.
-* `8A6D1E` is the gold the brand document already named as the light
-* FORGED gradient's start.
+* Opens (and lazily creates) `<root>/.mjolnir/cache/scan-v<CACHE_VERSION>.json`. A
+* corrupt, hostile or future-versioned cache file degrades to a cold
+* cache — never fails the scan.
 */
-const BADGE_BAND = {
-	critical: "A83A35",
-	warning: "7A5F16",
-	trusted: "1F6F7C",
-	forged: "8A6D1E",
-	unmeasured: "5C646E"
-};
-SURFACE.ink950, SURFACE.ink900, SURFACE.ink850, SURFACE.ink800, BRAND.steel, BRAND.steelDim, BRAND.gold, BRAND.goldBright, BRAND.goldHot, BRAND.aurora, BRAND.auroraBright, BRAND.auroraCyan, BRAND.auroraGreen, BRAND.auroraViolet;
-SCORE.trusted, SCORE.forged, SCORE.warning, SCORE.critical, STATUS.info, TEXT.onGold, STATUS.ok, EVIDENCE.e0, EVIDENCE.e1, EVIDENCE.e2, TRUST.l0, TRUST.l1, TRUST.l2, TRUST.l3, TRUST.l4, TRUST.l5;
-//#endregion
-//#region src/reporter/score-state.ts
-const HEADLINES = {
-	critical: "The hammer is cracked — {n} findings break its edge.",
-	warning: "The hammer holds — but {n} findings weigh it down.",
-	trusted: "Held in worthy hands — {n} findings remain.",
-	forged: "Static score 100 — no findings on the analyzed surface.",
-	unmeasured: "No tests found — the hammer cannot be weighed."
-};
-const RUNES = {
-	critical: "ᚲ",
-	warning: "ᚦ",
-	trusted: "ᛏ",
-	forged: "ᛟ",
-	unmeasured: "ᛁ"
-};
-/** Band mapping (the one mapping, three consumers): <50 critical, 50–79
-* warning, 80–99 trusted, 100 forged, null unmeasured. */
-function deriveScoreState(score) {
-	if (score === null) return {
-		score: null,
-		band: "unmeasured",
-		verdict: "UNWORTHY",
-		color: "dim",
-		powerLevel: 0,
-		headline: HEADLINES.unmeasured,
-		rune: RUNES.unmeasured
-	};
-	if (score >= 100) return {
-		score,
-		band: "forged",
-		verdict: "FORGED",
-		color: "forged",
-		powerLevel: score,
-		headline: HEADLINES.forged,
-		rune: RUNES.forged
-	};
-	if (score >= 80) return {
-		score,
-		band: "trusted",
-		verdict: "WORTHY",
-		color: "trusted",
-		powerLevel: score,
-		headline: HEADLINES.trusted,
-		rune: RUNES.trusted
-	};
-	if (score >= 50) return {
-		score,
-		band: "warning",
-		verdict: "NEEDS WORK",
-		color: "warning",
-		powerLevel: score,
-		headline: HEADLINES.warning,
-		rune: RUNES.warning
-	};
+function createScanCache(root) {
+	const dir = join(root, ".mjolnir", "cache");
+	const file = join(dir, `scan-v${CACHE_VERSION}.json`);
+	let entries = {};
+	let dirty = false;
+	const entryBytes = /* @__PURE__ */ new Map();
+	let totalBytes = 0;
+	try {
+		if (existsSync(file)) {
+			const stat = lstatSync(file);
+			if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_TOTAL_BYTES) throw new Error("invalid cache file");
+			entries = parseJsonFile(readFileSync(file, "utf8"), file, isCacheFile).entries;
+			for (const [k, v] of Object.entries(entries)) {
+				const size = Buffer.byteLength(JSON.stringify(v), "utf8") + k.length + 4;
+				entryBytes.set(k, size);
+				totalBytes += size;
+			}
+			if (totalBytes > MAX_TOTAL_BYTES) throw new Error("cache byte budget exceeded");
+		}
+	} catch {
+		entries = {};
+		entryBytes.clear();
+		totalBytes = 0;
+	}
 	return {
-		score,
-		band: "critical",
-		verdict: "UNWORTHY",
-		color: "error",
-		powerLevel: score,
-		headline: HEADLINES.critical,
-		rune: RUNES.critical
+		stats: {
+			hits: 0,
+			misses: 0,
+			file
+		},
+		lookup(key) {
+			const entry = entries[key];
+			if (!entry) {
+				this.stats.misses++;
+				return;
+			}
+			this.stats.hits++;
+			delete entries[key];
+			entries[key] = entry;
+			return structuredClone(entry.findings);
+		},
+		store(key, findings, fileBudgetExceeded) {
+			if (fileBudgetExceeded) return;
+			if (findings.length > MAX_FINDINGS_PER_ENTRY) return;
+			const entryJson = JSON.stringify(findings);
+			const newBytes = Buffer.byteLength(entryJson, "utf8") + key.length + 4;
+			if (newBytes > MAX_TOTAL_BYTES) return;
+			const replacedBytes = entryBytes.get(key) ?? 0;
+			delete entries[key];
+			entries[key] = { findings: structuredClone(findings) };
+			entryBytes.set(key, newBytes);
+			totalBytes = totalBytes - replacedBytes + newBytes;
+			let count = Object.keys(entries).length;
+			while ((count > MAX_ENTRIES$1 || totalBytes > MAX_TOTAL_BYTES) && count > 1) {
+				const oldest = Object.keys(entries)[0];
+				totalBytes -= entryBytes.get(oldest);
+				delete entries[oldest];
+				entryBytes.delete(oldest);
+				count--;
+			}
+			dirty = true;
+		},
+		persist() {
+			if (!dirty) return;
+			try {
+				mkdirSync(dir, { recursive: true });
+				writeFileAtomic(file, JSON.stringify({
+					version: CACHE_VERSION,
+					entries
+				}), { encoding: "utf8" });
+			} catch {}
+		}
 	};
 }
-/** Substitute a findings count into a headline template. Pure text
-* helper so every surface formats identically. */
-function headlineFor(state, findings) {
-	return state.headline.replace("{n}", String(findings));
-}
 //#endregion
 //#region src/reporter/theme.ts
 /**
@@ -12620,8 +13471,8 @@ function headlineFor(state, findings) {
 *
 * Symbols always accompany color (color-blind safe, R11).
 *
-* Score-state colors come from ScoreState (score-state.ts) — the single
-* source of truth shared with the badge and (P2) the web.
+* Score-state colors come from ScoreState (presentation.ts) — the single
+* source of truth shared with the badge, the dashboard and the site.
 *
 * Terminal robustness (Master-Stabilization-Plan Sprint 5 Task 22):
 * box-drawing/gauge helpers accept an explicit width so callers can
@@ -12798,14 +13649,11 @@ function padTo(s, width) {
 */
 function scoreGauge(score, p, width = 30, ascii = false) {
 	const filled = Math.round(score / 100 * width);
-	const color = gaugeColor(score, p);
+	const color = gaugeColorForBand(deriveScoreState(score).band, p);
 	if (ascii) return color("#".repeat(filled)) + ".".repeat(Math.max(0, width - filled));
 	const head = filled > 0 && filled < width ? "▓" : "";
 	return color("█".repeat(Math.max(0, filled - (head ? 1 : 0)))) + color(head) + "░".repeat(width - filled);
 }
-function gaugeColor(score, p) {
-	return gaugeColorForBand(deriveScoreState(score).band, p);
-}
 /**
 * The single band → palette-key mapping, delegated from ScoreState so
 * gauge, verdict and badge colors can never disagree again.
@@ -13960,7 +14808,7 @@ function runForensics(target, options = {}) {
 		const base = stat.isFile() ? dirname(target) : target;
 		flakyMdPath = join(base, "FLAKY.md");
 		try {
-			writeFileSync(flakyMdPath, renderFlakyMd(report));
+			writeFileAtomic(flakyMdPath, renderFlakyMd(report));
 		} catch {
 			flakyMdPath = void 0;
 		}
@@ -14276,6 +15124,31 @@ function loadPlugins(root, gateOpen = false) {
 * next catalog render (locked by tests/local-rules.spec.ts).
 */
 const LOCAL_RULES_DIR = "mjolnir-rules";
+const MAX_EXTERNAL_RULES = 1e3;
+const MAX_RULE_FILE_BYTES = 1048576;
+const MAX_PATTERNS_PER_RULE = 100;
+function hasNestedQuantifier(pattern) {
+	for (let i = 0; i < pattern.length; i++) {
+		if (pattern.charAt(i) !== "(") continue;
+		let bodyHasQuantifier = false;
+		let j = i + 1;
+		for (; j < pattern.length && pattern.charAt(j) !== ")"; j++) {
+			const bodyChar = pattern.charAt(j);
+			if (bodyChar === "+" || bodyChar === "*" || bodyChar === "?") {
+				bodyHasQuantifier = true;
+				break;
+			}
+		}
+		if (bodyHasQuantifier) {
+			while (j < pattern.length && pattern.charAt(j) !== ")") j++;
+			if (j + 1 < pattern.length) {
+				const next = pattern.charAt(j + 1);
+				if (next === "+" || next === "*" || next === "{") return true;
+			}
+		}
+	}
+	return false;
+}
 const ALLOWED_CATEGORIES = /* @__PURE__ */ new Set([
 	"QA-TEST",
 	"QA-TQUAL",
@@ -14305,7 +15178,7 @@ const ALLOWED_QA_IMPACTS = /* @__PURE__ */ new Set([
 * Missing directory → empty result (not an error — most workspaces
 * carry none).
 */
-async function loadLocalRules(root, gateOpen = true) {
+async function loadLocalRules(root, gateOpen = false) {
 	const result = {
 		rules: [],
 		errors: [],
@@ -14313,6 +15186,15 @@ async function loadLocalRules(root, gateOpen = true) {
 	};
 	const dir = join(root, LOCAL_RULES_DIR);
 	if (!existsSync(dir)) return result;
+	try {
+		if (lstatSync(dir).isSymbolicLink()) {
+			result.errors.push(`external rules directory "${LOCAL_RULES_DIR}/" is a symlink — skipped`);
+			return result;
+		}
+	} catch (err) {
+		result.errors.push(`external rules directory "${LOCAL_RULES_DIR}/" could not be inspected: ${err instanceof Error ? err.message : String(err)}`);
+		return result;
+	}
 	let entries;
 	try {
 		entries = readdirSync(dir);
@@ -14321,7 +15203,20 @@ async function loadLocalRules(root, gateOpen = true) {
 		return result;
 	}
 	for (const entry of entries.sort()) {
+		if (result.rules.length >= MAX_EXTERNAL_RULES) {
+			result.errors.push(`external rule budget exceeded (${MAX_EXTERNAL_RULES})`);
+			break;
+		}
 		const path = join(dir, entry);
+		try {
+			if (lstatSync(path).isSymbolicLink()) {
+				result.errors.push(`external rule "${LOCAL_RULES_DIR}/${entry}" is a symlink — skipped`);
+				continue;
+			}
+		} catch (err) {
+			result.errors.push(`external rule "${LOCAL_RULES_DIR}/${entry}" could not be inspected: ${err instanceof Error ? err.message : String(err)}`);
+			continue;
+		}
 		if (entry.endsWith(".json")) loadJsonRule(path, result);
 		else if (entry.endsWith(".mjs") || entry.endsWith(".js")) {
 			if (!gateOpen) result.skipped.push(`${LOCAL_RULES_DIR}/${entry}`);
@@ -14334,6 +15229,10 @@ function loadJsonRule(path, result) {
 	const name = `${LOCAL_RULES_DIR}/${path.split(/[\\/]/).pop()}`;
 	let raw;
 	try {
+		if (lstatSync(path).size > MAX_RULE_FILE_BYTES) {
+			result.errors.push(`external rule "${name}" exceeds the file size budget`);
+			return;
+		}
 		raw = JSON.parse(readFileSync(path, "utf8"));
 	} catch (err) {
 		result.errors.push(`external rule "${name}" is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
@@ -14354,7 +15253,7 @@ function loadJsonRule(path, result) {
 		return;
 	}
 	const patterns = decl["patterns"];
-	if (!Array.isArray(patterns) || patterns.length === 0 || !patterns.every((p) => typeof p === "string" && p.length > 0)) {
+	if (!Array.isArray(patterns) || patterns.length === 0 || patterns.length > MAX_PATTERNS_PER_RULE || !patterns.every((p) => typeof p === "string" && p.length > 0)) {
 		result.errors.push(`external rule ${id} must declare a non-empty "patterns" array of regex source strings.`);
 		return;
 	}
@@ -14370,6 +15269,10 @@ function loadJsonRule(path, result) {
 			result.errors.push(`external rule ${id} has a pattern longer than 512 chars — likely a copy-paste error.`);
 			return;
 		}
+		if (hasNestedQuantifier(p)) {
+			result.errors.push(`external rule ${id} has a nested quantifier that may cause catastrophic backtracking`);
+			return;
+		}
 		const quantifiers = p.match(/[+*?]|\{\d/g);
 		if (quantifiers && quantifiers.length > 64) {
 			result.errors.push(`external rule ${id} has a pattern with more than 64 quantifier/wildcard tokens — likely catastrophic backtracking.`);
@@ -14567,6 +15470,8 @@ var scan_pipeline_exports = /* @__PURE__ */ __exportAll({
 	summarizeForensicVerdicts: () => summarizeForensicVerdicts
 });
 const UNIVERSAL_RULES = RULES.map(asUniversal);
+const DEFAULT_MAX_DURATION_MS = 6e5;
+const MAX_DURATION_MS = 36e5;
 /** Registered rule IDs — used to warn on unknown severityOverrides keys (M4). */
 const KNOWN_RULE_IDS = new Set(RULES.map((r) => r.id));
 /**
@@ -14783,7 +15688,9 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 	let testDeclarationCount = 0;
 	let rulesPartial = false;
 	let parseFailed = 0;
+	let parseFallbacks = 0;
 	let scanned = 0;
+	let analyzed = 0;
 	for (const path of testFiles) {
 		if (Date.now() > deadline) {
 			rulesPartial = true;
@@ -14797,13 +15704,16 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 		if (!isCiAdapter) testFileCount++;
 		let text;
 		try {
-			text = readFileSync(path, "utf8").replace(/^\uFEFF/, "").replace(/\r\n?/g, "\n");
+			const readResult = readFileBounded(path, LIMITS$1.maxFileBytes);
+			if (!readResult.ok) {
+				skippedFiles++;
+				continue;
+			}
+			text = readResult.data.toString("utf8").replace(/^\uFEFF/, "").replace(/\r\n?/g, "\n");
 		} catch {
 			skippedFiles++;
 			continue;
 		}
-		let fileBudgetExceeded = false;
-		let fileRuleFailed = false;
 		const relPath = relative(workspace.root, path).replaceAll("\\", "/");
 		if (!isCiAdapter) {
 			const lang = {
@@ -14829,74 +15739,106 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 		});
 		let cacheKey = fileCacheKey(rulesDigest, text, identity(wantsAst ? "ast" : "regex"));
 		const cachedFindings = cache.lookup(cacheKey);
-		if (cachedFindings) {
-			for (const f of cachedFindings) findings.push(f);
-			continue;
-		}
-		hooks.onProgress?.({
-			phase: "parse",
-			done: scanned,
-			total: testFiles.length,
-			detail: relPath
-		});
-		const parsedFile = {
-			path: relPath,
-			text
-		};
-		let parsed;
-		const findingsStart = findings.length;
-		try {
-			if (adapter.parseAst && wantsAst) {
-				hooks.onProgress?.({
-					phase: "rules",
-					done: scanned,
-					total: testFiles.length,
-					detail: relPath
-				});
-				parsed = await adapter.parseAst(parsedFile);
-			}
-			const actualMode = parsed ? "ast" : "regex";
-			if (wantsAst && actualMode === "regex") {
-				cacheKey = fileCacheKey(rulesDigest, text, identity(actualMode));
-				const fallbackFindings = cache.lookup(cacheKey);
-				if (fallbackFindings) {
-					for (const f of fallbackFindings) findings.push(f);
-					continue;
+		const executor = createExecutor("sequential", 1, async (job) => {
+			if (job.cacheHit !== void 0) return {
+				path: job.path,
+				status: "CACHE_HIT",
+				findings: [...job.cacheHit],
+				parseFallback: false
+			};
+			let parseFallback = false;
+			let fileRuleFailed = false;
+			let fileBudgetExceeded = false;
+			let parsedAst;
+			try {
+				if (adapter.parseAst && job.wantsAst) {
+					hooks.onProgress?.({
+						phase: "rules",
+						done: scanned,
+						total: testFiles.length,
+						detail: job.path
+					});
+					parsedAst = await adapter.parseAst({
+						path: job.path,
+						text: job.text
+					});
 				}
-			}
-			const fileForRules = parsed ? {
-				...parsedFile,
-				ast: parsed.ast
-			} : parsedFile;
-			adapter.runRules(activeRules, fileForRules, (f, ruleId, category) => {
-				if (!isValidFindingRecord(f)) {
-					fileRuleFailed = true;
-					onRuleCrash?.(ruleId, relPath, /* @__PURE__ */ new Error(`malformed finding record rejected (severity/line/message must be present, severity ∈ error|warning|info): ${JSON.stringify(f)}`));
-					return;
+				const actualMode = parsedAst ? "ast" : "regex";
+				if (job.wantsAst && actualMode === "regex") {
+					parseFallback = true;
+					parseFallbacks++;
+					cacheKey = fileCacheKey(rulesDigest, job.text, identity(actualMode));
+					const fallbackFindings = cache.lookup(cacheKey);
+					if (fallbackFindings) return {
+						path: job.path,
+						status: "CACHE_HIT",
+						findings: [...fallbackFindings],
+						parseFallback: true
+					};
 				}
-				findings.push({
-					...f,
-					ruleId,
-					category
+				const fileForRules = parsedAst ? {
+					path: job.path,
+					text: job.text,
+					ast: parsedAst.ast
+				} : {
+					path: job.path,
+					text: job.text
+				};
+				const produced = [];
+				adapter.runRules(activeRules, fileForRules, (f, ruleId, category) => {
+					if (!isValidFindingRecord(f)) {
+						fileRuleFailed = true;
+						onRuleCrash?.(ruleId, job.path, /* @__PURE__ */ new Error(`malformed finding record rejected (severity/line/message must be present, severity ∈ error|warning|info): ${JSON.stringify(f)}`));
+						return;
+					}
+					produced.push({
+						...f,
+						ruleId,
+						category
+					});
+				}, (ruleId, error) => {
+					fileRuleFailed = true;
+					onRuleCrash?.(ruleId, job.path, error);
+				}, {
+					deadline: Math.min(deadline, Date.now() + LIMITS$1.maxFileAnalysisMs),
+					onExceeded: () => {
+						rulesPartial = true;
+						skippedFiles++;
+						truncationReasons.add("file-budget");
+						fileBudgetExceeded = true;
+					}
 				});
-			}, (ruleId, error) => {
-				fileRuleFailed = true;
-				onRuleCrash?.(ruleId, relPath, error);
-			}, {
-				deadline: Math.min(deadline, Date.now() + LIMITS$1.maxFileAnalysisMs),
-				onExceeded: () => {
-					rulesPartial = true;
-					skippedFiles++;
-					truncationReasons.add("file-budget");
-					fileBudgetExceeded = true;
-				}
-			});
-			if (!fileRuleFailed) cache.store(cacheKey, findings.slice(findingsStart), fileBudgetExceeded);
-		} catch {
-			skippedFiles++;
-			parseFailed++;
-		} finally {
-			parsed?.dispose();
+				if (!fileRuleFailed && !fileBudgetExceeded) analyzed++;
+				if (!fileRuleFailed) cache.store(cacheKey, produced, fileBudgetExceeded);
+				return {
+					path: job.path,
+					status: "OK",
+					findings: produced,
+					parseFallback
+				};
+			} catch {
+				if (job.wantsAst) parseFallbacks++;
+				skippedFiles++;
+				parseFailed++;
+				return {
+					path: job.path,
+					status: "FAILED",
+					findings: [],
+					parseFallback
+				};
+			} finally {
+				parsedAst?.dispose();
+			}
+		});
+		const outcome = (await executeFiles([{
+			path: relPath,
+			text,
+			wantsAst,
+			...cachedFindings !== void 0 ? { cacheHit: cachedFindings } : {}
+		}], executor))[0];
+		if (outcome?.status === "CACHE_HIT" || outcome?.status === "OK") {
+			for (const f of outcome.findings) findings.push(f);
+			if (cachedFindings !== void 0 && outcome.status === "CACHE_HIT") analyzed++;
 		}
 	}
 	return {
@@ -14905,7 +15847,9 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 		testDeclarationCount,
 		rulesPartial,
 		parseFailed,
-		scanned
+		parseFallbacks,
+		scanned,
+		analyzed
 	};
 }
 /**
@@ -14983,18 +15927,24 @@ function applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, dec
 	for (const f of findings) f.fixGroupId = f.ruleId;
 	const discoveredReport = discoverAndParseRuntimeReport(scanRoot.root);
 	const runtimeReportPath = discoveredReport?.path;
+	const runtimeIncomplete = discoveredReport !== void 0 && discoveredReport.report.analysisComplete !== true;
 	let forensicVerdicts;
+	let evidenceRecords = [];
 	if (discoveredReport && discoveredReport.report.analysisComplete === true) try {
-		buildEvidenceRecords(discoveredReport.report, discoveredReport.path);
+		evidenceRecords = buildEvidenceRecords(discoveredReport.report, discoveredReport.path);
 		stampRuntimeCorroboration(findings, discoveredReport.report, workspace.root);
 		forensicVerdicts = summarizeForensicVerdicts(discoveredReport.report);
-	} catch {}
+	} catch {
+		evidenceRecords = [];
+	}
 	return {
+		evidenceRecords,
 		testDeclarationCount,
 		scopeInfo,
 		suppressionCount,
 		frameworks,
 		runtimeReportPath,
+		runtimeIncomplete,
 		forensicVerdicts,
 		config
 	};
@@ -15063,10 +16013,13 @@ function assembleScanResult(o) {
 	if (o.scopeIgnored > 0) scopeReasons.push(`ignored:${o.scopeIgnored}`);
 	if (o.scopeUnrecognized > 0) scopeReasons.push(`unrecognized:${o.scopeUnrecognized}`);
 	if (o.parseFailed > 0) scopeReasons.push(`parseFailed:${o.parseFailed}`);
+	if (o.skippedFiles > 0) scopeReasons.push(`skipped:${o.skippedFiles}`);
+	if (o.scopeInfo.degraded) scopeReasons.push(`degraded:${o.scopeInfo.degraded}`);
+	if (o.runtimeIncomplete) scopeReasons.push("runtime-incomplete");
 	for (const reason of o.truncationReasons) scopeReasons.push(`truncated:${reason}`);
 	const scopeIntegrity = {
 		discovered: o.testFiles.length,
-		analyzed: Math.max(0, o.scanned),
+		analyzed: Math.max(0, o.analyzed ?? o.scanned),
 		ignored: o.scopeIgnored,
 		unrecognized: o.scopeUnrecognized,
 		parseFailed: o.parseFailed,
@@ -15075,28 +16028,61 @@ function assembleScanResult(o) {
 		...scopeReasons.length > 0 ? { reasons: scopeReasons } : {}
 	};
 	const scopeAdjustedTotal = scopeReasons.length > 0 && total >= 100 ? 99 : total;
+	let identityIncomplete = false;
 	const inputSnapshot = o.testFiles.map((p) => {
 		const relPath = relative(o.workspace.root, p).replaceAll("\\", "/");
 		try {
-			const content = readFileSync(p);
-			const hash = createHash("sha256").update(content).digest("hex").slice(0, 16);
+			const read = readFileBounded(resolve(o.workspace.root, p), LIMITS$1.maxFileBytes);
+			if (!read.ok) {
+				if (existsSync(o.workspace.root)) identityIncomplete = true;
+				return {
+					path: relPath,
+					size: 0,
+					hash: "UNAVAILABLE"
+				};
+			}
+			const hash = createHash("sha256").update(read.data).digest("hex");
 			return {
 				path: relPath,
-				size: content.length,
+				size: read.data.length,
 				hash
 			};
 		} catch {
+			if (existsSync(o.workspace.root)) identityIncomplete = true;
 			return {
 				path: relPath,
-				size: 0
+				size: 0,
+				hash: "UNAVAILABLE"
 			};
 		}
 	});
 	let reportDigest;
 	if (o.runtimeReportPath) try {
-		const reportBytes = readFileSync(o.runtimeReportPath);
-		reportDigest = createHash("sha256").update(reportBytes).digest("hex").slice(0, 16);
-	} catch {}
+		const reportPath = resolve(o.workspace.root, o.runtimeReportPath);
+		if (lstatSync(reportPath).isFile()) {
+			const read = readFileBounded(reportPath, LIMITS$1.maxFileBytes);
+			if (!read.ok) identityIncomplete = true;
+			else reportDigest = createHash("sha256").update(read.data).digest("hex");
+		}
+	} catch {
+		identityIncomplete = true;
+	}
+	const completion = deriveCompletion({
+		discoveryTruncated: o.discoveryTruncated,
+		rulesPartial: o.rulesPartial,
+		skippedFiles: o.skippedFiles,
+		rulesCrashed: o.rulesCrashed,
+		truncationReasons: o.truncationReasons,
+		scopeIgnored: o.scopeIgnored,
+		scopeUnrecognized: o.scopeUnrecognized,
+		parseFailed: o.parseFailed,
+		parseFallbacks: o.parseFallbacks ?? 0,
+		...o.scopeInfo.degraded !== void 0 ? { scopeDegraded: o.scopeInfo.degraded } : {},
+		...o.runtimeIncomplete !== void 0 ? { runtimeIncomplete: o.runtimeIncomplete } : {},
+		identityIncomplete
+	});
+	const repository = bindRepository(o.scanRoot.root);
+	const candidate = readCandidateBinding(o.scanRoot.root);
 	const runIdentity = buildRunIdentity({
 		files: inputSnapshot,
 		rules: [...o.REVISION_BY_RULE_ID.entries()].map(([id, detectorRevision]) => ({
@@ -15109,18 +16095,32 @@ function assembleScanResult(o) {
 		trustModelVersion: TRUST_MODEL_VERSION,
 		scoringModelVersion: SCORING_MODEL_VERSION,
 		frameworkSupportMatrixVersion: FRAMEWORK_SUPPORT_MATRIX_VERSION,
-		evidenceSchemaVersions: [1]
+		evidenceSchemaVersions: [1],
+		...repository,
+		...candidate !== null ? { candidate } : {}
+	});
+	const evidenceGraph = buildEvidenceGraph({
+		runId: runIdentity,
+		...candidate !== null ? { candidate: {
+			manifestId: candidate.manifestId,
+			candidateSha: candidate.candidateSha
+		} } : {}
 	});
-	const evidenceGraph = buildEvidenceGraph({ runId: runIdentity });
 	const hasTests = o.testFileCount > 0 && o.testDeclarationCount > 0;
 	const suiteInvalidatedBy = [...new Set(o.findings.filter((f) => SUITE_INVALIDATING_RULE_IDS.has(f.ruleId)).map((f) => f.ruleId))].sort();
+	const finalScore = hasTests ? completion.partial && scopeAdjustedTotal >= 100 ? 99 : scopeAdjustedTotal : null;
 	const result = {
 		schemaVersion: 1,
-		partial: o.discoveryTruncated || o.rulesPartial || o.skippedFiles > 0 || o.rulesCrashed > 0 || o.scopeInfo.degraded !== void 0,
+		partial: completion.partial,
 		scopeIntegrity,
 		runIdentity,
 		evidenceGraph,
-		score: hasTests ? scopeAdjustedTotal : null,
+		evidence: {
+			records: o.evidenceRecords ?? [],
+			counts: countEvidence(o.evidenceRecords ?? []),
+			artifact: o.runtimeReportPath ?? null
+		},
+		score: finalScore,
 		...hasTests ? {} : { reason: "no-tests-found" },
 		frameworks: o.frameworks.frameworks,
 		frameworkDetectionUnknown: o.frameworks.unknown,
@@ -15146,12 +16146,8 @@ function assembleScanResult(o) {
 			file: o.cache.stats.file
 		} } : {},
 		analysisStatus: {
-			discovery: o.discoveryTruncated ? "partial" : "complete",
-			rules: o.rulesPartial ? "partial" : "complete",
-			skippedFiles: o.skippedFiles,
-			durationMs: elapsed,
-			rulesCrashed: o.rulesCrashed,
-			...o.truncationReasons.size > 0 ? { truncationReasons: [...o.truncationReasons].sort() } : {}
+			...completion.analysisStatus,
+			durationMs: elapsed
 		},
 		scoringModelVersion: SCORING_MODEL_VERSION
 	};
@@ -15199,7 +16195,8 @@ function assembleScanResult(o) {
 */
 async function runScan(args, hooks = {}) {
 	const started = Date.now();
-	const deadline = started + args.maxDurationMs;
+	const requestedDuration = Number.isFinite(args.maxDurationMs) ? args.maxDurationMs : DEFAULT_MAX_DURATION_MS;
+	const deadline = started + Math.min(Math.max(1, requestedDuration), MAX_DURATION_MS);
 	const discovered = discoverWorkspace(args.target);
 	const targetAbs = resolve(args.target);
 	const scanRoot = discovered && discovered.root !== targetAbs && targetAbs.startsWith(discovered.root + sep) ? {
@@ -15288,7 +16285,9 @@ async function runScan(args, hooks = {}) {
 	testDeclarationCount = analysis.testDeclarationCount;
 	rulesPartial = analysis.rulesPartial;
 	parseFailed = analysis.parseFailed;
+	const parseFallbacks = analysis.parseFallbacks;
 	const scanned = analysis.scanned;
+	const analyzed = analysis.analyzed;
 	const postScan = applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, declarationsByFile, testDeclarationCount, tierByRuleId, REVISION_BY_RULE_ID);
 	testDeclarationCount = postScan.testDeclarationCount;
 	const result = assembleScanResult({
@@ -15304,7 +16303,9 @@ async function runScan(args, hooks = {}) {
 		scopeIgnored,
 		scopeUnrecognized,
 		parseFailed,
+		parseFallbacks,
 		scanned,
+		analyzed,
 		testFiles,
 		workspace,
 		scanRoot,
@@ -15317,6 +16318,7 @@ async function runScan(args, hooks = {}) {
 		suppressionCount: postScan.suppressionCount,
 		frameworks: postScan.frameworks,
 		runtimeReportPath: postScan.runtimeReportPath,
+		runtimeIncomplete: postScan.runtimeIncomplete,
 		forensicVerdicts: postScan.forensicVerdicts,
 		config: postScan.config,
 		fileProvenance,
@@ -15329,4 +16331,6 @@ async function runScan(args, hooks = {}) {
 	return result;
 }
 //#endregion
-export { massCeiling as $, box as A, isAdvisoryFinding as At, headlineFor as B, buildFooter as C, buildEvidenceGraph as Ct, plainContext as D, RULE_CATEGORIES as Dt, panel as E, QA_IMPACT_LABELS as Et, scoreGauge as F, buildDependencyGraph as G, EVIDENCE as H, shouldColorize as I, classifyProvenance as J, getReachableFiles as K, shouldUseAscii as L, padTo as M, palette as N, sectionHeader as O, SEVERITY_ORDER as Ot, sanitizeData as P, deductionFor as Q, wrapText as R, FLAKE_GLYPH as S, ENGINE_VERSION as St, okIcon as T, DEDUCTIONS as Tt, TINT as U, BADGE_BAND as V, TRUST as W, capForTier as X, computeAgenticProfile as Y, computeDimensions as Z, summarizeForensicVerdicts as _, ConfigValidationError as _t, applyPostScanProcessing as a, SEARCHED_FOR as at, renderSuppressions as b, isRecord as bt, discoverAndParseRuntimeReport as c, parseWorkflow as ct, isValidFindingRecord as d, parseTsFile as dt, RETIRED_RULE_IDS as et, pathMatchesGlob as f, detectFrameworks as ft, selectAdapter as g, isLintFixtureDir as gt, scan_pipeline_exports as h, globToRegExp as ht, SUITE_INVALIDATING_RULE_IDS as i, SCAN_ADAPTERS as it, measure as j, isValidCategory as jt, severityIcon as k, deriveEvidenceLevel as kt, discoverTestFilesPhase as l, parseYamlGuarded as lt, runScan as m, createIgnoreMatcher as mt, KNOWN_RULE_IDS as n, getRule as nt, assembleScanResult as o, isAzurePipelineFixture as ot, runFileAnalysisPhase as p, DEFAULT_IGNORE_MATCHER as pt, correlateFindings as q, OVERLAP_META_BY_RULE_ID as r, resolveGitPath as rt, buildUniversalRules as s, parseAzurePipeline as st, EVIDENCE_OVERRIDES as t, RULES as tt, fallbackWorkspace as u, computeCodeText as ut, loadLocalRules as v, isSuppressionActive as vt, nextStep as w, MEASURED_FP as wt, runForensics as x, parseJsonFile as xt, loadSuppressions as y, loadConfig as yt, deriveScoreState as z };
+export { BADGE_BAND as $, plainContext as A, isLintFixtureDir as At, shouldUseAscii as B, DEDUCTIONS as Bt, runForensics as C, computeCodeText as Ct, nextStep as D, LIMITS$1 as Dt, buildFooter as E, DEFAULT_IGNORE_MATCHER as Et, padTo as F, isRecord as Ft, countOrNull as G, deriveEvidenceLevel as Gt, atomicTempPath as H, RULE_CATEGORIES as Ht, palette as I, parseJsonFile as It, evidenceTag as J, deriveScoreState as K, isAdvisoryFinding as Kt, sanitizeData as L, ENGINE_VERSION as Lt, severityIcon as M, isSuppressionActive as Mt, box as N, loadConfig as Nt, okIcon as O, createIgnoreMatcher as Ot, measure as P, readFileBounded as Pt, TRUST_RUNGS as Q, scoreGauge as R, buildEvidenceGraph as Rt, renderSuppressions as S, parseYamlGuarded as St, FLAKE_GLYPH as T, detectFrameworks as Tt, sweepStaleTempFiles as U, SEVERITY_ORDER as Ut, wrapText as V, QA_IMPACT_LABELS as Vt, writeFileAtomic as W, TRUST_ORDER as Wt, testsAnalyzedCell as X, headlineFor as Y, verdictFor as Z, summarizeForensicVerdicts as _, SCAN_ADAPTERS as _t, applyPostScanProcessing as a, correlateFindings as at, loadLocalRules as b, parseAzurePipeline as bt, discoverAndParseRuntimeReport as c, capForTier as ct, isValidFindingRecord as d, massCeiling as dt, SCORE as et, pathMatchesGlob as f, RETIRED_RULE_IDS as ft, selectAdapter as g, runGit as gt, scan_pipeline_exports as h, resolveGitPath as ht, SUITE_INVALIDATING_RULE_IDS as i, getReachableFiles as it, sectionHeader as j, ConfigValidationError as jt, panel as k, globToRegExp as kt, discoverTestFilesPhase as l, computeDimensions as lt, runScan as m, getRule as mt, KNOWN_RULE_IDS as n, TINT as nt, assembleScanResult as o, classifyProvenance as ot, runFileAnalysisPhase as p, RULES as pt, evidenceLevelOf as q, isValidCategory as qt, OVERLAP_META_BY_RULE_ID as r, buildDependencyGraph as rt, buildUniversalRules as s, computeAgenticProfile as st, EVIDENCE_OVERRIDES as t, STATUS as tt, fallbackWorkspace as u, deductionFor as ut, pluginsGateOpen as v, SEARCHED_FOR as vt, sanitizeErrorText as w, parseTsFile as wt, loadSuppressions as x, parseWorkflow as xt, renderGateNotice as y, isAzurePipelineFixture as yt, shouldColorize as z, MEASURED_FP as zt };
+
+//# sourceMappingURL=scan-pipeline-CCJdEKNa.mjs.map