mjolnir-qa 3.0.0 → 4.0.0

package/dist/cli.mjs

@@ -1,17 +1,297 @@
 #!/usr/bin/env node
-import { $ as correlateFindings, A as plainContext, At as parseJsonFile, B as shouldUseAscii, Bt as isValidCategory, C as runForensics, Ct as globToRegExp, D as nextStep, Dt as loadConfig, E as buildFooter, Et as isSuppressionActive, F as padTo, Ft as QA_IMPACT_LABELS, G as EVIDENCE, H as deriveScoreState, I as palette, It as RULE_CATEGORIES, J as atomicTempPath, K as TINT, L as sanitizeData, Lt as SEVERITY_ORDER$1, M as severityIcon, Mt as buildEvidenceGraph, N as box, Nt as MEASURED_FP, O as okIcon, Ot as readFileBounded, P as measure, Pt as DEDUCTIONS, Q as getReachableFiles, R as scoreGauge, Rt as deriveEvidenceLevel, S as renderSuppressions, St as createIgnoreMatcher, T as FLAKE_GLYPH, Tt as ConfigValidationError, U as headlineFor, V as wrapText, W as BADGE_BAND, X as writeFileAtomic, Y as sweepStaleTempFiles, Z as buildDependencyGraph, _t as computeCodeText, at as massCeiling, b as loadLocalRules, bt as DEFAULT_IGNORE_MATCHER, ct as getRule, dt as SCAN_ADAPTERS, et as classifyProvenance, ft as SEARCHED_FOR, gt as parseYamlGuarded, h as scan_pipeline_exports, ht as parseWorkflow, it as deductionFor, j as sectionHeader, jt as ENGINE_VERSION, k as panel, kt as isRecord$3, lt as resolveGitPath, m as runScan$1, mt as parseAzurePipeline, n as KNOWN_RULE_IDS$1, nt as capForTier, ot as RETIRED_RULE_IDS, pt as isAzurePipelineFixture, q as TRUST, rt as computeDimensions, st as RULES, tt as computeAgenticProfile, ut as runGit, v as pluginsGateOpen, vt as parseTsFile, w as sanitizeErrorText, wt as isLintFixtureDir, x as loadSuppressions, xt as LIMITS, y as renderGateNotice, yt as detectFrameworks, z as shouldColorize, zt as isAdvisoryFinding } from "./scan-pipeline-CAH9_Qgh.mjs";
+import { $ as BADGE_BAND, A as plainContext, At as isLintFixtureDir, B as shouldUseAscii, Bt as DEDUCTIONS, C as runForensics, Ct as computeCodeText, D as nextStep, Dt as LIMITS, E as buildFooter, Et as DEFAULT_IGNORE_MATCHER, F as padTo, Ft as isRecord$3, G as countOrNull, Gt as deriveEvidenceLevel, H as atomicTempPath, Ht as RULE_CATEGORIES, I as palette, It as parseJsonFile, J as evidenceTag, K as deriveScoreState, Kt as isAdvisoryFinding, L as sanitizeData, Lt as ENGINE_VERSION, M as severityIcon, Mt as isSuppressionActive, N as box, Nt as loadConfig, O as okIcon, Ot as createIgnoreMatcher, P as measure, Pt as readFileBounded, Q as TRUST_RUNGS, R as scoreGauge, Rt as buildEvidenceGraph, S as renderSuppressions, St as parseYamlGuarded, T as FLAKE_GLYPH, Tt as detectFrameworks, U as sweepStaleTempFiles, Ut as SEVERITY_ORDER$1, V as wrapText, Vt as QA_IMPACT_LABELS, W as writeFileAtomic, Wt as TRUST_ORDER, X as testsAnalyzedCell, Y as headlineFor, Z as verdictFor, _t as SCAN_ADAPTERS, at as correlateFindings, b as loadLocalRules, bt as parseAzurePipeline, ct as capForTier, dt as massCeiling, et as SCORE, ft as RETIRED_RULE_IDS, gt as runGit, h as scan_pipeline_exports, ht as resolveGitPath, it as getReachableFiles, j as sectionHeader, jt as ConfigValidationError, k as panel, kt as globToRegExp, lt as computeDimensions, m as runScan$1, mt as getRule, n as KNOWN_RULE_IDS$1, nt as TINT, ot as classifyProvenance, pt as RULES, q as evidenceLevelOf, qt as isValidCategory, rt as buildDependencyGraph, st as computeAgenticProfile, tt as STATUS, ut as deductionFor, v as pluginsGateOpen, vt as SEARCHED_FOR, w as sanitizeErrorText, wt as parseTsFile, x as loadSuppressions, xt as parseWorkflow, y as renderGateNotice, yt as isAzurePipelineFixture, z as shouldColorize, zt as MEASURED_FP } from "./scan-pipeline-CCJdEKNa.mjs";
 import { accessSync, appendFileSync, chmodSync, constants, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import process$1 from "node:process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createHash } from "node:crypto";
+import { execFileSync } from "node:child_process";
 import ts, { ts as ts$1 } from "ts-morph";
 import { parse } from "yaml";
-import { execFileSync } from "node:child_process";
 import { createInterface } from "node:readline";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { tmpdir } from "node:os";
 import { isDeepStrictEqual } from "node:util";
+//#region src/claim-evidence.ts
+/**
+* The one place a rendered surface decides whether it may claim "clean".
+*
+* Trust Constitution laws 1, 2 and 11:
+*   1. Unknown is not Pass.
+*   2. Unsupported is not Pass.
+*  11. Partial is never clean; a complete empty result may be clean, an
+*      incomplete empty result is INCONCLUSIVE.
+*
+* The prototype commands each grew their own version of this decision, and
+* each of them got it subtly wrong — a hardcoded zero that read as a
+* measurement, a fabricated pass on an empty run, a partial scan that exited
+* clean. One function, one decision, so a surface cannot be more confident
+* than the evidence it was given.
+*/
+/**
+* The single determination. Callers may not compute their own.
+*/
+function decideClaim(evidence) {
+	if (!evidence.supported) return {
+		state: "INCONCLUSIVE",
+		exitCode: 2,
+		reason: evidence.unsupportedReason ? `UNSUPPORTED: ${evidence.unsupportedReason}` : "UNSUPPORTED: this surface cannot make a claim about the target."
+	};
+	if (evidence.partial) return {
+		state: "INCONCLUSIVE",
+		exitCode: 2,
+		reason: "PARTIAL: the analysis did not cover the whole surface, so no clean or blocking claim is made."
+	};
+	if (evidence.blockingFindings > 0) return {
+		state: "BLOCKED",
+		exitCode: 1,
+		reason: `BLOCKED: ${evidence.blockingFindings} finding(s) at the configured gate.`
+	};
+	return {
+		state: "READY",
+		exitCode: 0,
+		reason: "READY: complete analysis, no findings at the configured gate."
+	};
+}
+/**
+* Fail-closed for a surface that has no measurement of its own. A prototype
+* command that cannot measure must say so rather than render a plausible
+* number, and must not exit clean while doing it.
+*/
+function unmeasuredClaim(surface, why) {
+	return {
+		state: "INCONCLUSIVE",
+		exitCode: 2,
+		reason: `UNMEASURED: ${surface} cannot measure this. ${why}`
+	};
+}
+/**
+* The one exit-code matrix (plan V5-002).
+*
+* Every command that finishes an analysis routes its exit code through this
+* function. The previous arrangement had each surface compute its own, and
+* the gaps were not subtle:
+*
+*   - `--score` returned `exitForFindings(...)` with no `partial` check at
+*     all, so `--score` on a truncated scan with zero findings exited 0. That
+*     is the flag CI badge and baseline tooling use.
+*   - `exitForFindings` knew nothing about partial, so any caller that forgot
+*     the check silently produced a clean result.
+*
+* The order is the contract: an incomplete analysis is INCONCLUSIVE before
+* findings are considered at all. There is no gate setting that turns a
+* partial scan into a pass — `--blocking none` suppresses *findings*, not the
+* fact that the analysis did not finish.
+*/
+function scanExitCode(input) {
+	if (input.partial) return 2;
+	if (input.gate === "advisory") return 0;
+	const gateSeverities = input.gate === "warning" ? ["error", "warning"] : ["error"];
+	return input.findings.some((f) => gateSeverities.includes(f.severity) && input.isAdvisory?.(f) !== true) ? 1 : 0;
+}
+//#endregion
+//#region src/frameworks/framework-inventory.ts
+const FRAMEWORK_INVENTORY = [
+	{
+		frameworkId: "playwright",
+		entityType: "E2E_FRAMEWORK",
+		language: "TypeScript/JavaScript",
+		executorAdapterIds: ["typescript"],
+		maturity: "F4",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F5",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: [
+			"1.44",
+			"1.45",
+			"1.46",
+			"1.47",
+			"1.48"
+		],
+		keyGapForNextLevel: "GAP-PW-006 parallelism/worker safety analysis"
+	},
+	{
+		frameworkId: "jest",
+		entityType: "TEST_FRAMEWORK",
+		language: "TypeScript/JavaScript",
+		executorAdapterIds: ["typescript"],
+		maturity: "F3",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F4",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: ["29", "30"],
+		keyGapForNextLevel: "GAP-JEST-004 lifecycle modeling"
+	},
+	{
+		frameworkId: "vitest",
+		entityType: "TEST_FRAMEWORK",
+		language: "TypeScript/JavaScript",
+		executorAdapterIds: ["typescript"],
+		maturity: "F3",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F4",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: [
+			"1.6",
+			"2.0",
+			"2.1"
+		],
+		keyGapForNextLevel: "GAP-VIT-004 lifecycle modeling"
+	},
+	{
+		frameworkId: "pytest",
+		entityType: "TEST_FRAMEWORK",
+		language: "Python",
+		executorAdapterIds: ["python"],
+		maturity: "F2",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F3",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: [
+			"7.4",
+			"8.0",
+			"8.1",
+			"8.2",
+			"8.3"
+		],
+		keyGapForNextLevel: "GAP-PY-004 lifecycle modeling"
+	},
+	{
+		frameworkId: "junit",
+		entityType: "TEST_FRAMEWORK",
+		language: "Java",
+		executorAdapterIds: ["java"],
+		maturity: "F2",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F3",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: ["5.10", "5.11"],
+		keyGapForNextLevel: "GAP-JU-004 lifecycle modeling"
+	},
+	{
+		frameworkId: "nunit",
+		entityType: "TEST_FRAMEWORK",
+		language: "C#",
+		executorAdapterIds: ["csharp"],
+		maturity: "F2",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F3",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: ["3.14", "4.2"],
+		keyGapForNextLevel: "GAP-NU-004 lifecycle modeling"
+	},
+	{
+		frameworkId: "xunit",
+		entityType: "TEST_FRAMEWORK",
+		language: "C#",
+		executorAdapterIds: ["csharp"],
+		maturity: "F2",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F3",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: ["2.9"],
+		keyGapForNextLevel: "GAP-XU-004 lifecycle modeling"
+	},
+	{
+		frameworkId: "cypress",
+		entityType: "E2E_FRAMEWORK",
+		language: "TypeScript/JavaScript",
+		executorAdapterIds: ["typescript"],
+		maturity: "F2",
+		supportStatus: "EXPERIMENTAL",
+		targetMaturity: "F3",
+		targetSupportStatus: "OFFICIAL_PARTIAL",
+		validatedVersions: ["13"],
+		keyGapForNextLevel: "GAP-CY-004 lifecycle modeling"
+	},
+	{
+		frameworkId: "selenium",
+		entityType: "AUTOMATION_LIBRARY",
+		language: "Java/TypeScript/Python",
+		executorAdapterIds: [
+			"typescript",
+			"python",
+			"java"
+		],
+		maturity: "F1",
+		supportStatus: "EXPERIMENTAL",
+		targetMaturity: "F2",
+		targetSupportStatus: "OFFICIAL_PARTIAL",
+		validatedVersions: [
+			"4.20",
+			"4.21",
+			"4.22",
+			"4.23",
+			"4.24",
+			"4.25"
+		],
+		keyGapForNextLevel: "GAP-SE-002 AST-based usage analysis"
+	},
+	{
+		frameworkId: "testng",
+		entityType: "TEST_FRAMEWORK",
+		language: "Java",
+		executorAdapterIds: ["java"],
+		maturity: "F1",
+		supportStatus: "EXPERIMENTAL",
+		targetMaturity: "F2",
+		targetSupportStatus: "OFFICIAL_PARTIAL",
+		validatedVersions: ["7.10", "7.11"],
+		keyGapForNextLevel: "GAP-TN-002 AST-based usage analysis"
+	},
+	{
+		frameworkId: "github-actions",
+		entityType: "CI_PROVIDER",
+		language: "YAML",
+		executorAdapterIds: ["github-actions"],
+		maturity: "F3",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F4",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: ["v4"],
+		keyGapForNextLevel: "GAP-GHA-004 advanced matrix strategy modeling"
+	},
+	{
+		frameworkId: "azure-devops",
+		entityType: "CI_PROVIDER",
+		language: "YAML",
+		executorAdapterIds: ["azure-pipelines"],
+		maturity: "F3",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F4",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: ["2024"],
+		keyGapForNextLevel: "GAP-AZ-004 stage dependency graph modeling"
+	},
+	{
+		frameworkId: "jenkins",
+		entityType: "CI_PROVIDER",
+		language: "Groovy/YAML",
+		executorAdapterIds: ["jenkins"],
+		maturity: "F3",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F4",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: ["2.440", "2.450"],
+		keyGapForNextLevel: "GAP-JK-004 declarative pipeline advanced features"
+	},
+	{
+		frameworkId: "gitlab-ci",
+		entityType: "CI_PROVIDER",
+		language: "YAML",
+		executorAdapterIds: [],
+		maturity: "F0",
+		supportStatus: "UNSUPPORTED",
+		targetMaturity: "F1",
+		targetSupportStatus: "DISCOVERED",
+		validatedVersions: [],
+		keyGapForNextLevel: "GAP-GL-001 basic pipeline discovery"
+	}
+];
+function getFrameworkById(frameworkId) {
+	return FRAMEWORK_INVENTORY.find((f) => f.frameworkId === frameworkId);
+}
+//#endregion
 //#region src/commands/help.ts
 /** Ordered registry — grouped by the same categories the overview uses. */
 const HELP_ENTRIES = [
@@ -247,6 +527,80 @@ const HELP_ENTRIES = [
 		summary: "run as a read-only MCP server over stdio (scan / explain / diff / verify / forensics / triage / pw-report)",
 		usage: "mjolnir mcp",
 		examples: ["mjolnir mcp"]
+	},
+	{
+		verb: "release-report",
+		summary: "release readiness verdict: GO, CONDITIONAL GO, or NO-GO",
+		usage: "mjolnir release-report [path] [--since <ref>] [--history <json>]",
+		examples: ["mjolnir release-report . --since HEAD~1"]
+	},
+	{
+		verb: "report",
+		summary: "generate a Playwright-compatible report from scan results",
+		usage: "mjolnir report [path] [--output <file>]",
+		examples: ["mjolnir report . --output playwright-report.json"]
+	},
+	{
+		verb: "trend",
+		summary: "record, show, or diff local quality trend snapshots",
+		usage: "mjolnir trend <record|show|diff> [path] [--limit <N>]",
+		examples: ["mjolnir trend record .", "mjolnir trend show ."]
+	},
+	{
+		verb: "exec-report",
+		summary: "generate executive quality KPIs, risk, and recommendations (advisory)",
+		usage: "mjolnir exec-report [path]",
+		examples: ["mjolnir exec-report ."]
+	},
+	{
+		verb: "policy",
+		summary: "initialize, validate, or check team quality policy gates",
+		usage: "mjolnir policy <init|validate|check> [path] [--policy <file>]",
+		examples: ["mjolnir policy init .", "mjolnir policy check . --policy mjolnir.policy.json"]
+	},
+	{
+		verb: "quarantine",
+		summary: "review deterministic quarantine proposals (read-only prototype)",
+		usage: "mjolnir quarantine <list|review|stats> [path]",
+		examples: ["mjolnir quarantine list .", "mjolnir quarantine stats"]
+	},
+	{
+		verb: "analyze",
+		summary: "run bounded cross-file analysis with explicit findings",
+		usage: "mjolnir analyze [path] --cross-file",
+		examples: ["mjolnir analyze . --cross-file"]
+	},
+	{
+		verb: "ci-adapter",
+		summary: "generate GitHub Actions, GitLab CI, or Jenkins templates",
+		usage: "mjolnir ci-adapter <github|gitlab|jenkins> [target]",
+		examples: ["mjolnir ci-adapter github ."]
+	},
+	{
+		verb: "dashboard",
+		summary: "generate a self-contained quality dashboard HTML artifact",
+		usage: "mjolnir dashboard [path] [--output <file>]",
+		examples: ["mjolnir dashboard . --output dashboard.html"]
+	},
+	{
+		verb: "enterprise",
+		summary: "capability manifest for deployment review — records what this product does NOT provide (no server, no SSO, no hosted tier, no compliance packet)",
+		usage: "mjolnir enterprise config [output-dir]",
+		examples: ["mjolnir enterprise config ./enterprise-output"],
+		next: "sso and compliance subcommands were removed in 4.0 — they wrote artifacts describing capabilities Mjölnir does not have. Read the manifest's `notProvided` list instead."
+	},
+	{
+		verb: "business-case",
+		summary: "measured false-positive rates per finding; a cost figure only with --incident-cost",
+		usage: "mjolnir business-case [path] [--incident-cost <n>] [--strict]",
+		examples: ["mjolnir business-case .", "mjolnir business-case . --incident-cost 25000"],
+		next: "Mjölnir will not estimate the cost of a false-green incident for you — that number has to come from your own incident history."
+	},
+	{
+		verb: "maturity",
+		summary: "presence of named QA artifacts (a signal, not a maturity score)",
+		usage: "mjolnir maturity <assess|levels> [path]",
+		examples: ["mjolnir maturity assess .", "mjolnir maturity levels"]
 	}
 ];
 /** Scan-flag entries documented per-flag via the overview. */
@@ -400,7 +754,9 @@ const GROUPS = [
 			"baseline",
 			"diff",
 			"verify",
-			"ci-integrity"
+			"ci-integrity",
+			"ci-adapter",
+			"policy"
 		]
 	},
 	{
@@ -433,7 +789,17 @@ const GROUPS = [
 			"trust-trend",
 			"evidence-graph",
 			"framework-maturity",
-			"suppression-gate"
+			"suppression-gate",
+			"business-case",
+			"release-report",
+			"report",
+			"trend",
+			"exec-report",
+			"quarantine",
+			"analyze",
+			"dashboard",
+			"enterprise",
+			"maturity"
 		]
 	},
 	{
@@ -569,6 +935,133 @@ function renderRootHelp(schemaVersion = 1, options = {}) {
 	return lines.join("\n");
 }
 //#endregion
+//#region src/integrations/sentry.ts
+/**
+* Sentry crash reporting — opt-in, and inert unless a DSN is configured.
+*
+* Why opt-in: Mjölnir ships as an `npx` CLI over other people's private
+* repositories. A tool that reads a codebase must never phone home on its
+* own, so the ONLY switch is an explicit `SENTRY_DSN` in the environment.
+* Absent that, every function here returns immediately and `@sentry/node` is
+* never imported — zero network, zero added startup cost on a path whose
+* whole selling point is scan speed.
+*
+* Why an optional peer dependency: `@sentry/node` is ~1.5 MB unpacked and
+* nothing in a code scanner needs it. Making it a hard `dependency` would
+* tax every install for a feature most users never turn on, so it is an
+* optional peer: installs on request (`npm i @sentry/node`), absent by
+* default, and a missing module is handled as "reporting unavailable"
+* rather than as a crash.
+*
+* Capture points are deliberately the two EXISTING top-level catch blocks
+* (cli.ts entry, mcp/stdio.ts) rather than `process.on("uncaughtException")`
+* / `("unhandledRejection")` handlers. Registering those would silently
+* change the CLI's frozen exit-code contract (§24.1) and could keep a
+* process alive after a fatal error. One capture point per surface is
+* enough to answer "did Mjölnir itself break, and where".
+*
+* What is deliberately NOT sent: no user data (`sendDefaultPii: false`), no
+* traced request/span data (`tracesSampleRate: 0` — a batch CLI has no
+* request to trace), no console breadcrumbs, and no scan findings or file
+* contents. Events carry the error, its stack, the release, and the surface
+* that raised it.
+*/
+/** The loaded SDK, or null while reporting is off/unavailable. */
+let sdk = null;
+/**
+* Flush budget for the process-exit paths. Long enough for one HTTPS
+* envelope on a slow link, short enough that a broken network cannot turn
+* a crashed CLI into a hung one. Sentry's own default is 2s.
+*/
+const FLUSH_TIMEOUT_MS = 2e3;
+/** Writes a diagnostic without touching stdout. */
+function warn(message) {
+	process.stderr.write(`mjolnir: sentry — ${message}\n`);
+}
+/**
+* The release name Sentry groups events under. Matches the npm package
+* name so a release created from a tag and a release reported by the SDK
+* are the same release, not two half-populated ones.
+*/
+const SENTRY_RELEASE = `mjolnir-qa@${ENGINE_VERSION}`;
+/**
+* Resolve the environment tag. Unset means "a developer's machine" unless
+* CI says otherwise: a `npx` run is not a production event, and filing
+* those under `production` would poison the issue stream with noise from
+* end users triaging their own repos.
+*/
+function resolveEnvironment() {
+	const fromEnv = process.env.SENTRY_ENVIRONMENT?.trim();
+	if (fromEnv) return fromEnv;
+	return process.env.CI ? "ci" : "local";
+}
+/**
+* Turn reporting on if — and only if — a DSN is configured. Safe to call
+* from every entry point: the second call is a no-op that returns the
+* already-decided answer, so a process that reaches two surfaces cannot
+* initialize the SDK twice.
+*
+* Returns true when reporting is live. Never throws: a monitoring
+* integration that can take down the tool it monitors has failed at its
+* one job.
+*/
+async function initSentry() {
+	if (sdk) return true;
+	const dsn = process.env.SENTRY_DSN?.trim();
+	if (!dsn) return false;
+	let loaded;
+	try {
+		loaded = await import("@sentry/node");
+	} catch {
+		warn("SENTRY_DSN is set but @sentry/node is not installed. Install it with: npm install @sentry/node");
+		return false;
+	}
+	try {
+		loaded.init({
+			dsn,
+			release: SENTRY_RELEASE,
+			environment: resolveEnvironment(),
+			tracesSampleRate: 0,
+			sendDefaultPii: false,
+			attachStacktrace: true
+		});
+	} catch (error) {
+		warn(`SDK init failed (${error instanceof Error ? error.message : String(error)}). Crash reporting stays off.`);
+		return false;
+	}
+	sdk = loaded;
+	return true;
+}
+/**
+* Report one fatal error. `surface` names the entry point that raised it
+* ("cli" or "mcp") so the issue stream can be split by how Mjölnir was
+* being used when it broke. A non-Error throw is reported as-is rather
+* than dropped: a hostile throw value is exactly the case worth seeing.
+*/
+function captureInternalError(error, surface) {
+	if (!sdk) return;
+	try {
+		sdk.captureException(error, { tags: { surface } });
+	} catch (captureError) {
+		warn(`capture failed (${captureError instanceof Error ? captureError.message : String(captureError)}).`);
+	}
+}
+/**
+* Deliver anything buffered before the process exits. Awaits the SDK's
+* own transport drain and returns whether the envelope was handed off;
+* the caller is on an exit path, so the answer is deliberately not
+* surfaced as a failure — a lost crash report must not change the exit
+* code a caller (or CI) is about to read.
+*/
+async function flushSentry(timeoutMs = FLUSH_TIMEOUT_MS) {
+	if (!sdk) return false;
+	try {
+		return await sdk.flush(timeoutMs);
+	} catch {
+		return false;
+	}
+}
+//#endregion
 //#region src/integrations/ci-install.ts
 /**
 * CI integration (Sprint-Plan W7): generates .github/workflows/mjolnir.yml
@@ -583,8 +1076,10 @@ function renderRootHelp(schemaVersion = 1, options = {}) {
 * `ciInstall` silently overwrote hand-customized workflows. The template now
 * mirrors the dogfooded `.github/workflows/mjolnir.yml` (pinned action SHAs,
 * `if: always()` on reporting steps, a real gate step that reads
-* `mjolnir.json`, partial scans never block) and `ciInstall` refuses to
-* replace a customized workflow without an explicit `--force`.
+* `mjolnir.json`, and `ciInstall` refuses to replace a customized workflow
+* without an explicit `--force`. A partial scan FAILS the generated gate: an
+* analysis that did not finish has not proven anything about the surface it
+* did not reach.
 */
 /**
 * The gate-check script embedded in generated workflows (and executed
@@ -609,8 +1104,8 @@ function gateScript(gate) {
 		"  process.exit(1);",
 		"}",
 		"if (r.partial === true) {",
-		"  process.stdout.write(\"Scan was PARTIAL - some files were not analyzed; gate not enforced.\\n\");",
-		"  process.exit(0);",
+		"  process.stderr.write(\"Scan was PARTIAL - some files were not analyzed, so the surface is unverified. Failing: an incomplete scan is not a pass.\\n\");",
+		"  process.exit(1);",
 		"}",
 		"const findings = Array.isArray(r.findings) ? r.findings : [];",
 		"const errors = findings.filter(function (f) { return f && f.severity === \"error\"; }).length;",
@@ -621,6 +1116,39 @@ function gateScript(gate) {
 	].join("\n");
 }
 /**
+* The npm version a generated workflow should install.
+*
+* A generated CI workflow that names a version npm does not have is not a
+* configuration file, it is a 404 on the first run. While the working
+* candidate is a release candidate, `CLI_VERSION` is not on the registry, so
+* the npx template used to emit a tarball URL that could not resolve.
+*
+* Resolution order:
+*  1. `publishedStable` from the nearest package.json — the record of the last
+*     published release, present in current builds.
+*  2. That package's own `version` — correct for an installed published
+*     package (3.0.0 shipped before `publishedStable` existed).
+*  3. `CLI_VERSION` — a development build, where naming the working version
+*     is the honest description of what is being generated.
+*/
+function publishedVersionForInstall(startDir = import.meta.dirname) {
+	let dir = resolve(startDir);
+	for (let depth = 0; depth < 12; depth++) {
+		const candidate = join(dir, "package.json");
+		if (existsSync(candidate)) try {
+			const parsed = JSON.parse(readFileSync(candidate, "utf8"));
+			if (parsed.name === "mjolnir-qa") {
+				if (typeof parsed.publishedStable === "string" && parsed.publishedStable) return parsed.publishedStable;
+				if (typeof parsed.version === "string" && parsed.version) return parsed.version;
+			}
+		} catch {}
+		const parent = dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return ENGINE_VERSION;
+}
+/**
 * Template v2 (Terminal + CI UX Overhaul plan, M4): the summary step
 * calls `mjolnir summary mjolnir.json` — annotations + step summary via
 * ONE emitter — instead of the v1 inline SUMMARY_SCRIPT. The gate
@@ -661,6 +1189,12 @@ function indentBlock(text, spaces) {
 	return text.split("\n").map((l) => l.length > 0 ? pad + l : l).join("\n");
 }
 /** The generated workflow for one gate level. Exported for template tests. */
+/**
+* The npm version both generated templates install. Resolved once at module
+* load from the running package's own manifest, so a generated workflow can
+* never name a version the registry does not have.
+*/
+const INSTALL_VERSION = publishedVersionForInstall();
 const TEMPLATE = (gate) => `name: Mjölnir
 
 on:
@@ -686,15 +1220,15 @@ jobs:
           persist-credentials: false
       - name: Scan changed code (exit 1/2 is data — the gate step decides)
         continue-on-error: true
-        run: npx --yes https://registry.npmjs.org/mjolnir-qa/-/mjolnir-qa-${ENGINE_VERSION}.tgz . --scope changed --json > mjolnir.json
+        run: npx --yes https://registry.npmjs.org/mjolnir-qa/-/mjolnir-qa-${INSTALL_VERSION}.tgz . --scope changed --json > mjolnir.json
       - name: Annotations + Job Summary
         if: always()
         continue-on-error: true
-        run: npx --yes https://registry.npmjs.org/mjolnir-qa/-/mjolnir-qa-${ENGINE_VERSION}.tgz summary mjolnir.json
+        run: npx --yes https://registry.npmjs.org/mjolnir-qa/-/mjolnir-qa-${INSTALL_VERSION}.tgz summary mjolnir.json
       - name: Render PR comment
         if: always()
         continue-on-error: true
-        run: npx --yes https://registry.npmjs.org/mjolnir-qa/-/mjolnir-qa-${ENGINE_VERSION}.tgz pr-comment --from mjolnir.json > mjolnir-comment.md
+        run: npx --yes https://registry.npmjs.org/mjolnir-qa/-/mjolnir-qa-${INSTALL_VERSION}.tgz pr-comment --from mjolnir.json > mjolnir-comment.md
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
@@ -764,23 +1298,35 @@ const GATES = [
 ];
 /**
 * The action-ref the action-based template pins (P1: distribution).
-* `v1` is the major moving tag release.yml's action-tags job maintains on
-* every stable release — Marketplace convention. The generated workflow
-* pins the major, never @latest: a new release must not change gate
-* semantics without a commit of the consumer's.
+* The current `v3` major is maintained on every stable release by the
+* dedicated Action tag workflow. The generated workflow pins an immutable
+* Action SHA, never @latest.
 */
 const ACTION_REF = "Sergey-Bar/Mjolnir@4a588bc62d517bc85fc44c0eae64c6587d3bf70b";
 /**
 * The action-based workflow for one gate level (P1.3): the root
 * action.yml does checkout-independent scanning — setup-node, the scan
 * itself (writing mjolnir.json for the reporting steps), and the gate
-* via the action's `fail-on` input. The action owns the gate: with
-* fail-on error/warning its step exits 1 on findings at the gate, so the
-* workflow needs no separate gate step; partial scans never block (the
-* action downgrades exit 2 to a loud warning, per the frozen exit-code
-* contract). Reporting steps run `if: always()` exactly like the npx
-* template. Advisory mode adds an explicit advisory note as the last
-* step so the job summary says "never blocking" in plain words.
+* via the action's `fail-on` input. Reporting steps run `if: always()`
+* exactly like the npx template, so a run that found something still
+* produces a report.
+*
+* Three defects this template used to ship, all of which made a check that
+* could never go red:
+*
+*  1. The gate read `steps.mjolnir.outputs.exit`. The Action exposes
+*     `exit_code` — and exposing it as `exit-code` was itself the bug: a
+*     hyphenated output name parses as subtraction in an expression, so the
+*     read produced an empty string, neither branch fired, and the gate exited
+*     0 on findings. This is the same class as the Action output-id mismatch
+*     fixed in `action.yml`; the generated copy had to be fixed too, or every
+*     new user inherited it.
+*  2. Exit 2 (partial) was downgraded to a warning. An analysis that did not
+*     finish is not a pass — see the exit-code contract in docs/VERSIONING.md.
+*  3. `version:` was pinned to the engine's working version, which while the
+*     candidate is a release candidate is not on npm, so the generated
+*     workflow could not install what it asked for. The input is omitted now
+*     and the Action's own default (the published stable) applies.
 */
 const ACTION_TEMPLATE = (gate) => `name: Mjölnir
 
@@ -813,7 +1359,6 @@ jobs:
           scope: changed
           format: json
           fail-on: ${gate === "advisory" ? "none" : gate}
-          version: ${ENGINE_VERSION}
           pr-comment: "false"
           trust-artifact: "false"
           annotations: "true"
@@ -828,15 +1373,16 @@ jobs:
         if: always()
         shell: bash
         env:
-          MJ_SCAN_EXIT: \${{ steps.mjolnir.outputs.exit }}
+          MJ_SCAN_EXIT: \${{ steps.mjolnir.outputs.exit_code }}
         run: |
-          if [ "$MJ_SCAN_EXIT" = "1" ]; then
-            exit 1
-          fi
-          if [ "$MJ_SCAN_EXIT" = "2" ]; then
-            echo "::warning::Mjolnir analysis is partial; reporting remains visible but the gate is not claimed."
-          fi
-          exit 0
+          set -euo pipefail
+          case "\${MJ_SCAN_EXIT:-}" in
+            0) echo "Mjölnir scan clean at the configured gate." ;;
+            1) echo "::error::Mjölnir gate failed: findings at the configured gate."; exit 1 ;;
+            2) echo "::error::Mjölnir scan was PARTIAL — the surface was not fully analyzed, so no clean claim is made."; exit 1 ;;
+            "") echo "::error::Mjölnir produced no exit code; the action step did not run."; exit 1 ;;
+            *) echo "::error::Mjölnir exited \${MJ_SCAN_EXIT} (usage/internal error)."; exit 1 ;;
+          esac
 
   publish:
     needs: scan
@@ -912,7 +1458,7 @@ function ciInstall(root, gate, options = {}) {
 			diffSummary: summarizeContentDiff(current, template)
 		};
 	}
-	writeFileSync(target, template);
+	writeFileAtomic(target, template);
 	return {
 		written: target,
 		existed,
@@ -2963,16 +3509,6 @@ function renderTerminal(result, opts) {
 	appendFooter(lines, result, ui);
 	return lines.join("\n");
 }
-/**
-* Contract-stable three-band verdict (property-locked in
-* tests/scoring-precision.spec.ts). Delegates to the ScoreState model —
-* 100 keeps returning WORTHY here; the FORGED premium treatment lives
-* in the dedicated block, not in this public mapping.
-*/
-function verdictFor(score) {
-	const verdict = deriveScoreState(score).verdict;
-	return verdict === "FORGED" ? "WORTHY" : verdict;
-}
 /** Appends the score, gauge, verdict, and honesty metadata for the full scan. */
 function appendScoreSection(lines, result, p, width, ascii) {
 	const state = deriveScoreState(result.score);
@@ -3109,26 +3645,9 @@ function appendNextActions(lines, display, fullResult, ui) {
 	} else if (partial) lines.push(nextStep("mjolnir --verbose", ui));
 	lines.push("");
 }
-function evidenceTag$1(f) {
-	const level = f.evidenceLevel ?? deriveEvidenceLevel(f.findingType, f.confidence);
-	let tag = `${level} · ${level === "E2" ? "deterministic" : level === "E1" ? "heuristic" : "observation"}`;
-	if (f.measuredFpRate !== void 0) {
-		tag += ` · measured FP ${Math.round(f.measuredFpRate * 100)}%`;
-		if (f.measuredFpN !== void 0) tag += ` · n=${f.measuredFpN}`;
-	}
-	if (f.trustLevel !== void 0) tag += ` · trust ${f.trustLevel}`;
-	if (f.runtimeCorroboration !== void 0) {
-		const c = f.runtimeCorroboration;
-		let label = "file executed";
-		if (c.level === "defect") label = "defect corroborated";
-		else if (c.level === "test") label = "test executed";
-		tag += ` · runtime: ${label}`;
-	}
-	return `[${tag}]`;
-}
 /** Deterministic per-severity verification hint: what re-running should
-* show after the fix lands. Deduction is the honest, evidence-discounted
-* number this finding costs right now. */
+*  show after the fix lands. Deduction is the honest, evidence-discounted
+*  number this finding costs right now. */
 function verifyHint(f) {
 	const pts = deductionFor(f);
 	if (f.severity === "error") return pts > 0 ? `Re-run mjolnir after the change — the gate should stop failing and the score should recover by ${pts}.` : "Re-run mjolnir after the change — the finding should no longer appear.";
@@ -3141,7 +3660,7 @@ function toCard(f, tone) {
 		severity: f.severity,
 		loc: `${sanitizeData(f.ruleId)} · ${sanitizeData(f.file)}:${f.line}`,
 		problem: sanitizeData(problem),
-		evidence: evidenceTag$1(f),
+		evidence: evidenceTag(f),
 		impact: `${f.qaImpact} — ${sanitizeData(f.why)}`,
 		fix: sanitizeData(f.fix),
 		verify: verifyHint(f)
@@ -3261,7 +3780,7 @@ function appendFindings(lines, result, counts, verbose, ui, tone) {
 				continue;
 			}
 			const groupHead = `  ${severityIcon(maxSeverity(unit.findings), ui)} ${p.bold(sanitizeData(unit.ruleId))} ${p.dim(`× ${n} — same fix applies`)}`;
-			const groupEvidence = evidenceTag$1(first);
+			const groupEvidence = evidenceTag(first);
 			if (measure(`${groupHead} ${groupEvidence}`) <= width) lines.push(`${groupHead} ${p.dim(groupEvidence)}`);
 			else {
 				lines.push(groupHead);
@@ -3350,7 +3869,7 @@ function appendFooter(lines, result, ui) {
 		complete: result.analysisStatus.discovery !== "partial",
 		durationMs: result.analysisStatus.durationMs
 	}));
-	const advisory = result.findings.filter((f) => (f.evidenceLevel ?? deriveEvidenceLevel(f.findingType, f.confidence)) === "E0").length;
+	const advisory = result.findings.filter((f) => evidenceLevelOf(f) === "E0").length;
 	if (advisory > 0) pushWrapped(lines, p, `${advisory} advisory finding${advisory === 1 ? "" : "s"} (E0 — observation only, no score impact)`, width);
 	if (result.findings.length > 0) {
 		const firedRuleIds = new Set(result.findings.map((f) => f.ruleId));
@@ -3412,29 +3931,89 @@ function countBySeverity(result) {
 	}
 	return counts;
 }
-EVIDENCE.e0, EVIDENCE.e1, EVIDENCE.e2;
-const RUNG_MEANINGS = [
-	"observation only",
-	"heuristic static",
-	"deterministic static",
-	"the finding's file executed",
-	"the finding's test executed",
-	"the run verdict corroborates"
-];
-const RUNG_COLORS = [
-	TRUST.l0,
-	TRUST.l1,
-	TRUST.l2,
-	TRUST.l3,
-	TRUST.l4,
-	TRUST.l5
-];
-const TRUST_RUNGS = RUNG_MEANINGS.map((meaning, i) => ({
-	level: `L${i}`,
-	meaning,
-	runtime: i >= 3,
-	color: RUNG_COLORS[i]
-}));
+//#endregion
+//#region src/engine/trust-classification.ts
+/**
+* Completeness, decided once.
+*
+* Every branch here treats ABSENCE as "not proven complete" rather than as
+* "complete". That is the whole point: a missing `analysisStatus` is not a
+* clean bill of health, a zero ceiling reason is not a claim, and treating
+* either as completeness is how an unmeasured run gets to say "trust them".
+*/
+function isComplete(result, summary) {
+	if (result.partial) return false;
+	if (summary.ceilingReasons.length > 0) return false;
+	const status = result.analysisStatus;
+	if (status === void 0) return false;
+	if (status.discovery !== "complete" || status.rules !== "complete") return false;
+	if ((status.skippedFiles ?? 0) > 0) return false;
+	if ((status.rulesCrashed ?? 0) > 0) return false;
+	return (status.reasons ?? []).length === 0;
+}
+/**
+* The determination. Every surface calls this; none of them re-derives it.
+*/
+function classifyTrust(result, summary) {
+	const gaps = [];
+	const complete = isComplete(result, summary);
+	if (result.partial) gaps.push("the scan was partial");
+	const status = result.analysisStatus;
+	if (status === void 0) gaps.push("the report carries no analysisStatus, so completeness is unknown");
+	else {
+		if (status.discovery !== "complete") gaps.push("discovery was truncated");
+		if (status.rules !== "complete") gaps.push("rule evaluation was truncated");
+		if ((status.skippedFiles ?? 0) > 0) gaps.push(`${status.skippedFiles} file(s) were skipped`);
+		if ((status.rulesCrashed ?? 0) > 0) gaps.push(`${status.rulesCrashed} rule(s) crashed`);
+		for (const reason of status.reasons ?? []) if (!gaps.some((g) => g.includes(reason))) gaps.push(reason);
+	}
+	for (const ceiling of summary.ceilingReasons) gaps.push(`confidence ceiling: ${ceiling}`);
+	if (!complete) return {
+		claim: "INCOMPLETE",
+		order: 0,
+		licensesClean: false,
+		reason: "the analysis did not finish, so it proves nothing about the surface it did not reach",
+		gaps
+	};
+	const level = summary.level;
+	const rank = TRUST_ORDER.indexOf(level);
+	const confident = summary.confidence >= .75;
+	if (rank >= TRUST_ORDER.indexOf("L4")) return {
+		claim: "RUN_EVIDENCE_BACKS_FINDINGS",
+		order: 5,
+		licensesClean: result.findings.length > 0,
+		reason: confident ? "a real run corroborates these findings" : "a run exists but coverage is thin — verify the gaps",
+		gaps
+	};
+	if (rank >= TRUST_ORDER.indexOf("L3")) return {
+		claim: "RUNTIME_CORROBORATED",
+		order: 4,
+		licensesClean: result.findings.length > 0,
+		reason: confident ? "the relevant files executed — static and runtime signal agree" : "files executed, but evidence is thin — treat findings as leads",
+		gaps
+	};
+	if (level === "L0" || summary.evidenceCoverage === 0) return {
+		claim: "NO_EVIDENCE",
+		order: 1,
+		licensesClean: false,
+		reason: "static signal only, with no runtime evidence — an observation, not a verdict",
+		gaps
+	};
+	if (confident) return {
+		claim: "DETERMINISTIC_STATIC",
+		order: 3,
+		licensesClean: true,
+		reason: "deterministic static analysis, complete but uncorroborated by a run",
+		gaps
+	};
+	return {
+		claim: "THIN_STATIC_SIGNAL",
+		order: 2,
+		licensesClean: true,
+		reason: "static analysis is complete but low-confidence — treat findings as leads",
+		gaps
+	};
+}
 //#endregion
 //#region src/lib/format.ts
 /**
@@ -3446,11 +4025,6 @@ function pct$1(v) {
 	return `${Math.round(v * 100)}%`;
 }
 //#endregion
-//#region src/reporter/evidence-tag.ts
-function evidenceTag(f) {
-	return f.runtimeCorroboration ? f.runtimeCorroboration.level === "defect" ? "run corroborated" : "run executed" : (f.evidenceLevel ?? "E2") === "E2" ? "deterministic" : "pattern";
-}
-//#endregion
 //#region src/reporter/trust-report.ts
 /**
 * The rung labels, built from `src/brand/symbols.ts` rather than typed
@@ -3469,16 +4043,25 @@ function evidenceTag(f) {
 */
 const TRUST_LABELS = Object.fromEntries(TRUST_RUNGS.map((r) => [r.level, `${r.level} · ${r.meaning}${r.runtime ? " · runtime" : ""}`]));
 /**
-* The human verdict line derived from the measurement. Deterministic
-* mapping from (level, confidence) bands — a measurement-derived label,
-* never a new verdict enum (plan §3/§36: no new global enums).
-*/
-function trustHeadline(s) {
-	if (s.level === "L5" || s.level === "L4") return s.confidence >= .75 ? "Run evidence backs these findings — trust them." : "Run evidence exists, but the scan was incomplete — verify the gaps.";
-	if (s.level === "L3") return s.confidence >= .75 ? "The relevant files executed — solid static + runtime signal." : "Files executed, evidence is thin — treat findings as leads.";
-	if (s.level === "L0") return "Static signal only, with no runtime evidence — treat as an observation, not a verdict.";
-	if (s.confidence >= .75) return "Deterministic static analysis — trustworthy, uncorroborated by a run.";
-	return "Static signal only, incomplete analysis — treat as leads, not verdicts.";
+* The human verdict line, rendered from the ONE determination.
+*
+* This used to be a band mapping over (level, confidence) living here, in the
+* reporter — engine knowledge in a presentation layer, which is how a second
+* surface ends up disagreeing with the first. The decision now lives in
+* `src/engine/trust-classification.ts` and every surface renders the same
+* answer; this function only chooses words.
+*/
+function trustHeadline(s, classification) {
+	const claim = classification?.claim;
+	if (claim !== void 0) switch (claim) {
+		case "RUN_EVIDENCE_BACKS_FINDINGS": return s.confidence >= .75 ? "Run evidence backs these findings — trust them." : "Run evidence exists, but the scan was incomplete — verify the gaps.";
+		case "RUNTIME_CORROBORATED": return s.confidence >= .75 ? "The relevant files executed — solid static + runtime signal." : "Files executed, evidence is thin — treat findings as leads.";
+		case "DETERMINISTIC_STATIC": return "Deterministic static analysis — trustworthy, uncorroborated by a run.";
+		case "THIN_STATIC_SIGNAL": return "Static signal only, incomplete analysis — treat as leads, not verdicts.";
+		case "NO_EVIDENCE": return "Static signal only, with no runtime evidence — treat as an observation, not a verdict.";
+		case "INCOMPLETE": return "The analysis did not finish — it proves nothing about the surface it did not reach.";
+	}
+	return "Trust could not be established for this run.";
 }
 /** WHY THIS VERDICT — evidence-backed reasons, each from a real field. */
 function trustReasons(result, s) {
@@ -3538,9 +4121,10 @@ function renderTrustReport(result, opts) {
 		provisionalRuleIds: [],
 		ceilingReasons: []
 	};
+	const classification = classifyTrust(result, s);
 	lines.push(sectionHeader("TRUST VERDICT", ui));
 	lines.push(`  ${p.accent(TRUST_LABELS[s.level] ?? s.level)}`);
-	lines.push(`  ${trustHeadline(s)}`);
+	lines.push(`  ${trustHeadline(s, classification)}`);
 	lines.push("");
 	lines.push(sectionHeader("CONFIDENCE", ui));
 	lines.push(`  confidence          ${pct$1(s.confidence)}${s.confidenceCeiling !== void 0 ? `  (ceiling ${pct$1(s.confidenceCeiling)})` : ""}`);
@@ -3549,7 +4133,7 @@ function renderTrustReport(result, opts) {
 	if (s.measuredFpOfFiredRules !== void 0) lines.push(`  measured FP (fired) ${pct$1(s.measuredFpOfFiredRules)} — evidence-weighted`);
 	else if (s.provisionalRuleIds.length > 0) lines.push(`  measured FP (fired) PROVISIONAL — unmeasured rules fired: ${s.provisionalRuleIds.slice(0, 3).join(", ")}${s.provisionalRuleIds.length > 3 ? `, +${s.provisionalRuleIds.length - 3} more` : ""}`);
 	else lines.push("  measured FP (fired) none fired — nothing to weight");
-	lines.push(`  tests analyzed      ${result.testDeclarationCount ?? 0} declaration(s) in ${result.testFileCount ?? 0} file(s)`);
+	lines.push(`  tests analyzed      ${testsAnalyzedCell(result.testDeclarationCount, result.testFileCount)}`);
 	lines.push("");
 	lines.push(sectionHeader("WHY THIS VERDICT", ui));
 	for (const r of trustReasons(result, s)) lines.push(`  - ${r}`);
@@ -3727,9 +4311,13 @@ function escapeLabel(text) {
 function classDef(name, tint) {
 	return `  classDef ${name} fill:${tint.fill},stroke:${tint.stroke},color:${tint.text};`;
 }
+/** Band → the Mermaid class name that paints it. BW-104: this used to
+*  re-declare the 80/50 boundaries, so the diagram could colour a
+*  dimension the terminal called UNWORTHY. It now asks the one model. */
 function dimensionStyleClass(dim) {
-	if (dim.score >= 80) return "healthy";
-	if (dim.score >= 50) return "warn";
+	const band = deriveScoreState(dim.score).band;
+	if (band === "forged" || band === "trusted") return "healthy";
+	if (band === "warning") return "warn";
 	return "critical";
 }
 const SEVERITY_ORDER = [
@@ -3960,14 +4548,7 @@ const EVIDENCE_VALUES = /* @__PURE__ */ new Set([
 	"E1",
 	"E2"
 ]);
-const TRUST_VALUES = /* @__PURE__ */ new Set([
-	"L0",
-	"L1",
-	"L2",
-	"L3",
-	"L4",
-	"L5"
-]);
+const TRUST_VALUES = new Set(TRUST_ORDER);
 /** Human message for any thrown value — never "undefined"/"[object Object]". */
 function errorText$1(err) {
 	if (err instanceof Error) return err.message;
@@ -4118,6 +4699,67 @@ function loadSavedReport(reportPath) {
 function reportExists(reportPath) {
 	return existsSync(reportPath);
 }
+function identityOf(result) {
+	const identity = result.runIdentity;
+	return isRecord$2(identity) ? identity : void 0;
+}
+/**
+* Classify a loaded report. Pure — it reads the report and the caller's
+* expectation, touches nothing else.
+*
+* `expected` is optional on purpose: a caller with no expectation still gets an
+* honest classification, it just cannot detect a cross-identity read.
+*/
+function classifySavedReport(result, expected) {
+	const identity = identityOf(result);
+	if (identity === void 0) return {
+		state: "OPEN",
+		reason: "report carries no run identity — it predates machine-anchored identity, or was written by hand. Usable as history, not as proof."
+	};
+	const scanId = identity["scanId"];
+	if (typeof scanId !== "string" || scanId.length === 0) return {
+		state: "OPEN",
+		reason: "run identity has no scanId — the identity is unusable."
+	};
+	const commit = typeof identity["commit"] === "string" ? identity["commit"] : void 0;
+	const candidate = identity["candidate"];
+	const candidateManifestId = isRecord$2(candidate) && typeof candidate["manifestId"] === "string" ? candidate["manifestId"] : void 0;
+	if (expected !== void 0) {
+		if (expected.scanId !== void 0 && expected.scanId !== scanId) return {
+			state: "OPEN",
+			reason: `report was produced by a different run (${scanId}) than the current one (${expected.scanId})`
+		};
+		if (expected.commit !== void 0 && expected.commit !== commit) return {
+			state: "OPEN",
+			reason: `report was produced against commit ${commit ?? "unknown"}, not ${expected.commit}`
+		};
+		if (expected.candidateManifestId !== void 0 && expected.candidateManifestId !== candidateManifestId) return {
+			state: "OPEN",
+			reason: `report is bound to candidate ${candidateManifestId ?? "none"}, not ${expected.candidateManifestId}`
+		};
+	}
+	return {
+		state: "VERIFIED",
+		scanId,
+		...commit !== void 0 ? { commit } : {},
+		...candidateManifestId !== void 0 ? { candidateManifestId } : {}
+	};
+}
+/**
+* Load a saved report AND classify it.
+*
+* `loadSavedReport` stays for callers that genuinely only need the parse; the
+* trust-aware path is here so that no consumer reaches a report's contents
+* without having been told how much they may believe.
+*/
+function loadSavedReportStrict(reportPath, expected) {
+	const result = loadSavedReport(reportPath);
+	return {
+		result,
+		trust: classifySavedReport(result, expected),
+		path: reportPath
+	};
+}
 //#endregion
 //#region src/integrations/github/evidence-sanitization.ts
 const MAX_MARKDOWN_TEXT_LENGTH = 500;
@@ -4297,7 +4939,7 @@ function renderTrustReportMarkdown(result, label, commit) {
 	lines.push(`| Inconclusive | ${pct$1(s.inconclusiveRate)} |`);
 	lines.push(`| Measured FP (fired) | ${s.measuredFpOfFiredRules !== void 0 ? pct$1(s.measuredFpOfFiredRules) : s.provisionalRuleIds.length > 0 ? `PROVISIONAL (${s.provisionalRuleIds.length} unmeasured)` : "n/a"} |`);
 	lines.push(`| Score | ${result.score ?? "unknown"} |`);
-	lines.push(`| Tests analyzed | ${result.testDeclarationCount ?? 0} in ${result.testFileCount ?? 0} files |`);
+	lines.push(`| Tests analyzed | ${testsAnalyzedCell(result.testDeclarationCount, result.testFileCount)} |`);
 	lines.push("");
 	if (s.ceilingReasons.length > 0) {
 		lines.push(`Incompleteness factors: ${s.ceilingReasons.map(publicText).join(", ")}.`);
@@ -4360,8 +5002,8 @@ function renderTrustReportJson(result, commit) {
 		scopeIntegrity: result.scopeIntegrity ?? null,
 		verdict: completionVerdict,
 		tests: {
-			files: result.testFileCount ?? 0,
-			declarations: result.testDeclarationCount ?? 0
+			files: countOrNull(result.testFileCount),
+			declarations: countOrNull(result.testDeclarationCount)
 		},
 		findings: {
 			total: result.findings.length,
@@ -4375,7 +5017,7 @@ function renderTrustReportJson(result, commit) {
 			file: publicJsonText(f.file),
 			line: f.line,
 			severity: f.severity,
-			evidence: f.runtimeCorroboration === void 0 ? f.evidenceLevel ?? "E2" : f.runtimeCorroboration.level,
+			evidence: f.runtimeCorroboration === void 0 ? evidenceLevelOf(f) : f.runtimeCorroboration.level,
 			message: publicJsonText(f.message)
 		})),
 		nextAction: publicJsonText(nextAction(result))
@@ -4396,20 +5038,18 @@ function renderTrustReportHtml(result, label, commit) {
 	const warnings = result.findings.filter((f) => f.severity === "warning").length;
 	const infos = result.findings.filter((f) => f.severity === "info").length;
 	const advisory = result.findings.filter((f) => isAdvisoryFinding(f)).length;
-	const confidenceRows = [];
 	const measuredFpCell = s.measuredFpOfFiredRules !== void 0 ? pct$1(s.measuredFpOfFiredRules) : s.provisionalRuleIds.length > 0 ? `PROVISIONAL (${s.provisionalRuleIds.length} unmeasured)` : "n/a";
-	confidenceRows.push(`Confidence|${pct$1(s.confidence)}${s.confidenceCeiling !== void 0 ? ` (ceiling ${pct$1(s.confidenceCeiling)})` : ""}`);
-	confidenceRows.push(`Evidence coverage|${pct$1(s.evidenceCoverage)}`);
-	confidenceRows.push(`Inconclusive|${pct$1(s.inconclusiveRate)}`);
-	confidenceRows.push(`Measured FP (fired)|${measuredFpCell}`);
-	confidenceRows.push(`Score|${result.score ?? "unknown"}`);
-	confidenceRows.push(`Tests analyzed|${result.testDeclarationCount ?? 0} in ${result.testFileCount ?? 0} files`);
-	const confidenceRowsHtml = confidenceRows.map((row) => {
-		const [k, v] = row.split("|");
-		return `<tr><td>${esc(k ?? "")}</td><td>${esc(v ?? "")}</td></tr>`;
-	}).join("\n          ");
+	const confidenceRowsHtml = [
+		["Confidence", `${pct$1(s.confidence)}${s.confidenceCeiling !== void 0 ? ` (ceiling ${pct$1(s.confidenceCeiling)})` : ""}`],
+		["Evidence coverage", pct$1(s.evidenceCoverage)],
+		["Inconclusive", pct$1(s.inconclusiveRate)],
+		["Measured FP (fired)", measuredFpCell],
+		["Score", result.score === null ? "unknown" : String(result.score)],
+		["Tests analyzed", testsAnalyzedCell(result.testDeclarationCount, result.testFileCount)]
+	].map(([k, v]) => `<tr><th scope="row">${esc(k)}</th><td>${esc(v)}</td></tr>`).join("\n          ");
 	const risksTable = risks.length === 0 ? `<p>None — no non-advisory findings fired.</p>` : `<table>
-          <thead><tr><th>Rule</th><th>Location</th><th>Evidence</th><th>Message</th></tr></thead>
+          <caption>The ${risks.length} highest-risk non-advisory findings. Evidence shows what each finding actually rests on.</caption>
+          <thead><tr><th scope="col">Rule</th><th scope="col">Location</th><th scope="col">Evidence</th><th scope="col">Message</th></tr></thead>
           <tbody>
           ${risks.map((f) => {
 		const ev = evidenceTag(f);
@@ -4448,6 +5088,8 @@ function renderTrustReportHtml(result, label, commit) {
 		`<section id="confidence">`,
 		`<h2>Confidence</h2>`,
 		`<table>`,
+		`          <caption>Mjölnir confidence measurements. A value of “unknown — not measured” means the scan did not produce that measurement; it is not zero.</caption>`,
+		`          <thead><tr><th scope="col">Measurement</th><th scope="col">Value</th></tr></thead>`,
 		`          <tbody>`,
 		`          ${confidenceRowsHtml}`,
 		`          </tbody>`,
@@ -4495,13 +5137,15 @@ async function runTrustReportCommand(argv, io) {
 			io.err("error: --commit requires the run's HEAD sha");
 			return 10;
 		}
-		let scan;
+		let loaded;
 		try {
-			scan = loadSavedReport(resolve(fromPath));
+			loaded = loadSavedReportStrict(resolve(fromPath));
 		} catch (err) {
 			io.err(`error: cannot read ${fromPath}: ${errorMessage(err)}`);
 			return 10;
 		}
+		const scan = loaded.result;
+		if (loaded.trust.state !== "VERIFIED") io.err(`warning: ${loaded.trust.reason} The trust report below describes an OPEN artifact.`);
 		if (commitArg && scan.runIdentity?.commit && scan.runIdentity.commit !== commitArg) {
 			io.err(`error: report commit ${scan.runIdentity.commit} does not match --commit ${commitArg}`);
 			return 10;
@@ -4513,7 +5157,7 @@ async function runTrustReportCommand(argv, io) {
 		const md = renderTrustReportMarkdown(scan, fromPath, commitArg ?? null);
 		if (argv.includes("--stdout")) {
 			io.out(md);
-			return 0;
+			return loaded.trust.state === "VERIFIED" ? 0 : 2;
 		}
 		try {
 			const outPath = resolve(dirname(fromPath), TRUST_REPORT_MD);
@@ -4626,7 +5270,7 @@ function renderConfidenceTable(result, summary) {
 	lines.push(`| Evidence coverage | ${pct$1(summary.evidenceCoverage)} |`);
 	lines.push(`| Inconclusive | ${pct$1(summary.inconclusiveRate)} |`);
 	lines.push(`| Measured FP (fired) | ${summary.measuredFpOfFiredRules !== void 0 ? pct$1(summary.measuredFpOfFiredRules) : summary.provisionalRuleIds.length > 0 ? `PROVISIONAL (${summary.provisionalRuleIds.length} unmeasured)` : "n/a"} |`);
-	lines.push(`| Tests analyzed | ${result.testDeclarationCount ?? 0} in ${result.testFileCount ?? 0} files |`);
+	lines.push(`| Tests analyzed | ${testsAnalyzedCell(result.testDeclarationCount, result.testFileCount)} |`);
 	lines.push("");
 	lines.push("</details>");
 	return lines;
@@ -4902,7 +5546,7 @@ function evidenceLines(f, ui) {
 	}
 	return lines;
 }
-const SUPPRESSION_HINT = "Suppression (only with cause): an `ignore` entry in mjolnir.config.json — reason REQUIRED, expires after 90 days. Prefer fixing the root cause.";
+const SUPPRESSION_HINT = "Suppression (only with cause): an `ignore` entry in mjolnir.config.json — reason REQUIRED; only an explicit ISO `expires` date is bounded. Prefer fixing the root cause.";
 /** Render the why answer. Pure over (match, ui). */
 function renderWhy(match, ui = plainContext()) {
 	const { p } = ui;
@@ -5658,14 +6302,19 @@ function buildHandover(scan, forensics) {
 		heading: "⚠ CI trust warnings (green ≠ verified)",
 		items: ciTrust.slice(0, 4).map((f) => `${f.file}:${f.line} — ${f.message}`)
 	});
-	if (new Set(scan.findings.map((f) => f.file)).size === 0 && scan.score !== null && scan.score >= 90 || scan.findings.length === 0) sections.push({
+	if (new Set(scan.findings.map((f) => f.file)).size === 0 && scan.score !== null && deriveScoreState(scan.score).band === "trusted" || scan.findings.length === 0) sections.push({
 		heading: "🟢 Solid foundation",
 		items: ["No tracked anti-patterns found in scanned specs — good place to start contributing."]
 	});
-	const totalIssues = fakeGreen.length + flaky.length + ciTrust.length + (forensics?.flakyTests ?? 0);
+	const flakyFromRuntime = forensics === null ? null : forensics.flakyTests;
+	const totalIssues = fakeGreen.length + flaky.length + ciTrust.length + (flakyFromRuntime ?? 0);
+	if (flakyFromRuntime === null) sections.push({
+		heading: "⚠ Not measured — no runtime evidence",
+		items: ["No run report was ingested, so flakiness, retries and real pass/fail outcomes are UNKNOWN here. Run `mjolnir forensics <results-dir>` (or point this at a test-results directory) before treating this suite as green.", "Everything above is static analysis only (trust L0–L2): it can show a pattern, never confirm a test ran."]
+	});
 	return {
 		sections,
-		summaryLine: totalIssues === 0 ? "Welcome aboard — the suite is in good shape." : `${totalIssues} thing${totalIssues === 1 ? "" : "s"} to know about before your first release sign-off.`
+		summaryLine: totalIssues > 0 ? `${totalIssues} thing${totalIssues === 1 ? "" : "s"} to know about before your first release sign-off.` : flakyFromRuntime === null ? "Static analysis found nothing — but no runtime evidence was ingested, so this is NOT a statement that the suite is in good shape." : "Welcome aboard — the suite is in good shape."
 	};
 }
 function renderHandover(map) {
@@ -5843,7 +6492,7 @@ async function computeImpact(root, options) {
 			if (blob === null) continue;
 			const dest = join(tmpDir, relPath);
 			mkdirSync(dirname(dest), { recursive: true });
-			writeFileSync(dest, blob);
+			writeFileAtomic(dest, blob);
 		}
 		if (truncated) {
 			baseTreeTruncated = {
@@ -7017,7 +7666,8 @@ async function runScanCommand(argv, io = {
 			onProgress: (e) => progress.onEvent(e),
 			onGateNotice: (notice) => io.err(notice),
 			...args.debug ? { onRuleCrash: (ruleId, file, error) => {
-				crashLog.push(`${ruleId} crashed on ${file}: ${error instanceof Error ? error.message : String(error)}`);
+				const detail = error instanceof Error ? [error.message, error.stack].filter((value) => Boolean(value)).join("\n") : String(error);
+				crashLog.push(`${ruleId} crashed on ${file}: ${detail}`);
 			} } : {}
 		});
 		progress.done();
@@ -7030,7 +7680,12 @@ async function runScanCommand(argv, io = {
 			if (args.json) io.err("--score overrides --json; stdout is the bare score.");
 			const { config: scoreConfig } = loadConfig(target, { knownRuleIds: KNOWN_RULE_IDS$1 });
 			io.out(result.score === null ? "unknown" : String(result.score));
-			return exitForFindings(result.findings, args.blocking === "none" ? "advisory" : args.blocking ?? scoreConfig.gate ?? "error");
+			return scanExitCode({
+				partial: result.partial,
+				findings: result.findings,
+				gate: args.blocking === "none" ? "advisory" : args.blocking ?? scoreConfig.gate ?? "error",
+				isAdvisory: isAdvisoryFinding
+			});
 		}
 		renderScanOutput(result, args, target, io);
 		if (args.format === "terminal") {
@@ -7047,7 +7702,12 @@ async function runScanCommand(argv, io = {
 		if (result.partial) return 2;
 		const { config, warnings } = loadConfig(target, { knownRuleIds: KNOWN_RULE_IDS$1 });
 		for (const w of warnings) io.err(w);
-		return exitForFindings(result.findings, args.blocking === "none" ? "advisory" : args.blocking ?? config.gate ?? "error");
+		return scanExitCode({
+			partial: false,
+			findings: result.findings,
+			gate: args.blocking === "none" ? "advisory" : args.blocking ?? config.gate ?? "error",
+			isAdvisory: isAdvisoryFinding
+		});
 	} catch (err) {
 		if (err instanceof ConfigValidationError) {
 			io.err(err.message);
@@ -8571,9 +9231,14 @@ function truncateMessage(message, max = 250) {
 * `--path-prefix <dir>` re-scopes for subdirectory scans.
 */
 const DETAILS_PER_SEVERITY_CAP = 25;
-function scoreBar$1(score, width = 20) {
-	const filled = Math.round(score / 100 * width);
-	return `${"█".repeat(filled)}${"░".repeat(Math.max(0, width - filled))}`;
+/**
+* The score bar. BW-105: the canonical gauge with the inert palette — the
+* job summary is a Markdown file, so it takes the gauge's geometry (bar +
+* head tick) and none of its SGR escapes, while the band is carried in
+* words on the line above.
+*/
+function scoreBar$1(score) {
+	return scoreGauge(score, palette(false), 20);
 }
 /** Markdown step summary. Pure over (result, options) — testable. */
 function renderStepSummary(result, options = {}) {
@@ -8783,9 +9448,19 @@ function fpLine(f) {
 	if (f.measuredFpRate === void 0) return "Measured FP rate: none — this rule ships on assumption (no measured false-positive rate).";
 	return `Measured FP rate: ${Math.round(f.measuredFpRate * 100)}%${f.measuredFpN !== void 0 ? ` over ${f.measuredFpN} classified verdicts` : ""}.`;
 }
-function scoreBar(score, width = 20) {
-	const filled = Math.round(score / 100 * width);
-	return `${"█".repeat(filled)}${"░".repeat(Math.max(0, width - filled))}`;
+/**
+* The score bar. BW-105: this used to be a private, COLOURLESS copy of
+* `scoreGauge` — 20 blocks of `█`/`░` with no head tick, so 99 and 100
+* rendered identically and a reader could not read a band off the bar.
+*
+* It delegates to the canonical gauge with the inert palette: the head-tick
+* geometry is the gauge's own, and NO SGR escapes reach a Markdown file
+* (which would render as literal `[38;2;…m` on GitHub). The band itself is
+* carried in words on the line above — `VERDICT (band)` — which is R11
+* anyway: a colour is never the only signal.
+*/
+function scoreBar(score) {
+	return scoreGauge(score, palette(false), 20);
 }
 function scopeNote(options) {
 	const parts = [];
@@ -8921,7 +9596,7 @@ function renderHandoff(result, options = {}, version = ENGINE_VERSION) {
 	});
 	lines.push("## How to use this document");
 	lines.push("");
-	lines.push("- Validate each occurrence according to its evidence level before editing.", "- Apply the smallest behavior-preserving fix.", "- Re-run the verification procedure below; correlate by fingerprint.", "- Never suppress a finding merely to obtain a green scan (suppressions live in `mjolnir.config.json`, require a reason, and expire after 90 days).");
+	lines.push("- Validate each occurrence according to its evidence level before editing.", "- Apply the smallest behavior-preserving fix.", "- Re-run the verification procedure below; correlate by fingerprint.", "- Never suppress a finding merely to obtain a green scan (suppressions live in `mjolnir.config.json` and require a reason; only an explicit ISO `expires` date is bounded).");
 	lines.push("");
 	lines.push(scopeNote(options) ? scopeNote(options).trim() : "");
 	if (!scopeNote(options)) lines.pop();
@@ -9079,10 +9754,10 @@ function agentBrief(surface, cwdNote) {
 		`Run \`${cwdNote}npx mjolnir-qa@${ENGINE_VERSION} . --scope changed\` before finishing any task that touched test code.`,
 		"",
 		"- Exit 0 = clean. Exit 1 = new findings on changed lines: fix them (smallest behavior-preserving change) or justify them to the user.",
-		`- npx mjolnir-qa@${ENGINE_VERSION} why <file>:<line> explains any finding (evidence level, measured FP rate, fix).`,
+		`- npx mjolnir-qa@${ENGINE_VERSION} why <file>:<line> explains any finding (evidence level, measured FP rate or explicit unmeasured state, fix).`,
 		`- npx mjolnir-qa@${ENGINE_VERSION} handoff renders a full remediation plan from a saved --json report.`,
 		`- Agent loop: establish the before-state once with npx mjolnir-qa@${ENGINE_VERSION} baseline (commits .mjolnir/baseline.json); after fixing, npx mjolnir-qa@${ENGINE_VERSION} verify prints the before/after digest — resolved (per §15 lifecycle) / new / unchanged by ruleId+location, and the score delta. Exit 0 clean, 1 new errors, 2 partial or no baseline.`,
-		"- NEVER suppress a finding merely to obtain a green scan (suppressions live in mjolnir.config.json, require a reason, and expire after 90 days).",
+		"- NEVER suppress a finding merely to obtain a green scan (suppressions live in mjolnir.config.json and require a reason; only an explicit ISO `expires` date is bounded).",
 		"- After fixing: re-run the scan, report files changed, report checks not run, report unresolved findings honestly.",
 		"",
 		"## Agent safety contract (non-negotiable)",
@@ -9229,7 +9904,7 @@ function executeInstall(entries) {
 		if (e.action === "refuse" || e.action === "no-op") continue;
 		const dir = join(e.file, "..");
 		mkdirSync(dir, { recursive: true });
-		writeFileSync(e.file, e.content);
+		writeFileAtomic(e.file, e.content);
 		written++;
 	}
 	return written;
@@ -9349,22 +10024,22 @@ function executeHookInstall(entry) {
 	switch (entry.action) {
 		case "create":
 			mkdirSync(join(entry.file, ".."), { recursive: true });
-			writeFileSync(entry.file, `#!/bin/sh\n${hookBlock(ENGINE_VERSION)}\n`);
+			writeFileAtomic(entry.file, `#!/bin/sh\n${hookBlock(ENGINE_VERSION)}\n`);
 			return true;
 		case "append": {
 			const existing = readFileSync(entry.file, "utf8");
 			const sep = existing.endsWith("\n") ? "" : "\n";
-			writeFileSync(entry.file, `${existing}${sep}\n${hookBlock(ENGINE_VERSION)}\n`);
+			writeFileAtomic(entry.file, `${existing}${sep}\n${hookBlock(ENGINE_VERSION)}\n`);
 			return true;
 		}
 		case "update": {
 			const existing = readFileSync(entry.file, "utf8");
 			const openIdx = existing.indexOf(HOOK_MARKER_OPEN);
 			const closeIdx = existing.indexOf(HOOK_MARKER_CLOSE);
-			if (openIdx !== -1 && closeIdx !== -1) writeFileSync(entry.file, existing.slice(0, openIdx) + hookBlock(ENGINE_VERSION) + existing.slice(closeIdx + 29));
+			if (openIdx !== -1 && closeIdx !== -1) writeFileAtomic(entry.file, existing.slice(0, openIdx) + hookBlock(ENGINE_VERSION) + existing.slice(closeIdx + 29));
 			else {
 				const sep = existing.endsWith("\n") ? "" : "\n";
-				writeFileSync(entry.file, `${existing}${sep}\n${hookBlock(ENGINE_VERSION)}\n`);
+				writeFileAtomic(entry.file, `${existing}${sep}\n${hookBlock(ENGINE_VERSION)}\n`);
 			}
 			return true;
 		}
@@ -9841,6 +10516,15 @@ function checkArtifactIntegrity(root) {
 		details: bad
 	};
 }
+function isReleaseVersion(value) {
+	const isNumeric = (part) => /^\d+$/.test(part) && (part === "0" || !part.startsWith("0"));
+	const [core, prerelease, ...extra] = value.split("-");
+	const [major, minor, patch, ...coreExtra] = (core ?? "").split(".");
+	if (extra.length > 0 || major === void 0 || minor === void 0 || patch === void 0 || coreExtra.length > 0 || !isNumeric(major) || !isNumeric(minor) || !isNumeric(patch)) return false;
+	if (prerelease === void 0) return true;
+	const [kind, number, ...rcExtra] = prerelease.split(".");
+	return kind === "rc" && number !== void 0 && isNumeric(number) && rcExtra.length === 0;
+}
 function checkReleaseVersionConsistency(root) {
 	const pkgPath = join(root, "package.json");
 	const clPath = join(root, "CHANGELOG.md");
@@ -9850,9 +10534,14 @@ function checkReleaseVersionConsistency(root) {
 		details: ["package.json or CHANGELOG.md missing"]
 	};
 	const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
-	const cl = readFileSync(clPath, "utf8");
-	const head = /^##\s+\[?(\d+\.\d+\.\d+)\]?/m.exec(cl)?.[1];
-	if (!pkg.version || head === void 0) return {
+	const head = readFileSync(clPath, "utf8").split(/\r?\n/).reduce((found, line) => {
+		if (found !== void 0 || !line.startsWith("## [")) return found;
+		const headingEnd = line.indexOf("]", 4);
+		if (headingEnd < 5) return void 0;
+		const candidate = line.slice(4, headingEnd).trim();
+		return isReleaseVersion(candidate) ? candidate : void 0;
+	}, void 0);
+	if (!pkg.version || !isReleaseVersion(pkg.version) || head === void 0 || !isReleaseVersion(head)) return {
 		evidence: "INCONCLUSIVE",
 		determination: "INCONCLUSIVE",
 		details: ["unparsable version surfaces"]
@@ -10072,98 +10761,90 @@ function runReleaseTrustCommand(argv, io = {
 //#endregion
 //#region src/commands/business-case.ts
 /**
-* `mjolnir business-case` — ROI estimate per finding (extended).
-*
-* Projects the business impact of untrustworthy verification by
-* combining:
-*   - Measured false-positive rate per rule (from the FP audit
-*     corpus)
-*   - Industry-specific cost of a false-green release per incident
-*   - Historical incident data from git log (optional)
-*   - Projected savings over 6/12 months (optional)
-*
-* Static analysis — no test execution, no telemetry, deterministic
-* output.
-*/
-const DEFAULT_INCIDENT_COST = 25e3;
-/** Industry cost multipliers for false-green incidents. */
-const INDUSTRY_COSTS = {
-	default: DEFAULT_INCIDENT_COST,
-	fintech: 5e4,
-	healthcare: 1e5,
-	ecommerce: 15e3,
-	saas: 3e4,
-	enterprise: 4e4,
-	gaming: 2e4,
-	education: 1e4
-};
-const INDUSTRY_DESCRIPTIONS = {
-	default: "general",
-	fintech: "financial services (regulatory fines, PCI/HIPAA)",
-	healthcare: "healthcare (HIPAA, patient safety)",
-	ecommerce: "e-commerce (cart abandonment, lost sales)",
-	saas: "SaaS (churn, reputation)",
-	enterprise: "enterprise (contract penalties, SLA breaches)",
-	gaming: "gaming (player trust, reviews)",
-	education: "education (student data, accreditation)"
-};
-/** Calculate expected savings per finding. */
+* `mjolnir business-case` — measured false-positive rates, and the
+* arithmetic a reader can audit.
+*
+* What changed, and why: this command multiplied a MEASURED false-positive
+* rate by a table of invented incident costs (fintech $50 000, healthcare
+* $100 000, …) with no source, and printed the product as "Expected
+* Savings" and "Total potential savings". A dollar figure with no
+* provenance is worse than no dollar figure: someone puts it in a
+* business case and defends it in a room. It also had a `--history` flag
+* whose own help text promised "estimates from actual scan improvements"
+* and which did nothing but print a pointer elsewhere, and a `--projected`
+* flag that divided the total by six and called the result a monthly rate.
+*
+* So the invented cost table is gone. The one number this command can
+* defend is the measured false-positive rate and how many findings carry
+* it. A dollar conversion happens only when the reader supplies the cost
+* of an incident themselves (`--incident-cost`), because then the number
+* has a source: theirs.
+*
+* Scheduled for removal in 5.0 — see docs/RELEASE-TRAINS.md.
+*/
+/**
+* Evidence weight per level, applied to a user-supplied incident cost.
+* E0 is an observation and never counts — there is nothing to save against
+* a claim nobody made.
+*/
 function expectedSavings(fpRate, evidenceLevel, incidentCost) {
 	if (fpRate === null || fpRate === void 0) return null;
 	const confidence = evidenceLevel === "E2" ? 1 : evidenceLevel === "E1" ? .5 : 0;
 	if (confidence === 0) return null;
 	return Math.round(incidentCost * (1 - fpRate) * confidence);
 }
-function renderSummary(savingsPerFinding, incidentCost, industry, totalSavings) {
+function renderSummary(savingsPerFinding, incidentCost, totalSavings) {
+	const measured = savingsPerFinding.filter((s) => s.fpRate !== null).length;
 	const lines = [
-		"Mjölnir Business Case — Estimated ROI per finding",
-		"=================================================",
+		"Mjölnir — measured false-positive rates on the findings that fired",
+		"=".repeat(58),
 		"",
-		`Industry profile: ${industry} (${INDUSTRY_DESCRIPTIONS[industry] ?? "general"})`,
-		`Assumed cost per false-green incident: $${incidentCost}`,
-		`Sample: ${savingsPerFinding.filter((s) => s.fpRate !== null).length} of ${savingsPerFinding.length} rules have measured FP rates`,
+		`Measured: ${measured} of ${savingsPerFinding.length} findings carry a corpus-measured FP rate.`,
+		...incidentCost === null ? [
+			"",
+			"NO DOLLAR FIGURES ARE SHOWN. Converting a false-positive rate into money",
+			"requires the cost of one false-green incident in YOUR organisation, which",
+			"this tool does not know and will not invent. Pass --incident-cost <n> to",
+			"see the arithmetic; the number is then yours, not Mjölnir's."
+		] : [
+			"",
+			`Incident cost used: $${incidentCost.toLocaleString()} (your figure, from --incident-cost).`,
+			`Findings that fired: ${savingsPerFinding.length}.`
+		],
 		"",
-		"| Rule ID | FP Rate | Evidence | Expected Savings |",
-		"| ------- | ------- | -------- | --------------- |"
+		"| Rule ID | FP Rate | n | Evidence | Expected cost |",
+		"| ------- | ------- | - | -------- | ------------- |"
 	];
-	for (const { ruleId, fpRate, evidenceLevel, expectedSavings: savings } of savingsPerFinding) {
-		const fpDisplay = fpRate !== null ? `${Math.round(fpRate * 100)}%` : "unmeasured";
-		const savingsDisplay = savings !== null ? `$${savings}` : "n/a";
-		lines.push(`| ${ruleId} | ${fpDisplay} | ${evidenceLevel} | ${savingsDisplay} |`);
-	}
-	lines.push("");
-	lines.push("Interpretation:");
-	lines.push("---------------");
-	lines.push("- E2 findings (deterministic proof) carry full business risk — eliminate first");
-	lines.push("- E1 findings (pattern evidence) carry half the assessed risk");
-	lines.push("- Unmeasured rules (n < 10) have no quantified FP rate — add corpus classification");
-	lines.push(`- Total potential savings across all findings: $${totalSavings.toLocaleString()}`);
+	for (const { ruleId, fpRate, fpN, evidenceLevel, expectedSavings: savings } of savingsPerFinding) {
+		const fpDisplay = fpRate !== null ? `${Math.round(fpRate * 100)}%` : "not measured";
+		const nDisplay = fpN !== null ? String(fpN) : "—";
+		const savingsDisplay = incidentCost === null || savings === null ? "—" : `$${savings.toLocaleString()}`;
+		lines.push(`| ${ruleId} | ${fpDisplay} | ${nDisplay} | ${evidenceLevel} | ${savingsDisplay} |`);
+	}
+	lines.push("");
+	lines.push("How to read this:");
+	lines.push("--------------------");
+	lines.push("- E2 is deterministic proof and counts in full; E1 is pattern evidence and counts half;");
+	lines.push("  E0 is an observation and never counts. The evidence column is why the weight differs.");
+	lines.push("- A rule with no measured FP rate is NOT assumed safe. It is unmeasured, and it says so.");
+	if (totalSavings !== null) lines.push(`- Total expected cost across these findings: $${totalSavings.toLocaleString()}`);
 	return lines.join("\n");
 }
-function renderProjection(monthlySavings, months, incidentCost) {
-	const totalProjected = monthlySavings * months;
-	const incidentsPrevented = Math.round(totalProjected / incidentCost);
-	return [
-		"",
-		"SAVINGS PROJECTION",
-		"==================",
-		"",
-		`Monthly savings estimate:  $${monthlySavings.toLocaleString()}`,
-		`Projection period:        ${months} months`,
-		`Projected total savings:  $${totalProjected.toLocaleString()}`,
-		`Incidents prevented:      ~${incidentsPrevented} (at $${incidentCost.toLocaleString()}/incident)`,
-		""
-	].join("\n");
-}
 /**
 * Entry point for `mjolnir business-case`.
 *
 * Flags:
-*   --industry <type>    Industry cost profile (default/fintech/healthcare/...)
-*   --history <months>   Use git history for the last N months (estimates from
-*                        actual scan improvements, not projections)
-*   --projected <months> Show projected savings over N months
+*   --incident-cost <n>  The cost of ONE false-green incident in your
+*                        organisation. Until you supply it, no dollar
+*                        figure is printed at all.
 *   --strict             Include quarantine-tier findings
+*
+* `--history` and `--projected` are GONE. Both promised arithmetic this
+* tool cannot do: `--history` claimed to estimate from actual scan
+* improvements while reading no history at all, and `--projected` divided
+* the total by six and called the quotient a monthly rate. A flag that
+* does not do what its help says is worse than no flag, because the help
+* is the promise.
 */
 async function runBusinessCaseCommand(argv, io = {
 	out,
@@ -10171,25 +10852,29 @@ async function runBusinessCaseCommand(argv, io = {
 }) {
 	try {
 		const target = argv.find((a) => !a.startsWith("-")) ?? ".";
-		const industryIdx = argv.indexOf("--industry");
-		const industry = industryIdx !== -1 ? argv[industryIdx + 1] ?? "default" : "default";
-		const historyIdx = argv.indexOf("--history");
-		const historyMonths = historyIdx !== -1 ? Number.parseInt(argv[historyIdx + 1] ?? "", 10) : 0;
-		const projectedIdx = argv.indexOf("--projected");
-		const projectedMonths = projectedIdx !== -1 ? Number.parseInt(argv[projectedIdx + 1] ?? "", 10) : 0;
 		const strict = argv.includes("--strict");
-		const historyProvided = historyIdx !== -1;
-		const projectedProvided = projectedIdx !== -1;
-		if (historyProvided && historyMonths < 0) {
-			(io.err ?? err)("--history requires a positive number of months");
-			return 20;
+		for (const gone of [
+			"--industry",
+			"--history",
+			"--projected"
+		]) if (argv.includes(gone)) {
+			(io.err ?? err)(`${gone} is no longer accepted. ` + (gone === "--industry" ? "Incident costs are not industry defaults; pass --incident-cost <n> with a figure from your own incident history." : gone === "--history" ? "It read no history. Use `mjolnir impact --since <date>` for evidence-backed change data." : "A projection is an arithmetic identity, not an estimate. Use `mjolnir trend` for measured history."));
+			return 10;
 		}
-		if (projectedProvided && projectedMonths <= 0) {
-			(io.err ?? err)("--projected requires a positive number of months");
-			return 20;
+		const costIdx = argv.indexOf("--incident-cost");
+		let incidentCost = null;
+		if (costIdx !== -1) {
+			const raw = argv[costIdx + 1];
+			const parsed = Number.parseInt(raw ?? "", 10);
+			if (raw === void 0 || raw.startsWith("-") || !Number.isFinite(parsed) || parsed <= 0) {
+				(io.err ?? err)("--incident-cost requires a positive number: the cost of one false-green incident.");
+				return 10;
+			}
+			incidentCost = parsed;
 		}
-		const incidentCost = INDUSTRY_COSTS[industry] ?? DEFAULT_INCIDENT_COST;
 		io.out(`Scanning ${target} ...`);
+		const invalid = validateScanTarget(target, io.err ?? err);
+		if (invalid !== null) return invalid;
 		const savingsPerFinding = (await runScan({
 			target,
 			json: false,
@@ -10198,29 +10883,18 @@ async function runBusinessCaseCommand(argv, io = {
 			scopeChanged: false,
 			format: "terminal",
 			strict
-		})).findings.map((f) => {
-			const fpRate = f.measuredFpRate ?? null;
-			const evidenceLevel = f.evidenceLevel ?? "E0";
-			const savings = expectedSavings(fpRate, evidenceLevel, incidentCost);
-			return {
-				ruleId: f.ruleId,
-				fpRate,
-				evidenceLevel,
-				expectedSavings: savings
-			};
-		});
-		const totalExpectedSavings = savingsPerFinding.reduce((sum, f) => sum + (f.expectedSavings ?? 0), 0);
-		io.out(renderSummary(savingsPerFinding, incidentCost, industry, totalExpectedSavings));
-		if (projectedMonths > 0) {
-			const monthlySavings = Math.round(totalExpectedSavings / 6);
-			io.out(renderProjection(monthlySavings, projectedMonths, incidentCost));
-		}
-		if (historyMonths > 0) io.out(`\nHistorical analysis (last ${historyMonths} months):\n  NOTE: Historical incident costing requires CI log access.
-  Run \`mjolnir impact --since \${historyMonths}.months.ago\` for
-  evidence-backed impact data from git history.
-  Run \`mjolnir release-report --since v\${historyMonths}.0.0\` for
-  release-quality trajectory.`);
-		io.out("\nThese are projections based on measured FP rates from the OSS corpus.");
+		})).findings.map((f) => ({
+			ruleId: f.ruleId,
+			fpRate: f.measuredFpRate ?? null,
+			fpN: f.measuredFpN ?? null,
+			evidenceLevel: evidenceLevelOf(f),
+			expectedSavings: incidentCost === null ? null : expectedSavings(f.measuredFpRate ?? null, evidenceLevelOf(f), incidentCost)
+		}));
+		const totalExpectedSavings = incidentCost === null ? null : savingsPerFinding.reduce((sum, f) => sum + (f.expectedSavings ?? 0), 0);
+		io.out(renderSummary(savingsPerFinding, incidentCost, totalExpectedSavings));
+		io.out("");
+		io.out("The FP rates above are measured on the OSS corpus. The dollar column, if you");
+		io.out("asked for one, uses YOUR incident cost — Mjölnir does not estimate it.");
 		io.out("Run with --strict to also surface quarantine-tier findings.");
 		return 0;
 	} catch (e) {
@@ -10237,10 +10911,18 @@ async function runBusinessCaseCommand(argv, io = {
 * posture and renders a management-ready verdict:
 *   GO · CONDITIONAL GO · NO-GO
 *
-* One command, screenshot-into-the-release-channel ready.
+* What changed, and why: this report hardcoded `hygieneFixed: 0`,
+* `hygieneIntroduced: 0`, `newTestsAdded: 0`, `newTestsWithoutAssertions: 0`
+* and `flakyAtLastRelease: 0`, and printed them as measured figures beside a
+* ✓/↑ trend mark — so a report that measured nothing looked like a report
+* that measured an absence. It also added 0.5/0.2/0.1 engineer-hours per
+* finding to produce a "test-debt cost estimate" nobody had estimated, and it
+* ignored the scan's `partial` flag, so a truncated scan could reach GO.
 *
-* Exit codes (frozen contract): 0 GO · 1 CONDITIONAL GO ·
-* 2 NO-GO · 10 usage · 20 internal.
+* Unmeasured values are now `null` and print as "not measured". Trend marks
+* require two real measurements. GO requires a complete scan. The release
+* decision itself moves to the canonical proof in v5 (V5-070); until then this
+* is a summary, and says so.
 */
 const ui$7 = plainContext();
 /** Rules that count as CI integrity issues for release verdicts. */
@@ -10249,34 +10931,40 @@ const CI_INTEGRITY_RULES = /* @__PURE__ */ new Set([
 	"QA-CI-002",
 	"QA-CI-008"
 ]);
+const NOT_MEASURED = "not measured";
+function show(value) {
+	return value === null ? NOT_MEASURED : String(value);
+}
 function renderVerdictBlock(v) {
 	const lines = [];
 	lines.push(sectionHeader(`RELEASE READINESS — since ${v.since}`, ui$7));
 	lines.push("");
 	lines.push(`Score: ${v.score !== null ? v.score + "/100" : "unknown"}`);
+	lines.push(`Analysis complete: ${v.partial ? "no (PARTIAL)" : "yes"}`);
+	if (v.partial) lines.push("A partial scan cannot support a GO verdict: the unanalyzed surface is exactly where an unknown finding would live.");
 	lines.push("");
 	lines.push("Test hygiene since last release:");
-	lines.push(`  Issues fixed:        ${v.hygieneFixed}`);
-	lines.push(`  Issues introduced:   ${v.hygieneIntroduced}`);
+	lines.push(`  Issues fixed:        ${show(v.hygieneFixed)}`);
+	lines.push(`  Issues introduced:   ${show(v.hygieneIntroduced)}`);
 	lines.push("");
 	lines.push("New tests added:");
-	lines.push(`  Total:                ${v.newTestsAdded}`);
-	lines.push(`  Without assertions:   ${v.newTestsWithoutAssertions}`);
+	lines.push(`  Total:                ${show(v.newTestsAdded)}`);
+	lines.push(`  Without assertions:   ${show(v.newTestsWithoutAssertions)}`);
 	lines.push("");
 	lines.push("Skipped during the cycle:");
-	lines.push(`  ${v.skippedDuringCycle}  ← what we are NOT verifying`);
+	lines.push(`  ${v.skippedDuringCycle}${v.skippedDuringCycle > 0 ? "  ← what we are NOT verifying" : ""}`);
 	lines.push("");
 	lines.push("Flaky tests:");
 	lines.push(`  At release:      ${v.flakyAtRelease}`);
-	const improvement = v.flakyAtRelease <= v.flakyAtLastRelease ? " ✓" : " ↑";
-	lines.push(`  At last release: ${v.flakyAtLastRelease}${improvement}`);
+	const improvement = v.flakyAtLastRelease === null ? "" : v.flakyAtRelease <= v.flakyAtLastRelease ? " ✓" : " ↑";
+	lines.push(`  At last release: ${show(v.flakyAtLastRelease)}${improvement}`);
 	lines.push("");
 	lines.push("CI integrity:");
 	const coeMark = v.continueOnErrorActive === 0 ? " ✓" : " ⚠";
 	lines.push(`  continue-on-error still active: ${v.continueOnErrorActive}${coeMark}`);
 	lines.push(`  Total CI integrity issues:      ${v.ciIntegrityIssues}`);
 	lines.push("");
-	lines.push(`Test-debt cost estimate: ~${v.testDebtHours.toFixed(1)} engineer-hours/qtr`);
+	lines.push(`Test-debt cost estimate: ${v.testDebtHours === null ? NOT_MEASURED : `~${v.testDebtHours.toFixed(1)} engineer-hours/qtr`}`);
 	lines.push("");
 	lines.push(`Blocking findings (error):   ${v.blockingFindings}`);
 	lines.push(`Warning findings (warning):  ${v.advisoryFindings}`);
@@ -10296,7 +10984,7 @@ function renderVerdictBlock(v) {
 		if (v.continueOnErrorActive > 0) lines.push(`  → ${v.continueOnErrorActive} continue-on-error still active — review before ship`);
 		if (v.skippedDuringCycle > 0) lines.push(`  → ${v.skippedDuringCycle} skipped test(s) — verify coverage gaps`);
 		if (v.blockingFindings === 0 && v.advisoryFindings > 0) lines.push(`  → ${v.advisoryFindings} advisory finding(s) — review before ship`);
-	} else lines.push("All gates clear. Release with confidence.");
+	} else lines.push("No gate in this report fired. This is a summary of one static scan, not a release authorization: the canonical release proof is the authority, and it requires candidate-bound evidence this command does not have.");
 	lines.push("");
 	lines.push("Screenshot this report into the release channel.");
 	return lines.join("\n");
@@ -10312,6 +11000,13 @@ function determineVerdict(result, history) {
 			reasons
 		};
 	}
+	if (result.partial) {
+		reasons.push("scan was PARTIAL — the unanalyzed surface is unverified");
+		return {
+			verdict: "NO-GO",
+			reasons
+		};
+	}
 	const flakyCount = history.flakyAtRelease ?? 0;
 	const ciIssues = history.continueOnErrorActive ?? 0;
 	const skipped = history.skippedDuringCycle ?? 0;
@@ -10334,24 +11029,20 @@ function buildReleaseReport(result, since, history = {}) {
 	const { verdict } = determineVerdict(result, history);
 	const errorFindings = result.findings.filter((f) => f.severity === "error");
 	const warningFindings = result.findings.filter((f) => f.severity === "warning");
-	let testDebtHours = 0;
-	for (const f of result.findings) if (CI_INTEGRITY_RULES.has(f.ruleId)) testDebtHours += .5;
-	else if (f.severity === "error") testDebtHours += .5;
-	else if (f.severity === "warning") testDebtHours += .2;
-	else testDebtHours += .1;
 	return {
 		verdict,
 		since,
-		hygieneFixed: 0,
-		hygieneIntroduced: 0,
-		newTestsAdded: 0,
-		newTestsWithoutAssertions: 0,
+		partial: result.partial,
+		hygieneFixed: null,
+		hygieneIntroduced: null,
+		newTestsAdded: null,
+		newTestsWithoutAssertions: null,
 		skippedDuringCycle: history.skippedDuringCycle ?? 0,
 		flakyAtRelease: history.flakyAtRelease ?? 0,
-		flakyAtLastRelease: 0,
+		flakyAtLastRelease: null,
 		ciIntegrityIssues: warningFindings.length,
 		continueOnErrorActive: errorFindings.filter((f) => CI_INTEGRITY_RULES.has(f.ruleId)).length,
-		testDebtHours,
+		testDebtHours: history.testDebtHours ?? null,
 		blockingFindings: errorFindings.length,
 		advisoryFindings: warningFindings.length,
 		score: result.score,
@@ -10393,18 +11084,18 @@ async function runReleaseReportCommand(argv, io) {
 			target,
 			json: false,
 			verbose: false,
-			maxDurationMs: Number.POSITIVE_INFINITY,
+			maxDurationMs: 6e5,
 			scopeChanged: false,
 			format: "terminal",
 			strict: false
 		}), since, history);
 		io.out(renderReleaseReport(report));
-		switch (report.verdict) {
-			case "GO": return 0;
-			case "CONDITIONAL GO": return 1;
-			case "NO-GO": return 1;
-			default: return 20;
+		if (report.verdict === "GO") {
+			io.err("mjolnir release-report: this is a static-scan summary, not release authorization. Run the release gate (npm run candidate:decision:release) before shipping.");
+			return 0;
 		}
+		if (report.verdict === "CONDITIONAL GO" || report.verdict === "NO-GO") return 1;
+		return 20;
 	} catch (e) {
 		internalErrorMessage(e, io.err, false);
 		return 20;
@@ -10413,56 +11104,42 @@ async function runReleaseReportCommand(argv, io) {
 //#endregion
 //#region src/commands/report-playwright.ts
 /**
-* `mjolnir report playwright` — Playwright Reporter Package (SDET-2).
+* `mjolnir report` — Mjölnir findings in the Playwright report shape.
 *
-* Generates a Playwright-compatible JSON report from Mjölnir scan results,
-* enabling Playwright's own UI and tooling to visualize Mjölnir findings.
+* What this command does NOT do, and why: a Playwright report describes tests
+* that were EXECUTED, with per-test outcomes and durations. A static scan
+* executed nothing. Presenting findings as Playwright `suites`/`tests` with a
+* `passed` status manufactured a runtime result that never happened — and on a
+* clean scan it published "0 tests, all passed", which a Playwright consumer
+* reads as a green test run.
 *
-* The report follows the Playwright JSON report schema's structure:
-* each finding becomes a "test" entry with Mjölnir's verdict as outcome.
+* So the execution block is empty and says so, and the findings live in the
+* `mjolnir` extension block where they are honestly labelled as static
+* analysis. The file is a findings report in a familiar shape, not a test run.
 */
 const ui$6 = plainContext();
-function findingOutcome(f) {
-	if (f.severity === "error") return "failed";
-	if (f.severity === "warning") return "expectedFailure";
-	return "passed";
-}
 function buildPlaywrightReport(result) {
 	const now = /* @__PURE__ */ new Date();
-	const findingsByFile = /* @__PURE__ */ new Map();
-	for (const f of result.findings) {
-		const existing = findingsByFile.get(f.file) ?? [];
-		existing.push(f);
-		findingsByFile.set(f.file, existing);
-	}
-	const suites = Array.from(findingsByFile.entries()).map(([file, findings]) => ({
-		title: file,
-		file,
-		tests: findings.map((f) => ({
-			title: `${f.ruleId}: ${f.message}`,
-			path: file,
-			outcome: findingOutcome(f),
-			duration: 0,
-			annotations: [{
-				type: f.severity === "error" ? "error" : "warning",
-				message: `${f.ruleId} — ${f.message}${f.fix ? `\nFix: ${f.fix}` : ""}`
-			}]
-		}))
-	}));
-	const allTests = suites.flatMap((s) => s.tests);
+	const partial = result.partial === true;
+	const hasError = result.findings.some((f) => f.severity === "error");
+	const status = partial ? "interrupted" : hasError ? "failed" : "passed";
 	return {
 		version: 1,
 		startTime: now.toISOString(),
 		endTime: now.toISOString(),
 		duration: 0,
-		status: result.findings.some((f) => f.severity === "error") ? "failed" : "passed",
-		totalTests: allTests.length,
-		passedTests: allTests.filter((t) => t.outcome === "passed").length,
-		failedTests: allTests.filter((t) => t.outcome === "failed").length,
-		suites,
+		status,
+		totalTests: 0,
+		passedTests: 0,
+		failedTests: 0,
+		suites: [],
 		mjolnir: {
+			execution: "STATIC_ANALYSIS",
+			status,
+			partial,
 			score: result.score,
 			framework: result.frameworks[0] ?? "unknown",
+			frameworkDetectionUnknown: result.frameworkDetectionUnknown === true,
 			findings: result.findings.map((f) => {
 				const entry = {
 					ruleId: f.ruleId,
@@ -10509,13 +11186,19 @@ async function runReportPlaywrightCommand(argv, io) {
 		if (!existsSync(outDir)) mkdirSync(outDir, { recursive: true });
 		const fullPath = requestedOutput;
 		writeFileAtomic(fullPath, JSON.stringify(report, null, 2) + "\n", { encoding: "utf8" });
-		const header = sectionHeader("PLAYWRIGHT REPORT", ui$6);
+		const decision = decideClaim({
+			partial: result.partial,
+			blockingFindings: result.findings.filter((f) => f.severity === "error").length,
+			supported: true
+		});
+		const header = sectionHeader("PLAYWRIGHT-SHAPED FINDINGS REPORT", ui$6);
 		io.out(`${header}\n`);
 		io.out(`Score: ${result.score !== null ? result.score + "/100" : "unknown"}`);
 		io.out(`Findings: ${result.findings.length} (${result.findings.filter((f) => f.severity === "error").length} error, ${result.findings.filter((f) => f.severity === "warning").length} warning)`);
 		io.out(`Report written: ${fullPath}`);
-		io.out(`Tests: ${report.totalTests} total, ${report.passedTests} passed, ${report.failedTests} failed`);
-		return result.findings.some((f) => f.severity === "error") ? 1 : 0;
+		io.out("Executed tests: 0 — this is static analysis, not a test run. The Playwright suite block is empty by design.");
+		io.out(`Determination: ${decision.state} — ${decision.reason}`);
+		return decision.exitCode;
 	} catch (e) {
 		internalErrorMessage(e, io.err, false);
 		return 20;
@@ -10655,32 +11338,49 @@ async function runTrendCommand(argv, io) {
 //#endregion
 //#region src/commands/exec-report.ts
 /**
-* `mjolnir exec-report` — Executive Quality Report (QM-3).
+* `mjolnir exec-report` — a short, measured summary of one scan.
 *
-* Generates a board-ready quality report with KPIs, trend summary,
-* risk assessment, and strategic recommendations.
+* What changed, and why: this command used to render an executive "Risk Level:
+* LOW", KPI deltas ("↑ healthy") with no previous run to compare against,
+* and assurances ("Score 85/100 is excellent — maintain current quality gate")
+* that no measurement supports. It also ignored the `partial` flag entirely,
+* so a truncated scan could print "No findings — clean scan." and exit 0.
 *
-* Output is human-readable terminal format suitable for copying into
-* executive presentations or email briefings.
+* It now reports only what the scan measured, names the surface each number
+* came from, and defers the verdict to the one determination function
+* (`decideClaim`) so a partial scan can never read as clean. Whether a
+* business is "low risk" is a decision this tool does not make for anyone.
 */
 const ui$4 = plainContext();
-function assessRisk(findings) {
-	const errors = findings.filter((f) => f.severity === "error").length;
-	const warnings = findings.filter((f) => f.severity === "warning").length;
-	if (errors > 5 || warnings > 20) return "high";
-	if (errors > 0 || warnings > 5) return "medium";
-	return "low";
-}
-function buildRecommendations(findings, score) {
-	const recs = [];
-	const errors = findings.filter((f) => f.severity === "error").length;
-	const warnings = findings.filter((f) => f.severity === "warning").length;
-	if (errors > 0) recs.push(`Fix ${errors} error finding(s) blocking release confidence`);
-	if (warnings > 0) recs.push(`Review ${warnings} warning finding(s) before next release`);
-	if (score !== null && score < 70) recs.push(`Score ${score}/100 is below the 70 threshold — prioritize rule coverage`);
-	if (score !== null && score >= 90) recs.push(`Score ${score}/100 is excellent — maintain current quality gate`);
-	if (recs.length === 0) recs.push("No critical issues — maintain current quality practices");
-	return recs;
+function buildExecutiveKpis(result) {
+	const errors = result.findings.filter((f) => f.severity === "error").length;
+	const warnings = result.findings.filter((f) => f.severity === "warning").length;
+	return [
+		{
+			label: "Worthiness score",
+			value: result.score !== null ? `${result.score}/100` : "not measured",
+			source: "scan result score",
+			direction: "higher-is-better"
+		},
+		{
+			label: "Error findings",
+			value: String(errors),
+			source: "scan result findings",
+			direction: "lower-is-better"
+		},
+		{
+			label: "Warning findings",
+			value: String(warnings),
+			source: "scan result findings",
+			direction: "lower-is-better"
+		},
+		{
+			label: "Analysis complete",
+			value: result.partial ? "no (partial)" : "yes",
+			source: "scan result partial flag",
+			direction: null
+		}
+	];
 }
 async function runExecReportCommand(argv, io) {
 	const target = argv.find((a) => !a.startsWith("-")) ?? ".";
@@ -10693,60 +11393,34 @@ async function runExecReportCommand(argv, io) {
 			target,
 			json: true,
 			verbose: false,
-			maxDurationMs: Number.POSITIVE_INFINITY,
+			maxDurationMs: 6e5,
 			scopeChanged: false,
 			format: "json",
 			strict: false
 		});
-		const risk = assessRisk(result.findings);
-		const recommendations = buildRecommendations(result.findings, result.score);
-		const kpis = [
-			{
-				label: "Worthiness Score",
-				value: result.score !== null ? `${result.score}/100` : "N/A",
-				delta: result.score !== null && result.score >= 80 ? "↑ healthy" : result.score !== null ? "↓ needs work" : "—",
-				status: result.score !== null && result.score >= 80 ? "good" : result.score !== null && result.score >= 60 ? "warning" : "critical"
-			},
-			{
-				label: "Total Findings",
-				value: String(result.findings.length),
-				delta: "",
-				status: result.findings.length <= 5 ? "good" : result.findings.length <= 20 ? "warning" : "critical"
-			},
-			{
-				label: "Errors",
-				value: String(result.findings.filter((f) => f.severity === "error").length),
-				delta: "",
-				status: result.findings.filter((f) => f.severity === "error").length === 0 ? "good" : "critical"
-			},
-			{
-				label: "Warnings",
-				value: String(result.findings.filter((f) => f.severity === "warning").length),
-				delta: "",
-				status: result.findings.filter((f) => f.severity === "warning").length <= 5 ? "good" : "warning"
-			}
-		];
-		const header = sectionHeader("EXECUTIVE QUALITY REPORT", ui$4);
+		const decision = decideClaim({
+			partial: result.partial,
+			blockingFindings: result.findings.filter((f) => f.severity === "error").length,
+			supported: true
+		});
+		const kpis = buildExecutiveKpis(result);
+		const header = sectionHeader("SCAN SUMMARY", ui$4);
 		io.out(`${header}\n`);
-		io.out(`Generated: ${(/* @__PURE__ */ new Date()).toISOString()}`);
 		io.out(`Target: ${target}`);
-		io.out(`Risk Level: ${risk.toUpperCase()}`);
+		io.out(`Determination: ${decision.state} — ${decision.reason}`);
 		io.out("");
-		io.out("--- Key Performance Indicators ---");
-		for (const kpi of kpis) {
-			const icon = kpi.status === "good" ? "✅" : kpi.status === "warning" ? "⚠️ " : "🔴";
-			io.out(`  ${icon} ${kpi.label}: ${kpi.value} ${kpi.delta}`);
-		}
+		io.out("--- Measured values ---");
+		for (const kpi of kpis) io.out(`  ${kpi.label}: ${kpi.value}  (source: ${kpi.source})`);
 		io.out("");
-		io.out("--- Top Findings ---");
+		io.out("--- Top findings ---");
 		const top = result.findings.slice(0, 5);
 		for (const f of top) io.out(`  [${f.severity.toUpperCase()}] ${f.ruleId}: ${f.message} (${f.file}:${f.line})`);
-		if (result.findings.length === 0) io.out("  No findings — clean scan.");
+		if (result.findings.length === 0) io.out(result.partial ? "  No findings in the analyzed portion of the surface. The scan was PARTIAL, so this is not a clean result." : "  No findings in a complete scan of this surface.");
+		if (result.findings.length > top.length) io.out(`  …and ${result.findings.length - top.length} more.`);
 		io.out("");
-		io.out("--- Recommendations ---");
-		for (const r of recommendations) io.out(`  • ${r}`);
+		io.out("Not reported here: business risk, ROI, or release readiness. Those are decisions, and this tool has no evidence for them.");
 		io.out("");
-		return result.findings.some((f) => f.severity === "error") ? 1 : 0;
+		return decision.exitCode;
 	} catch (e) {
 		internalErrorMessage(e, io.err, false);
 		return 20;
@@ -10804,7 +11478,7 @@ async function runPolicyCommand(argv, io) {
 		const policy = defaultPolicy();
 		const dir = target === ".mjolnir" ? target : ".";
 		if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-		writeFileSync(policyPath, JSON.stringify(policy, null, 2) + "\n");
+		writeFileAtomic(policyPath, JSON.stringify(policy, null, 2) + "\n");
 		io.out(`Policy written to ${policyPath}`);
 		io.out(`Use 'mjolnir policy validate ${policyPath}' to validate.`);
 		io.out(`Use 'mjolnir policy check <target> --policy ${policyPath}' to check results.`);
@@ -10880,83 +11554,158 @@ async function runPolicyCommand(argv, io) {
 //#endregion
 //#region src/commands/quarantine.ts
 /**
-* `mjolnir quarantine` — Quarantine Workflow Management (TL-3).
+* `mjolnir quarantine` — quarantined-test workflow.
 *
-* Manages quarantined tests: list proposed quarantines, review them,
-* accept/defer/reject, and track quarantine state over time.
+* What changed, and why: this command derived a quarantine "proposal" from a
+* STATIC scan by inventing an attempt count from severity (`attempts: 3` for an
+* error, `2` for a warning), then printed "Quarantines updated." after an
+* action that changed nothing, and printed hardcoded zeros as if they were
+* measured statistics. A quarantine decision is a claim about a flaky test's
+* runtime behaviour; a static scan has no runtime behaviour to claim, so it
+* cannot produce one.
 *
-* Subcommands:
-*   list      — show all proposed quarantines from a forensics report
-*   review    — review a specific quarantine proposal
-*   stats     — show quarantine statistics
+* It now refuses to invent. Proposals require runtime evidence (attempts and
+* an observed failure) from a saved forensics report; without one it says so
+* and points at `mjolnir forensics`. There is no quarantine store yet — the
+* ledger this belongs in is the suppression ledger (see
+* docs/RELEASE-TRAINS.md, V5-090) — so nothing claims to be updated.
 *
-* Reads forensics output to propose quarantines deterministically:
-*   propose when attempts >= 2 AND everFailed, priority by attempts then duration.
+* Scheduled for removal in 5.0.
 */
 const ui$3 = plainContext();
-function buildQuarantineProposals(findings) {
-	return findings.filter((f) => f.severity === "error" || f.severity === "warning").map((f, i) => ({
-		id: `Q-${String(i + 1).padStart(3, "0")}`,
-		ruleId: f.ruleId,
-		file: f.file,
-		line: f.line,
-		message: f.message,
-		attempts: f.severity === "error" ? 3 : 2,
+const CANDIDATE_KEYS = [
+	"flaky",
+	"flakyTests",
+	"tests",
+	"retries",
+	"failures",
+	"results"
+];
+function asRecord(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	return value;
+}
+/**
+* Extract runtime failure evidence from a saved forensics report. A record
+* without an observed attempt count is not evidence and is dropped rather than
+* defaulted.
+*/
+function runtimeFailuresFromReport(parsed) {
+	const root = asRecord(parsed);
+	if (!root) return [];
+	const candidates = [];
+	for (const key of CANDIDATE_KEYS) {
+		const value = root[key];
+		if (Array.isArray(value)) candidates.push(...value);
+	}
+	const evidence = [];
+	for (const candidate of candidates) {
+		const record = asRecord(candidate);
+		if (!record) continue;
+		const attempts = typeof record.attempts === "number" ? record.attempts : typeof record.failureCount === "number" ? record.failureCount : void 0;
+		if (attempts === void 0) continue;
+		const file = typeof record.file === "string" ? record.file : void 0;
+		if (!file) continue;
+		evidence.push({
+			ruleId: typeof record.title === "string" ? record.title : "UNKNOWN",
+			file,
+			line: typeof record.line === "number" ? record.line : 0,
+			message: typeof record.message === "string" ? record.message : "no message recorded",
+			attempts,
+			everFailed: record.everFailed === true || attempts > 0
+		});
+	}
+	return evidence;
+}
+function buildQuarantineProposals(evidence) {
+	return evidence.filter((item) => item.attempts >= 2 && item.everFailed).sort((a, b) => b.attempts - a.attempts || a.file.localeCompare(b.file) || a.line - b.line).map((item, index) => ({
+		id: `Q-${String(index + 1).padStart(3, "0")}`,
+		ruleId: item.ruleId,
+		file: item.file,
+		line: item.line,
+		message: item.message,
+		attempts: item.attempts,
+		everFailed: item.everFailed,
 		status: "proposed",
-		reason: f.severity === "error" ? "High-severity finding — quarantine recommended" : "Warning — review before quarantine"
+		reason: `${item.attempts} observed attempt(s) with a recorded failure — runtime evidence, not inferred from severity`
 	}));
 }
-async function runQuarantineCommand(argv, io) {
+function readReport(path) {
+	const root = resolve(path);
+	if (!existsSync(root)) return {
+		ok: false,
+		reason: `no such file: ${path}`
+	};
+	try {
+		return {
+			ok: true,
+			value: JSON.parse(readFileSync(root, "utf8"))
+		};
+	} catch (e) {
+		return {
+			ok: false,
+			reason: e instanceof Error ? e.message : "unreadable report"
+		};
+	}
+}
+function runQuarantineCommand(argv, io) {
 	const subcommand = argv[0] ?? "list";
-	const target = argv.slice(1).find((a) => !a.startsWith("-")) ?? ".";
+	const rest = argv.slice(1);
+	const target = rest.find((a) => !a.startsWith("-")) ?? ".";
+	const reportIdx = rest.indexOf("--from");
 	if (subcommand === "list") {
-		const findings = await runScan$1({
-			target,
-			json: true,
-			verbose: false,
-			maxDurationMs: Number.POSITIVE_INFINITY,
-			scopeChanged: false,
-			format: "json",
-			strict: false
-		}).catch((e) => {
-			internalErrorMessage(e, io.err, false);
-			return null;
-		});
-		if (!findings) return 20;
-		const proposals = buildQuarantineProposals(findings.findings);
-		if (proposals.length === 0) {
-			io.out("No quarantine proposals. All findings are within acceptable thresholds.");
-			return 0;
+		if (reportIdx === -1 || !rest[reportIdx + 1]) {
+			io.out(sectionHeader("QUARANTINE PROPOSALS", ui$3));
+			io.out("");
+			io.out("No runtime report supplied, so no proposals can be produced.");
+			io.out("A quarantine proposal asserts that a test actually failed more than once. A static scan has no runtime behaviour to observe, so Mjölnir will not invent one.");
+			io.out("");
+			io.out("Produce one: mjolnir forensics <results-dir> && mjolnir quarantine list --from <report.json>");
+			return unmeasuredClaim("quarantine list", "proposals require observed runtime failures, and no forensics report was supplied.").exitCode;
+		}
+		const reportPath = rest[reportIdx + 1];
+		const reportRoot = resolve(target);
+		const requested = resolve(reportPath);
+		const rel = relative(reportRoot, requested);
+		if (isAbsolute(rel) || rel.startsWith("..")) {
+			io.err("mjolnir quarantine: --from report must stay within the target root");
+			return 10;
 		}
+		const report = readReport(reportPath);
+		if (!report.ok) {
+			io.err(`mjolnir quarantine: cannot read report: ${report.reason}`);
+			return 10;
+		}
+		const evidence = runtimeFailuresFromReport(report.value);
+		const proposals = buildQuarantineProposals(evidence);
 		io.out(sectionHeader("QUARANTINE PROPOSALS", ui$3));
 		io.out("");
-		io.out(`| ID | Rule | File | Severity | Status |`);
-		io.out(`| -- | ---- | ---- | -------- | ------ |`);
-		for (const p of proposals) io.out(`| ${p.id} | ${p.ruleId} | ${p.file} | proposed | proposed |`);
+		if (proposals.length === 0) {
+			io.out(`0 proposal(s) from ${evidence.length} runtime record(s). Nothing in this report shows a test failing more than once.`);
+			return unmeasuredClaim("quarantine list", "no runtime record met the observed-failure threshold; an empty proposal list is not a clean test suite.").exitCode;
+		}
+		io.out("| ID | Attempts | Test | File | Status |");
+		io.out("| -- | -------- | ---- | ---- | ------ |");
+		for (const p of proposals) io.out(`| ${p.id} | ${p.attempts} | ${p.ruleId} | ${p.file}:${p.line} | ${p.status} |`);
 		io.out("");
-		io.out(`${proposals.length} proposal(s). Use 'mjolnir quarantine review' to manage.`);
-		return findings.findings.some((f) => f.severity === "error") ? 1 : 0;
+		io.out(`${proposals.length} proposal(s) from observed runtime failures. Accepting one is a human decision this command does not make.`);
+		return unmeasuredClaim("quarantine list", "proposals are a human decision queue, not an enforced gate.").exitCode;
 	}
 	if (subcommand === "review") {
-		const proposals = buildQuarantineProposals([]);
-		const action = argv.find((a) => a === "--accept" || a === "--defer" || a === "--reject");
 		io.out(sectionHeader("QUARANTINE REVIEW", ui$3));
 		io.out("");
-		io.out("Pending reviews:");
-		for (const p of proposals) io.out(`  ${p.id}: ${p.ruleId} — ${p.message} (${p.file}:${p.line})`);
-		if (action) {
-			io.out(`Action: ${action}`);
-			io.out("Quarantines updated.");
-		} else io.out("Use --accept, --defer, or --reject to manage.");
-		return 0;
+		io.out("No quarantine store exists, so there is nothing to review and nothing was changed.");
+		io.out("Quarantine state lives in the suppression ledger: edit .mjolnir/suppressions.json, where every entry is versioned, justified, and subject to expiry.");
+		return unmeasuredClaim("quarantine review", "the command is a placeholder; the ledger is the source of truth.").exitCode;
 	}
 	if (subcommand === "stats") {
 		io.out(sectionHeader("QUARANTINE STATS", ui$3));
 		io.out("");
-		io.out("Total: 0 | Proposed: 0 | Accepted: 0 | Deferred: 0 | Rejected: 0");
+		io.out("No quarantine store exists, so no statistics can be reported.");
+		io.out("Printing zeros here would look like a measured absence of flakiness. It is not one.");
 		io.out("");
-		io.out("No quarantine activity recorded yet.");
-		return 0;
+		io.out("Run `mjolnir trust-trend` for measured history, or read .mjolnir/suppressions.json for the current suppression ledger.");
+		return unmeasuredClaim("quarantine stats", "no store exists to measure; zeros would be a fabricated statistic.").exitCode;
 	}
 	io.err(`Unknown quarantine subcommand: ${subcommand}`);
 	return 10;
@@ -11180,7 +11929,7 @@ function runCiAdapterCommand(argv, io) {
 		default: return 10;
 	}
 	try {
-		writeFileSync(join(target, filename), output);
+		writeFileAtomic(join(target, filename), output);
 	} catch (error) {
 		io.err(`Unable to write CI template: ${error instanceof Error ? error.message : String(error)}`);
 		return 20;
@@ -11200,16 +11949,32 @@ function runCiAdapterCommand(argv, io) {
 * file with inline CSS and JavaScript, suitable for embedding
 * in team wikis or sharing via static hosting.
 */
+/** Band → CSS colour, read from the brand tokens so the dashboard cannot
+*  name a colour of its own. `trusted` is aurora-cyan, not green: green is
+*  reserved for non-score success (the terminal's `Palette.ok`). */
+const BAND_HEX = {
+	critical: SCORE.critical,
+	warning: SCORE.warning,
+	trusted: SCORE.trusted,
+	forged: SCORE.forged,
+	unmeasured: SCORE.unmeasured
+};
+const FINDINGS_SHOWN_LIMIT = 100;
 function escapeHtml(text) {
 	return sanitizeErrorText(text, { maxLength: 1e3 }).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&#39;");
 }
 function generateDashboardHtml(data) {
-	const scoreColor = data.score === null ? "#888" : data.score >= 80 ? "#22c55e" : data.score >= 60 ? "#eab308" : "#ef4444";
-	const rows = data.findings.map((f) => `<tr><td>${escapeHtml(f.ruleId)}</td><td><span style="color:${f.severity === "error" ? "#ef4444" : f.severity === "warning" ? "#eab308" : "#22c55e"}">${escapeHtml(f.severity)}</span></td><td>${escapeHtml(f.file)}</td><td>${escapeHtml(f.message)}</td></tr>`).join("");
+	const scoreColor = BAND_HEX[deriveScoreState(data.score).band];
+	const severityColor = (severity) => severity === "error" ? STATUS.error : severity === "warning" ? STATUS.warning : STATUS.ok;
+	const rows = data.findings.map((f) => `<tr><td>${escapeHtml(f.ruleId)}</td><td><span style="color:${severityColor(f.severity)}">${escapeHtml(f.severity)}</span></td><td>${escapeHtml(f.file)}</td><td>${escapeHtml(f.message)}</td></tr>`).join("");
+	const banner = data.partial ? `<p style="color:${STATUS.warning};font-weight:600">PARTIAL ANALYSIS — the whole surface was not analyzed. These numbers describe the analyzed portion only.</p>` : "";
+	const truncation = data.findingsShown < data.totalFindings ? `<p>Showing ${data.findingsShown} of ${data.totalFindings} findings (display limit).</p>` : "";
+	const frameworkValue = data.frameworkCount === null ? "unknown" : String(data.frameworkCount);
 	return `<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta charset="UTF-8">
+${data.generatedAt === null ? "" : `<meta name="mjolnir-generated-at" content="${escapeHtml(data.generatedAt)}">\n`}<meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Quality Dashboard</title>
 <style>
   body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; max-width: 960px; margin: 0 auto; padding: 2rem; background: #0a0a0a; color: #e5e5e5; }
@@ -11226,16 +11991,15 @@ function generateDashboardHtml(data) {
 </head>
 <body>
 <h1>🔍 Quality Dashboard</h1>
-<p>Generated: ${escapeHtml(data.generatedAt)}</p>
-<div class="score">${data.score !== null ? data.score + "/100" : "N/A"}</div>
+${banner}${data.generatedAt === null ? `<p>Deterministic build — no generation timestamp is recorded, so this file is byte-identical for an unchanged repository.</p>` : ""}<div class="score">${data.score !== null ? data.score + "/100" : "N/A"}</div>
 <div class="kpi-grid">
   <div class="kpi"><div class="value">${data.totalFindings}</div><div class="label">Findings</div></div>
-  <div class="kpi"><div class="value" style="color:#ef4444">${data.errorCount}</div><div class="label">Errors</div></div>
-  <div class="kpi"><div class="value" style="color:#eab308">${data.warningCount}</div><div class="label">Warnings</div></div>
-  <div class="kpi"><div class="value">${data.frameworkCount}</div><div class="label">Frameworks</div></div>
+  <div class="kpi"><div class="value" style="color:${STATUS.error}">${data.errorCount}</div><div class="label">Errors</div></div>
+  <div class="kpi"><div class="value" style="color:${STATUS.warning}">${data.warningCount}</div><div class="label">Warnings</div></div>
+  <div class="kpi"><div class="value">${frameworkValue}</div><div class="label">Frameworks</div></div>
 </div>
 <h2>Findings</h2>
-<table><thead><tr><th>Rule</th><th>Severity</th><th>File</th><th>Message</th></tr></thead><tbody>${rows}</tbody></table>
+${truncation}<table><caption>Findings on the analyzed surface, newest severity first. Capped at ${FINDINGS_SHOWN_LIMIT} rows.</caption><thead><tr><th scope="col">Rule</th><th scope="col">Severity</th><th scope="col">File</th><th scope="col">Message</th></tr></thead><tbody>${rows}</tbody></table>
 </body>
 </html>`;
 }
@@ -11243,6 +12007,7 @@ async function runDashboardCommand(argv, io) {
 	const target = argv.find((a) => !a.startsWith("-")) ?? ".";
 	const outputIdx = argv.indexOf("--output");
 	const outputPath = outputIdx !== -1 ? argv[outputIdx + 1] ?? "dashboard.html" : "dashboard.html";
+	const deterministic = argv.includes("--deterministic");
 	if (!existsSync(target)) {
 		io.err(`mjolnir dashboard: target does not exist: ${target}`);
 		return 10;
@@ -11255,7 +12020,7 @@ async function runDashboardCommand(argv, io) {
 		return 10;
 	}
 	try {
-		const { runScan } = await import("./scan-pipeline-CRe7-MQn.mjs");
+		const { runScan } = await import("./scan-pipeline-Bg-46cLS.mjs");
 		const result = await runScan({
 			target,
 			json: true,
@@ -11265,26 +12030,37 @@ async function runDashboardCommand(argv, io) {
 			format: "json",
 			strict: false
 		});
+		const shown = result.findings.slice(0, FINDINGS_SHOWN_LIMIT);
 		const data = {
 			score: result.score,
 			totalFindings: result.findings.length,
 			errorCount: result.findings.filter((f) => f.severity === "error").length,
 			warningCount: result.findings.filter((f) => f.severity === "warning").length,
-			frameworkCount: result.frameworks.length,
-			findings: result.findings.slice(0, 100).map((f) => ({
+			frameworkCount: result.frameworkDetectionUnknown ? null : result.frameworks.length,
+			partial: result.partial,
+			findingsShown: shown.length,
+			findings: shown.map((f) => ({
 				ruleId: f.ruleId,
 				severity: f.severity,
 				file: f.file,
 				message: f.message
 			})),
-			generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			generatedAt: deterministic ? null : (/* @__PURE__ */ new Date()).toISOString()
 		};
 		const html = generateDashboardHtml(data);
 		writeFileAtomic(resolvedOutput, html, { encoding: "utf8" });
 		io.out(`Dashboard written to ${resolvedOutput}`);
 		io.out(`Score: ${data.score !== null ? data.score + "/100" : "N/A"}`);
 		io.out(`Findings: ${data.totalFindings} (${data.errorCount} errors, ${data.warningCount} warnings)`);
-		return data.errorCount > 0 ? 1 : 0;
+		if (data.frameworkCount === null) io.out("Frameworks: unknown — detection did not complete");
+		if (data.findingsShown < data.totalFindings) io.out(`Table shows ${data.findingsShown} of ${data.totalFindings} findings (display limit).`);
+		const decision = decideClaim({
+			partial: data.partial,
+			blockingFindings: data.errorCount,
+			supported: true
+		});
+		io.out(`Determination: ${decision.state} — ${decision.reason}`);
+		return decision.exitCode;
 	} catch (e) {
 		internalErrorMessage(e, io.err, false);
 		return 20;
@@ -11293,18 +12069,34 @@ async function runDashboardCommand(argv, io) {
 //#endregion
 //#region src/commands/enterprise.ts
 /**
-* `mjolnir enterprise` — Enterprise Deployment (QM-4).
+* `mjolnir enterprise` — refuses, and says what exists instead.
+*
+* What changed, and why: this command wrote three kinds of artifact that
+* Mjölnir cannot back.
 *
-* Generates enterprise deployment artifacts:
-*   - Self-hosted deployment config
-*   - SSO/SAML setup guide
-*   - Compliance templates (SOC 2, HIPAA, PCI-DSS)
-*   - Custom policy templates
+* 1. A deployment config declaring `"authentication": "sso-saml"`. There
+*    is no server, no session, and no SAML implementation in this product.
+*    The config described a deployment that does not exist.
+* 2. An SSO setup guide instructing the reader to add an `sso` block to
+*    `mjolnir.config.json`. Nothing reads that key. The guide was
+*    confident, plausible, and inert.
+* 3. Three compliance templates — SOC 2, HIPAA, PCI-DSS — mapping
+*    controls to "SSO/SAML integration", a "built-in scan audit trail"
+*    and a "privacy scan". None of those is a Mjölnir feature: a scan
+*    reads a repository and prints. A compliance template is a document
+*    an organisation shows an auditor, so mapping controls to
+*    capabilities that do not exist is not a cosmetic bug.
 *
-* Subcommands:
-*   config      — generate deployment config
-*   sso         — generate SSO setup guide
-*   compliance  — generate compliance template
+* So the command no longer writes files. What it can honestly offer is
+* `enterprise/threat-model.json` and `enterprise/data-flows.json`, which
+* ARE real, ARE validated in CI by `npm run enterprise:threat-model`,
+* and describe the product that exists: a zero-network local CLI.
+*
+* The `config` subcommand still emits a fact file, because a manifest of
+* what the tool is and is not is genuinely useful to an operator
+* evaluating it — as long as it records absence instead of inventing it.
+*
+* Scheduled for removal in 5.0 — see docs/RELEASE-TRAINS.md.
 */
 const ui$1 = plainContext();
 function runEnterpriseCommand(argv, io) {
@@ -11313,119 +12105,108 @@ function runEnterpriseCommand(argv, io) {
 	if (!existsSync(outputDir)) mkdirSync(outputDir, { recursive: true });
 	if (subcommand === "config") {
 		const config = {
-			service: "mjolnir-qa",
-			version: "2.0.0",
-			deployment: {
-				type: "self-hosted",
-				protocol: "https",
-				port: 443,
-				authentication: "sso-saml",
-				sessionTimeout: "8h",
-				maxFileSize: "100MB"
-			},
-			features: {
-				rules: true,
-				plugins: true,
-				cache: true,
-				reporter: true,
-				mcp: true
-			},
-			logging: {
-				level: "info",
-				retention: "90d",
-				audit: true
-			}
+			product: "mjolnir-qa",
+			version: ENGINE_VERSION,
+			shape: "zero-runtime-dependency local CLI",
+			network: "none — no telemetry, no hosted service, no sync",
+			runtimeDependencies: 0,
+			verified: [
+				"local-only execution (tests/contract/privacy-network-isolation.spec.ts)",
+				"versioned threat + data-flow model (npm run enterprise:threat-model)",
+				"deterministic machine contract, drift-locked (contractVersion 1)"
+			],
+			notProvided: [
+				"SSO / SAML / OIDC — no server, no session, no identity provider integration",
+				"hosted control plane, multi-tenant sync, or audit-log service",
+				"compliance certification or auditor-facing control mapping",
+				"air-gapped installation or offline recovery drill (see GAP-M26-015)"
+			],
+			unsupportedRequests: "docs/M26-SUPPORT-MATRIX.json records each of these as an explicit BLOCKED cell rather than a plan."
 		};
-		const path = join(outputDir, "deployment-config.json");
-		writeFileSync(path, JSON.stringify(config, null, 2) + "\n");
-		io.out(sectionHeader("ENTERPRISE CONFIG", ui$1));
-		io.out(`Config written: ${path}`);
-		io.out(`Type: ${config.deployment.type}`);
-		io.out(`Auth: ${config.deployment.authentication}`);
-		return 0;
-	}
-	if (subcommand === "sso") {
-		const guide = `# SSO/SAML Setup Guide
-
-## Service Provider (SP) Configuration
-- Entity ID: https://your-domain.com/mjolnir
-- ACS URL: https://your-domain.com/mjolnir/auth/sso/callback
-- Binding: HTTP-POST
-
-## Identity Provider (IdP) Configuration
-- Metadata URL: https://your-idp.com/sso/metadata
-- Required Attributes:
-  - email (mapped to user identity)
-  - role (mapped to access level)
-  - department (mapped to team)
-
-## Mjölnir Configuration
-Add to mjolnir.config.json:
-\`\`\`json
-{
-  "sso": {
-    "enabled": true,
-    "provider": "saml",
-    "entryPoint": "https://your-idp.com/sso",
-    "attributeMapping": {
-      "email": "user",
-      "role": "accessLevel",
-      "department": "team"
-    }
-  }
-}
-\`\`\`
-`;
-		const path = join(outputDir, "sso-setup.md");
-		writeFileSync(path, guide);
-		io.out(`SSO guide written: ${path}`);
+		const path = join(outputDir, "capability-manifest.json");
+		writeFileAtomic(path, JSON.stringify(config, null, 2) + "\n");
+		io.out(sectionHeader("ENTERPRISE CAPABILITY MANIFEST", ui$1));
+		io.out(`Written: ${path}`);
+		io.out(`Version: ${ENGINE_VERSION} · runtime dependencies: 0 · network: none`);
+		io.out("");
+		io.out("This product is a local CLI. It provides no server, no SSO, no hosted");
+		io.out("control plane and no compliance certification. The manifest's");
+		io.out("`notProvided` list is the honest answer to a deployment questionnaire.");
 		return 0;
 	}
-	if (subcommand === "compliance") {
-		for (const framework of [
-			"SOC2",
-			"HIPAA",
-			"PCI-DSS"
-		]) {
-			const template = `# ${framework} Compliance Template for Mjölnir
-
-## Control Mapping
-| Control | Mjölnir Feature | Evidence |
-| --------- | --------------- | -------- |
-| Access Control | SSO/SAML integration | sso-setup.md |
-| Audit Logging | Built-in scan audit trail | --json output |
-| Data Protection | Local-first, zero-network | privacy scan |
-| Change Management | quarantined rules, policy gates | policy check |
-| Monitoring | dashboard, exec-report | HTML/terminal output |
-`;
-			const path = join(outputDir, `${framework.toLowerCase()}-compliance.md`);
-			writeFileSync(path, template);
-			io.out(`Compliance template: ${path}`);
-		}
-		return 0;
+	if (subcommand === "sso" || subcommand === "compliance") {
+		io.err(subcommand === "sso" ? "mjolnir enterprise sso: not available, and no artifact will be written.\n  Mjölnir is a local CLI with no server, no session and no identity-provider\n  integration. The previous SSO guide told readers to add an `sso` block to\n  mjolnir.config.json — a key nothing reads.\n  What exists: the threat + data-flow model, validated by\n  `npm run enterprise:threat-model`. See `mjolnir enterprise config`." : "mjolnir enterprise compliance: not available, and no artifact will be written.\n  Mjölnir cannot produce an auditor-facing control mapping. The previous\n  templates mapped controls to capabilities this product does not have\n  (SSO/SAML integration, a scan \"audit trail\", a \"privacy scan\"), which is\n  not a formatting bug — it is a false statement in a document meant for\n  an auditor.\n  What exists: enterprise/threat-model.json and enterprise/data-flows.json,\n  validated in CI, describing the product that actually ships.");
+		return 10;
 	}
 	io.err(`Unknown enterprise subcommand: ${subcommand}`);
+	io.err("Available: config");
 	return 10;
 }
 //#endregion
 //#region src/commands/maturity.ts
 /**
-* `mjolnir maturity` — Quality Maturity Model (QM-6).
-*
-* Assesses the organization's QA maturity across dimensions:
-*   Test hygiene — rule coverage, assertion quality
-*   CI integrity — gate coverage, feedback speed
-*   Runtime verification — forensics adoption, flake management
-*   Process maturity — triage cadence, suppression governance
+* `mjolnir maturity` — organizational QA-maturity signals.
 *
-* Output: maturity level (Initial → Managed → Defined → Quantitatively Managed → Optimizing)
-* with specific improvement recommendations.
+* What changed, and why: this command used to emit an "Overall: Optimizing
+* (87/100)" style assessment derived from whether three files happened to
+* exist, with hardcoded dimension scores (75/70/65/30) and a `ruleCount = 79`
+* fallback invented when a catalog could not be read. A file-existence proxy
+* is not a maturity measurement, and a number with no provenance is worse than
+* no number: it is a decision someone else will make on.
 *
-* Subcommands:
-*   assess   — run the maturity assessment
-*   levels   — show all maturity levels
+* It now reports what it can actually observe — the presence of specific,
+* named QA artifacts — and states that the artifact is a signal, not a score.
+* There is no overall score, because Mjölnir cannot measure organizational
+* maturity. Scheduled for removal in 5.0; see docs/RELEASE-TRAINS.md.
 */
 const ui = plainContext();
+const SIGNALS = [
+	{
+		id: "policy",
+		question: "Is a Mjölnir policy file committed?",
+		path: ".mjolnir/mjolnir.policy.json",
+		says: "a policy file exists in this checkout",
+		doesNotSay: "that the policy is enforced, current, or correct"
+	},
+	{
+		id: "suppressions",
+		question: "Is a suppression ledger committed?",
+		path: ".mjolnir/suppressions.json",
+		says: "suppressions are tracked as data",
+		doesNotSay: "that the suppressions are justified or still needed"
+	},
+	{
+		id: "history",
+		question: "Are previous runs recorded?",
+		path: ".mjolnir/stats.json",
+		says: "run history exists in this checkout",
+		doesNotSay: "that the history is complete, or that anyone reviewed it"
+	},
+	{
+		id: "baseline",
+		question: "Is a scan baseline committed?",
+		path: ".mjolnir/baseline.json",
+		says: "a baseline exists to diff against",
+		doesNotSay: "that the baseline was taken from a clean, complete scan"
+	},
+	{
+		id: "rule-catalog",
+		question: "Is the generated rule catalog committed?",
+		path: "docs/rules/catalog.md",
+		says: "generated rule documentation is in the repository",
+		doesNotSay: "how many rules are enabled, measured, or certified"
+	}
+];
+function assessMaturitySignals(root) {
+	return SIGNALS.map((signal) => ({
+		id: signal.id,
+		question: signal.question,
+		path: signal.path,
+		present: existsSync(join(root, signal.path)),
+		says: signal.says,
+		doesNotSay: signal.doesNotSay
+	}));
+}
 const MATURITY_LEVELS = [
 	"Initial",
 	"Managed",
@@ -11433,51 +12214,16 @@ const MATURITY_LEVELS = [
 	"Quantitatively Managed",
 	"Optimizing"
 ];
-function assessDimension(name, score, findings = []) {
-	if (score >= 90) return {
-		name,
-		level: "Optimizing",
-		score,
-		findings
-	};
-	if (score >= 75) return {
-		name,
-		level: "Quantitatively Managed",
-		score,
-		findings
-	};
-	if (score >= 60) return {
-		name,
-		level: "Defined",
-		score,
-		findings
-	};
-	if (score >= 40) return {
-		name,
-		level: "Managed",
-		score,
-		findings
-	};
-	return {
-		name,
-		level: "Initial",
-		score,
-		findings
-	};
-}
 function runMaturityCommand(argv, io) {
 	const subcommand = argv[0] ?? "assess";
 	const target = argv.slice(1).find((a) => !a.startsWith("-")) ?? ".";
 	if (subcommand === "levels") {
 		io.out(sectionHeader("MATURITY LEVELS", ui));
 		io.out("");
-		for (let i = 0; i < MATURITY_LEVELS.length; i++) {
-			const level = MATURITY_LEVELS[i];
-			io.out(`${i + 1}. ${level}`);
-		}
+		for (let i = 0; i < MATURITY_LEVELS.length; i++) io.out(`${i + 1}. ${MATURITY_LEVELS[i]}`);
 		io.out("");
-		io.out("Score ranges: Initial (0-39), Managed (40-59), Defined (60-74), Quantitatively Managed (75-89), Optimizing (90-100)");
-		return 0;
+		io.out("These are vocabulary only. Mjölnir does not place a repository on this scale: it observes named artifacts and reports which are present.");
+		return unmeasuredClaim("maturity levels", "A maturity level is a judgement, not a measurement.").exitCode;
 	}
 	if (subcommand === "assess") {
 		if (!existsSync(target)) {
@@ -11485,65 +12231,19 @@ function runMaturityCommand(argv, io) {
 			return 10;
 		}
 		try {
-			let ruleCount = 0;
-			const catalogPath = join(target, "docs", "rules", "catalog.md");
-			if (existsSync(catalogPath)) try {
-				ruleCount = (readFileSync(catalogPath, "utf8").match(/QA-/g) ?? []).length;
-			} catch {
-				ruleCount = 79;
-			}
-			else ruleCount = 79;
-			let hasPolicy = false;
-			const policyPath = join(target, ".mjolnir", "mjolnir.policy.json");
-			if (existsSync(policyPath)) try {
-				hasPolicy = true;
-			} catch {
-				hasPolicy = false;
-			}
-			let hasHistory = false;
-			const statsPath = join(target, ".mjolnir", "stats.json");
-			if (existsSync(statsPath)) try {
-				hasHistory = true;
-			} catch {
-				hasHistory = false;
-			}
-			let hasTrends = false;
-			const trendPath = join(target, ".mjolnir", "trend.jsonl");
-			if (existsSync(trendPath)) try {
-				hasTrends = true;
-			} catch {
-				hasTrends = false;
-			}
-			const dimensions = [
-				assessDimension("Test Hygiene", Math.min(100, Math.round(ruleCount / 100 * 100)), [`${ruleCount} rules loaded`, ruleCount >= 50 ? "Good rule coverage" : "Increase rule coverage"]),
-				assessDimension("CI Integrity", hasPolicy ? 75 : 30, [hasPolicy ? "Policy-as-code active" : "Implement policy-as-code", "Gate configuration verified"]),
-				assessDimension("Runtime Verification", hasTrends ? 70 : 25, [hasTrends ? "Trend tracking active" : "Start quality trend tracking", hasHistory ? "Historical data available" : "No historical data yet"]),
-				assessDimension("Process Maturity", hasHistory ? 65 : 20, [hasHistory ? "Fix tracking active" : "Start tracking fixes", "Triage cadence needs definition"])
-			];
-			const avgScore = Math.round(dimensions.reduce((sum, d) => sum + d.score, 0) / dimensions.length);
-			const overall = avgScore >= 90 ? "Optimizing" : avgScore >= 75 ? "Quantitatively Managed" : avgScore >= 60 ? "Defined" : avgScore >= 40 ? "Managed" : "Initial";
-			const assessment = {
-				timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-				overall,
-				overallScore: avgScore,
-				dimensions
-			};
-			io.out(sectionHeader("MATURITY ASSESSMENT", ui));
-			io.out(`Generated: ${assessment.timestamp}`);
-			io.out(`Overall: ${assessment.overall} (${assessment.overallScore}/100)`);
+			const signals = assessMaturitySignals(target);
+			const present = signals.filter((signal) => signal.present).length;
+			io.out(sectionHeader("QA ARTIFACT SIGNALS", ui));
+			io.out(`Target: ${target} · ${present}/${signals.length} named artifacts present`);
+			io.out("No overall score: Mjölnir cannot measure organizational maturity.");
 			io.out("");
-			for (const d of dimensions) {
-				const icon = d.score >= 75 ? "🟢" : d.score >= 50 ? "🟡" : "🔴";
-				io.out(`${icon} ${d.name}: ${d.level} (${d.score}/100)`);
-				for (const f of d.findings) io.out(`  - ${f}`);
-				io.out("");
+			for (const signal of signals) {
+				io.out(`${signal.present ? "[present]" : "[absent]"}  ${signal.question}`);
+				io.out(`    path: ${signal.path}`);
+				io.out(`    presence says: ${signal.says}`);
+				io.out(`    presence does NOT say: ${signal.doesNotSay}`);
 			}
-			const improvement = dimensions.filter((d) => d.score < 75).map((d) => `Improve ${d.name} to reach Quantitatively Managed`);
-			if (improvement.length > 0) {
-				io.out("--- Improvement Areas ---");
-				for (const i of improvement) io.out(`• ${i}`);
-			}
-			return 0;
+			return unmeasuredClaim("maturity", "These are artifact-presence signals, not a maturity assessment, so no clean result is reported.").exitCode;
 		} catch (e) {
 			internalErrorMessage(e, io.err, false);
 			return 20;
@@ -11670,7 +12370,7 @@ function analyzeCrossFileSignals(files, findings, root) {
 	}));
 	const correlationConclusions = correlateFindings(findings).map((c) => `${c.conclusionType}: ${c.corroboration}`).join("; ");
 	const graph = buildDependencyGraph(root);
-	const reachableFiles = getReachableFiles(orderedFiles.map((f) => f.path), graph);
+	const reachability = getReachableFiles(orderedFiles.map((f) => f.path), graph);
 	return {
 		signals: [
 			...duplicateTestNames,
@@ -11682,7 +12382,7 @@ function analyzeCrossFileSignals(files, findings, root) {
 		circularDependencies,
 		correlationConclusions,
 		dependencyGraphSize: graph.size,
-		reachableFilesCount: reachableFiles.length
+		reachability
 	};
 }
 function detectSharedImports(files) {
@@ -11762,7 +12462,9 @@ function renderCrossFileAnalysis(result) {
 	lines.push(`Shared imports: ${result.sharedImports.length}`);
 	lines.push(`Circular dependencies: ${result.circularDependencies.length}`);
 	lines.push(`Dependency graph size: ${result.dependencyGraphSize}`);
-	lines.push(`Reachable files: ${result.reachableFilesCount}`);
+	const { reachability } = result;
+	if (reachability.resolvedAny) lines.push(`Reachable files: ${reachability.reachable.length} (resolved from the dependency graph)`);
+	else lines.push(`Reachable files: not resolved — the graph is keyed by package manifest and none of the ${reachability.unresolvedStarts.length} starting file(s) could be placed. This number is not evidence of a traversal.`);
 	lines.push("");
 	if (result.signals.length > 0) {
 		lines.push("Signals:");
@@ -11927,190 +12629,6 @@ function renderEvidenceGraphResult(result) {
 	return lines.join("\n").trimEnd();
 }
 //#endregion
-//#region src/frameworks/framework-inventory.ts
-const FRAMEWORK_INVENTORY = [
-	{
-		frameworkId: "playwright",
-		entityType: "E2E_FRAMEWORK",
-		language: "TypeScript/JavaScript",
-		maturity: "F4",
-		supportStatus: "OFFICIAL_PARTIAL",
-		targetMaturity: "F5",
-		targetSupportStatus: "OFFICIAL_FULL",
-		validatedVersions: [
-			"1.44",
-			"1.45",
-			"1.46",
-			"1.47",
-			"1.48"
-		],
-		keyGapForNextLevel: "GAP-PW-006 parallelism/worker safety analysis"
-	},
-	{
-		frameworkId: "jest",
-		entityType: "TEST_FRAMEWORK",
-		language: "TypeScript/JavaScript",
-		maturity: "F3",
-		supportStatus: "OFFICIAL_PARTIAL",
-		targetMaturity: "F4",
-		targetSupportStatus: "OFFICIAL_FULL",
-		validatedVersions: ["29", "30"],
-		keyGapForNextLevel: "GAP-JEST-004 lifecycle modeling"
-	},
-	{
-		frameworkId: "vitest",
-		entityType: "TEST_FRAMEWORK",
-		language: "TypeScript/JavaScript",
-		maturity: "F3",
-		supportStatus: "OFFICIAL_PARTIAL",
-		targetMaturity: "F4",
-		targetSupportStatus: "OFFICIAL_FULL",
-		validatedVersions: [
-			"1.6",
-			"2.0",
-			"2.1"
-		],
-		keyGapForNextLevel: "GAP-VIT-004 lifecycle modeling"
-	},
-	{
-		frameworkId: "pytest",
-		entityType: "TEST_FRAMEWORK",
-		language: "Python",
-		maturity: "F2",
-		supportStatus: "OFFICIAL_PARTIAL",
-		targetMaturity: "F3",
-		targetSupportStatus: "OFFICIAL_FULL",
-		validatedVersions: [
-			"7.4",
-			"8.0",
-			"8.1",
-			"8.2",
-			"8.3"
-		],
-		keyGapForNextLevel: "GAP-PY-004 lifecycle modeling"
-	},
-	{
-		frameworkId: "junit",
-		entityType: "TEST_FRAMEWORK",
-		language: "Java",
-		maturity: "F2",
-		supportStatus: "OFFICIAL_PARTIAL",
-		targetMaturity: "F3",
-		targetSupportStatus: "OFFICIAL_FULL",
-		validatedVersions: ["5.10", "5.11"],
-		keyGapForNextLevel: "GAP-JU-004 lifecycle modeling"
-	},
-	{
-		frameworkId: "nunit",
-		entityType: "TEST_FRAMEWORK",
-		language: "C#",
-		maturity: "F2",
-		supportStatus: "OFFICIAL_PARTIAL",
-		targetMaturity: "F3",
-		targetSupportStatus: "OFFICIAL_FULL",
-		validatedVersions: ["3.14", "4.2"],
-		keyGapForNextLevel: "GAP-NU-004 lifecycle modeling"
-	},
-	{
-		frameworkId: "xunit",
-		entityType: "TEST_FRAMEWORK",
-		language: "C#",
-		maturity: "F2",
-		supportStatus: "OFFICIAL_PARTIAL",
-		targetMaturity: "F3",
-		targetSupportStatus: "OFFICIAL_FULL",
-		validatedVersions: ["2.9"],
-		keyGapForNextLevel: "GAP-XU-004 lifecycle modeling"
-	},
-	{
-		frameworkId: "cypress",
-		entityType: "E2E_FRAMEWORK",
-		language: "TypeScript/JavaScript",
-		maturity: "F2",
-		supportStatus: "EXPERIMENTAL",
-		targetMaturity: "F3",
-		targetSupportStatus: "OFFICIAL_PARTIAL",
-		validatedVersions: ["13"],
-		keyGapForNextLevel: "GAP-CY-004 lifecycle modeling"
-	},
-	{
-		frameworkId: "selenium",
-		entityType: "AUTOMATION_LIBRARY",
-		language: "Java/TypeScript/Python",
-		maturity: "F1",
-		supportStatus: "EXPERIMENTAL",
-		targetMaturity: "F2",
-		targetSupportStatus: "OFFICIAL_PARTIAL",
-		validatedVersions: [
-			"4.20",
-			"4.21",
-			"4.22",
-			"4.23",
-			"4.24",
-			"4.25"
-		],
-		keyGapForNextLevel: "GAP-SE-002 AST-based usage analysis"
-	},
-	{
-		frameworkId: "testng",
-		entityType: "TEST_FRAMEWORK",
-		language: "Java",
-		maturity: "F1",
-		supportStatus: "EXPERIMENTAL",
-		targetMaturity: "F2",
-		targetSupportStatus: "OFFICIAL_PARTIAL",
-		validatedVersions: ["7.10", "7.11"],
-		keyGapForNextLevel: "GAP-TN-002 AST-based usage analysis"
-	},
-	{
-		frameworkId: "github-actions",
-		entityType: "CI_PROVIDER",
-		language: "YAML",
-		maturity: "F3",
-		supportStatus: "OFFICIAL_PARTIAL",
-		targetMaturity: "F4",
-		targetSupportStatus: "OFFICIAL_FULL",
-		validatedVersions: ["v4"],
-		keyGapForNextLevel: "GAP-GHA-004 advanced matrix strategy modeling"
-	},
-	{
-		frameworkId: "azure-devops",
-		entityType: "CI_PROVIDER",
-		language: "YAML",
-		maturity: "F3",
-		supportStatus: "OFFICIAL_PARTIAL",
-		targetMaturity: "F4",
-		targetSupportStatus: "OFFICIAL_FULL",
-		validatedVersions: ["2024"],
-		keyGapForNextLevel: "GAP-AZ-004 stage dependency graph modeling"
-	},
-	{
-		frameworkId: "jenkins",
-		entityType: "CI_PROVIDER",
-		language: "Groovy/YAML",
-		maturity: "F3",
-		supportStatus: "OFFICIAL_PARTIAL",
-		targetMaturity: "F4",
-		targetSupportStatus: "OFFICIAL_FULL",
-		validatedVersions: ["2.440", "2.450"],
-		keyGapForNextLevel: "GAP-JK-004 declarative pipeline advanced features"
-	},
-	{
-		frameworkId: "gitlab-ci",
-		entityType: "CI_PROVIDER",
-		language: "YAML",
-		maturity: "F0",
-		supportStatus: "UNSUPPORTED",
-		targetMaturity: "F1",
-		targetSupportStatus: "DISCOVERED",
-		validatedVersions: [],
-		keyGapForNextLevel: "GAP-GL-001 basic pipeline discovery"
-	}
-];
-function getFrameworkById(frameworkId) {
-	return FRAMEWORK_INVENTORY.find((f) => f.frameworkId === frameworkId);
-}
-//#endregion
 //#region src/frameworks/scorecard.ts
 const SCORECARD_DIMENSIONS = [
 	"discovery",
@@ -14582,14 +15100,7 @@ function isValidFinding(value) {
 }
 function isValidTrustSummary(value) {
 	if (!isRecord$3(value)) return false;
-	return [
-		"L0",
-		"L1",
-		"L2",
-		"L3",
-		"L4",
-		"L5"
-	].includes(String(value.level)) && isFiniteNumber(value.confidence) && value.confidence >= 0 && value.confidence <= 1 && isFiniteNumber(value.evidenceCoverage) && value.evidenceCoverage >= 0 && value.evidenceCoverage <= 1 && isFiniteNumber(value.inconclusiveRate) && value.inconclusiveRate >= 0 && value.inconclusiveRate <= 1 && (value.measuredFpOfFiredRules === void 0 || isFiniteNumber(value.measuredFpOfFiredRules) && value.measuredFpOfFiredRules >= 0 && value.measuredFpOfFiredRules <= 1) && isStringArray(value.provisionalRuleIds) && (value.confidenceCeiling === void 0 || isFiniteNumber(value.confidenceCeiling) && value.confidenceCeiling >= 0 && value.confidenceCeiling <= 1) && isStringArray(value.ceilingReasons);
+	return TRUST_ORDER.includes(String(value.level)) && isFiniteNumber(value.confidence) && value.confidence >= 0 && value.confidence <= 1 && isFiniteNumber(value.evidenceCoverage) && value.evidenceCoverage >= 0 && value.evidenceCoverage <= 1 && isFiniteNumber(value.inconclusiveRate) && value.inconclusiveRate >= 0 && value.inconclusiveRate <= 1 && (value.measuredFpOfFiredRules === void 0 || isFiniteNumber(value.measuredFpOfFiredRules) && value.measuredFpOfFiredRules >= 0 && value.measuredFpOfFiredRules <= 1) && isStringArray(value.provisionalRuleIds) && (value.confidenceCeiling === void 0 || isFiniteNumber(value.confidenceCeiling) && value.confidenceCeiling >= 0 && value.confidenceCeiling <= 1) && isStringArray(value.ceilingReasons);
 }
 function isValidProvenance(value) {
 	if (!isRecord$3(value)) return false;
@@ -15087,14 +15598,22 @@ function validateScanTarget(target, err) {
 	return null;
 }
 /**
-* Exit-code decision for a finished scan under the given gate level
-* (audit H-7): the previously-dead config.gate field now selects which
-* severities block. Advisory (E0) findings never gate at any level.
+* Exit-code decision for findings only (audit H-7): the previously-dead
+* config.gate field selects which severities block. Advisory (E0) findings
+* never gate at any level.
+*
+* This is a findings-only view of the one exit matrix in `claim-evidence`.
+* Callers that have just finished an ANALYSIS must use `scanExitCode`
+* instead — this function cannot see `partial`, and a truncated scan with
+* zero findings is exactly the case that turns a bug into a green build.
 */
 function exitForFindings(findings, gate) {
-	if (gate === "advisory") return 0;
-	const gateSeverities = gate === "warning" ? ["error", "warning"] : ["error"];
-	return findings.some((f) => gateSeverities.includes(f.severity) && !isAdvisoryFinding(f)) ? 1 : 0;
+	return scanExitCode({
+		partial: false,
+		findings,
+		gate,
+		isAdvisory: isAdvisoryFinding
+	});
 }
 /** Testable `ci install` handler. Returns the process exit code. */
 function runCiInstall(argv, io = {
@@ -15286,11 +15805,19 @@ function isEntryPoint() {
 		return import.meta.url === pathToFileURL(argv1).href;
 	}
 }
-if (isEntryPoint()) try {
-	process$1.exitCode = await main();
-} catch (err) {
-	internalErrorMessage(err, (s) => process$1.stderr.write(s + "\n"), false);
-	process$1.exitCode = 20;
+if (isEntryPoint()) {
+	await initSentry();
+	try {
+		process$1.exitCode = await main();
+	} catch (err) {
+		captureInternalError(err, "cli");
+		internalErrorMessage(err, (s) => process$1.stderr.write(s + "\n"), false);
+		process$1.exitCode = 20;
+	} finally {
+		await flushSentry();
+	}
 }
 //#endregion
 export { ENGINE_VERSION as CLI_VERSION, DEFAULT_MAX_DURATION_MS, EVIDENCE_OVERRIDES, KNOWN_RULE_IDS, MAX_DURATION_MS, OVERLAP_META_BY_RULE_ID, SUITE_INVALIDATING_RULE_IDS, buildUniversalRules, discoverAndParseRuntimeReport, err, exitForFindings, fallbackWorkspace, internalErrorMessage, isEntryPoint, isValidFindingRecord, levenshtein, main, nearestFlags, out, parseArgs, parseArgsOrUsage, pathMatchesGlob, printUsage, renderScanOutput, runAnalyzeCommand, runBadgeCommand, runBaselineCommand, runBusinessCaseCommand, runCIIntegrityCommand, runCiAdapterCommand, runCiInstall, runContractVerifyCommand, runCreateRuleCommand, runCrossFileCommand, runDashboardCommand, runDebtCommand, runDiffCommand, runDoctorCommand, runDoctorPlaywright, runEnterpriseCommand, runEvidenceGraphCommand, runExecReportCommand, runExplainCommand, runFixCommand, runForensicsCommand, runFrameworkMaturityCommand, runHandoffCommand, runHandoverCommand, runHelpCommand, runImpactCommand, runInitCommand, runInstallCommand, runMaturityCommand, runMutationCommand, runPolicyCommand, runPrCommentCommand, runPwReportCommand, runQuarantineCommand, runReleaseReportCommand, runReleaseTrustCommand, runReportPlaywrightCommand, runRulesCommand, runScan, runScanCommand, runStatsCommand, runSummaryCommand, runSuppressionGateCommand, runSuppressions, runTrendCommand, runTriageCommand, runTrustReportCommand, runTrustTrendCommand, runVerifyCommand, runWhyCommand, usageErrorMessage, validateScanTarget };
+
+//# sourceMappingURL=cli.mjs.map