mjolnir-qa 3.0.0 → 4.0.0

package/dist/{scan-pipeline-CAH9_Qgh.mjs → scan-pipeline-CCJdEKNa.mjs}

@@ -1,14 +1,14 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import { createRequire } from "node:module";
-import { closeSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { closeSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, statSync, unlinkSync, writeSync } from "node:fs";
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createHash, randomBytes } from "node:crypto";
+import { execFileSync } from "node:child_process";
 import * as ts$2 from "ts-morph";
 import ts, { Project, SyntaxKind, ts as ts$1 } from "ts-morph";
 import { Language, Parser } from "web-tree-sitter";
 import { parse } from "yaml";
-import { execFileSync } from "node:child_process";
 import { inflateRawSync } from "node:zlib";
 //#region src/types.ts
 /** Severity ladder. Order matters for sorting and gating. */
@@ -60,6 +60,32 @@ function isValidCategory(value) {
 	return value !== void 0 && RULE_CATEGORIES.includes(value);
 }
 /**
+* Trust levels (Verification Trust Evolution Plan §16): the OVERALL
+* trust a consumer can place in one finding, combining the static
+* evidence ladder (E0–E2) with RUNTIME corroboration from a real run
+* report. Exposed honestly, never overclaimed:
+*   L0 — observation only (E0, no runtime evidence).
+*   L1 — heuristic static evidence (E1), no runtime evidence.
+*   L2 — deterministic static evidence (E2), no runtime evidence.
+*   L3 — RUNTIME: the file containing this finding appeared in a real
+*        run report (tests in that file executed).
+*   L4 — RUNTIME: the specific test containing this finding was
+*        identified in the report and executed (its outcome is known).
+*   L5 — RUNTIME: the run verdict directly corroborates the DEFECT
+*        class (e.g. a flake-risk finding whose test actually flaked,
+*        retried, or timed out in the report).
+* INVARIANT (structurally enforced): L3–L5 require runtime
+* corroboration — a static-only finding can never claim L4/L5.
+*/
+const TRUST_ORDER = [
+	"L0",
+	"L1",
+	"L2",
+	"L3",
+	"L4",
+	"L5"
+];
+/**
 * Honest default evidence level for a finding (Honesty Core Phase 1).
 * Derivation is deterministic and conservative:
 *   observation → E0 (never proof)
@@ -742,21 +768,13 @@ const MEASURED_FP = {
 * empty scan is an observation, not a proof).
 */
 function summaryTrustLevel(findings) {
-	const order = [
-		"L0",
-		"L1",
-		"L2",
-		"L3",
-		"L4",
-		"L5"
-	];
 	let best = 0;
 	for (const f of findings) {
 		const t = f.trustLevel ?? "L2";
-		const idx = order.indexOf(t);
+		const idx = TRUST_ORDER.indexOf(t);
 		if (idx > best) best = idx;
 	}
-	return order[best];
+	return TRUST_ORDER[best];
 }
 /**
 * A finding's trust rung (0–5) on the canonical ladder. Corroborated
@@ -767,14 +785,7 @@ function summaryTrustLevel(findings) {
 */
 function trustRung(f) {
 	const t = f.trustLevel ?? deriveTrustLevel(f);
-	return [
-		"L0",
-		"L1",
-		"L2",
-		"L3",
-		"L4",
-		"L5"
-	].indexOf(t);
+	return TRUST_ORDER.indexOf(t);
 }
 /**
 * Hard incompleteness ceilings (plan §6: partial/crash/truncation;
@@ -911,6 +922,17 @@ function buildRunIdentity(input) {
 		engineVersion: input.engineVersion
 	};
 	if (input.reportDigest) verdictInputs.reportDigest = input.reportDigest;
+	if (input.commit !== void 0) verdictInputs.commit = input.commit;
+	if (input.tree !== void 0) verdictInputs.tree = input.tree;
+	if (input.lockfile !== void 0) verdictInputs.lockfile = input.lockfile;
+	if (input.candidate !== void 0) verdictInputs.candidate = {
+		manifestId: input.candidate.manifestId,
+		state: input.candidate.state,
+		candidateSha: input.candidate.candidateSha,
+		baseSha: input.candidate.baseSha,
+		packageSha256: input.candidate.packageSha256,
+		lockfileSha256: input.candidate.lockfileSha256
+	};
 	if (input.trustModelVersion !== void 0) verdictInputs.trustModelVersion = input.trustModelVersion;
 	if (input.scoringModelVersion !== void 0) verdictInputs.scoringModelVersion = input.scoringModelVersion;
 	if (input.frameworkSupportMatrixVersion !== void 0) verdictInputs.frameworkSupportMatrixVersion = input.frameworkSupportMatrixVersion;
@@ -918,15 +940,31 @@ function buildRunIdentity(input) {
 	if (input.suppressionFingerprint !== void 0) verdictInputs.suppressionFingerprint = input.suppressionFingerprint;
 	if (input.policyFingerprint !== void 0) verdictInputs.policyFingerprint = input.policyFingerprint;
 	if (input.historicalEvidenceFingerprint !== void 0) verdictInputs.historicalEvidenceFingerprint = input.historicalEvidenceFingerprint;
+	const scanId = sha256$1(canonical(verdictInputs));
+	const boundLinks = [
+		"input",
+		"rules",
+		"config",
+		"engine"
+	];
+	if (input.commit !== void 0) boundLinks.push("commit");
+	if (input.tree !== void 0) boundLinks.push("tree");
+	if (input.lockfile !== void 0) boundLinks.push("lockfile");
+	if (input.candidate !== void 0) boundLinks.push("candidate");
 	return {
-		scanId: sha256$1(canonical(verdictInputs)),
+		scanId,
 		inputFingerprint,
 		rulesDigest,
 		configFingerprint,
 		engineVersion: input.engineVersion,
+		boundLinks,
 		...input.trustModelVersion !== void 0 ? { trustModelVersion: input.trustModelVersion } : {},
 		...input.scoringModelVersion !== void 0 ? { scoringModelVersion: input.scoringModelVersion } : {},
-		...input.frameworkSupportMatrixVersion !== void 0 ? { frameworkSupportMatrixVersion: input.frameworkSupportMatrixVersion } : {}
+		...input.frameworkSupportMatrixVersion !== void 0 ? { frameworkSupportMatrixVersion: input.frameworkSupportMatrixVersion } : {},
+		...input.commit !== void 0 ? { commit: input.commit } : {},
+		...input.tree !== void 0 ? { tree: input.tree } : {},
+		...input.lockfile !== void 0 ? { lockfile: input.lockfile } : {},
+		...input.candidate !== void 0 ? { candidate: input.candidate } : {}
 	};
 }
 /**
@@ -967,9 +1005,218 @@ function buildEvidenceGraph(parts) {
 				...parts.reproduction !== void 0 ? { ref: parts.reproduction } : {}
 			}
 		],
-		...parts.runId !== void 0 ? { runId: parts.runId } : {}
+		...parts.runId !== void 0 ? { runId: parts.runId } : {},
+		...parts.candidate !== void 0 ? { candidate: {
+			manifestId: parts.candidate.manifestId,
+			candidateSha: parts.candidate.candidateSha
+		} } : {}
+	};
+}
+//#endregion
+//#region src/engine/file-executor.ts
+function cacheHitOutcome(job) {
+	return {
+		path: job.path,
+		status: "CACHE_HIT",
+		findings: [...job.cacheHit ?? []],
+		parseFallback: false
+	};
+}
+/**
+* Drive a list of jobs through an executor and return outcomes in INPUT order.
+*
+* This is the function the pipeline calls. It is executor-agnostic on purpose:
+* swapping in a pooled executor must not require touching the caller, and the
+* ordering guarantee has to live here or it would live in each executor and
+* drift between them.
+*/
+async function executeFiles(jobs, executor, context = {}) {
+	const outcomes = new Array(jobs.length);
+	if (executor.concurrency <= 1 || jobs.length <= 1) {
+		for (let i = 0; i < jobs.length; i++) {
+			const job = jobs[i];
+			context.onProgress?.({
+				done: i,
+				total: jobs.length,
+				path: job.path
+			});
+			outcomes[i] = await runOne(job, executor, context);
+		}
+		context.onProgress?.({
+			done: jobs.length,
+			total: jobs.length,
+			path: jobs[jobs.length - 1]?.path ?? ""
+		});
+		return outcomes;
+	}
+	let next = 0;
+	let completed = 0;
+	const inFlight = /* @__PURE__ */ new Set();
+	const limit = Math.max(1, Math.floor(executor.concurrency));
+	const worker = async () => {
+		for (;;) {
+			const index = next++;
+			if (index >= jobs.length) return;
+			const job = jobs[index];
+			outcomes[index] = await runOne(job, executor, context);
+			completed++;
+			context.onProgress?.({
+				done: completed,
+				total: jobs.length,
+				path: job.path
+			});
+		}
+	};
+	for (let i = 0; i < Math.min(limit, jobs.length); i++) {
+		const promise = worker().then(() => void 0);
+		inFlight.add(promise);
+	}
+	await Promise.all(inFlight);
+	return outcomes;
+}
+async function runOne(job, executor, context) {
+	if (job.cacheHit !== void 0) return cacheHitOutcome(job);
+	try {
+		return await executor.execute(job, context);
+	} catch (error) {
+		return {
+			path: job.path,
+			status: "FAILED",
+			findings: [],
+			parseFallback: false,
+			error: error instanceof Error ? error : new Error(String(error))
+		};
+	}
+}
+/**
+* The strategy the pipeline uses today.
+*
+* `runOne` is supplied by the pipeline because parsing and rule execution
+* need the adapter and the active rule set, which are pipeline concerns. The
+* executor's job is the BOUNDARY and the bookkeeping, not the analysis — so
+* this factory exists to bind those two without the executor importing the
+* pipeline (which would be a cycle).
+*/
+function createExecutor(name, concurrency, runOne) {
+	return {
+		name,
+		concurrency,
+		execute: runOne
+	};
+}
+//#endregion
+//#region src/engine/candidate-binding.ts
+/**
+* Candidate binding (plan V5-010).
+*
+* Reads a candidate trust manifest and produces the immutable
+* `CandidateBinding` that a run identity is bound to. It also computes the
+* repository facts (commit, tree, lockfile digest) that the identity was
+* missing until this module existed.
+*
+* The law here is ABSENCE over invention. A manifest that is missing,
+* unreadable, or internally contradictory yields NO binding — not a partial
+* one. A consumer that can see "not bound" can refuse to trust the run; a
+* consumer handed a half-filled binding cannot tell what is missing, and will
+* trust the parts that are there.
+*/
+const CANDIDATE_MANIFEST_PATH = "candidate-trust-manifest.json";
+const SHA40 = /^[a-f0-9]{40}$/;
+const SHA256 = /^[a-f0-9]{64}$/;
+const STATES = ["WORKING_CANDIDATE", "RELEASE_CANDIDATE"];
+const AUTHORIZATION = ["NOT_AUTHORIZED", "AUTHORIZED"];
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function sha256File(path) {
+	try {
+		return createHash("sha256").update(readFileSync(path)).digest("hex");
+	} catch {
+		return;
+	}
+}
+function gitLine(root, args) {
+	try {
+		const trimmed = execFileSync("git", args, {
+			cwd: root,
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			],
+			windowsHide: true
+		}).trim();
+		return trimmed.length > 0 ? trimmed : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* The commit and tree the working tree is at. Both absent outside a
+* repository or with no commits — never substituted with a placeholder.
+*/
+function bindRepository(root) {
+	const commit = gitLine(root, ["rev-parse", "HEAD"]);
+	const tree = gitLine(root, ["rev-parse", "HEAD^{tree}"]);
+	const lockfile = sha256File(join(root, "package-lock.json"));
+	return {
+		...commit !== void 0 ? { commit } : {},
+		...tree !== void 0 ? { tree } : {},
+		...lockfile !== void 0 ? { lockfile } : {}
+	};
+}
+/**
+* Parse a candidate manifest into a binding, or return null when it cannot
+* honestly be bound.
+*
+* Null is returned for: no manifest, unreadable JSON, a missing or malformed
+* required field, or a state/authorization combination that cannot legally
+* exist (a WORKING_CANDIDATE carrying a commit, for example — the same
+* contradiction the release decision evaluator treats as BLOCKED).
+*/
+function parseCandidateBinding(raw) {
+	if (!isRecord$1(raw)) return null;
+	const identity = raw.identity;
+	if (!isRecord$1(identity)) return null;
+	const state = identity.state;
+	const candidateSha = identity.candidateSha;
+	const baseSha = identity.baseSha;
+	const packageSha256 = identity.packageSha256;
+	const lockfileSha256 = identity.lockfileSha256;
+	if (typeof state !== "string" || !STATES.includes(state)) return null;
+	if (typeof baseSha !== "string" || !SHA40.test(baseSha)) return null;
+	if (typeof packageSha256 !== "string" || !SHA256.test(packageSha256)) return null;
+	if (typeof lockfileSha256 !== "string" || !SHA256.test(lockfileSha256)) return null;
+	if (candidateSha !== null && (typeof candidateSha !== "string" || !SHA40.test(candidateSha))) return null;
+	const manifestId = raw.manifestId;
+	if (typeof manifestId !== "string" || manifestId.length === 0) return null;
+	const owner = typeof raw.owner === "string" ? raw.owner : "UNASSIGNED";
+	const authorization = raw.releaseAuthorizationState;
+	if (typeof authorization !== "string" || !AUTHORIZATION.includes(authorization)) return null;
+	if (state === "WORKING_CANDIDATE") {
+		if (candidateSha !== null) return null;
+		if (authorization !== "NOT_AUTHORIZED") return null;
+	} else if (candidateSha === null) return null;
+	return {
+		manifestId,
+		state,
+		candidateSha,
+		baseSha,
+		packageSha256,
+		lockfileSha256,
+		owner,
+		releaseAuthorizationState: authorization
 	};
 }
+/** Read and bind the manifest from a checkout, or null. */
+function readCandidateBinding(root, manifestPath = CANDIDATE_MANIFEST_PATH) {
+	try {
+		return parseCandidateBinding(JSON.parse(readFileSync(join(root, manifestPath), "utf8")));
+	} catch {
+		return null;
+	}
+}
 //#endregion
 //#region src/engine/version.ts
 /**
@@ -980,7 +1227,7 @@ function buildEvidenceGraph(parts) {
 * scripts/sync-sarif-version.cjs and guarded by the version-consistency
 * spec. cli.ts re-exports this as CLI_VERSION.
 */
-const ENGINE_VERSION = "3.0.0";
+const ENGINE_VERSION = "4.0.0";
 //#endregion
 //#region src/engine/contract-versions.ts
 /**
@@ -1388,20 +1635,9 @@ function validate(cfg, knownRuleIds) {
 	return warnings;
 }
 /**
-* Bug-audit QA-2026-08-30 QA-6: the 90-day policy in the README was only
-* applied at WRITE time by the `ignore` command — a hand-written entry
-* without `expires` stayed active forever, silently bypassing the
-* documented window.
-*
-* Audit S4 (remediation plan): the config-file MTIME is no longer an
-* expiry anchor. Anchoring the 90-day default at mtime meant ANY edit to
-* mjolnir.config.json — a reformat, an unrelated key, a `touch` — reset
-* the 90-day window for EVERY hand-authored entry: suppressions could be
-* extended indefinitely without touching their own fields. The expiry is
-* now the entry's explicit `expires` date alone; an entry without one
-* stays active and is honestly labeled "(no expiry set)" in the
-* suppressions report. Hand-authored entries should declare `expires` at
-* creation (README §Configuration documents the shape).
+* Expiry is evaluated only from an explicit ISO `expires` date. A missing
+* date remains active and is reported as having no expiry. Config-file mtime
+* is never an expiry anchor.
 */
 function isSuppressionActive(ign, now = /* @__PURE__ */ new Date()) {
 	if (!ign.expires) return true;
@@ -1684,7 +1920,33 @@ function sharedWalk(options) {
 *
 * When nothing is detectable we report `unknown` and the scanner analyzes
 * all test-looking files — stated honestly in output rather than guessed.
+*
+* ## One ID space (plan V5-024)
+*
+* This detector used to declare its own `TestFramework` union of three
+* literals while `src/frameworks/framework-inventory.ts` catalogued fourteen
+* framework ids. Two vocabularies for one concept is how a support matrix
+* starts disagreeing with what the tool actually detects: a framework can be
+* catalogued as OFFICIAL_PARTIAL and never once be emitted by the code that
+* claims to detect it.
+*
+* So the ids here are `FrameworkId`s — the inventory's own vocabulary — and
+* `DETECTABLE_TEST_FRAMEWORKS` is the subset this detector can actually
+* resolve from a checkout. That subset is the HONEST limit of detection, and
+* `detectableVsCatalogued()` reports the remainder rather than letting a
+* three-item list read as the whole catalog.
+*/
+/**
+* The catalogued frameworks whose detection is implemented today.
+*
+* Every entry must exist in the inventory — enforced by the parity spec, not
+* by comment.
 */
+const DETECTABLE_TEST_FRAMEWORKS = [
+	"jest",
+	"vitest",
+	"playwright"
+];
 const CONFIG_FILES = {
 	jest: [
 		"jest.config.ts",
@@ -1703,7 +1965,7 @@ const CONFIG_FILES = {
 };
 function detectFrameworks(ws) {
 	const found = /* @__PURE__ */ new Set();
-	for (const fw of Object.keys(CONFIG_FILES)) if (CONFIG_FILES[fw].some((f) => existsSync(join(ws.root, f)))) found.add(fw);
+	for (const fw of DETECTABLE_TEST_FRAMEWORKS) if (CONFIG_FILES[fw].some((f) => existsSync(join(ws.root, f)))) found.add(fw);
 	if (!found.has("jest") && ws.packageJson["jest"] !== void 0) found.add("jest");
 	const deps = {
 		...ws.packageJson["dependencies"],
@@ -1725,11 +1987,7 @@ function detectFrameworks(ws) {
 		};
 	}
 	return {
-		frameworks: [
-			"jest",
-			"vitest",
-			"playwright"
-		].filter((f) => found.has(f)),
+		frameworks: DETECTABLE_TEST_FRAMEWORKS.filter((f) => found.has(f)),
 		unknown: false
 	};
 }
@@ -1746,6 +2004,13 @@ function detectFrameworks(ws) {
 * byte-identical — a score shift is a regression, not an improvement.
 */
 let project = null;
+/**
+* The shared ts-morph project.
+*
+* Exported so an adapter's `dispose()` can evict the file it parsed: ts-morph
+* caches by file path, so without eviction a long scan holds every parsed
+* SourceFile until the process exits (plan V5-021).
+*/
 function getProject() {
 	if (!project) project = new Project({
 		useInMemoryFileSystem: true,
@@ -2272,7 +2537,36 @@ function frameworkFilterApplies(rule, file) {
 * "cypress", `@jest/globals` → "jest", `vitest` → "vitest". Config
 * gating is rule-declared (`configFiles`), not hard-coded here.
 */
-const TEST_FILE_RE = /\.(?:test|spec)\.(?:js|jsx|ts|tsx|mjs|cjs)$|\.cy\.(?:js|jsx|ts|tsx)$/;
+/**
+* `.test.` / `.spec.` filenames, plus the Cypress `.cy.` convention.
+*
+* `mts` and `cts` are TypeScript's Node-native ESM/CJS extensions. They were
+* missing here, and the omission was invisible in the worst way — not a wrong
+* answer, but an ABSENCE.
+*
+* Reproduced: a repo containing two byte-identical tests, one at
+* `tests/control.spec.ts` and one at `tests/slow.spec.mts`, each with a
+* `QA-TEST-004` hard sleep:
+*
+*   discovered: 1, analyzed: 1, unrecognized: 1, scopeVerdict: "PARTIAL"
+*
+* The `.ts` test produced the finding. The `.mts` test produced nothing at
+* all — it was never scanned, so every rule that could have caught it was
+* silent on it, with no finding, no low-evidence note, and no indication that
+* a test file had been skipped. A test scanner that cannot see a whole file
+* extension has a false green that is invisible by construction: the reader
+* has nothing to distrust, because there is nothing there.
+*
+* The corroboration that this was an oversight rather than a decision sits
+* four lines below: PW_CONFIG_RE already accepted `cts`. The config regex knew
+* about the Node-native extensions; the test-file regex did not.
+*
+* `discovery/scan-adapters.ts:isUnrecognizedSourceCandidate` already counted
+* these paths as uncovered surface, so the scope accounting had been reporting
+* the hole the whole time — it was being read as a known limitation rather than
+* as a defect.
+*/
+const TEST_FILE_RE = /\.(?:test|spec)\.(?:js|jsx|ts|tsx|mjs|cjs|mts|cts)$|\.cy\.(?:js|jsx|ts|tsx)$/;
 /**
 * Fallback config list for `configOnly` rules that do not declare
 * `configFiles` (the legacy playwright.config.* gating, preserved
@@ -2379,11 +2673,42 @@ const typescriptAdapter = {
 			fixtureDirMemo: /* @__PURE__ */ new Map()
 		});
 	},
+	/**
+	* The ONE AST seam (plan V5-021).
+	*
+	* This adapter used to parse inside `runRules`, on the synchronous path,
+	* while Java and C# exposed the async `parseAst` hook. Two seams meant two
+	* sets of consequences, both of them bad:
+	*
+	*   - the pipeline computes `wantsAst` as `adapter.parseAst !== undefined`,
+	*     so a TypeScript file never took the AST path through the pipeline at
+	*     all, and its parse failures were invisible to the pipeline's
+	*     fallback counters;
+	*   - nothing called `dispose()` for the ts-morph path, so a scan held
+	*     every parsed SourceFile for its whole lifetime.
+	*
+	* Parsing now happens here, once, through the same contract every other
+	* adapter uses. `dispose()` drops this file's SourceFile from the shared
+	* project; ts-morph caches per file path, so removing it is what keeps
+	* memory proportional to one file rather than to the whole scan.
+	*/
+	parseAst(file) {
+		const sourceFile = parseTsFile(file);
+		if (sourceFile === void 0) return void 0;
+		return {
+			ast: sourceFile,
+			dispose: () => {
+				try {
+					getProject().removeSourceFile(sourceFile);
+				} catch {}
+			}
+		};
+	},
 	runRules(rules, file, emit, onCrash, budget) {
-		const withAst = {
+		const withAst = file.ast === void 0 ? {
 			...file,
 			ast: parseTsFile(file)
-		};
+		} : file;
 		const withTags = {
 			...withAst,
 			frameworkTags: frameworkTagsFromImports(withAst.text)
@@ -3802,9 +4127,37 @@ function discoverAllTestFiles(ctx, languageAdapters, buckets, fixtureDirMemo) {
 		}
 	});
 }
+/**
+* Would ignoring this file have removed it from the scanned surface?
+*
+* The bug this fixes, reproduced: a repo containing a real test file plus
+* `vendor.min.js` and `pnpm-lock.yaml` reported
+*
+*   discovered: 1, analyzed: 1, ignored: 2, scopeVerdict: "PARTIAL"
+*
+* Every discovered test file HAD been analyzed. The surface was complete. But
+* DEFAULT_IGNORES matches minified bundles and lockfiles, and the ignored
+* counter accepted any path with a source extension — so a minified bundle and
+* a lockfile downgraded a finished scan to "unverified".
+*
+* That is not a conservative bias, it is a broken signal. The terminal tells
+* the reader "some files were not analyzed, so the surface is unverified" —
+* which was false. And because minified bundles and lockfiles exist in
+* essentially every real repository, a PROVEN scan was unreachable in
+* practice, so the corpus regression guard failed 23 of 37 repositories on
+* exactly this. A gate that cannot pass teaches people to ignore it.
+*
+* The asymmetry is the tell. `isUnrecognizedSourceCandidate` below applies a
+* test-relevance test before counting a file; this one did not. Both count
+* against the same verdict, so both must ask the same question.
+*
+* An ignored file that IS a test file still downgrades the verdict. That is
+* the case the honesty law exists for, and this does not touch it.
+*/
 function isScopeRelevantIgnored(path) {
 	const name = path.replaceAll("\\", "/").split("/").pop() ?? path;
-	return /\.(?:[cm]?[jt]sx?|py|java|cs|ya?ml|min\.js)$/i.test(name);
+	if (!/\.(?:[cm]?[jt]sx?|py|java|cs|ya?ml|min\.js)$/i.test(name)) return false;
+	return isKnownTestFile(path);
 }
 function isUnrecognizedSourceCandidate(path) {
 	const normalized = path.replaceAll("\\", "/");
@@ -7691,7 +8044,6 @@ const pyBareTruthinessAssert = defineRule({
 		const re = /^[ \t]*assert\s+([A-Za-z_][\w.]*(?:\([^()]*\))?)[ \t]*$/gm;
 		const predicateRe = /^(?:(?:any|all|isinstance)\s*\(|[\w.]*\.(?:startswith|endswith|exists|isdir|isfile|islink|ismount|check|isdigit|isalpha|isalnum|isnumeric|isdecimal|isspace|islower|isupper|istitle|isidentifier|isprintable|isascii)\s*\(|re\.(?:match|search|fullmatch)\s*\()/;
 		const isGuardFollowedByRealUse = (text, matchIndex, target) => {
-			const root = target.split(".")[0];
 			const lineEnd = text.indexOf("\n", matchIndex);
 			if (lineEnd === -1) return false;
 			const lines = text.slice(lineEnd + 1).split("\n");
@@ -7701,8 +8053,11 @@ const pyBareTruthinessAssert = defineRule({
 				if (/^\s*def\s/.test(l) && window.length > 0) break;
 				window.push(l);
 			}
-			const usesRoot = new RegExp(`\\b${root}\\b`);
-			return window.some((l) => usesRoot.test(l));
+			const root = target.match(/^[a-z_]\w*/i)?.[0];
+			if (!root) return false;
+			return window.some((line) => {
+				return (line.match(/[a-z_]\w*/gi) ?? []).some((token) => token === root);
+			});
 		};
 		let m;
 		while ((m = re.exec(text)) !== null) {
@@ -11705,6 +12060,22 @@ function normalizeOne(report, artifact, v) {
 function buildEvidenceRecords(report, artifact) {
 	return report.verdicts.map((v) => normalizeOne(report, artifact, v)).sort(compareEvidenceRecords);
 }
+function countEvidence(records) {
+	const counts = {
+		total: records.length,
+		failed: 0,
+		flaky: 0,
+		skipped: 0,
+		timedOut: 0
+	};
+	for (const r of records) {
+		if (r.status.failed) counts.failed++;
+		if (r.status.passedOnRetry) counts.flaky++;
+		if (r.status.skipped) counts.skipped++;
+		if (r.status.timedOut) counts.timedOut++;
+	}
+	return counts;
+}
 //#endregion
 //#region src/engine/provenance.ts
 const GENERATED_HEADER_RE = /^\s*(?:\/\/|#|\/\*)\s*(?:auto[- ]?generated|generated by|do not edit)/i;
@@ -11992,6 +12363,11 @@ var DependencyGraph = class {
 	get size() {
 		return this.nodes.size;
 	}
+	/** Whether the graph knows this exact key. Reachability must not
+	*  treat "not in the graph" as "nothing to traverse" without saying so. */
+	has(path) {
+		return this.nodes.has(path);
+	}
 };
 function parsePackageJson(filePath) {
 	if (!existsSync(filePath)) return void 0;
@@ -12079,20 +12455,40 @@ function parseManifest(filePath) {
 	if (filePath.endsWith("pom.xml")) return parsePomXml(filePath);
 }
 /**
-* Given a set of starting files (e.g. test files), return all files
-* transitively reachable through the dependency graph.
+* Given a set of starting files (e.g. test files), return the files
+* transitively reachable through the dependency graph, plus an honest
+* account of what could not be resolved.
+*
+* KNOWN LIMITATION (BW-022, still open): the graph is keyed by manifest path
+* and this query is given source paths, so today `unresolvedStarts` is
+* normally every input. The traversal itself is correct for a graph whose
+* keys are the paths being queried — which is what the unit tests build, and
+* which is why they passed while production did nothing. Fixing the seam
+* means giving a file a resolvable owning manifest and deciding impact's
+* direction (dependents, not dependencies), which is a design change, not a
+* patch. Until then this function reports that it resolved nothing instead
+* of implying otherwise.
 */
 function getReachableFiles(fromFiles, graph) {
 	const reachable = /* @__PURE__ */ new Set();
+	const unresolvedStarts = [];
 	const stack = [...fromFiles];
 	while (stack.length > 0) {
 		const current = stack.pop();
 		if (current === void 0) continue;
 		if (reachable.has(current)) continue;
-		reachable.add(current);
+		if (graph.has(current)) reachable.add(current);
+		else if (fromFiles.includes(current)) {
+			unresolvedStarts.push(current);
+			continue;
+		}
 		for (const dep of graph.getDependencies(current)) if (!reachable.has(dep)) stack.push(dep);
 	}
-	return [...reachable].sort();
+	return {
+		reachable: [...reachable].sort(),
+		unresolvedStarts: unresolvedStarts.sort(),
+		resolvedAny: unresolvedStarts.length < fromFiles.length
+	};
 }
 //#endregion
 //#region src/engine/incremental-analysis.ts
@@ -12132,739 +12528,934 @@ function isIncrementalSafe(changedFiles) {
 	};
 }
 //#endregion
-//#region src/engine/monorepo-analysis.ts
-const WORTHY_THRESHOLD = 80;
-const NEEDS_WORK_THRESHOLD = 50;
-function verdictOf(score) {
-	if (score === null) return "fail";
-	if (score >= WORTHY_THRESHOLD) return "pass";
-	if (score >= NEEDS_WORK_THRESHOLD) return "warn";
-	return "fail";
-}
-function hasBlocker(findings) {
-	return findings.some((f) => f.severity === "error");
-}
+//#region src/brand/tokens.ts
 /**
-* Aggregate per-package results into an overall verdict.
+* The single source of brand truth.
 *
-* Worst-package propagation: if ANY package has a blocker (error-severity
-* finding) or a failing score, the overall result fails regardless of
-* strategy. This is the safety net — a single poisoned package must not
-* hide behind averaging.
+* Every colour, typeface and motion constant Mjölnir shows a human —
+* terminal, README SVGs, demo video, website, docs, badges — resolves to
+* a value in this file. Nothing else may define one.
+*
+* WHY THIS EXISTS. Before it, the palette existed in six independent
+* copies: `site/.vitepress/theme/styles/vars.css`, `NORSE` in
+* `src/reporter/theme.ts`, `scripts/readme-svg.ts`,
+* `scripts/video/terminal-page.ts`, `scripts/generate-readme-architecture.ts`
+* and the table in `assets/brand/README.md`. Exactly one pair of those
+* was guarded (site-doctor Check 8, doc ↔ vars.css). The unguarded edges
+* are where the shipped surfaces drifted apart: the terminal and the site
+* disagreed on six semantic roles, the architecture diagram invented its
+* own neutral ramp, and the README badges still carried a palette retired
+* two releases earlier. `scripts/brand-doctor.mjs` now checks every edge
+* against this file.
+*
+* PURITY. Pure data. No I/O, no rendering, no environment access, no
+* imports, no logic. Consumers convert (hex → ANSI triplet, hex → CSS)
+* themselves. Same reason `presentation.ts` is pure: it makes the whole
+* thing golden-testable and safe to ship inside the npm package, where
+* it costs a few hundred bytes and replaces values the package already
+* carried anyway.
+*
+* DERIVATION. The palette is the one derived from the logo in PR #20
+* (brushed steel and forge gold under an aurora, over midnight iron).
+* Where the terminal disagreed with it, the terminal converges — see
+* `PENDING_TERMINAL` below. Full rationale: `assets/brand/README.md`.
+*
+* ACCESSIBILITY. Every foreground token in `BRAND` meets WCAG AA
+* (≥ 4.5:1) against every surface token it is allowed to sit on. That is
+* not a claim, it is `brand-doctor` rule 8, which computes the ratios.
+* The weakest legal pairing is `steelDim` on `ink800` at 5.00:1.
 */
-function analyzeMonorepo(packages, config) {
-	const results = packages.map((p) => ({
-		...p,
-		verdict: hasBlocker(p.findings) ? "fail" : verdictOf(p.score)
-	}));
-	if (results.length === 0) return {
-		packages: results,
-		overallScore: null,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy
-	};
-	const blockerPkg = results.find((r) => r.verdict === "fail" || hasBlocker(r.findings));
-	if (blockerPkg) return {
-		packages: results,
-		overallScore: blockerPkg.score,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy,
-		blockerPackage: blockerPkg.packageName
-	};
-	switch (config.weightingStrategy) {
-		case "worst-package": return worstPackageAggregation(results, config);
-		case "average": return averageAggregation(results, config);
-		case "configurable": return configurableAggregation(results, config);
-	}
-}
-function worstPackageAggregation(results, config) {
-	const firstResult = results[0];
-	if (firstResult === void 0) return {
-		packages: results,
-		overallScore: null,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy
-	};
-	let worst = firstResult;
-	for (const r of results) if ((r.score ?? 0) < (worst.score ?? 0)) worst = r;
-	return {
-		packages: results,
-		overallScore: worst.score,
-		overallVerdict: worst.verdict,
-		strategy: config.weightingStrategy,
-		...worst.verdict === "fail" ? { blockerPackage: worst.packageName } : {}
-	};
-}
-function averageAggregation(results, config) {
-	const scored = results.filter((r) => r.score !== null);
-	if (scored.length === 0) return {
-		packages: results,
-		overallScore: null,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy
-	};
-	const avg = scored.reduce((sum, r) => sum + (r.score ?? 0), 0) / scored.length;
-	return {
-		packages: results,
-		overallScore: Math.round(avg),
-		overallVerdict: verdictOf(Math.round(avg)),
-		strategy: config.weightingStrategy
-	};
-}
-function configurableAggregation(results, config) {
-	const weights = config.packageWeights ?? {};
-	let totalWeight = 0;
-	let weightedSum = 0;
-	for (const r of results) {
-		const w = weights[r.packageName] ?? 1;
-		totalWeight += w;
-		weightedSum += (r.score ?? 0) * w;
-	}
-	if (totalWeight === 0) return {
-		packages: results,
-		overallScore: null,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy
-	};
-	const score = Math.round(weightedSum / totalWeight);
-	return {
-		packages: results,
-		overallScore: score,
-		overallVerdict: verdictOf(score),
-		strategy: config.weightingStrategy
-	};
-}
-//#endregion
-//#region src/lib/fs-atomic.ts
 /**
-* Atomic file writes (audit S9).
+* The two brand hues plus the neutral they sit on.
 *
-* Every durability-critical write in Mjölnir (baseline, stats, badge,
-* TRIAGE.md, scaffolded rule files) used to hand-roll
-* `writeFileSync(path, data)` — a crash mid-write left a TRUNCATED file
-* at the real path, and a subsequent read (diff, badge endpoint) served
-* confident nonsense from it.
+* GOLD IS SCARCE. It means forged / certified / earned / decisive — the
+* primary mark, the FORGED state, one call to action. It is not a paint
+* bucket: gold as default text, default border or default heading is a
+* brand-doctor finding, not a style choice.
 *
-* `writeFileAtomic` writes to a temp sibling, then RENAMES. On the same
-* volume rename is atomic: readers see either the complete old file or
-* the complete new file, never a half-written one. The temp name is
-* created with `wx` (exclusive) so concurrent writers cannot interleave,
-* stale temps are cleaned up on failure, and on Windows the rename is
-* retried briefly because a concurrent reader can hold the destination
-* open (EBUSY/EPERM).
+* AURORA is verification energy — the secondary, and the hue that marks
+* the runtime half of the trust ladder.
 */
-function atomicTempPath(path) {
-	return `${path}.mjolnir-${process.pid}-${Date.now()}-${randomBytes(4).toString("hex")}.tmp`;
-}
+const BRAND = {
+	gold: "#C19A34",
+	goldBright: "#E6BD57",
+	goldHot: "#F4DC9C",
+	/** Pressed / deepest gold — the only step dark enough to carry white. */
+	goldDeep: "#A5811C",
+	aurora: "#37ABBD",
+	auroraBright: "#45C1D4",
+	auroraCyan: "#5CBDE0",
+	/** The aurora's outer curtains: atmosphere and section identity only,
+	* never a verdict or a status. */
+	auroraGreen: "#5FD6A4",
+	auroraViolet: "#9D8CF5",
+	steel: "#C8CBCF",
+	steelDim: "#8B939D"
+};
 /**
-* Atomically replace `path` with `data`.
+* Midnight iron. One ramp, four steps, darkest first.
+*
+* `terminal` and `terminalBar` share one tone deliberately: the window's
+* only seam is a hairline ring and an inset shadow, never a second fill.
+* `chromeDot` is the three window dots — see the note on
+* `PENDING_TERMINAL.chromeDots` for why they are no longer red/amber/green.
 */
-function writeFileAtomic(path, data, opts = {}) {
-	const dir = dirname(path);
-	if (opts.mkdirs !== false && !existsSync(dir)) mkdirSync(dir, { recursive: true });
-	const tmp = atomicTempPath(path);
-	let fd;
-	try {
-		fd = openSync(tmp, "wx", opts.mode ?? 420);
-		writeSync(fd, data, null, opts.encoding ?? "utf8");
-	} finally {
-		if (fd !== void 0) closeSync(fd);
-	}
-	try {
-		renameWithWindowsRetry(tmp, path);
-	} catch (err) {
-		try {
-			if (existsSync(tmp)) unlinkSync(tmp);
-		} catch {}
-		throw err;
-	}
-}
+const SURFACE = {
+	ink950: "#0A1119",
+	ink900: "#0C1420",
+	ink850: "#111A29",
+	ink800: "#18243A",
+	/** Raised panel (cards, elevated surfaces). */
+	panel: "#141F33",
+	/** Soft fill (inline code, quiet chips). */
+	soft: "#1A2740",
+	/** Terminal body — the deepest tone, so a terminal reads as recessed. */
+	terminal: "#0A1119",
+	/** Terminal title bar — the same tone; the seam is shadow, not colour. */
+	terminalBar: "#0A1119",
+	/** The three window dots. One neutral, not a traffic light. */
+	chromeDot: "#18243A"
+};
+const TEXT = {
+	primary: "#EAEEF5",
+	secondary: "#ABB6C6",
+	muted: "#8B939D",
+	/** Ink for text set ON gold (buttons, the FORGED chip). 7.17:1 on `gold`. */
+	onGold: "#0A1119"
+};
 /**
-* renameSync retry loop for Windows: a concurrent reader (another scan,
-* a badge endpoint, an editor) holding the destination open makes
-* rename fail with EBUSY/EPERM. A short bounded retry closes the race
-* without turning an atomic swap into a partial write.
+* Non-score status. `ok` is the one green in the system and it is NOT a
+* score colour — it survives only for contexts with no worthiness
+* meaning ("autofix applied", "analysis complete"). A green score would
+* say "your software is fine", which is the exact claim this product
+* refuses to make.
+*/
+const STATUS = {
+	ok: "#4FB477",
+	info: "#5CC4E0",
+	warning: "#E6BD57",
+	error: "#EC6B66"
+};
+/**
+* The four ScoreState bands plus the unmeasured state. Band thresholds
+* and runes live in `src/reporter/presentation.ts`, which stays free of
+* colour — it emits a palette KEY and each surface resolves it here.
 *
-* Internal contract test hook: the platform check keeps this loop off
-* the POSIX hot path; on win32 the EBUSY/EPERM arms are exercised by
-* the fs-atomic-retry spec (mocked renameSync).
+* `unmeasured` is steel-dim on purpose. UNKNOWN is a legitimate answer,
+* not a failure: colouring it red would make "we did not measure this"
+* look like "this is broken", which is precisely the dishonesty the
+* north-star law exists to prevent.
 */
-const RENAME_RETRIES = 8;
-const RENAME_RETRY_DELAY_MS = 25;
-/** Synchronous sleep that does not spin the CPU. */
-function sleepSync(ms) {
-	try {
-		Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-	} catch {
-		const until = Date.now() + ms;
-		while (Date.now() < until);
-	}
-}
-function renameWithWindowsRetry(from, to) {
-	for (let attempt = 0;; attempt++) try {
-		renameSync(from, to);
-		return;
-	} catch (err) {
-		const code = err?.code;
-		if (process.platform === "win32" && (code === "EBUSY" || code === "EPERM") && attempt < RENAME_RETRIES) {
-			sleepSync(RENAME_RETRY_DELAY_MS);
-			continue;
-		}
-		throw err;
-	}
-}
-const STALE_TEMP_AGE_MS = 864e5;
-const TEMP_PID_RE = /^.+\.mjolnir-([1-9]\d{0,9})-(\d{13})-[0-9a-f]{8}\.tmp$/;
-function sweepStaleTempFiles(dir) {
-	let swept = 0;
-	let entries;
-	try {
-		entries = readdirSync(dir);
-	} catch {
-		return 0;
-	}
-	const cutoff = Date.now() - STALE_TEMP_AGE_MS;
-	for (const entry of entries) {
-		const match = TEMP_PID_RE.exec(entry);
-		if (!match || Number(match[2]) > cutoff) continue;
-		const path = join(dir, entry);
-		try {
-			const stat = lstatSync(path);
-			if (!stat.isFile() || stat.mtimeMs > cutoff) continue;
-			if (pidAlive(Number(match[1]))) continue;
-			unlinkSync(path);
-			swept++;
-		} catch {
-			continue;
-		}
-	}
-	return swept;
-}
-function pidAlive(pid) {
-	if (!Number.isSafeInteger(pid) || pid <= 0 || pid > 2147483647) return true;
-	if (pid === process.pid) return true;
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch (err) {
-		return err?.code !== "ESRCH";
-	}
-}
-//#endregion
-//#region src/engine/scan-cache.ts
+const SCORE = {
+	critical: "#EC6B66",
+	warning: "#E6BD57",
+	trusted: "#5CC4E0",
+	forged: "#F4DC9C",
+	unmeasured: "#8B939D"
+};
 /**
-* Local incremental scan cache (Beta-to-Stable 1.0 plan, M5.2 / A-2).
+* E0 → E1 → E2 is a certainty ramp, and it is deliberately HUE-FREE.
 *
-* Content-addressed, local-only verdict cache: `--cache` reuses the
-* per-file rule outputs of a previous scan when the file's bytes AND the
-* active rule set are unchanged, and invalidates everything else. The
-* key is `sha256(fileText) + rulesDigest` + the file's own identity
-* (repo-relative path + adapter id + parse mode — audit C1/W9), where
-* the rules digest folds
-* in every active rule's id + `detectorRevision ?? 1` (the existing
-* stale-measurement machinery — Verification Trust Evolution Plan §07 —
-* reused as the cache invalidation signal, per A-2) plus a source hash
-* of each external plugin/local rule's `run` function, so a plugin that
-* changes code without bumping its revision still misses.
+* Evidence level says how sure we are, not whether the news is good. A
+* deterministic proof (E2) is a defect we are certain about — painting
+* it gold or green would read as an achievement. So certainty is carried
+* by brightness alone, and the *shape* does the real work:
 *
-* Privacy posture: the cache lives under `<repo>/.mjolnir/cache/`, is
-* gitignored, never leaves the machine, and this module performs zero
-* network I/O — fs and crypto only (asserted by the privacy spec).
+*     E0  open ring        observation, no weight
+*     E1  half-filled      pattern evidence, half weight
+*     E2  sealed           deterministic proof, full weight
 *
-* Only raw rule-loop outputs are cached. Everything after the loop
-* (severity overrides, suppressions, overlap dedup, evidence stamping,
-* tier policy, runtime corroboration, scoring) re-runs on every scan,
-* so a cached scan is byte-equivalent to a fresh one by construction.
+* Colour never carries this alone (R11): the geometry is the signal and
+* survives `--ascii`, `NO_COLOR` and monochrome print.
 */
-const CACHE_VERSION = 2;
-/** Entry cap: a monorepo-scale suite stays far below this; bounded file. */
-const MAX_ENTRIES$1 = 4096;
+const EVIDENCE = {
+	e0: "#8B939D",
+	e1: "#ABB6C6",
+	e2: "#EAEEF5"
+};
 /**
-* Audit M5: total byte budget. The old cap counted only ENTRIES, so
-* 4096 files × ~100KB of findings each could still produce a
-* multi-hundred-MB writeFileSync on persist. The budget bounds the
-* serialized size; the newest entries win (real LRU-by-use).
+* L0–L5, and the most important boundary in the product.
+*
+* L0–L2 are STATIC: the neutral steel ramp, brightening to the static
+* ceiling at L2. L3–L5 require a real run, and the hue changes to aurora
+* exactly there. The boundary is a hue break, not a gradient step,
+* because it is a change of kind and not of degree — a static-only
+* finding can never climb past L2, however confident it is.
+*
+* Every surface that draws the ladder must draw that break.
 */
-const MAX_TOTAL_BYTES = 33554432;
-const MAX_FINDINGS_PER_ENTRY = 1e4;
-function isCachedFinding(value) {
-	if (!isRecord(value)) return false;
-	return typeof value["ruleId"] === "string" && typeof value["category"] === "string" && typeof value["severity"] === "string" && typeof value["confidence"] === "string" && typeof value["findingType"] === "string" && typeof value["file"] === "string" && Number.isSafeInteger(value["line"]) && Number.isSafeInteger(value["column"]) && typeof value["message"] === "string" && typeof value["why"] === "string" && typeof value["fix"] === "string";
-}
-function isCacheFile(value) {
-	if (!isRecord(value) || value["version"] !== CACHE_VERSION) return false;
-	const entries = value["entries"];
-	if (!isRecord(entries) || Object.keys(entries).length > MAX_ENTRIES$1) return false;
-	return Object.values(entries).every((entry) => isRecord(entry) && Array.isArray(entry["findings"]) && entry["findings"].length <= MAX_FINDINGS_PER_ENTRY && entry["findings"].every(isCachedFinding));
-}
-/** sha256 hex of a string — the only hash this module needs. */
-function sha256(text) {
-	return createHash("sha256").update(text).digest("hex");
-}
-/**
-* Digest of the active rule set: id + effective detectorRevision for
-* every rule (sorted for determinism), plus a content hash of all rule
-* source files. The directory-tree hash catches changes to ANY file
-* under src/rules/ — same-file helpers, cross-module imports, shared
-* utilities — without needing to trace the import graph. This is the
-* only reliable way to detect helper function changes in a bundled
-* ESM codebase where String(fn) doesn't reveal transitive dependencies.
-*/
-function computeRulesDigest(rules) {
-	const parts = rules.map((r) => `${r.id}:${r.detectorRevision ?? 1}`).sort();
-	const rulesDirHash = hashRulesSourceTree(rules);
-	return sha256(parts.join("|") + "\0" + rulesDirHash);
-}
-/**
-* Hash all .ts files under src/rules/ (when the first rule's modulePath
-* reveals the project root). Falls back to per-rule function source
-* hashing when the directory cannot be resolved.
-*/
-function hashRulesSourceTree(rules) {
-	const firstPath = rules.find((r) => r.modulePath)?.modulePath;
-	if (!firstPath) return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
-	const idx = firstPath.replace(/\\/g, "/").indexOf("/src/rules/");
-	if (idx < 0) return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
-	const rulesDir = firstPath.replace(/\\/g, "/").slice(0, idx + 11);
-	try {
-		const hash = createHash("sha256");
-		hashDir(rulesDir, hash, 0);
-		return hash.digest("hex").slice(0, 16);
-	} catch {
-		return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
-	}
-}
-function hashDir(dir, hash, depth) {
-	if (depth > 8) return;
-	let entries;
-	try {
-		entries = readdirSync(dir, { withFileTypes: true });
-	} catch {
-		return;
-	}
-	entries.sort((a, b) => a.name.localeCompare(b.name));
-	for (const entry of entries) {
-		if (entry.name === "node_modules" || entry.name === ".git") continue;
-		const full = join(dir, entry.name);
-		if (entry.isDirectory()) hashDir(full, hash, depth + 1);
-		else if (entry.isFile() && /\.tsx?$/.test(entry.name)) try {
-			hash.update(entry.name);
-			hash.update(readFileSync(full));
-		} catch {}
+const TRUST = {
+	l0: "#8B939D",
+	l1: "#ABB6C6",
+	l2: "#C8CBCF",
+	l3: "#37ABBD",
+	l4: "#45C1D4",
+	l5: "#5CC4E0"
+};
+const TINT = {
+	gold: {
+		fill: "#F6EBCC",
+		stroke: "#7A5F16",
+		text: "#4A3A0E"
+	},
+	aurora: {
+		fill: "#D9F0F4",
+		stroke: "#1F6F7C",
+		text: "#10353C"
+	},
+	error: {
+		fill: "#FADEDD",
+		stroke: "#A83A35",
+		text: "#4E1B19"
+	},
+	/** The unmeasured / unknown state. Neutral, never the error tint. */
+	neutral: {
+		fill: "#E4E7EB",
+		stroke: "#5C646E",
+		text: "#262B31"
+	},
+	ok: {
+		fill: "#DCF0E4",
+		stroke: "#276B45",
+		text: "#163A26"
 	}
-}
+};
 /**
-* Content-addressed key for one file's rule-loop verdicts.
+* The score bands as the badge Mjölnir itself generates renders them.
 *
-* Audit C1: the key MUST identify the verdict's producer, not just the
-* bytes — two files with byte-identical text (a copied spec, a generated
-* snapshot) previously shared one entry, and the first file's cached
-* findings were re-emitted for the second with the wrong `file` stamp.
-* The key therefore folds in the repo-relative path AND the adapter id,
-* plus a parse-mode token (audit W9): a file whose analysis degraded to
-* the regex fallback (or skipped the AST path) must not collide with a
-* fully-AST-analyzed verdict for the same bytes — the fallback output
-* belongs only to the fallback mode.
+* These are DEEPER than the score tokens on purpose, and it is not a
+* style preference: shields.io sets the message text in white and gives
+* you no say in it. `score.forged` (#F4DC9C) under white text measures
+* 1.35:1 — an unreadable badge, shipped to look on-brand. The brand's
+* own deep steps put every band between 4.9 and 6.3:1.
+*
+* What they replace was worse than off-brand, it was wrong:
+*
+*   band        was              rendered as        white-on   now       white-on
+*   ────────────────────────────────────────────────────────────────────────────
+*   0-49        `red`            #dd4343            4.24       #A83A35   6.32
+*   50-79       `yellow`         #d8b800            1.95       #7A5F16   6.04
+*   80-99       `important`      #ea7233  ORANGE    3.02       #1F6F7C   5.80
+*   100         `success`        #44bb00  GREEN     2.51       #8A6D1E   4.90
+*   unmeasured  `lightgrey`      #939393            3.07       #5C646E   5.99
+*
+* Two of those were defects, not preferences. `success` is green, and
+* green is not a score colour here — a 100 badge said "your software is
+* fine", which is the one claim this product refuses to make. And
+* `important` is ORANGE, not the blue-family colour the code's own
+* comment claimed for eight releases: every WORTHY badge ever rendered
+* showed the trusted band in a warning colour. Nobody had resolved a
+* shields name to a value and looked.
+*
+* Values are hex without `#`, the form shields.io's endpoint takes.
+* `A83A35`, `7A5F16`, `1F6F7C` and `5C646E` are the `TINT` strokes —
+* the same deep steps the mermaid diagrams use, for the same reason.
+* `8A6D1E` is the gold the brand document already named as the light
+* FORGED gradient's start.
 */
-function fileCacheKey(rulesDigest, fileText, identity) {
-	const parseMode = identity.parseMode ?? "ast";
-	return sha256(`${CACHE_VERSION}\u0000${rulesDigest}\u0000${identity.relPath}\u0000${identity.adapterId}\u0000${parseMode}\u0000${fileText}`);
-}
-/** No-op cache used when --cache is absent: zero stats, zero I/O. */
-const disabledScanCache = {
-	stats: {
-		hits: 0,
-		misses: 0,
-		file: ""
-	},
-	lookup: () => void 0,
-	store: () => {},
-	persist: () => {}
+const BADGE_BAND = {
+	critical: "A83A35",
+	warning: "7A5F16",
+	trusted: "1F6F7C",
+	forged: "8A6D1E",
+	unmeasured: "5C646E"
 };
-/**
-* Opens (and lazily creates) `<root>/.mjolnir/cache/scan-v<CACHE_VERSION>.json`. A
-* corrupt, hostile or future-versioned cache file degrades to a cold
-* cache — never fails the scan.
-*/
-function createScanCache(root) {
-	const dir = join(root, ".mjolnir", "cache");
-	const file = join(dir, `scan-v${CACHE_VERSION}.json`);
-	let entries = {};
-	let dirty = false;
-	const entryBytes = /* @__PURE__ */ new Map();
-	let totalBytes = 0;
-	try {
-		if (existsSync(file)) {
-			const stat = lstatSync(file);
-			if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_TOTAL_BYTES) throw new Error("invalid cache file");
-			entries = parseJsonFile(readFileSync(file, "utf8"), file, isCacheFile).entries;
-			for (const [k, v] of Object.entries(entries)) {
-				const size = Buffer.byteLength(JSON.stringify(v), "utf8") + k.length + 4;
-				entryBytes.set(k, size);
-				totalBytes += size;
-			}
-			if (totalBytes > MAX_TOTAL_BYTES) throw new Error("cache byte budget exceeded");
-		}
-	} catch {
-		entries = {};
-		entryBytes.clear();
-		totalBytes = 0;
-	}
-	return {
-		stats: {
-			hits: 0,
-			misses: 0,
-			file
-		},
-		lookup(key) {
-			const entry = entries[key];
-			if (!entry) {
-				this.stats.misses++;
-				return;
-			}
-			this.stats.hits++;
-			delete entries[key];
-			entries[key] = entry;
-			return structuredClone(entry.findings);
-		},
-		store(key, findings, fileBudgetExceeded) {
-			if (fileBudgetExceeded) return;
-			if (findings.length > MAX_FINDINGS_PER_ENTRY) return;
-			const entryJson = JSON.stringify(findings);
-			const newBytes = Buffer.byteLength(entryJson, "utf8") + key.length + 4;
-			if (newBytes > MAX_TOTAL_BYTES) return;
-			const replacedBytes = entryBytes.get(key) ?? 0;
-			delete entries[key];
-			entries[key] = { findings: structuredClone(findings) };
-			entryBytes.set(key, newBytes);
-			totalBytes = totalBytes - replacedBytes + newBytes;
-			let count = Object.keys(entries).length;
-			while ((count > MAX_ENTRIES$1 || totalBytes > MAX_TOTAL_BYTES) && count > 1) {
-				const oldest = Object.keys(entries)[0];
-				totalBytes -= entryBytes.get(oldest);
-				delete entries[oldest];
-				entryBytes.delete(oldest);
-				count--;
-			}
-			dirty = true;
-		},
-		persist() {
-			if (!dirty) return;
-			try {
-				mkdirSync(dir, { recursive: true });
-				writeFileAtomic(file, JSON.stringify({
-					version: CACHE_VERSION,
-					entries
-				}), { encoding: "utf8" });
-			} catch {}
-		}
-	};
-}
+SURFACE.ink950, SURFACE.ink900, SURFACE.ink850, SURFACE.ink800, BRAND.steel, BRAND.steelDim, BRAND.gold, BRAND.goldBright, BRAND.goldHot, BRAND.aurora, BRAND.auroraBright, BRAND.auroraCyan, BRAND.auroraGreen, BRAND.auroraViolet;
+SCORE.trusted, SCORE.forged, SCORE.warning, SCORE.critical, STATUS.info, TEXT.onGold, STATUS.ok, EVIDENCE.e0, EVIDENCE.e1, EVIDENCE.e2, TRUST.l0, TRUST.l1, TRUST.l2, TRUST.l3, TRUST.l4, TRUST.l5;
+EVIDENCE.e0, EVIDENCE.e1, EVIDENCE.e2;
+const RUNG_MEANINGS = [
+	"observation only",
+	"heuristic static",
+	"deterministic static",
+	"the finding's file executed",
+	"the finding's test executed",
+	"the run verdict corroborates"
+];
+const RUNG_COLORS = [
+	TRUST.l0,
+	TRUST.l1,
+	TRUST.l2,
+	TRUST.l3,
+	TRUST.l4,
+	TRUST.l5
+];
+const TRUST_RUNGS = RUNG_MEANINGS.map((meaning, i) => ({
+	level: `L${i}`,
+	meaning,
+	runtime: i >= 3,
+	color: RUNG_COLORS[i]
+}));
 //#endregion
-//#region src/brand/tokens.ts
+//#region src/reporter/presentation.ts
 /**
-* The single source of brand truth.
+* presentation.ts — the one place a presentation DECISION is made.
 *
-* Every colour, typeface and motion constant Mjölnir shows a human —
-* terminal, README SVGs, demo video, website, docs, badges — resolves to
-* a value in this file. Nothing else may define one.
+* BITTERSWEET `BW-030a`. Before this module the same decision was written
+* down four different times and every surface drifted:
 *
-* WHY THIS EXISTS. Before it, the palette existed in six independent
-* copies: `site/.vitepress/theme/styles/vars.css`, `NORSE` in
-* `src/reporter/theme.ts`, `scripts/readme-svg.ts`,
-* `scripts/video/terminal-page.ts`, `scripts/generate-readme-architecture.ts`
-* and the table in `assets/brand/README.md`. Exactly one pair of those
-* was guarded (site-doctor Check 8, doc ↔ vars.css). The unguarded edges
-* are where the shipped surfaces drifted apart: the terminal and the site
-* disagreed on six semantic roles, the architecture diagram invented its
-* own neutral ramp, and the README badges still carried a palette retired
-* two releases earlier. `scripts/brand-doctor.mjs` now checks every edge
-* against this file.
+*   - score bands: `score-state.ts` (50/80), `dashboard.ts` (50/60),
+*     `handover.ts` (50/90), `mermaid.ts` (50/80), `monorepo-analysis.ts`
+*     (50/80);
+*   - the evidence descriptor: `terminal.ts` returned the full
+*     `[E2 · deterministic · measured FP 8% · n=14 · trust L3]` while
+*     `evidence-tag.ts` — which called itself the "single definition
+*     site" — returned four bare words and defaulted a missing level to
+*     `E2`, the STRONGEST one;
+*   - the score bar: `theme.ts:scoreGauge` plus four private reimplementations.
 *
-* PURITY. Pure data. No I/O, no rendering, no environment access, no
-* imports, no logic. Consumers convert (hex → ANSI triplet, hex → CSS)
-* themselves. Same reason `score-state.ts` is pure: it makes the whole
-* thing golden-testable and safe to ship inside the npm package, where
-* it costs a few hundred bytes and replaces values the package already
-* carried anyway.
+* THE ONE RULE OF THIS MODULE: it owns decisions, never data and never
+* I/O. It reads a `Finding` / a score number / a `Palette` and returns
+* the word, band, threshold or descriptor to print. It opens no file,
+* touches no clock, spawns no process and formats no HTML document. If a
+* second responsibility appears here, split it in the same change.
 *
-* DERIVATION. The palette is the one derived from the logo in PR #20
-* (brushed steel and forge gold under an aurora, over midnight iron).
-* Where the terminal disagreed with it, the terminal converges — see
-* `PENDING_TERMINAL` below. Full rationale: `assets/brand/README.md`.
+* Pure: the same input always yields the same output, so every decision
+* is golden-testable and two runs of the same scan cannot disagree.
 *
-* ACCESSIBILITY. Every foreground token in `BRAND` meets WCAG AA
-* (≥ 4.5:1) against every surface token it is allowed to sit on. That is
-* not a claim, it is `brand-doctor` rule 8, which computes the ratios.
-* The weakest legal pairing is `steelDim` on `ink800` at 5.00:1.
+* Layout note — the threshold LITERALS stay physically here rather than in
+* a registry object so that `site/scripts/gen-report.mjs`, which parses
+* `score >= N` branches out of this file to build the site's band ruler,
+* keeps parsing one canonical file. `SCORE_THRESHOLDS` is derived from
+* those literals; it is the nameable form, not a second copy of them.
 */
 /**
-* The two brand hues plus the neutral they sit on.
+* What a surface prints when a number was never measured.
 *
-* GOLD IS SCARCE. It means forged / certified / earned / decisive — the
-* primary mark, the FORGED state, one call to action. It is not a paint
-* bucket: gold as default text, default border or default heading is a
-* brand-doctor finding, not a style choice.
-*
-* AURORA is verification energy — the secondary, and the hue that marks
-* the runtime half of the trust ladder.
+* The bug this replaces: `testDeclarationCount ?? 0` rendered
+* "0 tests analyzed in 0 files" for a producer that simply did not
+* measure. A zero is a CLAIM — it says the count was taken and found
+* nothing. Absent means nobody looked. `dashboard.ts` already modelled
+* this correctly for frameworks (`frameworkCount: null` → "unknown");
+* its sibling `trust-report.ts` did not, so the same repo produced two
+* artifacts that disagreed about whether a measurement existed.
 */
-const BRAND = {
-	gold: "#C19A34",
-	goldBright: "#E6BD57",
-	goldHot: "#F4DC9C",
-	/** Pressed / deepest gold — the only step dark enough to carry white. */
-	goldDeep: "#A5811C",
-	aurora: "#37ABBD",
-	auroraBright: "#45C1D4",
-	auroraCyan: "#5CBDE0",
-	/** The aurora's outer curtains: atmosphere and section identity only,
-	* never a verdict or a status. */
-	auroraGreen: "#5FD6A4",
-	auroraViolet: "#9D8CF5",
-	steel: "#C8CBCF",
-	steelDim: "#8B939D"
-};
+const UNMEASURED = "unknown — not measured";
 /**
-* Midnight iron. One ramp, four steps, darkest first.
+* Render a count for a human surface: the number when it was measured,
+* `unknown — not measured` when it was not. Never `0` for an absent
+* measurement.
+*/
+function countOrUnknown(value, unit) {
+	if (value === void 0) return UNMEASURED;
+	return unit === void 0 ? String(value) : `${value} ${unit}`;
+}
+/**
+* The machine-surface counterpart: an unmeasured count is `null`, which
+* JSON has a word for, rather than `0`, which does not. Used by the
+* trust-report JSON artifact; the scan machine contract
+* (`engine/machine-contract.ts`) is drift-locked and untouched.
+*/
+function countOrNull(value) {
+	return value ?? null;
+}
+/**
+* The "Tests analyzed" cell, shared by every human surface that shows it.
 *
-* `terminal` and `terminalBar` share one tone deliberately: the window's
-* only seam is a hairline ring and an inset shadow, never a second fill.
-* `chromeDot` is the three window dots — see the note on
-* `PENDING_TERMINAL.chromeDots` for why they are no longer red/amber/green.
+* Three renderers had this line written out separately, identically, and
+* all three rendered `testDeclarationCount ?? 0` — "0 tests analyzed in 0
+* files" — for a producer that never measured a declaration at all. Two
+* of them are the *sibling* artifacts for the same scan (the PR comment
+* and the trust report), so the same run told a reviewer both "0 tests
+* analyzed" and "no tests found".
+*
+* Declared-but-file-count-absent (and the reverse) are reported honestly
+* rather than filled in from each other.
 */
-const SURFACE = {
-	ink950: "#0A1119",
-	ink900: "#0C1420",
-	ink850: "#111A29",
-	ink800: "#18243A",
-	/** Raised panel (cards, elevated surfaces). */
-	panel: "#141F33",
-	/** Soft fill (inline code, quiet chips). */
-	soft: "#1A2740",
-	/** Terminal body — the deepest tone, so a terminal reads as recessed. */
-	terminal: "#0A1119",
-	/** Terminal title bar — the same tone; the seam is shadow, not colour. */
-	terminalBar: "#0A1119",
-	/** The three window dots. One neutral, not a traffic light. */
-	chromeDot: "#18243A"
+function testsAnalyzedCell(declarations, files) {
+	if (declarations === void 0 && files === void 0) return UNMEASURED;
+	const declText = countOrUnknown(declarations);
+	if (files === void 0) return `${declText} in unknown files`;
+	return `${declText} in ${files} ${files === 1 ? "file" : "files"}`;
+}
+const HEADLINES = {
+	critical: "The hammer is cracked — {n} findings break its edge.",
+	warning: "The hammer holds — but {n} findings weigh it down.",
+	trusted: "Held in worthy hands — {n} findings remain.",
+	forged: "Static score 100 — no findings on the analyzed surface.",
+	unmeasured: "No tests found — the hammer cannot be weighed."
 };
-const TEXT = {
-	primary: "#EAEEF5",
-	secondary: "#ABB6C6",
-	muted: "#8B939D",
-	/** Ink for text set ON gold (buttons, the FORGED chip). 7.17:1 on `gold`. */
-	onGold: "#0A1119"
+const RUNES = {
+	critical: "ᚲ",
+	warning: "ᚦ",
+	trusted: "ᛏ",
+	forged: "ᛟ",
+	unmeasured: "ᛁ"
 };
 /**
-* Non-score status. `ok` is the one green in the system and it is NOT a
-* score colour — it survives only for contexts with no worthiness
-* meaning ("autofix applied", "analysis complete"). A green score would
-* say "your software is fine", which is the exact claim this product
-* refuses to make.
-*/
-const STATUS = {
-	ok: "#4FB477",
-	info: "#5CC4E0",
-	warning: "#E6BD57",
-	error: "#EC6B66"
+* The named form of the band boundaries. `report:honesty` /
+* `thresholds:parity` assert that no surface outside this module
+* re-invents a boundary; a consumer that genuinely needs one names it
+* here rather than typing the number.
+*/
+const SCORE_THRESHOLDS = {
+	/** Below this is `critical`. */
+	criticalBelow: 50,
+	/** At or above this is `trusted`. */
+	trustedAtOrAbove: 80,
+	/** The one score that is `forged`. */
+	forgedAt: 100
 };
 /**
-* The four ScoreState bands plus the unmeasured state. Band thresholds
-* and runes live in `src/reporter/score-state.ts`, which stays free of
-* colour — it emits a palette KEY and each surface resolves it here.
+* Band mapping — the one mapping, every consumer: <50 critical,
+* 50–79 warning, 80–99 trusted, 100 forged, null unmeasured.
+*/
+function deriveScoreState(score) {
+	if (score === null) return {
+		score: null,
+		band: "unmeasured",
+		verdict: "UNWORTHY",
+		color: "dim",
+		powerLevel: 0,
+		headline: HEADLINES.unmeasured,
+		rune: RUNES.unmeasured
+	};
+	if (score >= SCORE_THRESHOLDS.forgedAt) return {
+		score,
+		band: "forged",
+		verdict: "FORGED",
+		color: "forged",
+		powerLevel: score,
+		headline: HEADLINES.forged,
+		rune: RUNES.forged
+	};
+	if (score >= 80) return {
+		score,
+		band: "trusted",
+		verdict: "WORTHY",
+		color: "trusted",
+		powerLevel: score,
+		headline: HEADLINES.trusted,
+		rune: RUNES.trusted
+	};
+	if (score >= 50) return {
+		score,
+		band: "warning",
+		verdict: "NEEDS WORK",
+		color: "warning",
+		powerLevel: score,
+		headline: HEADLINES.warning,
+		rune: RUNES.warning
+	};
+	return {
+		score,
+		band: "critical",
+		verdict: "UNWORTHY",
+		color: "error",
+		powerLevel: score,
+		headline: HEADLINES.critical,
+		rune: RUNES.critical
+	};
+}
+/** Substitute a findings count into a headline template. Pure text
+* helper so every surface formats identically. */
+function headlineFor(state, findings) {
+	return state.headline.replace("{n}", String(findings));
+}
+/**
+* Contract-stable three-band verdict (property-locked in
+* tests/scoring-precision.spec.ts). Delegates to the ScoreState model —
+* 100 keeps returning WORTHY here; the FORGED premium treatment lives
+* in the dedicated block, not in this public mapping.
 *
-* `unmeasured` is steel-dim on purpose. UNKNOWN is a legitimate answer,
-* not a failure: colouring it red would make "we did not measure this"
-* look like "this is broken", which is precisely the dishonesty the
-* north-star law exists to prevent.
+* The `FORGED → WORTHY` collapse is a DOCUMENTED PROJECTION that
+* preserves the three-band public contract, not a divergence to be
+* "fixed": a consumer reading the verdict word must not be able to tell
+* a 100 from a 99, because the 100 carries no runtime evidence and the
+* score alone never earned it.
 */
-const SCORE = {
-	critical: "#EC6B66",
-	warning: "#E6BD57",
-	trusted: "#5CC4E0",
-	forged: "#F4DC9C",
-	unmeasured: "#8B939D"
+function verdictFor(score) {
+	const verdict = deriveScoreState(score).verdict;
+	return verdict === "FORGED" ? "WORTHY" : verdict;
+}
+const EVIDENCE_KIND = {
+	E0: "observation",
+	E1: "heuristic",
+	E2: "deterministic"
 };
 /**
-* E0 → E1 → E2 is a certainty ramp, and it is deliberately HUE-FREE.
+* The effective evidence level of a finding.
 *
-* Evidence level says how sure we are, not whether the news is good. A
-* deterministic proof (E2) is a defect we are certain about — painting
-* it gold or green would read as an achievement. So certainty is carried
-* by brightness alone, and the *shape* does the real work:
+* The `?? deriveEvidenceLevel(...)` fallback IS the fix for BW-101. The
+* deleted `evidence-tag.ts` defaulted a missing level to `E2` — the
+* strongest claim the product can make — which is the exact inverse of
+* its own principle: absent evidence is not proof, so it is derived
+* conservatively from the finding's own type and confidence.
+*/
+function evidenceLevelOf(f) {
+	return f.evidenceLevel ?? deriveEvidenceLevel(f.findingType, f.confidence);
+}
+/** What the runtime report actually vouched for, in the product's words. */
+function runtimeLabel(f) {
+	const c = f.runtimeCorroboration;
+	if (c === void 0) return null;
+	if (c.level === "defect") return "defect corroborated";
+	if (c.level === "test") return "test executed";
+	return "file executed";
+}
+/**
+* The canonical evidence descriptor — `[E2 · deterministic · measured FP
+* 8% · n=14 · trust L3 · runtime: file executed]`.
 *
-*     E0  open ring        observation, no weight
-*     E1  half-filled      pattern evidence, half weight
-*     E2  sealed           deterministic proof, full weight
+* This is the version `terminal.ts` already shipped, promoted to the one
+* definition site. The HTML and markdown surfaces now gain the measured
+* false-positive rate, the sample size, the trust rung and what runtime
+* corroborated — they used to show four bare words that a reader could
+* mistake for the whole evidence story.
 *
-* Colour never carries this alone (R11): the geometry is the signal and
-* survives `--ascii`, `NO_COLOR` and monochrome print.
+* Every clause is conditional on the finding actually carrying that
+* evidence. Nothing here is ever defaulted into existence.
 */
-const EVIDENCE = {
-	e0: "#8B939D",
-	e1: "#ABB6C6",
-	e2: "#EAEEF5"
-};
+function evidenceTag(f) {
+	const level = evidenceLevelOf(f);
+	let tag = `${level} · ${EVIDENCE_KIND[level]}`;
+	if (f.measuredFpRate !== void 0) {
+		tag += ` · measured FP ${Math.round(f.measuredFpRate * 100)}%`;
+		if (f.measuredFpN !== void 0) tag += ` · n=${f.measuredFpN}`;
+	}
+	if (f.trustLevel !== void 0) tag += ` · trust ${f.trustLevel}`;
+	const runtime = runtimeLabel(f);
+	if (runtime !== null) tag += ` · runtime: ${runtime}`;
+	return `[${tag}]`;
+}
+//#endregion
+//#region src/engine/monorepo-analysis.ts
 /**
-* L0–L5, and the most important boundary in the product.
+* Package verdict, derived from the one ScoreState band model (BW-104).
+* These two constants used to be a private copy of the band boundaries;
+* the numeric vocabulary here is a different projection of the same bands
+* — "pass" is trusted or forged, "warn" is warning, "fail" is critical or
+* unmeasurable — so the boundaries are read, never retyped.
+*/
+function verdictOf(score) {
+	if (score === null) return "fail";
+	const band = deriveScoreState(score).band;
+	if (band === "forged" || band === "trusted") return "pass";
+	return band === "warning" ? "warn" : "fail";
+}
+function hasBlocker(findings) {
+	return findings.some((f) => f.severity === "error");
+}
+/**
+* Aggregate per-package results into an overall verdict.
 *
-* L0–L2 are STATIC: the neutral steel ramp, brightening to the static
-* ceiling at L2. L3–L5 require a real run, and the hue changes to aurora
-* exactly there. The boundary is a hue break, not a gradient step,
-* because it is a change of kind and not of degree — a static-only
-* finding can never climb past L2, however confident it is.
+* Worst-package propagation: if ANY package has a blocker (error-severity
+* finding) or a failing score, the overall result fails regardless of
+* strategy. This is the safety net — a single poisoned package must not
+* hide behind averaging.
+*/
+function analyzeMonorepo(packages, config) {
+	const results = packages.map((p) => ({
+		...p,
+		verdict: hasBlocker(p.findings) ? "fail" : verdictOf(p.score)
+	}));
+	if (results.length === 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	const blockerPkg = results.find((r) => r.verdict === "fail" || hasBlocker(r.findings));
+	if (blockerPkg) return {
+		packages: results,
+		overallScore: blockerPkg.score,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy,
+		blockerPackage: blockerPkg.packageName
+	};
+	switch (config.weightingStrategy) {
+		case "worst-package": return worstPackageAggregation(results, config);
+		case "average": return averageAggregation(results, config);
+		case "configurable": return configurableAggregation(results, config);
+	}
+}
+function worstPackageAggregation(results, config) {
+	const firstResult = results[0];
+	if (firstResult === void 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	let worst = firstResult;
+	for (const r of results) if ((r.score ?? 0) < (worst.score ?? 0)) worst = r;
+	return {
+		packages: results,
+		overallScore: worst.score,
+		overallVerdict: worst.verdict,
+		strategy: config.weightingStrategy,
+		...worst.verdict === "fail" ? { blockerPackage: worst.packageName } : {}
+	};
+}
+function averageAggregation(results, config) {
+	const scored = results.filter((r) => r.score !== null);
+	if (scored.length === 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	const avg = scored.reduce((sum, r) => sum + (r.score ?? 0), 0) / scored.length;
+	return {
+		packages: results,
+		overallScore: Math.round(avg),
+		overallVerdict: verdictOf(Math.round(avg)),
+		strategy: config.weightingStrategy
+	};
+}
+function configurableAggregation(results, config) {
+	const weights = config.packageWeights ?? {};
+	let totalWeight = 0;
+	let weightedSum = 0;
+	for (const r of results) {
+		const w = weights[r.packageName] ?? 1;
+		totalWeight += w;
+		weightedSum += (r.score ?? 0) * w;
+	}
+	if (totalWeight === 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	const score = Math.round(weightedSum / totalWeight);
+	return {
+		packages: results,
+		overallScore: score,
+		overallVerdict: verdictOf(score),
+		strategy: config.weightingStrategy
+	};
+}
+//#endregion
+//#region src/lib/fs-atomic.ts
+/**
+* Atomic file writes (audit S9).
 *
-* Every surface that draws the ladder must draw that break.
+* Every durability-critical write in Mjölnir (baseline, stats, badge,
+* TRIAGE.md, scaffolded rule files) used to hand-roll
+* `writeFileSync(path, data)` — a crash mid-write left a TRUNCATED file
+* at the real path, and a subsequent read (diff, badge endpoint) served
+* confident nonsense from it.
+*
+* `writeFileAtomic` writes to a temp sibling, then RENAMES. On the same
+* volume rename is atomic: readers see either the complete old file or
+* the complete new file, never a half-written one. The temp name is
+* created with `wx` (exclusive) so concurrent writers cannot interleave,
+* stale temps are cleaned up on failure, and on Windows the rename is
+* retried briefly because a concurrent reader can hold the destination
+* open (EBUSY/EPERM).
 */
-const TRUST = {
-	l0: "#8B939D",
-	l1: "#ABB6C6",
-	l2: "#C8CBCF",
-	l3: "#37ABBD",
-	l4: "#45C1D4",
-	l5: "#5CC4E0"
-};
-const TINT = {
-	gold: {
-		fill: "#F6EBCC",
-		stroke: "#7A5F16",
-		text: "#4A3A0E"
-	},
-	aurora: {
-		fill: "#D9F0F4",
-		stroke: "#1F6F7C",
-		text: "#10353C"
-	},
-	error: {
-		fill: "#FADEDD",
-		stroke: "#A83A35",
-		text: "#4E1B19"
-	},
-	/** The unmeasured / unknown state. Neutral, never the error tint. */
-	neutral: {
-		fill: "#E4E7EB",
-		stroke: "#5C646E",
-		text: "#262B31"
-	},
-	ok: {
-		fill: "#DCF0E4",
-		stroke: "#276B45",
-		text: "#163A26"
+function atomicTempPath(path) {
+	return `${path}.mjolnir-${process.pid}-${Date.now()}-${randomBytes(4).toString("hex")}.tmp`;
+}
+/**
+* Atomically replace `path` with `data`.
+*
+* Accepts binary payloads as well as text: base-tree materialization in
+* `impact` writes git blobs, and a writer that only takes strings forces those
+* call sites back to the non-atomic path rather than keeping them contained.
+*/
+function writeFileAtomic(path, data, opts = {}) {
+	const dir = dirname(path);
+	if (opts.mkdirs !== false && !existsSync(dir)) mkdirSync(dir, { recursive: true });
+	const tmp = atomicTempPath(path);
+	let fd;
+	try {
+		fd = openSync(tmp, "wx", opts.mode ?? 420);
+		if (typeof data === "string") writeSync(fd, data, null, opts.encoding ?? "utf8");
+		else writeSync(fd, data);
+	} finally {
+		if (fd !== void 0) closeSync(fd);
+	}
+	try {
+		renameWithWindowsRetry(tmp, path);
+	} catch (err) {
+		try {
+			if (existsSync(tmp)) unlinkSync(tmp);
+		} catch {}
+		throw err;
+	}
+}
+/**
+* renameSync retry loop for Windows: a concurrent reader (another scan,
+* a badge endpoint, an editor) holding the destination open makes
+* rename fail with EBUSY/EPERM. A short bounded retry closes the race
+* without turning an atomic swap into a partial write.
+*
+* Internal contract test hook: the platform check keeps this loop off
+* the POSIX hot path; on win32 the EBUSY/EPERM arms are exercised by
+* the fs-atomic-retry spec (mocked renameSync).
+*/
+const RENAME_RETRIES = 8;
+const RENAME_RETRY_DELAY_MS = 25;
+/** Synchronous sleep that does not spin the CPU. */
+function sleepSync(ms) {
+	try {
+		Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+	} catch {
+		const until = Date.now() + ms;
+		while (Date.now() < until);
+	}
+}
+function renameWithWindowsRetry(from, to) {
+	for (let attempt = 0;; attempt++) try {
+		renameSync(from, to);
+		return;
+	} catch (err) {
+		const code = err?.code;
+		if (process.platform === "win32" && (code === "EBUSY" || code === "EPERM") && attempt < RENAME_RETRIES) {
+			sleepSync(RENAME_RETRY_DELAY_MS);
+			continue;
+		}
+		throw err;
+	}
+}
+const STALE_TEMP_AGE_MS = 864e5;
+const TEMP_PID_RE = /^.+\.mjolnir-([1-9]\d{0,9})-(\d{13})-[0-9a-f]{8}\.tmp$/;
+function sweepStaleTempFiles(dir) {
+	let swept = 0;
+	let entries;
+	try {
+		entries = readdirSync(dir);
+	} catch {
+		return 0;
+	}
+	const cutoff = Date.now() - STALE_TEMP_AGE_MS;
+	for (const entry of entries) {
+		const match = TEMP_PID_RE.exec(entry);
+		if (!match || Number(match[2]) > cutoff) continue;
+		const path = join(dir, entry);
+		try {
+			const stat = lstatSync(path);
+			if (!stat.isFile() || stat.mtimeMs > cutoff) continue;
+			if (pidAlive(Number(match[1]))) continue;
+			unlinkSync(path);
+			swept++;
+		} catch {
+			continue;
+		}
+	}
+	return swept;
+}
+function pidAlive(pid) {
+	if (!Number.isSafeInteger(pid) || pid <= 0 || pid > 2147483647) return true;
+	if (pid === process.pid) return true;
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (err) {
+		return err?.code !== "ESRCH";
+	}
+}
+//#endregion
+//#region src/engine/scan-cache.ts
+/**
+* Local incremental scan cache (Beta-to-Stable 1.0 plan, M5.2 / A-2).
+*
+* Content-addressed, local-only verdict cache: `--cache` reuses the
+* per-file rule outputs of a previous scan when the file's bytes AND the
+* active rule set are unchanged, and invalidates everything else. The
+* key is `sha256(fileText) + rulesDigest` + the file's own identity
+* (repo-relative path + adapter id + parse mode — audit C1/W9), where
+* the rules digest folds
+* in every active rule's id + `detectorRevision ?? 1` (the existing
+* stale-measurement machinery — Verification Trust Evolution Plan §07 —
+* reused as the cache invalidation signal, per A-2) plus a source hash
+* of each external plugin/local rule's `run` function, so a plugin that
+* changes code without bumping its revision still misses.
+*
+* Privacy posture: the cache lives under `<repo>/.mjolnir/cache/`, is
+* gitignored, never leaves the machine, and this module performs zero
+* network I/O — fs and crypto only (asserted by the privacy spec).
+*
+* Only raw rule-loop outputs are cached. Everything after the loop
+* (severity overrides, suppressions, overlap dedup, evidence stamping,
+* tier policy, runtime corroboration, scoring) re-runs on every scan,
+* so a cached scan is byte-equivalent to a fresh one by construction.
+*/
+const CACHE_VERSION = 2;
+/** Entry cap: a monorepo-scale suite stays far below this; bounded file. */
+const MAX_ENTRIES$1 = 4096;
+/**
+* Audit M5: total byte budget. The old cap counted only ENTRIES, so
+* 4096 files × ~100KB of findings each could still produce a
+* multi-hundred-MB writeFileSync on persist. The budget bounds the
+* serialized size; the newest entries win (real LRU-by-use).
+*/
+const MAX_TOTAL_BYTES = 33554432;
+const MAX_FINDINGS_PER_ENTRY = 1e4;
+function isCachedFinding(value) {
+	if (!isRecord(value)) return false;
+	return typeof value["ruleId"] === "string" && typeof value["category"] === "string" && typeof value["severity"] === "string" && typeof value["confidence"] === "string" && typeof value["findingType"] === "string" && typeof value["file"] === "string" && Number.isSafeInteger(value["line"]) && Number.isSafeInteger(value["column"]) && typeof value["message"] === "string" && typeof value["why"] === "string" && typeof value["fix"] === "string";
+}
+function isCacheFile(value) {
+	if (!isRecord(value) || value["version"] !== CACHE_VERSION) return false;
+	const entries = value["entries"];
+	if (!isRecord(entries) || Object.keys(entries).length > MAX_ENTRIES$1) return false;
+	return Object.values(entries).every((entry) => isRecord(entry) && Array.isArray(entry["findings"]) && entry["findings"].length <= MAX_FINDINGS_PER_ENTRY && entry["findings"].every(isCachedFinding));
+}
+/** sha256 hex of a string — the only hash this module needs. */
+function sha256(text) {
+	return createHash("sha256").update(text).digest("hex");
+}
+/**
+* Digest of the active rule set: id + effective detectorRevision for
+* every rule (sorted for determinism), plus a content hash of all rule
+* source files. The directory-tree hash catches changes to ANY file
+* under src/rules/ — same-file helpers, cross-module imports, shared
+* utilities — without needing to trace the import graph. This is the
+* only reliable way to detect helper function changes in a bundled
+* ESM codebase where String(fn) doesn't reveal transitive dependencies.
+*/
+function computeRulesDigest(rules) {
+	const parts = rules.map((r) => `${r.id}:${r.detectorRevision ?? 1}`).sort();
+	const rulesDirHash = hashRulesSourceTree(rules);
+	return sha256(parts.join("|") + "\0" + rulesDirHash);
+}
+/**
+* Hash all .ts files under src/rules/ (when the first rule's modulePath
+* reveals the project root). Falls back to per-rule function source
+* hashing when the directory cannot be resolved.
+*/
+function hashRulesSourceTree(rules) {
+	const firstPath = rules.find((r) => r.modulePath)?.modulePath;
+	if (!firstPath) return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
+	const idx = firstPath.replace(/\\/g, "/").indexOf("/src/rules/");
+	if (idx < 0) return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
+	const rulesDir = firstPath.replace(/\\/g, "/").slice(0, idx + 11);
+	try {
+		const hash = createHash("sha256");
+		hashDir(rulesDir, hash, 0);
+		return hash.digest("hex").slice(0, 16);
+	} catch {
+		return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
+	}
+}
+function hashDir(dir, hash, depth) {
+	if (depth > 8) return;
+	let entries;
+	try {
+		entries = readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return;
 	}
-};
+	entries.sort((a, b) => a.name.localeCompare(b.name));
+	for (const entry of entries) {
+		if (entry.name === "node_modules" || entry.name === ".git") continue;
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) hashDir(full, hash, depth + 1);
+		else if (entry.isFile() && /\.tsx?$/.test(entry.name)) try {
+			hash.update(entry.name);
+			hash.update(readFileSync(full));
+		} catch {}
+	}
+}
 /**
-* The score bands as the badge Mjölnir itself generates renders them.
-*
-* These are DEEPER than the score tokens on purpose, and it is not a
-* style preference: shields.io sets the message text in white and gives
-* you no say in it. `score.forged` (#F4DC9C) under white text measures
-* 1.35:1 — an unreadable badge, shipped to look on-brand. The brand's
-* own deep steps put every band between 4.9 and 6.3:1.
-*
-* What they replace was worse than off-brand, it was wrong:
-*
-*   band        was              rendered as        white-on   now       white-on
-*   ────────────────────────────────────────────────────────────────────────────
-*   0-49        `red`            #dd4343            4.24       #A83A35   6.32
-*   50-79       `yellow`         #d8b800            1.95       #7A5F16   6.04
-*   80-99       `important`      #ea7233  ORANGE    3.02       #1F6F7C   5.80
-*   100         `success`        #44bb00  GREEN     2.51       #8A6D1E   4.90
-*   unmeasured  `lightgrey`      #939393            3.07       #5C646E   5.99
-*
-* Two of those were defects, not preferences. `success` is green, and
-* green is not a score colour here — a 100 badge said "your software is
-* fine", which is the one claim this product refuses to make. And
-* `important` is ORANGE, not the blue-family colour the code's own
-* comment claimed for eight releases: every WORTHY badge ever rendered
-* showed the trusted band in a warning colour. Nobody had resolved a
-* shields name to a value and looked.
+* Content-addressed key for one file's rule-loop verdicts.
 *
-* Values are hex without `#`, the form shields.io's endpoint takes.
-* `A83A35`, `7A5F16`, `1F6F7C` and `5C646E` are the `TINT` strokes —
-* the same deep steps the mermaid diagrams use, for the same reason.
-* `8A6D1E` is the gold the brand document already named as the light
-* FORGED gradient's start.
+* Audit C1: the key MUST identify the verdict's producer, not just the
+* bytes — two files with byte-identical text (a copied spec, a generated
+* snapshot) previously shared one entry, and the first file's cached
+* findings were re-emitted for the second with the wrong `file` stamp.
+* The key therefore folds in the repo-relative path AND the adapter id,
+* plus a parse-mode token (audit W9): a file whose analysis degraded to
+* the regex fallback (or skipped the AST path) must not collide with a
+* fully-AST-analyzed verdict for the same bytes — the fallback output
+* belongs only to the fallback mode.
 */
-const BADGE_BAND = {
-	critical: "A83A35",
-	warning: "7A5F16",
-	trusted: "1F6F7C",
-	forged: "8A6D1E",
-	unmeasured: "5C646E"
-};
-SURFACE.ink950, SURFACE.ink900, SURFACE.ink850, SURFACE.ink800, BRAND.steel, BRAND.steelDim, BRAND.gold, BRAND.goldBright, BRAND.goldHot, BRAND.aurora, BRAND.auroraBright, BRAND.auroraCyan, BRAND.auroraGreen, BRAND.auroraViolet;
-SCORE.trusted, SCORE.forged, SCORE.warning, SCORE.critical, STATUS.info, TEXT.onGold, STATUS.ok, EVIDENCE.e0, EVIDENCE.e1, EVIDENCE.e2, TRUST.l0, TRUST.l1, TRUST.l2, TRUST.l3, TRUST.l4, TRUST.l5;
-//#endregion
-//#region src/reporter/score-state.ts
-const HEADLINES = {
-	critical: "The hammer is cracked — {n} findings break its edge.",
-	warning: "The hammer holds — but {n} findings weigh it down.",
-	trusted: "Held in worthy hands — {n} findings remain.",
-	forged: "Static score 100 — no findings on the analyzed surface.",
-	unmeasured: "No tests found — the hammer cannot be weighed."
-};
-const RUNES = {
-	critical: "ᚲ",
-	warning: "ᚦ",
-	trusted: "ᛏ",
-	forged: "ᛟ",
-	unmeasured: "ᛁ"
+function fileCacheKey(rulesDigest, fileText, identity) {
+	const parseMode = identity.parseMode ?? "ast";
+	return sha256(`${CACHE_VERSION}\u0000${rulesDigest}\u0000${identity.relPath}\u0000${identity.adapterId}\u0000${parseMode}\u0000${fileText}`);
+}
+/** No-op cache used when --cache is absent: zero stats, zero I/O. */
+const disabledScanCache = {
+	stats: {
+		hits: 0,
+		misses: 0,
+		file: ""
+	},
+	lookup: () => void 0,
+	store: () => {},
+	persist: () => {}
 };
-/** Band mapping (the one mapping, three consumers): <50 critical, 50–79
-* warning, 80–99 trusted, 100 forged, null unmeasured. */
-function deriveScoreState(score) {
-	if (score === null) return {
-		score: null,
-		band: "unmeasured",
-		verdict: "UNWORTHY",
-		color: "dim",
-		powerLevel: 0,
-		headline: HEADLINES.unmeasured,
-		rune: RUNES.unmeasured
-	};
-	if (score >= 100) return {
-		score,
-		band: "forged",
-		verdict: "FORGED",
-		color: "forged",
-		powerLevel: score,
-		headline: HEADLINES.forged,
-		rune: RUNES.forged
-	};
-	if (score >= 80) return {
-		score,
-		band: "trusted",
-		verdict: "WORTHY",
-		color: "trusted",
-		powerLevel: score,
-		headline: HEADLINES.trusted,
-		rune: RUNES.trusted
-	};
-	if (score >= 50) return {
-		score,
-		band: "warning",
-		verdict: "NEEDS WORK",
-		color: "warning",
-		powerLevel: score,
-		headline: HEADLINES.warning,
-		rune: RUNES.warning
-	};
+/**
+* Opens (and lazily creates) `<root>/.mjolnir/cache/scan-v<CACHE_VERSION>.json`. A
+* corrupt, hostile or future-versioned cache file degrades to a cold
+* cache — never fails the scan.
+*/
+function createScanCache(root) {
+	const dir = join(root, ".mjolnir", "cache");
+	const file = join(dir, `scan-v${CACHE_VERSION}.json`);
+	let entries = {};
+	let dirty = false;
+	const entryBytes = /* @__PURE__ */ new Map();
+	let totalBytes = 0;
+	try {
+		if (existsSync(file)) {
+			const stat = lstatSync(file);
+			if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_TOTAL_BYTES) throw new Error("invalid cache file");
+			entries = parseJsonFile(readFileSync(file, "utf8"), file, isCacheFile).entries;
+			for (const [k, v] of Object.entries(entries)) {
+				const size = Buffer.byteLength(JSON.stringify(v), "utf8") + k.length + 4;
+				entryBytes.set(k, size);
+				totalBytes += size;
+			}
+			if (totalBytes > MAX_TOTAL_BYTES) throw new Error("cache byte budget exceeded");
+		}
+	} catch {
+		entries = {};
+		entryBytes.clear();
+		totalBytes = 0;
+	}
 	return {
-		score,
-		band: "critical",
-		verdict: "UNWORTHY",
-		color: "error",
-		powerLevel: score,
-		headline: HEADLINES.critical,
-		rune: RUNES.critical
+		stats: {
+			hits: 0,
+			misses: 0,
+			file
+		},
+		lookup(key) {
+			const entry = entries[key];
+			if (!entry) {
+				this.stats.misses++;
+				return;
+			}
+			this.stats.hits++;
+			delete entries[key];
+			entries[key] = entry;
+			return structuredClone(entry.findings);
+		},
+		store(key, findings, fileBudgetExceeded) {
+			if (fileBudgetExceeded) return;
+			if (findings.length > MAX_FINDINGS_PER_ENTRY) return;
+			const entryJson = JSON.stringify(findings);
+			const newBytes = Buffer.byteLength(entryJson, "utf8") + key.length + 4;
+			if (newBytes > MAX_TOTAL_BYTES) return;
+			const replacedBytes = entryBytes.get(key) ?? 0;
+			delete entries[key];
+			entries[key] = { findings: structuredClone(findings) };
+			entryBytes.set(key, newBytes);
+			totalBytes = totalBytes - replacedBytes + newBytes;
+			let count = Object.keys(entries).length;
+			while ((count > MAX_ENTRIES$1 || totalBytes > MAX_TOTAL_BYTES) && count > 1) {
+				const oldest = Object.keys(entries)[0];
+				totalBytes -= entryBytes.get(oldest);
+				delete entries[oldest];
+				entryBytes.delete(oldest);
+				count--;
+			}
+			dirty = true;
+		},
+		persist() {
+			if (!dirty) return;
+			try {
+				mkdirSync(dir, { recursive: true });
+				writeFileAtomic(file, JSON.stringify({
+					version: CACHE_VERSION,
+					entries
+				}), { encoding: "utf8" });
+			} catch {}
+		}
 	};
 }
-/** Substitute a findings count into a headline template. Pure text
-* helper so every surface formats identically. */
-function headlineFor(state, findings) {
-	return state.headline.replace("{n}", String(findings));
-}
 //#endregion
 //#region src/reporter/theme.ts
 /**
@@ -12880,8 +13471,8 @@ function headlineFor(state, findings) {
 *
 * Symbols always accompany color (color-blind safe, R11).
 *
-* Score-state colors come from ScoreState (score-state.ts) — the single
-* source of truth shared with the badge and (P2) the web.
+* Score-state colors come from ScoreState (presentation.ts) — the single
+* source of truth shared with the badge, the dashboard and the site.
 *
 * Terminal robustness (Master-Stabilization-Plan Sprint 5 Task 22):
 * box-drawing/gauge helpers accept an explicit width so callers can
@@ -13058,14 +13649,11 @@ function padTo(s, width) {
 */
 function scoreGauge(score, p, width = 30, ascii = false) {
 	const filled = Math.round(score / 100 * width);
-	const color = gaugeColor(score, p);
+	const color = gaugeColorForBand(deriveScoreState(score).band, p);
 	if (ascii) return color("#".repeat(filled)) + ".".repeat(Math.max(0, width - filled));
 	const head = filled > 0 && filled < width ? "▓" : "";
 	return color("█".repeat(Math.max(0, filled - (head ? 1 : 0)))) + color(head) + "░".repeat(width - filled);
 }
-function gaugeColor(score, p) {
-	return gaugeColorForBand(deriveScoreState(score).band, p);
-}
 /**
 * The single band → palette-key mapping, delegated from ScoreState so
 * gauge, verdict and badge colors can never disagree again.
@@ -14220,7 +14808,7 @@ function runForensics(target, options = {}) {
 		const base = stat.isFile() ? dirname(target) : target;
 		flakyMdPath = join(base, "FLAKY.md");
 		try {
-			writeFileSync(flakyMdPath, renderFlakyMd(report));
+			writeFileAtomic(flakyMdPath, renderFlakyMd(report));
 		} catch {
 			flakyMdPath = void 0;
 		}
@@ -15126,8 +15714,6 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 			skippedFiles++;
 			continue;
 		}
-		let fileBudgetExceeded = false;
-		let fileRuleFailed = false;
 		const relPath = relative(workspace.root, path).replaceAll("\\", "/");
 		if (!isCiAdapter) {
 			const lang = {
@@ -15153,79 +15739,106 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 		});
 		let cacheKey = fileCacheKey(rulesDigest, text, identity(wantsAst ? "ast" : "regex"));
 		const cachedFindings = cache.lookup(cacheKey);
-		if (cachedFindings) {
-			for (const f of cachedFindings) findings.push(f);
-			analyzed++;
-			continue;
-		}
-		hooks.onProgress?.({
-			phase: "parse",
-			done: scanned,
-			total: testFiles.length,
-			detail: relPath
-		});
-		const parsedFile = {
-			path: relPath,
-			text
-		};
-		let parsed;
-		const findingsStart = findings.length;
-		try {
-			if (adapter.parseAst && wantsAst) {
-				hooks.onProgress?.({
-					phase: "rules",
-					done: scanned,
-					total: testFiles.length,
-					detail: relPath
-				});
-				parsed = await adapter.parseAst(parsedFile);
-			}
-			const actualMode = parsed ? "ast" : "regex";
-			if (wantsAst && actualMode === "regex") {
-				parseFallbacks++;
-				cacheKey = fileCacheKey(rulesDigest, text, identity(actualMode));
-				const fallbackFindings = cache.lookup(cacheKey);
-				if (fallbackFindings) {
-					for (const f of fallbackFindings) findings.push(f);
-					analyzed++;
-					continue;
+		const executor = createExecutor("sequential", 1, async (job) => {
+			if (job.cacheHit !== void 0) return {
+				path: job.path,
+				status: "CACHE_HIT",
+				findings: [...job.cacheHit],
+				parseFallback: false
+			};
+			let parseFallback = false;
+			let fileRuleFailed = false;
+			let fileBudgetExceeded = false;
+			let parsedAst;
+			try {
+				if (adapter.parseAst && job.wantsAst) {
+					hooks.onProgress?.({
+						phase: "rules",
+						done: scanned,
+						total: testFiles.length,
+						detail: job.path
+					});
+					parsedAst = await adapter.parseAst({
+						path: job.path,
+						text: job.text
+					});
 				}
-			}
-			const fileForRules = parsed ? {
-				...parsedFile,
-				ast: parsed.ast
-			} : parsedFile;
-			adapter.runRules(activeRules, fileForRules, (f, ruleId, category) => {
-				if (!isValidFindingRecord(f)) {
-					fileRuleFailed = true;
-					onRuleCrash?.(ruleId, relPath, /* @__PURE__ */ new Error(`malformed finding record rejected (severity/line/message must be present, severity ∈ error|warning|info): ${JSON.stringify(f)}`));
-					return;
+				const actualMode = parsedAst ? "ast" : "regex";
+				if (job.wantsAst && actualMode === "regex") {
+					parseFallback = true;
+					parseFallbacks++;
+					cacheKey = fileCacheKey(rulesDigest, job.text, identity(actualMode));
+					const fallbackFindings = cache.lookup(cacheKey);
+					if (fallbackFindings) return {
+						path: job.path,
+						status: "CACHE_HIT",
+						findings: [...fallbackFindings],
+						parseFallback: true
+					};
 				}
-				findings.push({
-					...f,
-					ruleId,
-					category
+				const fileForRules = parsedAst ? {
+					path: job.path,
+					text: job.text,
+					ast: parsedAst.ast
+				} : {
+					path: job.path,
+					text: job.text
+				};
+				const produced = [];
+				adapter.runRules(activeRules, fileForRules, (f, ruleId, category) => {
+					if (!isValidFindingRecord(f)) {
+						fileRuleFailed = true;
+						onRuleCrash?.(ruleId, job.path, /* @__PURE__ */ new Error(`malformed finding record rejected (severity/line/message must be present, severity ∈ error|warning|info): ${JSON.stringify(f)}`));
+						return;
+					}
+					produced.push({
+						...f,
+						ruleId,
+						category
+					});
+				}, (ruleId, error) => {
+					fileRuleFailed = true;
+					onRuleCrash?.(ruleId, job.path, error);
+				}, {
+					deadline: Math.min(deadline, Date.now() + LIMITS$1.maxFileAnalysisMs),
+					onExceeded: () => {
+						rulesPartial = true;
+						skippedFiles++;
+						truncationReasons.add("file-budget");
+						fileBudgetExceeded = true;
+					}
 				});
-			}, (ruleId, error) => {
-				fileRuleFailed = true;
-				onRuleCrash?.(ruleId, relPath, error);
-			}, {
-				deadline: Math.min(deadline, Date.now() + LIMITS$1.maxFileAnalysisMs),
-				onExceeded: () => {
-					rulesPartial = true;
-					skippedFiles++;
-					truncationReasons.add("file-budget");
-					fileBudgetExceeded = true;
-				}
-			});
-			if (!fileRuleFailed && !fileBudgetExceeded) analyzed++;
-			if (!fileRuleFailed) cache.store(cacheKey, findings.slice(findingsStart), fileBudgetExceeded);
-		} catch {
-			if (wantsAst) parseFallbacks++;
-			skippedFiles++;
-			parseFailed++;
-		} finally {
-			parsed?.dispose();
+				if (!fileRuleFailed && !fileBudgetExceeded) analyzed++;
+				if (!fileRuleFailed) cache.store(cacheKey, produced, fileBudgetExceeded);
+				return {
+					path: job.path,
+					status: "OK",
+					findings: produced,
+					parseFallback
+				};
+			} catch {
+				if (job.wantsAst) parseFallbacks++;
+				skippedFiles++;
+				parseFailed++;
+				return {
+					path: job.path,
+					status: "FAILED",
+					findings: [],
+					parseFallback
+				};
+			} finally {
+				parsedAst?.dispose();
+			}
+		});
+		const outcome = (await executeFiles([{
+			path: relPath,
+			text,
+			wantsAst,
+			...cachedFindings !== void 0 ? { cacheHit: cachedFindings } : {}
+		}], executor))[0];
+		if (outcome?.status === "CACHE_HIT" || outcome?.status === "OK") {
+			for (const f of outcome.findings) findings.push(f);
+			if (cachedFindings !== void 0 && outcome.status === "CACHE_HIT") analyzed++;
 		}
 	}
 	return {
@@ -15316,12 +15929,16 @@ function applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, dec
 	const runtimeReportPath = discoveredReport?.path;
 	const runtimeIncomplete = discoveredReport !== void 0 && discoveredReport.report.analysisComplete !== true;
 	let forensicVerdicts;
+	let evidenceRecords = [];
 	if (discoveredReport && discoveredReport.report.analysisComplete === true) try {
-		buildEvidenceRecords(discoveredReport.report, discoveredReport.path);
+		evidenceRecords = buildEvidenceRecords(discoveredReport.report, discoveredReport.path);
 		stampRuntimeCorroboration(findings, discoveredReport.report, workspace.root);
 		forensicVerdicts = summarizeForensicVerdicts(discoveredReport.report);
-	} catch {}
+	} catch {
+		evidenceRecords = [];
+	}
 	return {
+		evidenceRecords,
 		testDeclarationCount,
 		scopeInfo,
 		suppressionCount,
@@ -15464,6 +16081,8 @@ function assembleScanResult(o) {
 		...o.runtimeIncomplete !== void 0 ? { runtimeIncomplete: o.runtimeIncomplete } : {},
 		identityIncomplete
 	});
+	const repository = bindRepository(o.scanRoot.root);
+	const candidate = readCandidateBinding(o.scanRoot.root);
 	const runIdentity = buildRunIdentity({
 		files: inputSnapshot,
 		rules: [...o.REVISION_BY_RULE_ID.entries()].map(([id, detectorRevision]) => ({
@@ -15476,9 +16095,17 @@ function assembleScanResult(o) {
 		trustModelVersion: TRUST_MODEL_VERSION,
 		scoringModelVersion: SCORING_MODEL_VERSION,
 		frameworkSupportMatrixVersion: FRAMEWORK_SUPPORT_MATRIX_VERSION,
-		evidenceSchemaVersions: [1]
+		evidenceSchemaVersions: [1],
+		...repository,
+		...candidate !== null ? { candidate } : {}
+	});
+	const evidenceGraph = buildEvidenceGraph({
+		runId: runIdentity,
+		...candidate !== null ? { candidate: {
+			manifestId: candidate.manifestId,
+			candidateSha: candidate.candidateSha
+		} } : {}
 	});
-	const evidenceGraph = buildEvidenceGraph({ runId: runIdentity });
 	const hasTests = o.testFileCount > 0 && o.testDeclarationCount > 0;
 	const suiteInvalidatedBy = [...new Set(o.findings.filter((f) => SUITE_INVALIDATING_RULE_IDS.has(f.ruleId)).map((f) => f.ruleId))].sort();
 	const finalScore = hasTests ? completion.partial && scopeAdjustedTotal >= 100 ? 99 : scopeAdjustedTotal : null;
@@ -15488,6 +16115,11 @@ function assembleScanResult(o) {
 		scopeIntegrity,
 		runIdentity,
 		evidenceGraph,
+		evidence: {
+			records: o.evidenceRecords ?? [],
+			counts: countEvidence(o.evidenceRecords ?? []),
+			artifact: o.runtimeReportPath ?? null
+		},
 		score: finalScore,
 		...hasTests ? {} : { reason: "no-tests-found" },
 		frameworks: o.frameworks.frameworks,
@@ -15699,4 +16331,6 @@ async function runScan(args, hooks = {}) {
 	return result;
 }
 //#endregion
-export { correlateFindings as $, plainContext as A, parseJsonFile as At, shouldUseAscii as B, isValidCategory as Bt, runForensics as C, globToRegExp as Ct, nextStep as D, loadConfig as Dt, buildFooter as E, isSuppressionActive as Et, padTo as F, QA_IMPACT_LABELS as Ft, EVIDENCE as G, deriveScoreState as H, palette as I, RULE_CATEGORIES as It, atomicTempPath as J, TINT as K, sanitizeData as L, SEVERITY_ORDER as Lt, severityIcon as M, buildEvidenceGraph as Mt, box as N, MEASURED_FP as Nt, okIcon as O, readFileBounded as Ot, measure as P, DEDUCTIONS as Pt, getReachableFiles as Q, scoreGauge as R, deriveEvidenceLevel as Rt, renderSuppressions as S, createIgnoreMatcher as St, FLAKE_GLYPH as T, ConfigValidationError as Tt, headlineFor as U, wrapText as V, BADGE_BAND as W, writeFileAtomic as X, sweepStaleTempFiles as Y, buildDependencyGraph as Z, summarizeForensicVerdicts as _, computeCodeText as _t, applyPostScanProcessing as a, massCeiling as at, loadLocalRules as b, DEFAULT_IGNORE_MATCHER as bt, discoverAndParseRuntimeReport as c, getRule as ct, isValidFindingRecord as d, SCAN_ADAPTERS as dt, classifyProvenance as et, pathMatchesGlob as f, SEARCHED_FOR as ft, selectAdapter as g, parseYamlGuarded as gt, scan_pipeline_exports as h, parseWorkflow as ht, SUITE_INVALIDATING_RULE_IDS as i, deductionFor as it, sectionHeader as j, ENGINE_VERSION as jt, panel as k, isRecord as kt, discoverTestFilesPhase as l, resolveGitPath as lt, runScan as m, parseAzurePipeline as mt, KNOWN_RULE_IDS as n, capForTier as nt, assembleScanResult as o, RETIRED_RULE_IDS as ot, runFileAnalysisPhase as p, isAzurePipelineFixture as pt, TRUST as q, OVERLAP_META_BY_RULE_ID as r, computeDimensions as rt, buildUniversalRules as s, RULES as st, EVIDENCE_OVERRIDES as t, computeAgenticProfile as tt, fallbackWorkspace as u, runGit as ut, pluginsGateOpen as v, parseTsFile as vt, sanitizeErrorText as w, isLintFixtureDir as wt, loadSuppressions as x, LIMITS$1 as xt, renderGateNotice as y, detectFrameworks as yt, shouldColorize as z, isAdvisoryFinding as zt };
+export { BADGE_BAND as $, plainContext as A, isLintFixtureDir as At, shouldUseAscii as B, DEDUCTIONS as Bt, runForensics as C, computeCodeText as Ct, nextStep as D, LIMITS$1 as Dt, buildFooter as E, DEFAULT_IGNORE_MATCHER as Et, padTo as F, isRecord as Ft, countOrNull as G, deriveEvidenceLevel as Gt, atomicTempPath as H, RULE_CATEGORIES as Ht, palette as I, parseJsonFile as It, evidenceTag as J, deriveScoreState as K, isAdvisoryFinding as Kt, sanitizeData as L, ENGINE_VERSION as Lt, severityIcon as M, isSuppressionActive as Mt, box as N, loadConfig as Nt, okIcon as O, createIgnoreMatcher as Ot, measure as P, readFileBounded as Pt, TRUST_RUNGS as Q, scoreGauge as R, buildEvidenceGraph as Rt, renderSuppressions as S, parseYamlGuarded as St, FLAKE_GLYPH as T, detectFrameworks as Tt, sweepStaleTempFiles as U, SEVERITY_ORDER as Ut, wrapText as V, QA_IMPACT_LABELS as Vt, writeFileAtomic as W, TRUST_ORDER as Wt, testsAnalyzedCell as X, headlineFor as Y, verdictFor as Z, summarizeForensicVerdicts as _, SCAN_ADAPTERS as _t, applyPostScanProcessing as a, correlateFindings as at, loadLocalRules as b, parseAzurePipeline as bt, discoverAndParseRuntimeReport as c, capForTier as ct, isValidFindingRecord as d, massCeiling as dt, SCORE as et, pathMatchesGlob as f, RETIRED_RULE_IDS as ft, selectAdapter as g, runGit as gt, scan_pipeline_exports as h, resolveGitPath as ht, SUITE_INVALIDATING_RULE_IDS as i, getReachableFiles as it, sectionHeader as j, ConfigValidationError as jt, panel as k, globToRegExp as kt, discoverTestFilesPhase as l, computeDimensions as lt, runScan as m, getRule as mt, KNOWN_RULE_IDS as n, TINT as nt, assembleScanResult as o, classifyProvenance as ot, runFileAnalysisPhase as p, RULES as pt, evidenceLevelOf as q, isValidCategory as qt, OVERLAP_META_BY_RULE_ID as r, buildDependencyGraph as rt, buildUniversalRules as s, computeAgenticProfile as st, EVIDENCE_OVERRIDES as t, STATUS as tt, fallbackWorkspace as u, deductionFor as ut, pluginsGateOpen as v, SEARCHED_FOR as vt, sanitizeErrorText as w, parseTsFile as wt, loadSuppressions as x, parseWorkflow as xt, renderGateNotice as y, isAzurePipelineFixture as yt, shouldColorize as z, MEASURED_FP as zt };
+
+//# sourceMappingURL=scan-pipeline-CCJdEKNa.mjs.map