mjolnir-qa 3.0.0 → 5.0.0

package/dist/mcp/stdio.mjs

@@ -2,14 +2,14 @@ import { createRequire } from "node:module";
 import { createInterface } from "node:readline";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { createHash, randomBytes } from "node:crypto";
-import { closeSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { closeSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, statSync, unlinkSync, writeSync } from "node:fs";
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { execFileSync } from "node:child_process";
 import * as ts$2 from "ts-morph";
 import ts, { Project, SyntaxKind, ts as ts$1 } from "ts-morph";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { Language, Parser } from "web-tree-sitter";
 import { parse } from "yaml";
-import { execFileSync } from "node:child_process";
 import { inflateRawSync } from "node:zlib";
 //#region src/types.ts
 /** Severity ladder. Order matters for sorting and gating. */
@@ -19,6 +19,32 @@ const SEVERITY_ORDER = [
 	"info"
 ];
 /**
+* Trust levels (Verification Trust Evolution Plan §16): the OVERALL
+* trust a consumer can place in one finding, combining the static
+* evidence ladder (E0–E2) with RUNTIME corroboration from a real run
+* report. Exposed honestly, never overclaimed:
+*   L0 — observation only (E0, no runtime evidence).
+*   L1 — heuristic static evidence (E1), no runtime evidence.
+*   L2 — deterministic static evidence (E2), no runtime evidence.
+*   L3 — RUNTIME: the file containing this finding appeared in a real
+*        run report (tests in that file executed).
+*   L4 — RUNTIME: the specific test containing this finding was
+*        identified in the report and executed (its outcome is known).
+*   L5 — RUNTIME: the run verdict directly corroborates the DEFECT
+*        class (e.g. a flake-risk finding whose test actually flaked,
+*        retried, or timed out in the report).
+* INVARIANT (structurally enforced): L3–L5 require runtime
+* corroboration — a static-only finding can never claim L4/L5.
+*/
+const TRUST_ORDER = [
+	"L0",
+	"L1",
+	"L2",
+	"L3",
+	"L4",
+	"L5"
+];
+/**
 * Honest default evidence level for a finding (Honesty Core Phase 1).
 * Derivation is deterministic and conservative:
 *   observation → E0 (never proof)
@@ -59,6 +85,7 @@ const DEDUCTIONS = {
 //#region src/engine/completion.ts
 function deriveCompletion(input) {
 	const truncationReasons = [...new Set(input.truncationReasons)].sort();
+	const degradations = [...input.degradations ?? []].sort((a, b) => a.reason < b.reason ? -1 : a.reason > b.reason ? 1 : 0);
 	const reasons = /* @__PURE__ */ new Set();
 	if (input.discoveryTruncated) reasons.add("discovery-truncated");
 	if (input.rulesPartial) reasons.add("rules-partial");
@@ -68,14 +95,16 @@ function deriveCompletion(input) {
 	if (input.scopeUnrecognized > 0) reasons.add(`scope-unrecognized:${input.scopeUnrecognized}`);
 	if (input.parseFailed > 0) reasons.add(`parse-failed:${input.parseFailed}`);
 	if (input.parseFallbacks && input.parseFallbacks > 0) reasons.add(`parse-fallbacks:${input.parseFallbacks}`);
+	if (input.astFallbackFiles && input.astFallbackFiles > 0) reasons.add(`ast-budget-fallback-files:${input.astFallbackFiles}`);
 	if (input.scopeDegraded) reasons.add(`scope-degraded:${input.scopeDegraded}`);
 	if (input.runtimeIncomplete) reasons.add("runtime-incomplete");
 	if (input.identityIncomplete) reasons.add("identity-incomplete");
 	for (const reason of truncationReasons) reasons.add(`truncated:${reason}`);
+	for (const entry of degradations) reasons.add(`degraded:${entry.reason}:${entry.count}`);
 	const discoveryPartial = input.discoveryTruncated || input.scopeIgnored > 0 || input.scopeUnrecognized > 0 || input.scopeDegraded !== void 0;
 	const rulesPartial = input.rulesPartial || input.rulesCrashed > 0 || input.parseFailed > 0;
 	return {
-		partial: discoveryPartial || rulesPartial || input.skippedFiles > 0 || input.runtimeIncomplete === true || input.identityIncomplete === true || truncationReasons.length > 0,
+		partial: discoveryPartial || rulesPartial || input.skippedFiles > 0 || input.runtimeIncomplete === true || input.identityIncomplete === true || truncationReasons.length > 0 || degradations.length > 0,
 		analysisStatus: {
 			discovery: discoveryPartial ? "partial" : "complete",
 			rules: rulesPartial ? "partial" : "complete",
@@ -83,11 +112,49 @@ function deriveCompletion(input) {
 			rulesCrashed: input.rulesCrashed,
 			parseFallbacks: input.parseFallbacks ?? 0,
 			...truncationReasons.length > 0 ? { truncationReasons } : {},
+			...degradations.length > 0 ? { degradations } : {},
 			reasons: [...reasons].sort()
 		}
 	};
 }
 //#endregion
+//#region src/engine/degradation-ledger.ts
+/**
+* Append-only. Records are never edited and never removed by a recording
+* site; a reader takes a window, and the window is defined by index, so
+* "delete my entry" is not an operation this module offers.
+*/
+const records = [];
+/** Record one capability loss. `count` is for a site that fails N at once. */
+function recordDegradation(reason, count = 1) {
+	if (!Number.isInteger(count) || count < 1) return;
+	for (let index = 0; index < count; index++) records.push({ reason });
+}
+/**
+* Mark where this reader's window opens. Everything appended from here on is
+* what the reader will see; see the file header for what a concurrent scan
+* does to that boundary.
+*/
+function beginDegradationWindow() {
+	return records.length;
+}
+/** The records appended since `marker`, without consuming them. */
+function degradationsSince(marker) {
+	return records.slice(marker);
+}
+/**
+* Per-reason counts for a window, sorted by reason so the output is
+* byte-deterministic for the same set of degradations.
+*/
+function summarizeDegradations(window) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const record of window) counts.set(record.reason, (counts.get(record.reason) ?? 0) + 1);
+	return [...counts.entries()].map(([reason, count]) => ({
+		reason,
+		count
+	})).sort((a, b) => a.reason < b.reason ? -1 : a.reason > b.reason ? 1 : 0);
+}
+//#endregion
 //#region src/engine/runtime-corroboration.ts
 /**
 * Stamp runtime corroboration + trust levels onto findings (mutates in
@@ -701,21 +768,13 @@ const MEASURED_FP = {
 * empty scan is an observation, not a proof).
 */
 function summaryTrustLevel(findings) {
-	const order = [
-		"L0",
-		"L1",
-		"L2",
-		"L3",
-		"L4",
-		"L5"
-	];
 	let best = 0;
 	for (const f of findings) {
 		const t = f.trustLevel ?? "L2";
-		const idx = order.indexOf(t);
+		const idx = TRUST_ORDER.indexOf(t);
 		if (idx > best) best = idx;
 	}
-	return order[best];
+	return TRUST_ORDER[best];
 }
 /**
 * A finding's trust rung (0–5) on the canonical ladder. Corroborated
@@ -726,14 +785,7 @@ function summaryTrustLevel(findings) {
 */
 function trustRung(f) {
 	const t = f.trustLevel ?? deriveTrustLevel(f);
-	return [
-		"L0",
-		"L1",
-		"L2",
-		"L3",
-		"L4",
-		"L5"
-	].indexOf(t);
+	return TRUST_ORDER.indexOf(t);
 }
 /**
 * Hard incompleteness ceilings (plan §6: partial/crash/truncation;
@@ -870,6 +922,17 @@ function buildRunIdentity(input) {
 		engineVersion: input.engineVersion
 	};
 	if (input.reportDigest) verdictInputs.reportDigest = input.reportDigest;
+	if (input.commit !== void 0) verdictInputs.commit = input.commit;
+	if (input.tree !== void 0) verdictInputs.tree = input.tree;
+	if (input.lockfile !== void 0) verdictInputs.lockfile = input.lockfile;
+	if (input.candidate !== void 0) verdictInputs.candidate = {
+		manifestId: input.candidate.manifestId,
+		state: input.candidate.state,
+		candidateSha: input.candidate.candidateSha,
+		baseSha: input.candidate.baseSha,
+		packageSha256: input.candidate.packageSha256,
+		lockfileSha256: input.candidate.lockfileSha256
+	};
 	if (input.trustModelVersion !== void 0) verdictInputs.trustModelVersion = input.trustModelVersion;
 	if (input.scoringModelVersion !== void 0) verdictInputs.scoringModelVersion = input.scoringModelVersion;
 	if (input.frameworkSupportMatrixVersion !== void 0) verdictInputs.frameworkSupportMatrixVersion = input.frameworkSupportMatrixVersion;
@@ -877,15 +940,31 @@ function buildRunIdentity(input) {
 	if (input.suppressionFingerprint !== void 0) verdictInputs.suppressionFingerprint = input.suppressionFingerprint;
 	if (input.policyFingerprint !== void 0) verdictInputs.policyFingerprint = input.policyFingerprint;
 	if (input.historicalEvidenceFingerprint !== void 0) verdictInputs.historicalEvidenceFingerprint = input.historicalEvidenceFingerprint;
+	const scanId = sha256$1(canonical(verdictInputs));
+	const boundLinks = [
+		"input",
+		"rules",
+		"config",
+		"engine"
+	];
+	if (input.commit !== void 0) boundLinks.push("commit");
+	if (input.tree !== void 0) boundLinks.push("tree");
+	if (input.lockfile !== void 0) boundLinks.push("lockfile");
+	if (input.candidate !== void 0) boundLinks.push("candidate");
 	return {
-		scanId: sha256$1(canonical(verdictInputs)),
+		scanId,
 		inputFingerprint,
 		rulesDigest,
 		configFingerprint,
 		engineVersion: input.engineVersion,
+		boundLinks,
 		...input.trustModelVersion !== void 0 ? { trustModelVersion: input.trustModelVersion } : {},
 		...input.scoringModelVersion !== void 0 ? { scoringModelVersion: input.scoringModelVersion } : {},
-		...input.frameworkSupportMatrixVersion !== void 0 ? { frameworkSupportMatrixVersion: input.frameworkSupportMatrixVersion } : {}
+		...input.frameworkSupportMatrixVersion !== void 0 ? { frameworkSupportMatrixVersion: input.frameworkSupportMatrixVersion } : {},
+		...input.commit !== void 0 ? { commit: input.commit } : {},
+		...input.tree !== void 0 ? { tree: input.tree } : {},
+		...input.lockfile !== void 0 ? { lockfile: input.lockfile } : {},
+		...input.candidate !== void 0 ? { candidate: input.candidate } : {}
 	};
 }
 /**
@@ -926,9 +1005,353 @@ function buildEvidenceGraph(parts) {
 				...parts.reproduction !== void 0 ? { ref: parts.reproduction } : {}
 			}
 		],
-		...parts.runId !== void 0 ? { runId: parts.runId } : {}
+		...parts.runId !== void 0 ? { runId: parts.runId } : {},
+		...parts.candidate !== void 0 ? { candidate: {
+			manifestId: parts.candidate.manifestId,
+			candidateSha: parts.candidate.candidateSha
+		} } : {}
+	};
+}
+//#endregion
+//#region src/engine/file-executor.ts
+function cacheHitOutcome(job) {
+	return {
+		path: job.path,
+		status: "CACHE_HIT",
+		findings: [...job.cacheHit ?? []],
+		parseFallback: false
+	};
+}
+/**
+* Drive a list of jobs through an executor and return outcomes in INPUT order.
+*
+* This is the function the pipeline calls. It is executor-agnostic on purpose:
+* swapping in a pooled executor must not require touching the caller, and the
+* ordering guarantee has to live here or it would live in each executor and
+* drift between them.
+*/
+async function executeFiles(jobs, executor, context = {}) {
+	const outcomes = new Array(jobs.length);
+	if (executor.concurrency <= 1 || jobs.length <= 1) {
+		for (let i = 0; i < jobs.length; i++) {
+			const job = jobs[i];
+			context.onProgress?.({
+				done: i,
+				total: jobs.length,
+				path: job.path
+			});
+			outcomes[i] = await runOne(job, executor, context);
+		}
+		context.onProgress?.({
+			done: jobs.length,
+			total: jobs.length,
+			path: jobs[jobs.length - 1]?.path ?? ""
+		});
+		return outcomes;
+	}
+	let next = 0;
+	let completed = 0;
+	const inFlight = /* @__PURE__ */ new Set();
+	const limit = Math.max(1, Math.floor(executor.concurrency));
+	const worker = async () => {
+		for (;;) {
+			const index = next++;
+			if (index >= jobs.length) return;
+			const job = jobs[index];
+			outcomes[index] = await runOne(job, executor, context);
+			completed++;
+			context.onProgress?.({
+				done: completed,
+				total: jobs.length,
+				path: job.path
+			});
+		}
+	};
+	for (let i = 0; i < Math.min(limit, jobs.length); i++) {
+		const promise = worker().then(() => void 0);
+		inFlight.add(promise);
+	}
+	await Promise.all(inFlight);
+	return outcomes;
+}
+async function runOne(job, executor, context) {
+	if (job.cacheHit !== void 0) return cacheHitOutcome(job);
+	try {
+		return await executor.execute(job, context);
+	} catch (error) {
+		return {
+			path: job.path,
+			status: "FAILED",
+			findings: [],
+			parseFallback: false,
+			error: error instanceof Error ? error : new Error(String(error))
+		};
+	}
+}
+/**
+* The strategy the pipeline uses today.
+*
+* `runOne` is supplied by the pipeline because parsing and rule execution
+* need the adapter and the active rule set, which are pipeline concerns. The
+* executor's job is the BOUNDARY and the bookkeeping, not the analysis — so
+* this factory exists to bind those two without the executor importing the
+* pipeline (which would be a cycle).
+*/
+function createExecutor(name, concurrency, runOne) {
+	return {
+		name,
+		concurrency,
+		execute: runOne
+	};
+}
+//#endregion
+//#region src/scope/git-resolve.ts
+/**
+* Absolute-path git resolution (audit S1).
+*
+* `execFileSync("git", …)` resolves through PATH — including the CWD on
+* Windows (CreateProcess searches the current directory before PATH for
+* extension-less names depending on NoDefaultCurrentDirectoryInExePath).
+* Scanning an UNTRUSTED repo therefore let a checked-in `git.exe` (or
+* `git.bat`/`git.cmd`) hijack Mjölnir's own git invocations: the attacker
+* controls the diff output, the merge-base decision, and
+* `--scope changed`'s "what is new" answer — the exact data CI gates on.
+*
+* The fix: resolve git ONCE per process to an ABSOLUTE path by walking
+* the PATH directly (never consulting the CWD), verify the candidate is
+* an existing file, and pass that path to execFileSync. Resolution is
+* memoized; a failure to find a real git anywhere on PATH is recorded
+* and callers degrade without invoking a bare name.
+*/
+let resolvedGit = void 0;
+/**
+* The absolute path of the git binary Mjölnir will invoke, or null when
+* PATH carries no executable `git` at all. Callers must degrade without
+* invoking a bare name.
+*/
+function resolveGitPath() {
+	if (resolvedGit !== void 0) return resolvedGit;
+	const candidates = [process.platform === "win32" ? "git.exe" : "git"];
+	if (process.platform === "win32") {
+		const pathExt = process.env["PATHEXT"]?.split(";").filter(Boolean) ?? [];
+		for (const ext of pathExt) candidates.push(`git${ext.toLowerCase()}`);
+	}
+	const pathValue = process.env["PATH"] ?? "";
+	for (const dir of pathValue.split(delimiter)) {
+		if (dir === "") continue;
+		if (!isAbsolute(dir)) continue;
+		for (const candidate of candidates) {
+			const full = join(dir, candidate);
+			try {
+				if (existsSync(full)) {
+					resolvedGit = full;
+					return resolvedGit;
+				}
+			} catch {}
+		}
+	}
+	`${pathValue.length}`;
+	resolvedGit = null;
+	return resolvedGit;
+}
+/**
+* Run git with the S1-resolved absolute binary path. Returns stdout, or
+* null when git is missing or the command fails — the same contract as
+* the previous inline `git()` helpers, with the hijack surface closed.
+*/
+function runGit(root, args) {
+	const exe = resolveGitPath();
+	if (!exe) return null;
+	try {
+		return execFileSync(exe, [
+			"-C",
+			root,
+			...args
+		], {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			],
+			timeout: 15e3
+		});
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/lib/safe-json.ts
+/**
+* Reusable safe-JSON parse-and-validate helper.
+*
+* Replaces the `JSON.parse(text) as T` pattern with a two-step process:
+*   1. Try/catch around JSON.parse (descriptive error on bad JSON)
+*   2. Runtime validation of the parsed shape (caller-supplied predicate)
+*
+* The `validate` predicate is intentionally lightweight — it checks the
+* expected shape exists rather than exhaustively type-guarding every field.
+* Internal files (cache, hashes) use `isRecord`; user-facing files
+* (config, plugins) use stricter checks that throw descriptive errors.
+*/
+const MAX_JSON_BYTES = 16777216;
+function parseJsonFile(text, source, validate) {
+	if (Buffer.byteLength(text, "utf8") > MAX_JSON_BYTES) throw new Error(`JSON source exceeds the ${MAX_JSON_BYTES}-byte limit: ${source}`);
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch (err) {
+		throw new Error(`invalid JSON in ${source}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+	}
+	if (!validate(parsed)) throw new Error(`unexpected shape in ${source}`, { cause: parsed });
+	return parsed;
+}
+/**
+* Minimal validator: value is a plain object (not null, not array).
+* Sufficient for internal files (cache, hashes) where downstream
+* code already checks individual fields.
+*/
+function isRecord(v) {
+	try {
+		return typeof v === "object" && v !== null && !Array.isArray(v);
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/engine/candidate-binding.ts
+/**
+* Candidate binding (plan V5-010).
+*
+* Reads a candidate trust manifest and produces the immutable
+* `CandidateBinding` that a run identity is bound to. It also computes the
+* repository facts (commit, tree, lockfile digest) that the identity was
+* missing until this module existed.
+*
+* The law here is ABSENCE over invention. A manifest that is missing,
+* unreadable, or internally contradictory yields NO binding — not a partial
+* one. A consumer that can see "not bound" can refuse to trust the run; a
+* consumer handed a half-filled binding cannot tell what is missing, and will
+* trust the parts that are there.
+*/
+const CANDIDATE_MANIFEST_PATH = "candidate-trust-manifest.json";
+const SHA40 = /^[a-f0-9]{40}$/;
+const SHA256 = /^[a-f0-9]{64}$/;
+const STATES = ["WORKING_CANDIDATE", "RELEASE_CANDIDATE"];
+const AUTHORIZATION = ["NOT_AUTHORIZED", "AUTHORIZED"];
+function sha256File(path) {
+	try {
+		return createHash("sha256").update(readFileSync(path)).digest("hex");
+	} catch {
+		return;
+	}
+}
+/**
+* One git line, or nothing.
+*
+* Audit S1: the binary is the ABSOLUTE path `resolveGitPath()` found by
+* walking PATH itself, never the bare name. `bindRepository()` runs on every
+* scan (`scan-pipeline.ts`), and a bare `execFileSync("git", …)` lets a
+* `git.exe`/`git.bat`/`git.cmd` CHECKED INTO AN UNTRUSTED REPO hijack the
+* call on Windows, where CreateProcess searches the current directory before
+* PATH. The attacker then controls the `commit` and `tree` that land in
+* `runIdentity` and the evidence graph — the provenance a release decision
+* reads. This was the last bare-name exec left in `src/`; the invariant that
+* keeps it that way is `tests/contract/no-bare-process-exec.spec.ts`.
+*
+* The `-C <root>` shape (not `cwd`) matches every other hardened call site.
+* With no git on PATH at all, the answer is nothing — a scan of an unpacked
+* tarball has no commit, and its identity must say so rather than carrying a
+* placeholder that looks like provenance.
+*/
+function gitLine(root, args) {
+	const exe = resolveGitPath();
+	if (!exe) return void 0;
+	try {
+		const trimmed = execFileSync(exe, [
+			"-C",
+			root,
+			...args
+		], {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			],
+			windowsHide: true,
+			timeout: 15e3
+		}).trim();
+		return trimmed.length > 0 ? trimmed : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* The commit and tree the working tree is at. Both absent outside a
+* repository or with no commits — never substituted with a placeholder.
+*/
+function bindRepository(root) {
+	const commit = gitLine(root, ["rev-parse", "HEAD"]);
+	const tree = gitLine(root, ["rev-parse", "HEAD^{tree}"]);
+	const lockfile = sha256File(join(root, "package-lock.json"));
+	return {
+		...commit !== void 0 ? { commit } : {},
+		...tree !== void 0 ? { tree } : {},
+		...lockfile !== void 0 ? { lockfile } : {}
+	};
+}
+/**
+* Parse a candidate manifest into a binding, or return null when it cannot
+* honestly be bound.
+*
+* Null is returned for: no manifest, unreadable JSON, a missing or malformed
+* required field, or a state/authorization combination that cannot legally
+* exist (a WORKING_CANDIDATE carrying a commit, for example — the same
+* contradiction the release decision evaluator treats as BLOCKED).
+*/
+function parseCandidateBinding(raw) {
+	if (!isRecord(raw)) return null;
+	const identity = raw.identity;
+	if (!isRecord(identity)) return null;
+	const state = identity.state;
+	const candidateSha = identity.candidateSha;
+	const baseSha = identity.baseSha;
+	const packageSha256 = identity.packageSha256;
+	const lockfileSha256 = identity.lockfileSha256;
+	if (typeof state !== "string" || !STATES.includes(state)) return null;
+	if (typeof baseSha !== "string" || !SHA40.test(baseSha)) return null;
+	if (typeof packageSha256 !== "string" || !SHA256.test(packageSha256)) return null;
+	if (typeof lockfileSha256 !== "string" || !SHA256.test(lockfileSha256)) return null;
+	if (candidateSha !== null && (typeof candidateSha !== "string" || !SHA40.test(candidateSha))) return null;
+	const manifestId = raw.manifestId;
+	if (typeof manifestId !== "string" || manifestId.length === 0) return null;
+	const owner = typeof raw.owner === "string" ? raw.owner : "UNASSIGNED";
+	const authorization = raw.releaseAuthorizationState;
+	if (typeof authorization !== "string" || !AUTHORIZATION.includes(authorization)) return null;
+	if (state === "WORKING_CANDIDATE") {
+		if (candidateSha !== null) return null;
+		if (authorization !== "NOT_AUTHORIZED") return null;
+	} else if (candidateSha === null) return null;
+	return {
+		manifestId,
+		state,
+		candidateSha,
+		baseSha,
+		packageSha256,
+		lockfileSha256,
+		owner,
+		releaseAuthorizationState: authorization
 	};
 }
+/** Read and bind the manifest from a checkout, or null. */
+function readCandidateBinding(root, manifestPath = CANDIDATE_MANIFEST_PATH) {
+	try {
+		return parseCandidateBinding(JSON.parse(readFileSync(join(root, manifestPath), "utf8")));
+	} catch {
+		return null;
+	}
+}
 //#endregion
 //#region src/engine/version.ts
 /**
@@ -939,7 +1362,7 @@ function buildEvidenceGraph(parts) {
 * scripts/sync-sarif-version.cjs and guarded by the version-consistency
 * spec. cli.ts re-exports this as CLI_VERSION.
 */
-const ENGINE_VERSION = "3.0.0";
+const ENGINE_VERSION = "5.0.0";
 //#endregion
 //#region src/engine/contract-versions.ts
 /**
@@ -1068,9 +1491,12 @@ function discoverWorkspace(rootDir) {
 	const root = findProjectRoot(rootDir);
 	if (!root) return null;
 	let pkg = {};
-	try {
-		pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
-	} catch {}
+	const manifestPath = join(root, "package.json");
+	if (existsSync(manifestPath)) try {
+		pkg = JSON.parse(readFileSync(manifestPath, "utf8"));
+	} catch {
+		recordDegradation("workspace-manifest-unreadable");
+	}
 	const rawWorkspaces = pkg["workspaces"];
 	let globs = [];
 	if (Array.isArray(rawWorkspaces)) globs = rawWorkspaces.filter((w) => typeof w === "string");
@@ -1087,40 +1513,6 @@ function basename$1(p) {
 	return parts[parts.length - 1];
 }
 //#endregion
-//#region src/lib/safe-json.ts
-/**
-* Reusable safe-JSON parse-and-validate helper.
-*
-* Replaces the `JSON.parse(text) as T` pattern with a two-step process:
-*   1. Try/catch around JSON.parse (descriptive error on bad JSON)
-*   2. Runtime validation of the parsed shape (caller-supplied predicate)
-*
-* The `validate` predicate is intentionally lightweight — it checks the
-* expected shape exists rather than exhaustively type-guarding every field.
-* Internal files (cache, hashes) use `isRecord`; user-facing files
-* (config, plugins) use stricter checks that throw descriptive errors.
-*/
-const MAX_JSON_BYTES = 16777216;
-function parseJsonFile(text, source, validate) {
-	if (Buffer.byteLength(text, "utf8") > MAX_JSON_BYTES) throw new Error(`JSON source exceeds the ${MAX_JSON_BYTES}-byte limit: ${source}`);
-	let parsed;
-	try {
-		parsed = JSON.parse(text);
-	} catch (err) {
-		throw new Error(`invalid JSON in ${source}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
-	}
-	if (!validate(parsed)) throw new Error(`unexpected shape in ${source}`, { cause: parsed });
-	return parsed;
-}
-/**
-* Minimal validator: value is a plain object (not null, not array).
-* Sufficient for internal files (cache, hashes) where downstream
-* code already checks individual fields.
-*/
-function isRecord(v) {
-	return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-//#endregion
 //#region src/lib/fs-bounded.ts
 function closeQuiet(fd) {
 	try {
@@ -1347,20 +1739,15 @@ function validate(cfg, knownRuleIds) {
 	return warnings;
 }
 /**
-* Bug-audit QA-2026-08-30 QA-6: the 90-day policy in the README was only
-* applied at WRITE time by the `ignore` command — a hand-written entry
-* without `expires` stayed active forever, silently bypassing the
-* documented window.
+* Expiry is evaluated only from an explicit ISO `expires` date. A missing
+* date remains active and is reported as having no expiry. Config-file mtime
+* is never an expiry anchor.
 *
-* Audit S4 (remediation plan): the config-file MTIME is no longer an
-* expiry anchor. Anchoring the 90-day default at mtime meant ANY edit to
-* mjolnir.config.json — a reformat, an unrelated key, a `touch` — reset
-* the 90-day window for EVERY hand-authored entry: suppressions could be
-* extended indefinitely without touching their own fields. The expiry is
-* now the entry's explicit `expires` date alone; an entry without one
-* stays active and is honestly labeled "(no expiry set)" in the
-* suppressions report. Hand-authored entries should declare `expires` at
-* creation (README §Configuration documents the shape).
+* `now` defaults to the current instant so existing callers stay correct, but
+* a verdict function that reads the clock invisibly is a verdict nobody can
+* test at a boundary. `tests/contract/deterministic-clock.spec.ts` audits
+* `src/config/**` for a call site that supplies its own `new Date()` instead
+* of threading one through.
 */
 function isSuppressionActive(ign, now = /* @__PURE__ */ new Date()) {
 	if (!ign.expires) return true;
@@ -1638,7 +2025,33 @@ function sharedWalk(options) {
 *
 * When nothing is detectable we report `unknown` and the scanner analyzes
 * all test-looking files — stated honestly in output rather than guessed.
+*
+* ## One ID space (plan V5-024)
+*
+* This detector used to declare its own `TestFramework` union of three
+* literals while `src/frameworks/framework-inventory.ts` catalogued fourteen
+* framework ids. Two vocabularies for one concept is how a support matrix
+* starts disagreeing with what the tool actually detects: a framework can be
+* catalogued as OFFICIAL_PARTIAL and never once be emitted by the code that
+* claims to detect it.
+*
+* So the ids here are `FrameworkId`s — the inventory's own vocabulary — and
+* `DETECTABLE_TEST_FRAMEWORKS` is the subset this detector can actually
+* resolve from a checkout. That subset is the HONEST limit of detection, and
+* `detectableVsCatalogued()` reports the remainder rather than letting a
+* three-item list read as the whole catalog.
+*/
+/**
+* The catalogued frameworks whose detection is implemented today.
+*
+* Every entry must exist in the inventory — enforced by the parity spec, not
+* by comment.
 */
+const DETECTABLE_TEST_FRAMEWORKS = [
+	"jest",
+	"vitest",
+	"playwright"
+];
 const CONFIG_FILES = {
 	jest: [
 		"jest.config.ts",
@@ -1657,7 +2070,7 @@ const CONFIG_FILES = {
 };
 function detectFrameworks(ws) {
 	const found = /* @__PURE__ */ new Set();
-	for (const fw of Object.keys(CONFIG_FILES)) if (CONFIG_FILES[fw].some((f) => existsSync(join(ws.root, f)))) found.add(fw);
+	for (const fw of DETECTABLE_TEST_FRAMEWORKS) if (CONFIG_FILES[fw].some((f) => existsSync(join(ws.root, f)))) found.add(fw);
 	if (!found.has("jest") && ws.packageJson["jest"] !== void 0) found.add("jest");
 	const deps = {
 		...ws.packageJson["dependencies"],
@@ -1679,11 +2092,7 @@ function detectFrameworks(ws) {
 		};
 	}
 	return {
-		frameworks: [
-			"jest",
-			"vitest",
-			"playwright"
-		].filter((f) => found.has(f)),
+		frameworks: DETECTABLE_TEST_FRAMEWORKS.filter((f) => found.has(f)),
 		unknown: false
 	};
 }
@@ -1700,6 +2109,13 @@ function detectFrameworks(ws) {
 * byte-identical — a score shift is a regression, not an improvement.
 */
 let project = null;
+/**
+* The shared ts-morph project.
+*
+* Exported so an adapter's `dispose()` can evict the file it parsed: ts-morph
+* caches by file path, so without eviction a long scan holds every parsed
+* SourceFile until the process exits (plan V5-021).
+*/
 function getProject() {
 	if (!project) project = new Project({
 		useInMemoryFileSystem: true,
@@ -1727,6 +2143,7 @@ function parseTsFile(file) {
 		}
 		return p.createSourceFile(file.path, file.text);
 	} catch {
+		recordDegradation("ast-parse-failed");
 		return;
 	}
 }
@@ -1782,6 +2199,7 @@ function commentAndStringRanges(ctx) {
 		}
 		return ranges;
 	} catch {
+		recordDegradation("ast-range-scan-failed");
 		return [];
 	}
 }
@@ -1829,6 +2247,7 @@ function getCodeOnlyText(file) {
 		for (const r of ranges) for (let i = r.start; i < r.end && i < chars.length; i++) if (chars[i] !== "\n" && chars[i] !== "\r") chars[i] = " ";
 		return chars.join("");
 	} catch {
+		recordDegradation("ast-mask-unavailable");
 		return file.text;
 	}
 }
@@ -2213,7 +2632,45 @@ function frameworkFilterApplies(rule, file) {
 	return rule.frameworks.some((f) => tags.includes(f));
 }
 //#endregion
-//#region src/adapters/typescript.ts
+//#region src/engine/shared-run-rules.ts
+/**
+* Run ONE rule with crash isolation, and return what it produced.
+*
+* This is the block that was copy-pasted into all seven language adapters:
+*
+*   try { for (const f of rule.run(x)) emit(f, rule.id, rule.category); }
+*   catch (error) { onCrash?.(rule.id, error); }
+*
+* Extracting it is worth doing for one reason beyond line count. Crash
+* isolation is the mechanism that lets a third-party or experimental
+* detector fail without ending a scan, and it is the mechanism the whole
+* `rulesCrashed` count depends on. Seven copies means seven chances to
+* write `catch {}` and lose the count, and `tests/contract/
+* no-uncounted-degradation.spec.ts` can only audit what it can see.
+*
+* `null` means the rule CRASHED, which is not the same as an empty array:
+* an empty array is the rule abstaining, and the adapters skip emission for
+* both but the distinction is why the caller must not conflate them.
+*
+* Deliberately NOT extracted: the per-adapter filter chain and the budget
+* check. Those genuinely differ — the TypeScript adapter injects an AST,
+* framework tags, a lazy `codeText` getter, `appliesTo` scoping, config-only
+* gating and `configGateMatches`, and it ABORTS the whole file on budget
+* exhaustion where `runRulesShared` only `continue`s to the next rule.
+* Routing every adapter through `runRulesShared` as written would silently
+* change which rules run and when, which is precisely the unmeasured claim
+* this program exists to delete. This helper takes the part they share.
+*/
+function runRuleIsolated(rule, file, onCrash) {
+	try {
+		return rule.run(file);
+	} catch (error) {
+		onCrash?.(rule.id, error);
+		return null;
+	}
+}
+//#endregion
+//#region src/adapters/typescript.ts
 /**
 * TypeScript/JavaScript adapter (R1).
 * Wraps the proven regex-based engine behind the LanguageAdapter
@@ -2226,7 +2683,36 @@ function frameworkFilterApplies(rule, file) {
 * "cypress", `@jest/globals` → "jest", `vitest` → "vitest". Config
 * gating is rule-declared (`configFiles`), not hard-coded here.
 */
-const TEST_FILE_RE = /\.(?:test|spec)\.(?:js|jsx|ts|tsx|mjs|cjs)$|\.cy\.(?:js|jsx|ts|tsx)$/;
+/**
+* `.test.` / `.spec.` filenames, plus the Cypress `.cy.` convention.
+*
+* `mts` and `cts` are TypeScript's Node-native ESM/CJS extensions. They were
+* missing here, and the omission was invisible in the worst way — not a wrong
+* answer, but an ABSENCE.
+*
+* Reproduced: a repo containing two byte-identical tests, one at
+* `tests/control.spec.ts` and one at `tests/slow.spec.mts`, each with a
+* `QA-TEST-004` hard sleep:
+*
+*   discovered: 1, analyzed: 1, unrecognized: 1, scopeVerdict: "PARTIAL"
+*
+* The `.ts` test produced the finding. The `.mts` test produced nothing at
+* all — it was never scanned, so every rule that could have caught it was
+* silent on it, with no finding, no low-evidence note, and no indication that
+* a test file had been skipped. A test scanner that cannot see a whole file
+* extension has a false green that is invisible by construction: the reader
+* has nothing to distrust, because there is nothing there.
+*
+* The corroboration that this was an oversight rather than a decision sits
+* four lines below: PW_CONFIG_RE already accepted `cts`. The config regex knew
+* about the Node-native extensions; the test-file regex did not.
+*
+* `discovery/scan-adapters.ts:isUnrecognizedSourceCandidate` already counted
+* these paths as uncovered surface, so the scope accounting had been reporting
+* the hole the whole time — it was being read as a known limitation rather than
+* as a defect.
+*/
+const TEST_FILE_RE = /\.(?:test|spec)\.(?:js|jsx|ts|tsx|mjs|cjs|mts|cts)$|\.cy\.(?:js|jsx|ts|tsx)$/;
 /**
 * Fallback config list for `configOnly` rules that do not declare
 * `configFiles` (the legacy playwright.config.* gating, preserved
@@ -2333,11 +2819,42 @@ const typescriptAdapter = {
 			fixtureDirMemo: /* @__PURE__ */ new Map()
 		});
 	},
+	/**
+	* The ONE AST seam (plan V5-021).
+	*
+	* This adapter used to parse inside `runRules`, on the synchronous path,
+	* while Java and C# exposed the async `parseAst` hook. Two seams meant two
+	* sets of consequences, both of them bad:
+	*
+	*   - the pipeline computes `wantsAst` as `adapter.parseAst !== undefined`,
+	*     so a TypeScript file never took the AST path through the pipeline at
+	*     all, and its parse failures were invisible to the pipeline's
+	*     fallback counters;
+	*   - nothing called `dispose()` for the ts-morph path, so a scan held
+	*     every parsed SourceFile for its whole lifetime.
+	*
+	* Parsing now happens here, once, through the same contract every other
+	* adapter uses. `dispose()` drops this file's SourceFile from the shared
+	* project; ts-morph caches per file path, so removing it is what keeps
+	* memory proportional to one file rather than to the whole scan.
+	*/
+	parseAst(file) {
+		const sourceFile = parseTsFile(file);
+		if (sourceFile === void 0) return void 0;
+		return {
+			ast: sourceFile,
+			dispose: () => {
+				try {
+					getProject().removeSourceFile(sourceFile);
+				} catch {}
+			}
+		};
+	},
 	runRules(rules, file, emit, onCrash, budget) {
-		const withAst = {
+		const withAst = file.ast === void 0 ? {
 			...file,
 			ast: parseTsFile(file)
-		};
+		} : file;
 		const withTags = {
 			...withAst,
 			frameworkTags: frameworkTagsFromImports(withAst.text)
@@ -2362,11 +2879,9 @@ const typescriptAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run(enriched)) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, enriched, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -2394,6 +2909,7 @@ function loadWorkspaceShim(root) {
 			workspaceGlobs: []
 		};
 	} catch {
+		recordDegradation("workspace-manifest-unreadable");
 		return null;
 	}
 }
@@ -2748,11 +3264,9 @@ const pythonAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run(enriched)) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, enriched, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	},
 	async parseAst(file) {
@@ -2905,11 +3419,9 @@ const javaAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run(enriched)) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, enriched, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -3063,11 +3575,9 @@ const csharpAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run(enriched)) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, enriched, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -3245,6 +3755,7 @@ const githubActionsAdapter = {
 		try {
 			entries = readdirSync(wfDir);
 		} catch {
+			recordDegradation("ci-workflow-listing-unreadable");
 			return;
 		}
 		for (const name of entries) {
@@ -3285,15 +3796,13 @@ const githubActionsAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run({
-					path: file.path,
-					text: file.text,
-					ast: doc
-				})) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, {
+				path: file.path,
+				text: file.text,
+				ast: doc
+			}, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -3603,15 +4112,13 @@ const azurePipelinesAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run({
-					path: file.path,
-					text: file.text,
-					ast: doc
-				})) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, {
+				path: file.path,
+				text: file.text,
+				ast: doc
+			}, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -3682,14 +4189,12 @@ const jenkinsAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run({
-					path: file.path,
-					text: file.text
-				})) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, {
+				path: file.path,
+				text: file.text
+			}, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -3756,9 +4261,37 @@ function discoverAllTestFiles(ctx, languageAdapters, buckets, fixtureDirMemo) {
 		}
 	});
 }
+/**
+* Would ignoring this file have removed it from the scanned surface?
+*
+* The bug this fixes, reproduced: a repo containing a real test file plus
+* `vendor.min.js` and `pnpm-lock.yaml` reported
+*
+*   discovered: 1, analyzed: 1, ignored: 2, scopeVerdict: "PARTIAL"
+*
+* Every discovered test file HAD been analyzed. The surface was complete. But
+* DEFAULT_IGNORES matches minified bundles and lockfiles, and the ignored
+* counter accepted any path with a source extension — so a minified bundle and
+* a lockfile downgraded a finished scan to "unverified".
+*
+* That is not a conservative bias, it is a broken signal. The terminal tells
+* the reader "some files were not analyzed, so the surface is unverified" —
+* which was false. And because minified bundles and lockfiles exist in
+* essentially every real repository, a PROVEN scan was unreachable in
+* practice, so the corpus regression guard failed 23 of 37 repositories on
+* exactly this. A gate that cannot pass teaches people to ignore it.
+*
+* The asymmetry is the tell. `isUnrecognizedSourceCandidate` below applies a
+* test-relevance test before counting a file; this one did not. Both count
+* against the same verdict, so both must ask the same question.
+*
+* An ignored file that IS a test file still downgrades the verdict. That is
+* the case the honesty law exists for, and this does not touch it.
+*/
 function isScopeRelevantIgnored(path) {
 	const name = path.replaceAll("\\", "/").split("/").pop() ?? path;
-	return /\.(?:[cm]?[jt]sx?|py|java|cs|ya?ml|min\.js)$/i.test(name);
+	if (!/\.(?:[cm]?[jt]sx?|py|java|cs|ya?ml|min\.js)$/i.test(name)) return false;
+	return isKnownTestFile(path);
 }
 function isUnrecognizedSourceCandidate(path) {
 	const normalized = path.replaceAll("\\", "/");
@@ -3788,82 +4321,6 @@ function isInsideSkippedDir(root, absPath, skipNames) {
 }
 typescriptAdapter.testFileGlobs, pythonAdapter.testFileGlobs, javaAdapter.testFileGlobs, csharpAdapter.testFileGlobs, githubActionsAdapter.testFileGlobs, azurePipelinesAdapter.testFileGlobs, jenkinsAdapter.testFileGlobs;
 //#endregion
-//#region src/scope/git-resolve.ts
-/**
-* Absolute-path git resolution (audit S1).
-*
-* `execFileSync("git", …)` resolves through PATH — including the CWD on
-* Windows (CreateProcess searches the current directory before PATH for
-* extension-less names depending on NoDefaultCurrentDirectoryInExePath).
-* Scanning an UNTRUSTED repo therefore let a checked-in `git.exe` (or
-* `git.bat`/`git.cmd`) hijack Mjölnir's own git invocations: the attacker
-* controls the diff output, the merge-base decision, and
-* `--scope changed`'s "what is new" answer — the exact data CI gates on.
-*
-* The fix: resolve git ONCE per process to an ABSOLUTE path by walking
-* the PATH directly (never consulting the CWD), verify the candidate is
-* an existing file, and pass that path to execFileSync. Resolution is
-* memoized; a failure to find a real git anywhere on PATH is recorded
-* and callers degrade without invoking a bare name.
-*/
-let resolvedGit = void 0;
-/**
-* The absolute path of the git binary Mjölnir will invoke, or null when
-* PATH carries no executable `git` at all. Callers must degrade without
-* invoking a bare name.
-*/
-function resolveGitPath() {
-	if (resolvedGit !== void 0) return resolvedGit;
-	const candidates = [process.platform === "win32" ? "git.exe" : "git"];
-	if (process.platform === "win32") {
-		const pathExt = process.env["PATHEXT"]?.split(";").filter(Boolean) ?? [];
-		for (const ext of pathExt) candidates.push(`git${ext.toLowerCase()}`);
-	}
-	const pathValue = process.env["PATH"] ?? "";
-	for (const dir of pathValue.split(delimiter)) {
-		if (dir === "") continue;
-		if (!isAbsolute(dir)) continue;
-		for (const candidate of candidates) {
-			const full = join(dir, candidate);
-			try {
-				if (existsSync(full)) {
-					resolvedGit = full;
-					return resolvedGit;
-				}
-			} catch {}
-		}
-	}
-	`${pathValue.length}`;
-	resolvedGit = null;
-	return resolvedGit;
-}
-/**
-* Run git with the S1-resolved absolute binary path. Returns stdout, or
-* null when git is missing or the command fails — the same contract as
-* the previous inline `git()` helpers, with the hijack surface closed.
-*/
-function runGit(root, args) {
-	const exe = resolveGitPath();
-	if (!exe) return null;
-	try {
-		return execFileSync(exe, [
-			"-C",
-			root,
-			...args
-		], {
-			encoding: "utf8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			],
-			timeout: 15e3
-		});
-	} catch {
-		return null;
-	}
-}
-//#endregion
 //#region src/scope/changed.ts
 /**
 * Changed-scope engine (Sprint-Plan W6, Product-MVP §9 `--scope changed`).
@@ -7608,7 +8065,6 @@ const pyBareTruthinessAssert = defineRule({
 		const re = /^[ \t]*assert\s+([A-Za-z_][\w.]*(?:\([^()]*\))?)[ \t]*$/gm;
 		const predicateRe = /^(?:(?:any|all|isinstance)\s*\(|[\w.]*\.(?:startswith|endswith|exists|isdir|isfile|islink|ismount|check|isdigit|isalpha|isalnum|isnumeric|isdecimal|isspace|islower|isupper|istitle|isidentifier|isprintable|isascii)\s*\(|re\.(?:match|search|fullmatch)\s*\()/;
 		const isGuardFollowedByRealUse = (text, matchIndex, target) => {
-			const root = target.split(".")[0];
 			const lineEnd = text.indexOf("\n", matchIndex);
 			if (lineEnd === -1) return false;
 			const lines = text.slice(lineEnd + 1).split("\n");
@@ -7618,8 +8074,11 @@ const pyBareTruthinessAssert = defineRule({
 				if (/^\s*def\s/.test(l) && window.length > 0) break;
 				window.push(l);
 			}
-			const usesRoot = new RegExp(`\\b${root}\\b`);
-			return window.some((l) => usesRoot.test(l));
+			const root = target.match(/^[a-z_]\w*/i)?.[0];
+			if (!root) return false;
+			return window.some((line) => {
+				return (line.match(/[a-z_]\w*/gi) ?? []).some((token) => token === root);
+			});
 		};
 		let m;
 		while ((m = re.exec(text)) !== null) {
@@ -11302,6 +11761,53 @@ function getRule(id) {
 	return RULES.find((r) => r.id === id);
 }
 //#endregion
+//#region src/lib/compare.ts
+/**
+* Order that does not depend on who is asking.
+*
+* `String.prototype.localeCompare` with no locale argument resolves against
+* the PROCESS's default locale — the ICU collation chosen by `LANG`,
+* `LC_ALL` or the OS. So a sort written as
+* `[...xs].sort((a, b) => a.localeCompare(b))` produces a different order on
+* a developer's `de_DE` machine than on an en-US CI runner. For a display
+* list that is a nuisance; for anything that reaches a hash, a cache key, a
+* digest or a machine contract it is a correctness bug, because the same
+* repository then produces two different fingerprints.
+*
+* Two comparators, one per kind of site:
+*
+*   compareCodePoints — pure UTF-16 code-unit order. Identical everywhere,
+*   independent of ICU version, and already what `Array.prototype.sort`
+*   defaults to. Use for every value that reaches a fingerprint, a digest,
+*   a cache key, or a contract, and for any ordering with no human-facing
+*   reason to be pretty.
+*
+*   compareLocalized(locale) — the same collator, PINNED to a named locale
+*   instead of inheriting the environment, for a surface that genuinely
+*   wants readable order (a table of rule titles, a Mermaid legend). Pinned
+*   rather than removed because a reader-facing list of "Test / Logic /
+*   Mock" should not be ordered by code unit.
+*
+* A bare `localeCompare` with no second argument in `src/` is a defect and
+* `tests/contract/deterministic-ordering.spec.ts` fails the build on it.
+*/
+/** Code-unit order. Locale-free, ICU-free, and the Array.sort default. */
+function compareCodePoints(a, b) {
+	if (a === b) return 0;
+	return a < b ? -1 : 1;
+}
+/**
+* A readable-order comparator pinned to `locale`.
+*
+* The pin is the point: `a.localeCompare(b)` reads the environment, and the
+* environment is a machine setting, not a property of the code. Callers that
+* want stable output ask for a named locale and get the same answer on every
+* machine that ships the same ICU data.
+*/
+function compareLocalized(locale) {
+	return (a, b) => a.localeCompare(b, locale);
+}
+//#endregion
 //#region src/scorer/scorer.ts
 /**
 * Transparent scorer (Product-MVP §8).
@@ -11358,7 +11864,7 @@ function computeDimensions(findings) {
 		deductions.set(f.category, deductions.get(f.category) + deductionFor(f));
 	}
 	for (const dim of byCategory.values()) dim.score = Math.max(0, 100 - deductions.get(dim.category));
-	return [...byCategory.values()].sort((a, b) => a.category.localeCompare(b.category));
+	return [...byCategory.values()].sort((a, b) => compareCodePoints(a.category, b.category));
 }
 /**
 * Deduction-mass ceilings (product-gap-remediation master plan P2,
@@ -11581,6 +12087,22 @@ function normalizeOne(report, artifact, v) {
 function buildEvidenceRecords(report, artifact) {
 	return report.verdicts.map((v) => normalizeOne(report, artifact, v)).sort(compareEvidenceRecords);
 }
+function countEvidence(records) {
+	const counts = {
+		total: records.length,
+		failed: 0,
+		flaky: 0,
+		skipped: 0,
+		timedOut: 0
+	};
+	for (const r of records) {
+		if (r.status.failed) counts.failed++;
+		if (r.status.passedOnRetry) counts.flaky++;
+		if (r.status.skipped) counts.skipped++;
+		if (r.status.timedOut) counts.timedOut++;
+	}
+	return counts;
+}
 //#endregion
 //#region src/engine/provenance.ts
 const GENERATED_HEADER_RE = /^\s*(?:\/\/|#|\/\*)\s*(?:auto[- ]?generated|generated by|do not edit)/i;
@@ -11784,7 +12306,7 @@ function groupByRootCause(findings) {
 function correlateFindings(findings) {
 	const conclusions = [];
 	const rootCauseGroups = groupByRootCause(findings);
-	for (const [rootCause, group] of Array.from(rootCauseGroups.entries()).sort((a, b) => a[0].localeCompare(b[0]))) {
+	for (const [rootCause, group] of Array.from(rootCauseGroups.entries()).sort((a, b) => compareLocalized("en")(a[0], b[0]))) {
 		if (group.length < 2) continue;
 		const findingIds = group.map((f) => f.findingId ?? f.ruleId);
 		conclusions.push({
@@ -11796,7 +12318,7 @@ function correlateFindings(findings) {
 		});
 	}
 	const fileGroups = groupByFile(findings);
-	for (const [file, group] of Array.from(fileGroups.entries()).sort((a, b) => a[0].localeCompare(b[0]))) {
+	for (const [file, group] of Array.from(fileGroups.entries()).sort((a, b) => compareCodePoints(a[0], b[0]))) {
 		if (group.length < 2) continue;
 		const alreadyConvergent = /* @__PURE__ */ new Set();
 		for (const c of conclusions) if (c.conclusionType === "CONVERGENT") for (const id of c.findingIds) alreadyConvergent.add(id);
@@ -11868,6 +12390,11 @@ var DependencyGraph = class {
 	get size() {
 		return this.nodes.size;
 	}
+	/** Whether the graph knows this exact key. Reachability must not
+	*  treat "not in the graph" as "nothing to traverse" without saying so. */
+	has(path) {
+		return this.nodes.has(path);
+	}
 };
 function parsePackageJson(filePath) {
 	if (!existsSync(filePath)) return void 0;
@@ -11992,117 +12519,391 @@ function isIncrementalSafe(changedFiles) {
 	};
 }
 //#endregion
-//#region src/engine/monorepo-analysis.ts
-const WORTHY_THRESHOLD = 80;
-const NEEDS_WORK_THRESHOLD = 50;
-function verdictOf(score) {
-	if (score === null) return "fail";
-	if (score >= WORTHY_THRESHOLD) return "pass";
-	if (score >= NEEDS_WORK_THRESHOLD) return "warn";
-	return "fail";
-}
-function hasBlocker(findings) {
-	return findings.some((f) => f.severity === "error");
-}
+//#region src/brand/tokens.ts
 /**
-* Aggregate per-package results into an overall verdict.
+* The single source of brand truth.
 *
-* Worst-package propagation: if ANY package has a blocker (error-severity
-* finding) or a failing score, the overall result fails regardless of
-* strategy. This is the safety net — a single poisoned package must not
-* hide behind averaging.
-*/
-function analyzeMonorepo(packages, config) {
-	const results = packages.map((p) => ({
-		...p,
-		verdict: hasBlocker(p.findings) ? "fail" : verdictOf(p.score)
-	}));
-	if (results.length === 0) return {
-		packages: results,
-		overallScore: null,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy
-	};
-	const blockerPkg = results.find((r) => r.verdict === "fail" || hasBlocker(r.findings));
-	if (blockerPkg) return {
-		packages: results,
-		overallScore: blockerPkg.score,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy,
-		blockerPackage: blockerPkg.packageName
-	};
-	switch (config.weightingStrategy) {
-		case "worst-package": return worstPackageAggregation(results, config);
-		case "average": return averageAggregation(results, config);
-		case "configurable": return configurableAggregation(results, config);
-	}
-}
-function worstPackageAggregation(results, config) {
-	const firstResult = results[0];
-	if (firstResult === void 0) return {
-		packages: results,
-		overallScore: null,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy
-	};
-	let worst = firstResult;
-	for (const r of results) if ((r.score ?? 0) < (worst.score ?? 0)) worst = r;
-	return {
-		packages: results,
-		overallScore: worst.score,
-		overallVerdict: worst.verdict,
-		strategy: config.weightingStrategy,
-		...worst.verdict === "fail" ? { blockerPackage: worst.packageName } : {}
-	};
-}
-function averageAggregation(results, config) {
-	const scored = results.filter((r) => r.score !== null);
-	if (scored.length === 0) return {
-		packages: results,
-		overallScore: null,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy
-	};
-	const avg = scored.reduce((sum, r) => sum + (r.score ?? 0), 0) / scored.length;
-	return {
-		packages: results,
-		overallScore: Math.round(avg),
-		overallVerdict: verdictOf(Math.round(avg)),
-		strategy: config.weightingStrategy
-	};
-}
-function configurableAggregation(results, config) {
-	const weights = config.packageWeights ?? {};
-	let totalWeight = 0;
-	let weightedSum = 0;
-	for (const r of results) {
-		const w = weights[r.packageName] ?? 1;
-		totalWeight += w;
-		weightedSum += (r.score ?? 0) * w;
-	}
-	if (totalWeight === 0) return {
-		packages: results,
-		overallScore: null,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy
-	};
-	const score = Math.round(weightedSum / totalWeight);
-	return {
-		packages: results,
-		overallScore: score,
-		overallVerdict: verdictOf(score),
-		strategy: config.weightingStrategy
-	};
-}
-//#endregion
-//#region src/lib/fs-atomic.ts
-/**
-* Atomic file writes (audit S9).
+* Every colour, typeface and motion constant Mjölnir shows a human —
+* terminal, README SVGs, demo video, website, docs, badges — resolves to
+* a value in this file. Nothing else may define one.
 *
-* Every durability-critical write in Mjölnir (baseline, stats, badge,
-* TRIAGE.md, scaffolded rule files) used to hand-roll
-* `writeFileSync(path, data)` — a crash mid-write left a TRUNCATED file
-* at the real path, and a subsequent read (diff, badge endpoint) served
+* WHY THIS EXISTS. Before it, the palette existed in six independent
+* copies: `site/.vitepress/theme/styles/vars.css`, `NORSE` in
+* `src/reporter/theme.ts`, `scripts/readme-svg.ts`,
+* `scripts/video/terminal-page.ts`, `scripts/generate-readme-architecture.ts`
+* and the table in `assets/brand/README.md`. Exactly one pair of those
+* was guarded (site-doctor Check 8, doc ↔ vars.css). The unguarded edges
+* are where the shipped surfaces drifted apart: the terminal and the site
+* disagreed on six semantic roles, the architecture diagram invented its
+* own neutral ramp, and the README badges still carried a palette retired
+* two releases earlier. `scripts/brand-doctor.mjs` now checks every edge
+* against this file.
+*
+* PURITY. Pure data. No I/O, no rendering, no environment access, no
+* imports, no logic. Consumers convert (hex → ANSI triplet, hex → CSS)
+* themselves. Same reason `presentation.ts` is pure: it makes the whole
+* thing golden-testable and safe to ship inside the npm package, where
+* it costs a few hundred bytes and replaces values the package already
+* carried anyway.
+*
+* DERIVATION. The palette is the one derived from the logo in PR #20
+* (brushed steel and forge gold under an aurora, over midnight iron).
+* Where the terminal disagreed with it, the terminal converges — see
+* `PENDING_TERMINAL` below. Full rationale: `assets/brand/README.md`.
+*
+* ACCESSIBILITY. Every foreground token in `BRAND` meets WCAG AA
+* (≥ 4.5:1) against every surface token it is allowed to sit on. That is
+* not a claim, it is `brand-doctor` rule 8, which computes the ratios.
+* The weakest legal pairing is `steelDim` on `ink800` at 5.00:1.
+*/
+/**
+* The two brand hues plus the neutral they sit on.
+*
+* GOLD IS SCARCE. It means forged / certified / earned / decisive — the
+* primary mark, the FORGED state, one call to action. It is not a paint
+* bucket: gold as default text, default border or default heading is a
+* brand-doctor finding, not a style choice.
+*
+* AURORA is verification energy — the secondary, and the hue that marks
+* the runtime half of the trust ladder.
+*/
+const BRAND = {
+	gold: "#C19A34",
+	goldBright: "#E6BD57",
+	goldHot: "#F4DC9C",
+	/** Pressed / deepest gold — the only step dark enough to carry white. */
+	goldDeep: "#A5811C",
+	aurora: "#37ABBD",
+	auroraBright: "#45C1D4",
+	auroraCyan: "#5CBDE0",
+	/** The aurora's outer curtains: atmosphere and section identity only,
+	* never a verdict or a status. */
+	auroraGreen: "#5FD6A4",
+	auroraViolet: "#9D8CF5",
+	steel: "#C8CBCF",
+	steelDim: "#8B939D"
+};
+/**
+* Midnight iron. One ramp, four steps, darkest first.
+*
+* `terminal` and `terminalBar` share one tone deliberately: the window's
+* only seam is a hairline ring and an inset shadow, never a second fill.
+* `chromeDot` is the three window dots — see the note on
+* `PENDING_TERMINAL.chromeDots` for why they are no longer red/amber/green.
+*/
+const SURFACE = {
+	ink950: "#0A1119",
+	ink900: "#0C1420",
+	ink850: "#111A29",
+	ink800: "#18243A",
+	/** Raised panel (cards, elevated surfaces). */
+	panel: "#141F33",
+	/** Soft fill (inline code, quiet chips). */
+	soft: "#1A2740",
+	/** Terminal body — the deepest tone, so a terminal reads as recessed. */
+	terminal: "#0A1119",
+	/** Terminal title bar — the same tone; the seam is shadow, not colour. */
+	terminalBar: "#0A1119",
+	/** The three window dots. One neutral, not a traffic light. */
+	chromeDot: "#18243A"
+};
+const TEXT = {
+	primary: "#EAEEF5",
+	secondary: "#ABB6C6",
+	muted: "#8B939D",
+	/** Ink for text set ON gold (buttons, the FORGED chip). 7.17:1 on `gold`. */
+	onGold: "#0A1119"
+};
+/**
+* Non-score status. `ok` is the one green in the system and it is NOT a
+* score colour — it survives only for contexts with no worthiness
+* meaning ("autofix applied", "analysis complete"). A green score would
+* say "your software is fine", which is the exact claim this product
+* refuses to make.
+*/
+const STATUS = {
+	ok: "#4FB477",
+	info: "#5CC4E0",
+	warning: "#E6BD57",
+	error: "#EC6B66"
+};
+/**
+* The four ScoreState bands plus the unmeasured state. Band thresholds
+* and runes live in `src/reporter/presentation.ts`, which stays free of
+* colour — it emits a palette KEY and each surface resolves it here.
+*
+* `unmeasured` is steel-dim on purpose. UNKNOWN is a legitimate answer,
+* not a failure: colouring it red would make "we did not measure this"
+* look like "this is broken", which is precisely the dishonesty the
+* north-star law exists to prevent.
+*/
+const SCORE = {
+	critical: "#EC6B66",
+	warning: "#E6BD57",
+	trusted: "#5CC4E0",
+	forged: "#F4DC9C",
+	unmeasured: "#8B939D"
+};
+/**
+* E0 → E1 → E2 is a certainty ramp, and it is deliberately HUE-FREE.
+*
+* Evidence level says how sure we are, not whether the news is good. A
+* deterministic proof (E2) is a defect we are certain about — painting
+* it gold or green would read as an achievement. So certainty is carried
+* by brightness alone, and the *shape* does the real work:
+*
+*     E0  open ring        observation, no weight
+*     E1  half-filled      pattern evidence, half weight
+*     E2  sealed           deterministic proof, full weight
+*
+* Colour never carries this alone (R11): the geometry is the signal and
+* survives `--ascii`, `NO_COLOR` and monochrome print.
+*/
+const EVIDENCE = {
+	e0: "#8B939D",
+	e1: "#ABB6C6",
+	e2: "#EAEEF5"
+};
+/**
+* L0–L5, and the most important boundary in the product.
+*
+* L0–L2 are STATIC: the neutral steel ramp, brightening to the static
+* ceiling at L2. L3–L5 require a real run, and the hue changes to aurora
+* exactly there. The boundary is a hue break, not a gradient step,
+* because it is a change of kind and not of degree — a static-only
+* finding can never climb past L2, however confident it is.
+*
+* Every surface that draws the ladder must draw that break.
+*/
+const TRUST = {
+	l0: "#8B939D",
+	l1: "#ABB6C6",
+	l2: "#C8CBCF",
+	l3: "#37ABBD",
+	l4: "#45C1D4",
+	l5: "#5CC4E0"
+};
+SURFACE.ink950, SURFACE.ink900, SURFACE.ink850, SURFACE.ink800, BRAND.steel, BRAND.steelDim, BRAND.gold, BRAND.goldBright, BRAND.goldHot, BRAND.aurora, BRAND.auroraBright, BRAND.auroraCyan, BRAND.auroraGreen, BRAND.auroraViolet;
+SCORE.trusted, SCORE.forged, SCORE.warning, SCORE.critical, STATUS.info, TEXT.onGold, STATUS.ok, EVIDENCE.e0, EVIDENCE.e1, EVIDENCE.e2, TRUST.l0, TRUST.l1, TRUST.l2, TRUST.l3, TRUST.l4, TRUST.l5;
+EVIDENCE.e0, EVIDENCE.e1, EVIDENCE.e2;
+const RUNG_MEANINGS = [
+	"observation only",
+	"heuristic static",
+	"deterministic static",
+	"the finding's file executed",
+	"the finding's test executed",
+	"the run verdict corroborates"
+];
+const RUNG_COLORS = [
+	TRUST.l0,
+	TRUST.l1,
+	TRUST.l2,
+	TRUST.l3,
+	TRUST.l4,
+	TRUST.l5
+];
+RUNG_MEANINGS.map((meaning, i) => ({
+	level: `L${i}`,
+	meaning,
+	runtime: i >= 3,
+	color: RUNG_COLORS[i]
+}));
+const HEADLINES = {
+	critical: "The hammer is cracked — {n} findings break its edge.",
+	warning: "The hammer holds — but {n} findings weigh it down.",
+	trusted: "Held in worthy hands — {n} findings remain.",
+	forged: "Static score 100 — no findings on the analyzed surface.",
+	unmeasured: "No tests found — the hammer cannot be weighed."
+};
+const RUNES = {
+	critical: "ᚲ",
+	warning: "ᚦ",
+	trusted: "ᛏ",
+	forged: "ᛟ",
+	unmeasured: "ᛁ"
+};
+/**
+* The named form of the band boundaries. `report:honesty` /
+* `thresholds:parity` assert that no surface outside this module
+* re-invents a boundary; a consumer that genuinely needs one names it
+* here rather than typing the number.
+*/
+const SCORE_THRESHOLDS = {
+	/** Below this is `critical`. */
+	criticalBelow: 50,
+	/** At or above this is `trusted`. */
+	trustedAtOrAbove: 80,
+	/** The one score that is `forged`. */
+	forgedAt: 100
+};
+/**
+* Band mapping — the one mapping, every consumer: <50 critical,
+* 50–79 warning, 80–99 trusted, 100 forged, null unmeasured.
+*/
+function deriveScoreState(score) {
+	if (score === null) return {
+		score: null,
+		band: "unmeasured",
+		verdict: "UNWORTHY",
+		color: "dim",
+		powerLevel: 0,
+		headline: HEADLINES.unmeasured,
+		rune: RUNES.unmeasured
+	};
+	if (score >= SCORE_THRESHOLDS.forgedAt) return {
+		score,
+		band: "forged",
+		verdict: "FORGED",
+		color: "forged",
+		powerLevel: score,
+		headline: HEADLINES.forged,
+		rune: RUNES.forged
+	};
+	if (score >= 80) return {
+		score,
+		band: "trusted",
+		verdict: "WORTHY",
+		color: "trusted",
+		powerLevel: score,
+		headline: HEADLINES.trusted,
+		rune: RUNES.trusted
+	};
+	if (score >= 50) return {
+		score,
+		band: "warning",
+		verdict: "NEEDS WORK",
+		color: "warning",
+		powerLevel: score,
+		headline: HEADLINES.warning,
+		rune: RUNES.warning
+	};
+	return {
+		score,
+		band: "critical",
+		verdict: "UNWORTHY",
+		color: "error",
+		powerLevel: score,
+		headline: HEADLINES.critical,
+		rune: RUNES.critical
+	};
+}
+//#endregion
+//#region src/engine/monorepo-analysis.ts
+/**
+* Package verdict, derived from the one ScoreState band model (BW-104).
+* These two constants used to be a private copy of the band boundaries;
+* the numeric vocabulary here is a different projection of the same bands
+* — "pass" is trusted or forged, "warn" is warning, "fail" is critical or
+* unmeasurable — so the boundaries are read, never retyped.
+*/
+function verdictOf(score) {
+	if (score === null) return "fail";
+	const band = deriveScoreState(score).band;
+	if (band === "forged" || band === "trusted") return "pass";
+	return band === "warning" ? "warn" : "fail";
+}
+function hasBlocker(findings) {
+	return findings.some((f) => f.severity === "error");
+}
+/**
+* Aggregate per-package results into an overall verdict.
+*
+* Worst-package propagation: if ANY package has a blocker (error-severity
+* finding) or a failing score, the overall result fails regardless of
+* strategy. This is the safety net — a single poisoned package must not
+* hide behind averaging.
+*/
+function analyzeMonorepo(packages, config) {
+	const results = packages.map((p) => ({
+		...p,
+		verdict: hasBlocker(p.findings) ? "fail" : verdictOf(p.score)
+	}));
+	if (results.length === 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	const blockerPkg = results.find((r) => r.verdict === "fail" || hasBlocker(r.findings));
+	if (blockerPkg) return {
+		packages: results,
+		overallScore: blockerPkg.score,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy,
+		blockerPackage: blockerPkg.packageName
+	};
+	switch (config.weightingStrategy) {
+		case "worst-package": return worstPackageAggregation(results, config);
+		case "average": return averageAggregation(results, config);
+		case "configurable": return configurableAggregation(results, config);
+	}
+}
+function worstPackageAggregation(results, config) {
+	const firstResult = results[0];
+	if (firstResult === void 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	let worst = firstResult;
+	for (const r of results) if ((r.score ?? 0) < (worst.score ?? 0)) worst = r;
+	return {
+		packages: results,
+		overallScore: worst.score,
+		overallVerdict: worst.verdict,
+		strategy: config.weightingStrategy,
+		...worst.verdict === "fail" ? { blockerPackage: worst.packageName } : {}
+	};
+}
+function averageAggregation(results, config) {
+	const scored = results.filter((r) => r.score !== null);
+	if (scored.length === 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	const avg = scored.reduce((sum, r) => sum + (r.score ?? 0), 0) / scored.length;
+	return {
+		packages: results,
+		overallScore: Math.round(avg),
+		overallVerdict: verdictOf(Math.round(avg)),
+		strategy: config.weightingStrategy
+	};
+}
+function configurableAggregation(results, config) {
+	const weights = config.packageWeights ?? {};
+	let totalWeight = 0;
+	let weightedSum = 0;
+	for (const r of results) {
+		const w = weights[r.packageName] ?? 1;
+		totalWeight += w;
+		weightedSum += (r.score ?? 0) * w;
+	}
+	if (totalWeight === 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	const score = Math.round(weightedSum / totalWeight);
+	return {
+		packages: results,
+		overallScore: score,
+		overallVerdict: verdictOf(score),
+		strategy: config.weightingStrategy
+	};
+}
+//#endregion
+//#region src/lib/fs-atomic.ts
+/**
+* Atomic file writes (audit S9).
+*
+* Every durability-critical write in Mjölnir (baseline, stats, badge,
+* TRIAGE.md, scaffolded rule files) used to hand-roll
+* `writeFileSync(path, data)` — a crash mid-write left a TRUNCATED file
+* at the real path, and a subsequent read (diff, badge endpoint) served
 * confident nonsense from it.
 *
 * `writeFileAtomic` writes to a temp sibling, then RENAMES. On the same
@@ -12118,6 +12919,10 @@ function atomicTempPath(path) {
 }
 /**
 * Atomically replace `path` with `data`.
+*
+* Accepts binary payloads as well as text: base-tree materialization in
+* `impact` writes git blobs, and a writer that only takes strings forces those
+* call sites back to the non-atomic path rather than keeping them contained.
 */
 function writeFileAtomic(path, data, opts = {}) {
 	const dir = dirname(path);
@@ -12126,7 +12931,8 @@ function writeFileAtomic(path, data, opts = {}) {
 	let fd;
 	try {
 		fd = openSync(tmp, "wx", opts.mode ?? 420);
-		writeSync(fd, data, null, opts.encoding ?? "utf8");
+		if (typeof data === "string") writeSync(fd, data, null, opts.encoding ?? "utf8");
+		else writeSync(fd, data);
 	} finally {
 		if (fd !== void 0) closeSync(fd);
 	}
@@ -12252,304 +13058,138 @@ function hashRulesSourceTree(rules) {
 	try {
 		const hash = createHash("sha256");
 		hashDir(rulesDir, hash, 0);
-		return hash.digest("hex").slice(0, 16);
-	} catch {
-		return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
-	}
-}
-function hashDir(dir, hash, depth) {
-	if (depth > 8) return;
-	let entries;
-	try {
-		entries = readdirSync(dir, { withFileTypes: true });
-	} catch {
-		return;
-	}
-	entries.sort((a, b) => a.name.localeCompare(b.name));
-	for (const entry of entries) {
-		if (entry.name === "node_modules" || entry.name === ".git") continue;
-		const full = join(dir, entry.name);
-		if (entry.isDirectory()) hashDir(full, hash, depth + 1);
-		else if (entry.isFile() && /\.tsx?$/.test(entry.name)) try {
-			hash.update(entry.name);
-			hash.update(readFileSync(full));
-		} catch {}
-	}
-}
-/**
-* Content-addressed key for one file's rule-loop verdicts.
-*
-* Audit C1: the key MUST identify the verdict's producer, not just the
-* bytes — two files with byte-identical text (a copied spec, a generated
-* snapshot) previously shared one entry, and the first file's cached
-* findings were re-emitted for the second with the wrong `file` stamp.
-* The key therefore folds in the repo-relative path AND the adapter id,
-* plus a parse-mode token (audit W9): a file whose analysis degraded to
-* the regex fallback (or skipped the AST path) must not collide with a
-* fully-AST-analyzed verdict for the same bytes — the fallback output
-* belongs only to the fallback mode.
-*/
-function fileCacheKey(rulesDigest, fileText, identity) {
-	const parseMode = identity.parseMode ?? "ast";
-	return sha256(`${CACHE_VERSION}\u0000${rulesDigest}\u0000${identity.relPath}\u0000${identity.adapterId}\u0000${parseMode}\u0000${fileText}`);
-}
-/** No-op cache used when --cache is absent: zero stats, zero I/O. */
-const disabledScanCache = {
-	stats: {
-		hits: 0,
-		misses: 0,
-		file: ""
-	},
-	lookup: () => void 0,
-	store: () => {},
-	persist: () => {}
-};
-/**
-* Opens (and lazily creates) `<root>/.mjolnir/cache/scan-v<CACHE_VERSION>.json`. A
-* corrupt, hostile or future-versioned cache file degrades to a cold
-* cache — never fails the scan.
-*/
-function createScanCache(root) {
-	const dir = join(root, ".mjolnir", "cache");
-	const file = join(dir, `scan-v${CACHE_VERSION}.json`);
-	let entries = {};
-	let dirty = false;
-	const entryBytes = /* @__PURE__ */ new Map();
-	let totalBytes = 0;
-	try {
-		if (existsSync(file)) {
-			const stat = lstatSync(file);
-			if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_TOTAL_BYTES) throw new Error("invalid cache file");
-			entries = parseJsonFile(readFileSync(file, "utf8"), file, isCacheFile).entries;
-			for (const [k, v] of Object.entries(entries)) {
-				const size = Buffer.byteLength(JSON.stringify(v), "utf8") + k.length + 4;
-				entryBytes.set(k, size);
-				totalBytes += size;
-			}
-			if (totalBytes > MAX_TOTAL_BYTES) throw new Error("cache byte budget exceeded");
-		}
-	} catch {
-		entries = {};
-		entryBytes.clear();
-		totalBytes = 0;
-	}
-	return {
-		stats: {
-			hits: 0,
-			misses: 0,
-			file
-		},
-		lookup(key) {
-			const entry = entries[key];
-			if (!entry) {
-				this.stats.misses++;
-				return;
-			}
-			this.stats.hits++;
-			delete entries[key];
-			entries[key] = entry;
-			return structuredClone(entry.findings);
-		},
-		store(key, findings, fileBudgetExceeded) {
-			if (fileBudgetExceeded) return;
-			if (findings.length > MAX_FINDINGS_PER_ENTRY) return;
-			const entryJson = JSON.stringify(findings);
-			const newBytes = Buffer.byteLength(entryJson, "utf8") + key.length + 4;
-			if (newBytes > MAX_TOTAL_BYTES) return;
-			const replacedBytes = entryBytes.get(key) ?? 0;
-			delete entries[key];
-			entries[key] = { findings: structuredClone(findings) };
-			entryBytes.set(key, newBytes);
-			totalBytes = totalBytes - replacedBytes + newBytes;
-			let count = Object.keys(entries).length;
-			while ((count > MAX_ENTRIES$1 || totalBytes > MAX_TOTAL_BYTES) && count > 1) {
-				const oldest = Object.keys(entries)[0];
-				totalBytes -= entryBytes.get(oldest);
-				delete entries[oldest];
-				entryBytes.delete(oldest);
-				count--;
-			}
-			dirty = true;
-		},
-		persist() {
-			if (!dirty) return;
-			try {
-				mkdirSync(dir, { recursive: true });
-				writeFileAtomic(file, JSON.stringify({
-					version: CACHE_VERSION,
-					entries
-				}), { encoding: "utf8" });
-			} catch {}
-		}
-	};
-}
-//#endregion
-//#region src/brand/tokens.ts
-/**
-* The single source of brand truth.
-*
-* Every colour, typeface and motion constant Mjölnir shows a human —
-* terminal, README SVGs, demo video, website, docs, badges — resolves to
-* a value in this file. Nothing else may define one.
-*
-* WHY THIS EXISTS. Before it, the palette existed in six independent
-* copies: `site/.vitepress/theme/styles/vars.css`, `NORSE` in
-* `src/reporter/theme.ts`, `scripts/readme-svg.ts`,
-* `scripts/video/terminal-page.ts`, `scripts/generate-readme-architecture.ts`
-* and the table in `assets/brand/README.md`. Exactly one pair of those
-* was guarded (site-doctor Check 8, doc ↔ vars.css). The unguarded edges
-* are where the shipped surfaces drifted apart: the terminal and the site
-* disagreed on six semantic roles, the architecture diagram invented its
-* own neutral ramp, and the README badges still carried a palette retired
-* two releases earlier. `scripts/brand-doctor.mjs` now checks every edge
-* against this file.
-*
-* PURITY. Pure data. No I/O, no rendering, no environment access, no
-* imports, no logic. Consumers convert (hex → ANSI triplet, hex → CSS)
-* themselves. Same reason `score-state.ts` is pure: it makes the whole
-* thing golden-testable and safe to ship inside the npm package, where
-* it costs a few hundred bytes and replaces values the package already
-* carried anyway.
-*
-* DERIVATION. The palette is the one derived from the logo in PR #20
-* (brushed steel and forge gold under an aurora, over midnight iron).
-* Where the terminal disagreed with it, the terminal converges — see
-* `PENDING_TERMINAL` below. Full rationale: `assets/brand/README.md`.
-*
-* ACCESSIBILITY. Every foreground token in `BRAND` meets WCAG AA
-* (≥ 4.5:1) against every surface token it is allowed to sit on. That is
-* not a claim, it is `brand-doctor` rule 8, which computes the ratios.
-* The weakest legal pairing is `steelDim` on `ink800` at 5.00:1.
-*/
-/**
-* The two brand hues plus the neutral they sit on.
-*
-* GOLD IS SCARCE. It means forged / certified / earned / decisive — the
-* primary mark, the FORGED state, one call to action. It is not a paint
-* bucket: gold as default text, default border or default heading is a
-* brand-doctor finding, not a style choice.
-*
-* AURORA is verification energy — the secondary, and the hue that marks
-* the runtime half of the trust ladder.
-*/
-const BRAND = {
-	gold: "#C19A34",
-	goldBright: "#E6BD57",
-	goldHot: "#F4DC9C",
-	/** Pressed / deepest gold — the only step dark enough to carry white. */
-	goldDeep: "#A5811C",
-	aurora: "#37ABBD",
-	auroraBright: "#45C1D4",
-	auroraCyan: "#5CBDE0",
-	/** The aurora's outer curtains: atmosphere and section identity only,
-	* never a verdict or a status. */
-	auroraGreen: "#5FD6A4",
-	auroraViolet: "#9D8CF5",
-	steel: "#C8CBCF",
-	steelDim: "#8B939D"
-};
-/**
-* Midnight iron. One ramp, four steps, darkest first.
-*
-* `terminal` and `terminalBar` share one tone deliberately: the window's
-* only seam is a hairline ring and an inset shadow, never a second fill.
-* `chromeDot` is the three window dots — see the note on
-* `PENDING_TERMINAL.chromeDots` for why they are no longer red/amber/green.
-*/
-const SURFACE = {
-	ink950: "#0A1119",
-	ink900: "#0C1420",
-	ink850: "#111A29",
-	ink800: "#18243A",
-	/** Raised panel (cards, elevated surfaces). */
-	panel: "#141F33",
-	/** Soft fill (inline code, quiet chips). */
-	soft: "#1A2740",
-	/** Terminal body — the deepest tone, so a terminal reads as recessed. */
-	terminal: "#0A1119",
-	/** Terminal title bar — the same tone; the seam is shadow, not colour. */
-	terminalBar: "#0A1119",
-	/** The three window dots. One neutral, not a traffic light. */
-	chromeDot: "#18243A"
-};
-const TEXT = {
-	primary: "#EAEEF5",
-	secondary: "#ABB6C6",
-	muted: "#8B939D",
-	/** Ink for text set ON gold (buttons, the FORGED chip). 7.17:1 on `gold`. */
-	onGold: "#0A1119"
-};
-/**
-* Non-score status. `ok` is the one green in the system and it is NOT a
-* score colour — it survives only for contexts with no worthiness
-* meaning ("autofix applied", "analysis complete"). A green score would
-* say "your software is fine", which is the exact claim this product
-* refuses to make.
-*/
-const STATUS = {
-	ok: "#4FB477",
-	info: "#5CC4E0",
-	warning: "#E6BD57",
-	error: "#EC6B66"
-};
-/**
-* The four ScoreState bands plus the unmeasured state. Band thresholds
-* and runes live in `src/reporter/score-state.ts`, which stays free of
-* colour — it emits a palette KEY and each surface resolves it here.
-*
-* `unmeasured` is steel-dim on purpose. UNKNOWN is a legitimate answer,
-* not a failure: colouring it red would make "we did not measure this"
-* look like "this is broken", which is precisely the dishonesty the
-* north-star law exists to prevent.
-*/
-const SCORE = {
-	critical: "#EC6B66",
-	warning: "#E6BD57",
-	trusted: "#5CC4E0",
-	forged: "#F4DC9C",
-	unmeasured: "#8B939D"
-};
+		return hash.digest("hex").slice(0, 16);
+	} catch {
+		return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
+	}
+}
+function hashDir(dir, hash, depth) {
+	if (depth > 8) return;
+	let entries;
+	try {
+		entries = readdirSync(dir, { withFileTypes: true });
+	} catch {
+		recordDegradation("rules-tree-listing-unreadable");
+		return;
+	}
+	entries.sort((a, b) => compareCodePoints(a.name, b.name));
+	for (const entry of entries) {
+		if (entry.name === "node_modules" || entry.name === ".git") continue;
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) hashDir(full, hash, depth + 1);
+		else if (entry.isFile() && /\.tsx?$/.test(entry.name)) try {
+			hash.update(entry.name);
+			hash.update(readFileSync(full));
+		} catch {}
+	}
+}
 /**
-* E0 → E1 → E2 is a certainty ramp, and it is deliberately HUE-FREE.
-*
-* Evidence level says how sure we are, not whether the news is good. A
-* deterministic proof (E2) is a defect we are certain about — painting
-* it gold or green would read as an achievement. So certainty is carried
-* by brightness alone, and the *shape* does the real work:
-*
-*     E0  open ring        observation, no weight
-*     E1  half-filled      pattern evidence, half weight
-*     E2  sealed           deterministic proof, full weight
+* Content-addressed key for one file's rule-loop verdicts.
 *
-* Colour never carries this alone (R11): the geometry is the signal and
-* survives `--ascii`, `NO_COLOR` and monochrome print.
+* Audit C1: the key MUST identify the verdict's producer, not just the
+* bytes — two files with byte-identical text (a copied spec, a generated
+* snapshot) previously shared one entry, and the first file's cached
+* findings were re-emitted for the second with the wrong `file` stamp.
+* The key therefore folds in the repo-relative path AND the adapter id,
+* plus a parse-mode token (audit W9): a file whose analysis degraded to
+* the regex fallback (or skipped the AST path) must not collide with a
+* fully-AST-analyzed verdict for the same bytes — the fallback output
+* belongs only to the fallback mode.
 */
-const EVIDENCE = {
-	e0: "#8B939D",
-	e1: "#ABB6C6",
-	e2: "#EAEEF5"
+function fileCacheKey(rulesDigest, fileText, identity) {
+	const parseMode = identity.parseMode ?? "ast";
+	return sha256(`${CACHE_VERSION}\u0000${rulesDigest}\u0000${identity.relPath}\u0000${identity.adapterId}\u0000${parseMode}\u0000${fileText}`);
+}
+/** No-op cache used when --cache is absent: zero stats, zero I/O. */
+const disabledScanCache = {
+	stats: {
+		hits: 0,
+		misses: 0,
+		file: ""
+	},
+	lookup: () => void 0,
+	store: () => {},
+	persist: () => {}
 };
 /**
-* L0–L5, and the most important boundary in the product.
-*
-* L0–L2 are STATIC: the neutral steel ramp, brightening to the static
-* ceiling at L2. L3–L5 require a real run, and the hue changes to aurora
-* exactly there. The boundary is a hue break, not a gradient step,
-* because it is a change of kind and not of degree — a static-only
-* finding can never climb past L2, however confident it is.
-*
-* Every surface that draws the ladder must draw that break.
+* Opens (and lazily creates) `<root>/.mjolnir/cache/scan-v<CACHE_VERSION>.json`. A
+* corrupt, hostile or future-versioned cache file degrades to a cold
+* cache — never fails the scan.
 */
-const TRUST = {
-	l0: "#8B939D",
-	l1: "#ABB6C6",
-	l2: "#C8CBCF",
-	l3: "#37ABBD",
-	l4: "#45C1D4",
-	l5: "#5CC4E0"
-};
-SURFACE.ink950, SURFACE.ink900, SURFACE.ink850, SURFACE.ink800, BRAND.steel, BRAND.steelDim, BRAND.gold, BRAND.goldBright, BRAND.goldHot, BRAND.aurora, BRAND.auroraBright, BRAND.auroraCyan, BRAND.auroraGreen, BRAND.auroraViolet;
-SCORE.trusted, SCORE.forged, SCORE.warning, SCORE.critical, STATUS.info, TEXT.onGold, STATUS.ok, EVIDENCE.e0, EVIDENCE.e1, EVIDENCE.e2, TRUST.l0, TRUST.l1, TRUST.l2, TRUST.l3, TRUST.l4, TRUST.l5;
+function createScanCache(root) {
+	const dir = join(root, ".mjolnir", "cache");
+	const file = join(dir, `scan-v${CACHE_VERSION}.json`);
+	let entries = {};
+	let dirty = false;
+	const entryBytes = /* @__PURE__ */ new Map();
+	let totalBytes = 0;
+	try {
+		if (existsSync(file)) {
+			const stat = lstatSync(file);
+			if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_TOTAL_BYTES) throw new Error("invalid cache file");
+			entries = parseJsonFile(readFileSync(file, "utf8"), file, isCacheFile).entries;
+			for (const [k, v] of Object.entries(entries)) {
+				const size = Buffer.byteLength(JSON.stringify(v), "utf8") + k.length + 4;
+				entryBytes.set(k, size);
+				totalBytes += size;
+			}
+			if (totalBytes > MAX_TOTAL_BYTES) throw new Error("cache byte budget exceeded");
+		}
+	} catch {
+		entries = {};
+		entryBytes.clear();
+		totalBytes = 0;
+	}
+	return {
+		stats: {
+			hits: 0,
+			misses: 0,
+			file
+		},
+		lookup(key) {
+			const entry = entries[key];
+			if (!entry) {
+				this.stats.misses++;
+				return;
+			}
+			this.stats.hits++;
+			delete entries[key];
+			entries[key] = entry;
+			return structuredClone(entry.findings);
+		},
+		store(key, findings, fileBudgetExceeded) {
+			if (fileBudgetExceeded) return;
+			if (findings.length > MAX_FINDINGS_PER_ENTRY) return;
+			const entryJson = JSON.stringify(findings);
+			const newBytes = Buffer.byteLength(entryJson, "utf8") + key.length + 4;
+			if (newBytes > MAX_TOTAL_BYTES) return;
+			const replacedBytes = entryBytes.get(key) ?? 0;
+			delete entries[key];
+			entries[key] = { findings: structuredClone(findings) };
+			entryBytes.set(key, newBytes);
+			totalBytes = totalBytes - replacedBytes + newBytes;
+			let count = Object.keys(entries).length;
+			while ((count > MAX_ENTRIES$1 || totalBytes > MAX_TOTAL_BYTES) && count > 1) {
+				const oldest = Object.keys(entries)[0];
+				totalBytes -= entryBytes.get(oldest);
+				delete entries[oldest];
+				entryBytes.delete(oldest);
+				count--;
+			}
+			dirty = true;
+		},
+		persist() {
+			if (!dirty) return;
+			try {
+				mkdirSync(dir, { recursive: true });
+				writeFileAtomic(file, JSON.stringify({
+					version: CACHE_VERSION,
+					entries
+				}), { encoding: "utf8" });
+			} catch {}
+		}
+	};
+}
 //#endregion
 //#region src/reporter/theme.ts
 /**
@@ -12565,8 +13205,8 @@ SCORE.trusted, SCORE.forged, SCORE.warning, SCORE.critical, STATUS.info, TEXT.on
 *
 * Symbols always accompany color (color-blind safe, R11).
 *
-* Score-state colors come from ScoreState (score-state.ts) — the single
-* source of truth shared with the badge and (P2) the web.
+* Score-state colors come from ScoreState (presentation.ts) — the single
+* source of truth shared with the badge, the dashboard and the site.
 *
 * Terminal robustness (Master-Stabilization-Plan Sprint 5 Task 22):
 * box-drawing/gauge helpers accept an explicit width so callers can
@@ -13729,7 +14369,7 @@ function runForensics(target, options = {}) {
 		const base = stat.isFile() ? dirname(target) : target;
 		flakyMdPath = join(base, "FLAKY.md");
 		try {
-			writeFileSync(flakyMdPath, renderFlakyMd(report));
+			writeFileAtomic(flakyMdPath, renderFlakyMd(report));
 		} catch {
 			flakyMdPath = void 0;
 		}
@@ -13831,11 +14471,11 @@ function listFiles(dir) {
 	return out.map((p) => p);
 }
 plainContext();
-function loadSuppressions(root) {
+function loadSuppressions(root, now = /* @__PURE__ */ new Date()) {
 	const { config } = loadConfig(root);
 	const entries = (config.ignore ?? []).map((ign) => ({
 		...ign,
-		status: isSuppressionActive(ign, /* @__PURE__ */ new Date()) ? "active" : "expired"
+		status: isSuppressionActive(ign, now) ? "active" : "expired"
 	}));
 	return {
 		total: entries.length,
@@ -14568,6 +15208,7 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 	let rulesPartial = false;
 	let parseFailed = 0;
 	let parseFallbacks = 0;
+	let astFallbackFiles = 0;
 	let scanned = 0;
 	let analyzed = 0;
 	for (const path of testFiles) {
@@ -14593,8 +15234,6 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 			skippedFiles++;
 			continue;
 		}
-		let fileBudgetExceeded = false;
-		let fileRuleFailed = false;
 		const relPath = relative(workspace.root, path).replaceAll("\\", "/");
 		if (!isCiAdapter) {
 			const lang = {
@@ -14613,6 +15252,10 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 			});
 		}
 		const wantsAst = adapter.parseAst !== void 0 && Date.now() <= deadline;
+		if (adapter.parseAst !== void 0 && !wantsAst) {
+			truncationReasons.add("ast-budget-fallback");
+			astFallbackFiles++;
+		}
 		const identity = (mode) => ({
 			relPath,
 			adapterId: adapter.id,
@@ -14620,79 +15263,106 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 		});
 		let cacheKey = fileCacheKey(rulesDigest, text, identity(wantsAst ? "ast" : "regex"));
 		const cachedFindings = cache.lookup(cacheKey);
-		if (cachedFindings) {
-			for (const f of cachedFindings) findings.push(f);
-			analyzed++;
-			continue;
-		}
-		hooks.onProgress?.({
-			phase: "parse",
-			done: scanned,
-			total: testFiles.length,
-			detail: relPath
-		});
-		const parsedFile = {
-			path: relPath,
-			text
-		};
-		let parsed;
-		const findingsStart = findings.length;
-		try {
-			if (adapter.parseAst && wantsAst) {
-				hooks.onProgress?.({
-					phase: "rules",
-					done: scanned,
-					total: testFiles.length,
-					detail: relPath
-				});
-				parsed = await adapter.parseAst(parsedFile);
-			}
-			const actualMode = parsed ? "ast" : "regex";
-			if (wantsAst && actualMode === "regex") {
-				parseFallbacks++;
-				cacheKey = fileCacheKey(rulesDigest, text, identity(actualMode));
-				const fallbackFindings = cache.lookup(cacheKey);
-				if (fallbackFindings) {
-					for (const f of fallbackFindings) findings.push(f);
-					analyzed++;
-					continue;
+		const executor = createExecutor("sequential", 1, async (job) => {
+			if (job.cacheHit !== void 0) return {
+				path: job.path,
+				status: "CACHE_HIT",
+				findings: [...job.cacheHit],
+				parseFallback: false
+			};
+			let parseFallback = false;
+			let fileRuleFailed = false;
+			let fileBudgetExceeded = false;
+			let parsedAst;
+			try {
+				if (adapter.parseAst && job.wantsAst) {
+					hooks.onProgress?.({
+						phase: "rules",
+						done: scanned,
+						total: testFiles.length,
+						detail: job.path
+					});
+					parsedAst = await adapter.parseAst({
+						path: job.path,
+						text: job.text
+					});
 				}
-			}
-			const fileForRules = parsed ? {
-				...parsedFile,
-				ast: parsed.ast
-			} : parsedFile;
-			adapter.runRules(activeRules, fileForRules, (f, ruleId, category) => {
-				if (!isValidFindingRecord(f)) {
-					fileRuleFailed = true;
-					onRuleCrash?.(ruleId, relPath, /* @__PURE__ */ new Error(`malformed finding record rejected (severity/line/message must be present, severity ∈ error|warning|info): ${JSON.stringify(f)}`));
-					return;
+				const actualMode = parsedAst ? "ast" : "regex";
+				if (job.wantsAst && actualMode === "regex") {
+					parseFallback = true;
+					parseFallbacks++;
+					cacheKey = fileCacheKey(rulesDigest, job.text, identity(actualMode));
+					const fallbackFindings = cache.lookup(cacheKey);
+					if (fallbackFindings) return {
+						path: job.path,
+						status: "CACHE_HIT",
+						findings: [...fallbackFindings],
+						parseFallback: true
+					};
 				}
-				findings.push({
-					...f,
-					ruleId,
-					category
+				const fileForRules = parsedAst ? {
+					path: job.path,
+					text: job.text,
+					ast: parsedAst.ast
+				} : {
+					path: job.path,
+					text: job.text
+				};
+				const produced = [];
+				adapter.runRules(activeRules, fileForRules, (f, ruleId, category) => {
+					if (!isValidFindingRecord(f)) {
+						fileRuleFailed = true;
+						onRuleCrash?.(ruleId, job.path, /* @__PURE__ */ new Error(`malformed finding record rejected (severity/line/message must be present, severity ∈ error|warning|info): ${JSON.stringify(f)}`));
+						return;
+					}
+					produced.push({
+						...f,
+						ruleId,
+						category
+					});
+				}, (ruleId, error) => {
+					fileRuleFailed = true;
+					onRuleCrash?.(ruleId, job.path, error);
+				}, {
+					deadline: Math.min(deadline, Date.now() + LIMITS$1.maxFileAnalysisMs),
+					onExceeded: () => {
+						rulesPartial = true;
+						skippedFiles++;
+						truncationReasons.add("file-budget");
+						fileBudgetExceeded = true;
+					}
 				});
-			}, (ruleId, error) => {
-				fileRuleFailed = true;
-				onRuleCrash?.(ruleId, relPath, error);
-			}, {
-				deadline: Math.min(deadline, Date.now() + LIMITS$1.maxFileAnalysisMs),
-				onExceeded: () => {
-					rulesPartial = true;
-					skippedFiles++;
-					truncationReasons.add("file-budget");
-					fileBudgetExceeded = true;
-				}
-			});
-			if (!fileRuleFailed && !fileBudgetExceeded) analyzed++;
-			if (!fileRuleFailed) cache.store(cacheKey, findings.slice(findingsStart), fileBudgetExceeded);
-		} catch {
-			if (wantsAst) parseFallbacks++;
-			skippedFiles++;
-			parseFailed++;
-		} finally {
-			parsed?.dispose();
+				if (!fileRuleFailed && !fileBudgetExceeded) analyzed++;
+				if (!fileRuleFailed) cache.store(cacheKey, produced, fileBudgetExceeded);
+				return {
+					path: job.path,
+					status: "OK",
+					findings: produced,
+					parseFallback
+				};
+			} catch {
+				if (job.wantsAst) parseFallbacks++;
+				skippedFiles++;
+				parseFailed++;
+				return {
+					path: job.path,
+					status: "FAILED",
+					findings: [],
+					parseFallback
+				};
+			} finally {
+				parsedAst?.dispose();
+			}
+		});
+		const outcome = (await executeFiles([{
+			path: relPath,
+			text,
+			wantsAst,
+			...cachedFindings !== void 0 ? { cacheHit: cachedFindings } : {}
+		}], executor))[0];
+		if (outcome?.status === "CACHE_HIT" || outcome?.status === "OK") {
+			for (const f of outcome.findings) findings.push(f);
+			if (cachedFindings !== void 0 && outcome.status === "CACHE_HIT") analyzed++;
 		}
 	}
 	return {
@@ -14703,7 +15373,8 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 		parseFailed,
 		parseFallbacks,
 		scanned,
-		analyzed
+		analyzed,
+		astFallbackFiles
 	};
 }
 /**
@@ -14783,12 +15454,16 @@ function applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, dec
 	const runtimeReportPath = discoveredReport?.path;
 	const runtimeIncomplete = discoveredReport !== void 0 && discoveredReport.report.analysisComplete !== true;
 	let forensicVerdicts;
+	let evidenceRecords = [];
 	if (discoveredReport && discoveredReport.report.analysisComplete === true) try {
-		buildEvidenceRecords(discoveredReport.report, discoveredReport.path);
+		evidenceRecords = buildEvidenceRecords(discoveredReport.report, discoveredReport.path);
 		stampRuntimeCorroboration(findings, discoveredReport.report, workspace.root);
 		forensicVerdicts = summarizeForensicVerdicts(discoveredReport.report);
-	} catch {}
+	} catch {
+		evidenceRecords = [];
+	}
 	return {
+		evidenceRecords,
 		testDeclarationCount,
 		scopeInfo,
 		suppressionCount,
@@ -14927,10 +15602,14 @@ function assembleScanResult(o) {
 		scopeUnrecognized: o.scopeUnrecognized,
 		parseFailed: o.parseFailed,
 		parseFallbacks: o.parseFallbacks ?? 0,
+		...o.astFallbackFiles !== void 0 ? { astFallbackFiles: o.astFallbackFiles } : {},
+		...o.degradations !== void 0 ? { degradations: o.degradations } : {},
 		...o.scopeInfo.degraded !== void 0 ? { scopeDegraded: o.scopeInfo.degraded } : {},
 		...o.runtimeIncomplete !== void 0 ? { runtimeIncomplete: o.runtimeIncomplete } : {},
 		identityIncomplete
 	});
+	const repository = bindRepository(o.scanRoot.root);
+	const candidate = readCandidateBinding(o.scanRoot.root);
 	const runIdentity = buildRunIdentity({
 		files: inputSnapshot,
 		rules: [...o.REVISION_BY_RULE_ID.entries()].map(([id, detectorRevision]) => ({
@@ -14943,9 +15622,17 @@ function assembleScanResult(o) {
 		trustModelVersion: TRUST_MODEL_VERSION,
 		scoringModelVersion: SCORING_MODEL_VERSION,
 		frameworkSupportMatrixVersion: FRAMEWORK_SUPPORT_MATRIX_VERSION,
-		evidenceSchemaVersions: [1]
+		evidenceSchemaVersions: [1],
+		...repository,
+		...candidate !== null ? { candidate } : {}
+	});
+	const evidenceGraph = buildEvidenceGraph({
+		runId: runIdentity,
+		...candidate !== null ? { candidate: {
+			manifestId: candidate.manifestId,
+			candidateSha: candidate.candidateSha
+		} } : {}
 	});
-	const evidenceGraph = buildEvidenceGraph({ runId: runIdentity });
 	const hasTests = o.testFileCount > 0 && o.testDeclarationCount > 0;
 	const suiteInvalidatedBy = [...new Set(o.findings.filter((f) => SUITE_INVALIDATING_RULE_IDS.has(f.ruleId)).map((f) => f.ruleId))].sort();
 	const finalScore = hasTests ? completion.partial && scopeAdjustedTotal >= 100 ? 99 : scopeAdjustedTotal : null;
@@ -14955,6 +15642,11 @@ function assembleScanResult(o) {
 		scopeIntegrity,
 		runIdentity,
 		evidenceGraph,
+		evidence: {
+			records: o.evidenceRecords ?? [],
+			counts: countEvidence(o.evidenceRecords ?? []),
+			artifact: o.runtimeReportPath ?? null
+		},
 		score: finalScore,
 		...hasTests ? {} : { reason: "no-tests-found" },
 		frameworks: o.frameworks.frameworks,
@@ -15030,13 +15722,15 @@ function assembleScanResult(o) {
 */
 async function runScan(args, hooks = {}) {
 	const started = Date.now();
+	const degradationWindow = beginDegradationWindow();
 	const requestedDuration = Number.isFinite(args.maxDurationMs) ? args.maxDurationMs : DEFAULT_MAX_DURATION_MS$1;
 	const deadline = started + Math.min(Math.max(1, requestedDuration), MAX_DURATION_MS$1);
 	const discovered = discoverWorkspace(args.target);
 	const targetAbs = resolve(args.target);
 	const scanRoot = discovered && discovered.root !== targetAbs && targetAbs.startsWith(discovered.root + sep) ? {
 		...discovered,
-		root: targetAbs
+		root: targetAbs,
+		packageJson: {}
 	} : discovered ?? fallbackWorkspace(targetAbs);
 	const workspace = scanRoot;
 	if (args.verbose) hooks.onConfigWarning?.(`verbose: scan root (config/ignore anchor): ${workspace.root}`);
@@ -15121,6 +15815,7 @@ async function runScan(args, hooks = {}) {
 	rulesPartial = analysis.rulesPartial;
 	parseFailed = analysis.parseFailed;
 	const parseFallbacks = analysis.parseFallbacks;
+	const astFallbackFiles = analysis.astFallbackFiles;
 	const scanned = analysis.scanned;
 	const analyzed = analysis.analyzed;
 	const postScan = applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, declarationsByFile, testDeclarationCount, tierByRuleId, REVISION_BY_RULE_ID);
@@ -15139,6 +15834,8 @@ async function runScan(args, hooks = {}) {
 		scopeUnrecognized,
 		parseFailed,
 		parseFallbacks,
+		astFallbackFiles,
+		degradations: summarizeDegradations(degradationsSince(degradationWindow)),
 		scanned,
 		analyzed,
 		testFiles,
@@ -15165,6 +15862,39 @@ async function runScan(args, hooks = {}) {
 	resetTsMorphProject();
 	return result;
 }
+//#endregion
+//#region src/cli-io.ts
+/**
+* The ONE error-to-message derivation in `src/`.
+*
+* This tree carried four near-copies: two `errorMessage` (byte-identical) and
+* two `errorText`. The two `errorText` copies were not identical, which is the
+* part that mattered — `String(someObject)` renders `[object Object]`, so the
+* copy that lost the payload turned a hostile non-Error throw into a message
+* that names nothing. The richer arms are kept here, so every call site gets
+* the informative one and the difference stops being a per-file accident.
+*
+* The arms, in order:
+*   Error            -> `.message`. The 99% case, and the only one that
+*                       carries a stack the caller may still want.
+*   string           -> itself. A thrown string is already the message.
+*   plain object     -> `JSON.stringify`. A non-Error throw of `{ code:
+*                       "EISDIR" }` is a REAL failure shape in Node, and
+*                       `[object Object]` hides the only field that says
+*                       what went wrong.
+*   anything else    -> `String(err)`. Symbols and undefined included, so
+*                       nothing vanishes.
+*
+* The call this replaces was `err instanceof Error ? err.message : String(err)`
+* in `src/mcp/server.ts` and `src/commands/doctor.ts`; `tests/cli/summary.spec.ts`
+* already pins the object arm.
+*/
+function errorMessage(err) {
+	if (err instanceof Error) return err.message;
+	if (typeof err === "string") return err;
+	if (typeof err === "object" && err !== null) return JSON.stringify(err);
+	return String(err);
+}
 /**
 * Fields that participate in the verification digest: identity (ruleId,
 * detectorRevision, file, line, column) + evidence (severity,
@@ -15317,6 +16047,11 @@ function explainRule(ruleId, fixturesRoot) {
 		ok: false,
 		error: `Unknown rule ID "${ruleId}". Run \`mjolnir rules\` for the full catalog.`
 	};
+	const window = beginDegradationWindow();
+	const degraded = () => {
+		const counts = summarizeDegradations(degradationsSince(window));
+		return counts.length > 0 ? { exampleDegraded: counts } : {};
+	};
 	const fixturePath = firstFixtureFile(join(fixturesRoot, ruleId, "must-fire"));
 	if (!fixturePath) return {
 		ok: true,
@@ -15326,9 +16061,11 @@ function explainRule(ruleId, fixturesRoot) {
 	try {
 		text = readFileSync(fixturePath, "utf8").replace(/\r\n/g, "\n");
 	} catch {
+		recordDegradation("explain-fixture-unreadable");
 		return {
 			ok: true,
-			rule
+			rule,
+			...degraded()
 		};
 	}
 	const normalizedPath = fixturePath.replaceAll("\\", "/");
@@ -15338,9 +16075,11 @@ function explainRule(ruleId, fixturesRoot) {
 		else try {
 			ast = isAzurePipelineFixture(normalizedPath) ? parseAzurePipeline(text) : parseWorkflow(text);
 		} catch {
+			recordDegradation("explain-workflow-parse-failed");
 			return {
 				ok: true,
-				rule
+				rule,
+				...degraded()
 			};
 		}
 	}
@@ -15357,9 +16096,11 @@ function explainRule(ruleId, fixturesRoot) {
 			codeText
 		});
 	} catch {
+		recordDegradation("explain-rule-crash");
 		return {
 			ok: true,
-			rule
+			rule,
+			...degraded()
 		};
 	}
 	const example = findings[0];
@@ -16120,15 +16861,11 @@ async function handleToolCall(call) {
 			id: call.id,
 			error: {
 				code: MCP_ERRORS.INTERNAL,
-				message: errorMessage$1(err)
+				message: errorMessage(err)
 			}
 		};
 	}
 }
-/** Normalize any thrown value to a string (unit-tested both arms). */
-function errorMessage$1(err) {
-	return err instanceof Error ? err.message : String(err);
-}
 /** JSON-RPC request shape validation (strict — §21). */
 function validateRequest(msg) {
 	if (typeof msg !== "object" || msg === null) return {
@@ -16231,14 +16968,6 @@ async function handleMcpMessage(msg) {
 	};
 }
 //#endregion
-//#region src/cli-io.ts
-/**
-* The single error-to-message derivation shared by every catch site:
-* Error instances render their message; anything else is stringified
-* honestly (a hostile non-Error throw must surface, not vanish).
-*/
-const errorMessage = (err) => err instanceof Error ? err.message : String(err);
-//#endregion
 //#region src/mcp/transport.ts
 /**
 * MCP stdio transport loop (blueprint §21 — the framing around the
@@ -16337,6 +17066,133 @@ async function handleStdioLine(line, write) {
 	write(`${JSON.stringify(response)}\n`);
 }
 //#endregion
+//#region src/integrations/sentry.ts
+/**
+* Sentry crash reporting — opt-in, and inert unless a DSN is configured.
+*
+* Why opt-in: Mjölnir ships as an `npx` CLI over other people's private
+* repositories. A tool that reads a codebase must never phone home on its
+* own, so the ONLY switch is an explicit `SENTRY_DSN` in the environment.
+* Absent that, every function here returns immediately and `@sentry/node` is
+* never imported — zero network, zero added startup cost on a path whose
+* whole selling point is scan speed.
+*
+* Why an optional peer dependency: `@sentry/node` is ~1.5 MB unpacked and
+* nothing in a code scanner needs it. Making it a hard `dependency` would
+* tax every install for a feature most users never turn on, so it is an
+* optional peer: installs on request (`npm i @sentry/node`), absent by
+* default, and a missing module is handled as "reporting unavailable"
+* rather than as a crash.
+*
+* Capture points are deliberately the two EXISTING top-level catch blocks
+* (cli.ts entry, mcp/stdio.ts) rather than `process.on("uncaughtException")`
+* / `("unhandledRejection")` handlers. Registering those would silently
+* change the CLI's frozen exit-code contract (§24.1) and could keep a
+* process alive after a fatal error. One capture point per surface is
+* enough to answer "did Mjölnir itself break, and where".
+*
+* What is deliberately NOT sent: no user data (`sendDefaultPii: false`), no
+* traced request/span data (`tracesSampleRate: 0` — a batch CLI has no
+* request to trace), no console breadcrumbs, and no scan findings or file
+* contents. Events carry the error, its stack, the release, and the surface
+* that raised it.
+*/
+/** The loaded SDK, or null while reporting is off/unavailable. */
+let sdk = null;
+/**
+* Flush budget for the process-exit paths. Long enough for one HTTPS
+* envelope on a slow link, short enough that a broken network cannot turn
+* a crashed CLI into a hung one. Sentry's own default is 2s.
+*/
+const FLUSH_TIMEOUT_MS = 2e3;
+/** Writes a diagnostic without touching stdout. */
+function warn(message) {
+	process.stderr.write(`mjolnir: sentry — ${message}\n`);
+}
+/**
+* The release name Sentry groups events under. Matches the npm package
+* name so a release created from a tag and a release reported by the SDK
+* are the same release, not two half-populated ones.
+*/
+const SENTRY_RELEASE = `mjolnir-qa@${ENGINE_VERSION}`;
+/**
+* Resolve the environment tag. Unset means "a developer's machine" unless
+* CI says otherwise: a `npx` run is not a production event, and filing
+* those under `production` would poison the issue stream with noise from
+* end users triaging their own repos.
+*/
+function resolveEnvironment() {
+	const fromEnv = process.env.SENTRY_ENVIRONMENT?.trim();
+	if (fromEnv) return fromEnv;
+	return process.env.CI ? "ci" : "local";
+}
+/**
+* Turn reporting on if — and only if — a DSN is configured. Safe to call
+* from every entry point: the second call is a no-op that returns the
+* already-decided answer, so a process that reaches two surfaces cannot
+* initialize the SDK twice.
+*
+* Returns true when reporting is live. Never throws: a monitoring
+* integration that can take down the tool it monitors has failed at its
+* one job.
+*/
+async function initSentry() {
+	if (sdk) return true;
+	const dsn = process.env.SENTRY_DSN?.trim();
+	if (!dsn) return false;
+	let loaded;
+	try {
+		loaded = await import("@sentry/node");
+	} catch {
+		warn("SENTRY_DSN is set but @sentry/node is not installed. Install it with: npm install @sentry/node");
+		return false;
+	}
+	try {
+		loaded.init({
+			dsn,
+			release: SENTRY_RELEASE,
+			environment: resolveEnvironment(),
+			tracesSampleRate: 0,
+			sendDefaultPii: false,
+			attachStacktrace: true
+		});
+	} catch (error) {
+		warn(`SDK init failed (${error instanceof Error ? error.message : String(error)}). Crash reporting stays off.`);
+		return false;
+	}
+	sdk = loaded;
+	return true;
+}
+/**
+* Report one fatal error. `surface` names the entry point that raised it
+* ("cli" or "mcp") so the issue stream can be split by how Mjölnir was
+* being used when it broke. A non-Error throw is reported as-is rather
+* than dropped: a hostile throw value is exactly the case worth seeing.
+*/
+function captureInternalError(error, surface) {
+	if (!sdk) return;
+	try {
+		sdk.captureException(error, { tags: { surface } });
+	} catch (captureError) {
+		warn(`capture failed (${captureError instanceof Error ? captureError.message : String(captureError)}).`);
+	}
+}
+/**
+* Deliver anything buffered before the process exits. Awaits the SDK's
+* own transport drain and returns whether the envelope was handed off;
+* the caller is on an exit path, so the answer is deliberately not
+* surfaced as a failure — a lost crash report must not change the exit
+* code a caller (or CI) is about to read.
+*/
+async function flushSentry(timeoutMs = FLUSH_TIMEOUT_MS) {
+	if (!sdk) return false;
+	try {
+		return await sdk.flush(timeoutMs);
+	} catch {
+		return false;
+	}
+}
+//#endregion
 //#region src/mcp/stdio.ts
 /**
 * The standalone MCP stdio binary (blueprint §21), built to
@@ -16355,9 +17211,14 @@ async function handleStdioLine(line, write) {
 * subprocess coverage cannot merge into the parent istanbul report,
 * same class as dist/**), so it is excluded from the coverage ratchet.
 */
-runStdioTransport(process.stdin, process.stdout).then(() => process.exit(0)).catch((err) => {
+initSentry();
+runStdioTransport(process.stdin, process.stdout).then(() => process.exit(0)).catch(async (err) => {
+	captureInternalError(err, "mcp");
+	await flushSentry();
 	process.stderr.write(`mjolnir mcp fatal: ${err instanceof Error ? err.message : err}\n`);
 	process.exitCode = 20;
 });
 //#endregion
 export {};
+
+//# sourceMappingURL=stdio.mjs.map