mjolnir-qa 3.0.0 → 5.0.0

package/dist/{scan-pipeline-CAH9_Qgh.mjs → scan-pipeline-DT8DWAMl.mjs}

@@ -1,14 +1,14 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import { createRequire } from "node:module";
-import { closeSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { closeSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, statSync, unlinkSync, writeSync } from "node:fs";
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createHash, randomBytes } from "node:crypto";
+import { execFileSync } from "node:child_process";
 import * as ts$2 from "ts-morph";
 import ts, { Project, SyntaxKind, ts as ts$1 } from "ts-morph";
 import { Language, Parser } from "web-tree-sitter";
 import { parse } from "yaml";
-import { execFileSync } from "node:child_process";
 import { inflateRawSync } from "node:zlib";
 //#region src/types.ts
 /** Severity ladder. Order matters for sorting and gating. */
@@ -60,6 +60,32 @@ function isValidCategory(value) {
 	return value !== void 0 && RULE_CATEGORIES.includes(value);
 }
 /**
+* Trust levels (Verification Trust Evolution Plan §16): the OVERALL
+* trust a consumer can place in one finding, combining the static
+* evidence ladder (E0–E2) with RUNTIME corroboration from a real run
+* report. Exposed honestly, never overclaimed:
+*   L0 — observation only (E0, no runtime evidence).
+*   L1 — heuristic static evidence (E1), no runtime evidence.
+*   L2 — deterministic static evidence (E2), no runtime evidence.
+*   L3 — RUNTIME: the file containing this finding appeared in a real
+*        run report (tests in that file executed).
+*   L4 — RUNTIME: the specific test containing this finding was
+*        identified in the report and executed (its outcome is known).
+*   L5 — RUNTIME: the run verdict directly corroborates the DEFECT
+*        class (e.g. a flake-risk finding whose test actually flaked,
+*        retried, or timed out in the report).
+* INVARIANT (structurally enforced): L3–L5 require runtime
+* corroboration — a static-only finding can never claim L4/L5.
+*/
+const TRUST_ORDER = [
+	"L0",
+	"L1",
+	"L2",
+	"L3",
+	"L4",
+	"L5"
+];
+/**
 * Honest default evidence level for a finding (Honesty Core Phase 1).
 * Derivation is deterministic and conservative:
 *   observation → E0 (never proof)
@@ -100,6 +126,7 @@ const DEDUCTIONS = {
 //#region src/engine/completion.ts
 function deriveCompletion(input) {
 	const truncationReasons = [...new Set(input.truncationReasons)].sort();
+	const degradations = [...input.degradations ?? []].sort((a, b) => a.reason < b.reason ? -1 : a.reason > b.reason ? 1 : 0);
 	const reasons = /* @__PURE__ */ new Set();
 	if (input.discoveryTruncated) reasons.add("discovery-truncated");
 	if (input.rulesPartial) reasons.add("rules-partial");
@@ -109,14 +136,16 @@ function deriveCompletion(input) {
 	if (input.scopeUnrecognized > 0) reasons.add(`scope-unrecognized:${input.scopeUnrecognized}`);
 	if (input.parseFailed > 0) reasons.add(`parse-failed:${input.parseFailed}`);
 	if (input.parseFallbacks && input.parseFallbacks > 0) reasons.add(`parse-fallbacks:${input.parseFallbacks}`);
+	if (input.astFallbackFiles && input.astFallbackFiles > 0) reasons.add(`ast-budget-fallback-files:${input.astFallbackFiles}`);
 	if (input.scopeDegraded) reasons.add(`scope-degraded:${input.scopeDegraded}`);
 	if (input.runtimeIncomplete) reasons.add("runtime-incomplete");
 	if (input.identityIncomplete) reasons.add("identity-incomplete");
 	for (const reason of truncationReasons) reasons.add(`truncated:${reason}`);
+	for (const entry of degradations) reasons.add(`degraded:${entry.reason}:${entry.count}`);
 	const discoveryPartial = input.discoveryTruncated || input.scopeIgnored > 0 || input.scopeUnrecognized > 0 || input.scopeDegraded !== void 0;
 	const rulesPartial = input.rulesPartial || input.rulesCrashed > 0 || input.parseFailed > 0;
 	return {
-		partial: discoveryPartial || rulesPartial || input.skippedFiles > 0 || input.runtimeIncomplete === true || input.identityIncomplete === true || truncationReasons.length > 0,
+		partial: discoveryPartial || rulesPartial || input.skippedFiles > 0 || input.runtimeIncomplete === true || input.identityIncomplete === true || truncationReasons.length > 0 || degradations.length > 0,
 		analysisStatus: {
 			discovery: discoveryPartial ? "partial" : "complete",
 			rules: rulesPartial ? "partial" : "complete",
@@ -124,11 +153,49 @@ function deriveCompletion(input) {
 			rulesCrashed: input.rulesCrashed,
 			parseFallbacks: input.parseFallbacks ?? 0,
 			...truncationReasons.length > 0 ? { truncationReasons } : {},
+			...degradations.length > 0 ? { degradations } : {},
 			reasons: [...reasons].sort()
 		}
 	};
 }
 //#endregion
+//#region src/engine/degradation-ledger.ts
+/**
+* Append-only. Records are never edited and never removed by a recording
+* site; a reader takes a window, and the window is defined by index, so
+* "delete my entry" is not an operation this module offers.
+*/
+const records = [];
+/** Record one capability loss. `count` is for a site that fails N at once. */
+function recordDegradation(reason, count = 1) {
+	if (!Number.isInteger(count) || count < 1) return;
+	for (let index = 0; index < count; index++) records.push({ reason });
+}
+/**
+* Mark where this reader's window opens. Everything appended from here on is
+* what the reader will see; see the file header for what a concurrent scan
+* does to that boundary.
+*/
+function beginDegradationWindow() {
+	return records.length;
+}
+/** The records appended since `marker`, without consuming them. */
+function degradationsSince(marker) {
+	return records.slice(marker);
+}
+/**
+* Per-reason counts for a window, sorted by reason so the output is
+* byte-deterministic for the same set of degradations.
+*/
+function summarizeDegradations(window) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const record of window) counts.set(record.reason, (counts.get(record.reason) ?? 0) + 1);
+	return [...counts.entries()].map(([reason, count]) => ({
+		reason,
+		count
+	})).sort((a, b) => a.reason < b.reason ? -1 : a.reason > b.reason ? 1 : 0);
+}
+//#endregion
 //#region src/engine/runtime-corroboration.ts
 /**
 * Stamp runtime corroboration + trust levels onto findings (mutates in
@@ -742,21 +809,13 @@ const MEASURED_FP = {
 * empty scan is an observation, not a proof).
 */
 function summaryTrustLevel(findings) {
-	const order = [
-		"L0",
-		"L1",
-		"L2",
-		"L3",
-		"L4",
-		"L5"
-	];
 	let best = 0;
 	for (const f of findings) {
 		const t = f.trustLevel ?? "L2";
-		const idx = order.indexOf(t);
+		const idx = TRUST_ORDER.indexOf(t);
 		if (idx > best) best = idx;
 	}
-	return order[best];
+	return TRUST_ORDER[best];
 }
 /**
 * A finding's trust rung (0–5) on the canonical ladder. Corroborated
@@ -767,14 +826,7 @@ function summaryTrustLevel(findings) {
 */
 function trustRung(f) {
 	const t = f.trustLevel ?? deriveTrustLevel(f);
-	return [
-		"L0",
-		"L1",
-		"L2",
-		"L3",
-		"L4",
-		"L5"
-	].indexOf(t);
+	return TRUST_ORDER.indexOf(t);
 }
 /**
 * Hard incompleteness ceilings (plan §6: partial/crash/truncation;
@@ -911,6 +963,17 @@ function buildRunIdentity(input) {
 		engineVersion: input.engineVersion
 	};
 	if (input.reportDigest) verdictInputs.reportDigest = input.reportDigest;
+	if (input.commit !== void 0) verdictInputs.commit = input.commit;
+	if (input.tree !== void 0) verdictInputs.tree = input.tree;
+	if (input.lockfile !== void 0) verdictInputs.lockfile = input.lockfile;
+	if (input.candidate !== void 0) verdictInputs.candidate = {
+		manifestId: input.candidate.manifestId,
+		state: input.candidate.state,
+		candidateSha: input.candidate.candidateSha,
+		baseSha: input.candidate.baseSha,
+		packageSha256: input.candidate.packageSha256,
+		lockfileSha256: input.candidate.lockfileSha256
+	};
 	if (input.trustModelVersion !== void 0) verdictInputs.trustModelVersion = input.trustModelVersion;
 	if (input.scoringModelVersion !== void 0) verdictInputs.scoringModelVersion = input.scoringModelVersion;
 	if (input.frameworkSupportMatrixVersion !== void 0) verdictInputs.frameworkSupportMatrixVersion = input.frameworkSupportMatrixVersion;
@@ -918,15 +981,31 @@ function buildRunIdentity(input) {
 	if (input.suppressionFingerprint !== void 0) verdictInputs.suppressionFingerprint = input.suppressionFingerprint;
 	if (input.policyFingerprint !== void 0) verdictInputs.policyFingerprint = input.policyFingerprint;
 	if (input.historicalEvidenceFingerprint !== void 0) verdictInputs.historicalEvidenceFingerprint = input.historicalEvidenceFingerprint;
+	const scanId = sha256$1(canonical(verdictInputs));
+	const boundLinks = [
+		"input",
+		"rules",
+		"config",
+		"engine"
+	];
+	if (input.commit !== void 0) boundLinks.push("commit");
+	if (input.tree !== void 0) boundLinks.push("tree");
+	if (input.lockfile !== void 0) boundLinks.push("lockfile");
+	if (input.candidate !== void 0) boundLinks.push("candidate");
 	return {
-		scanId: sha256$1(canonical(verdictInputs)),
+		scanId,
 		inputFingerprint,
 		rulesDigest,
 		configFingerprint,
 		engineVersion: input.engineVersion,
+		boundLinks,
 		...input.trustModelVersion !== void 0 ? { trustModelVersion: input.trustModelVersion } : {},
 		...input.scoringModelVersion !== void 0 ? { scoringModelVersion: input.scoringModelVersion } : {},
-		...input.frameworkSupportMatrixVersion !== void 0 ? { frameworkSupportMatrixVersion: input.frameworkSupportMatrixVersion } : {}
+		...input.frameworkSupportMatrixVersion !== void 0 ? { frameworkSupportMatrixVersion: input.frameworkSupportMatrixVersion } : {},
+		...input.commit !== void 0 ? { commit: input.commit } : {},
+		...input.tree !== void 0 ? { tree: input.tree } : {},
+		...input.lockfile !== void 0 ? { lockfile: input.lockfile } : {},
+		...input.candidate !== void 0 ? { candidate: input.candidate } : {}
 	};
 }
 /**
@@ -967,9 +1046,353 @@ function buildEvidenceGraph(parts) {
 				...parts.reproduction !== void 0 ? { ref: parts.reproduction } : {}
 			}
 		],
-		...parts.runId !== void 0 ? { runId: parts.runId } : {}
+		...parts.runId !== void 0 ? { runId: parts.runId } : {},
+		...parts.candidate !== void 0 ? { candidate: {
+			manifestId: parts.candidate.manifestId,
+			candidateSha: parts.candidate.candidateSha
+		} } : {}
+	};
+}
+//#endregion
+//#region src/engine/file-executor.ts
+function cacheHitOutcome(job) {
+	return {
+		path: job.path,
+		status: "CACHE_HIT",
+		findings: [...job.cacheHit ?? []],
+		parseFallback: false
+	};
+}
+/**
+* Drive a list of jobs through an executor and return outcomes in INPUT order.
+*
+* This is the function the pipeline calls. It is executor-agnostic on purpose:
+* swapping in a pooled executor must not require touching the caller, and the
+* ordering guarantee has to live here or it would live in each executor and
+* drift between them.
+*/
+async function executeFiles(jobs, executor, context = {}) {
+	const outcomes = new Array(jobs.length);
+	if (executor.concurrency <= 1 || jobs.length <= 1) {
+		for (let i = 0; i < jobs.length; i++) {
+			const job = jobs[i];
+			context.onProgress?.({
+				done: i,
+				total: jobs.length,
+				path: job.path
+			});
+			outcomes[i] = await runOne(job, executor, context);
+		}
+		context.onProgress?.({
+			done: jobs.length,
+			total: jobs.length,
+			path: jobs[jobs.length - 1]?.path ?? ""
+		});
+		return outcomes;
+	}
+	let next = 0;
+	let completed = 0;
+	const inFlight = /* @__PURE__ */ new Set();
+	const limit = Math.max(1, Math.floor(executor.concurrency));
+	const worker = async () => {
+		for (;;) {
+			const index = next++;
+			if (index >= jobs.length) return;
+			const job = jobs[index];
+			outcomes[index] = await runOne(job, executor, context);
+			completed++;
+			context.onProgress?.({
+				done: completed,
+				total: jobs.length,
+				path: job.path
+			});
+		}
+	};
+	for (let i = 0; i < Math.min(limit, jobs.length); i++) {
+		const promise = worker().then(() => void 0);
+		inFlight.add(promise);
+	}
+	await Promise.all(inFlight);
+	return outcomes;
+}
+async function runOne(job, executor, context) {
+	if (job.cacheHit !== void 0) return cacheHitOutcome(job);
+	try {
+		return await executor.execute(job, context);
+	} catch (error) {
+		return {
+			path: job.path,
+			status: "FAILED",
+			findings: [],
+			parseFallback: false,
+			error: error instanceof Error ? error : new Error(String(error))
+		};
+	}
+}
+/**
+* The strategy the pipeline uses today.
+*
+* `runOne` is supplied by the pipeline because parsing and rule execution
+* need the adapter and the active rule set, which are pipeline concerns. The
+* executor's job is the BOUNDARY and the bookkeeping, not the analysis — so
+* this factory exists to bind those two without the executor importing the
+* pipeline (which would be a cycle).
+*/
+function createExecutor(name, concurrency, runOne) {
+	return {
+		name,
+		concurrency,
+		execute: runOne
+	};
+}
+//#endregion
+//#region src/scope/git-resolve.ts
+/**
+* Absolute-path git resolution (audit S1).
+*
+* `execFileSync("git", …)` resolves through PATH — including the CWD on
+* Windows (CreateProcess searches the current directory before PATH for
+* extension-less names depending on NoDefaultCurrentDirectoryInExePath).
+* Scanning an UNTRUSTED repo therefore let a checked-in `git.exe` (or
+* `git.bat`/`git.cmd`) hijack Mjölnir's own git invocations: the attacker
+* controls the diff output, the merge-base decision, and
+* `--scope changed`'s "what is new" answer — the exact data CI gates on.
+*
+* The fix: resolve git ONCE per process to an ABSOLUTE path by walking
+* the PATH directly (never consulting the CWD), verify the candidate is
+* an existing file, and pass that path to execFileSync. Resolution is
+* memoized; a failure to find a real git anywhere on PATH is recorded
+* and callers degrade without invoking a bare name.
+*/
+let resolvedGit = void 0;
+/**
+* The absolute path of the git binary Mjölnir will invoke, or null when
+* PATH carries no executable `git` at all. Callers must degrade without
+* invoking a bare name.
+*/
+function resolveGitPath() {
+	if (resolvedGit !== void 0) return resolvedGit;
+	const candidates = [process.platform === "win32" ? "git.exe" : "git"];
+	if (process.platform === "win32") {
+		const pathExt = process.env["PATHEXT"]?.split(";").filter(Boolean) ?? [];
+		for (const ext of pathExt) candidates.push(`git${ext.toLowerCase()}`);
+	}
+	const pathValue = process.env["PATH"] ?? "";
+	for (const dir of pathValue.split(delimiter)) {
+		if (dir === "") continue;
+		if (!isAbsolute(dir)) continue;
+		for (const candidate of candidates) {
+			const full = join(dir, candidate);
+			try {
+				if (existsSync(full)) {
+					resolvedGit = full;
+					return resolvedGit;
+				}
+			} catch {}
+		}
+	}
+	`${pathValue.length}`;
+	resolvedGit = null;
+	return resolvedGit;
+}
+/**
+* Run git with the S1-resolved absolute binary path. Returns stdout, or
+* null when git is missing or the command fails — the same contract as
+* the previous inline `git()` helpers, with the hijack surface closed.
+*/
+function runGit(root, args) {
+	const exe = resolveGitPath();
+	if (!exe) return null;
+	try {
+		return execFileSync(exe, [
+			"-C",
+			root,
+			...args
+		], {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			],
+			timeout: 15e3
+		});
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/lib/safe-json.ts
+/**
+* Reusable safe-JSON parse-and-validate helper.
+*
+* Replaces the `JSON.parse(text) as T` pattern with a two-step process:
+*   1. Try/catch around JSON.parse (descriptive error on bad JSON)
+*   2. Runtime validation of the parsed shape (caller-supplied predicate)
+*
+* The `validate` predicate is intentionally lightweight — it checks the
+* expected shape exists rather than exhaustively type-guarding every field.
+* Internal files (cache, hashes) use `isRecord`; user-facing files
+* (config, plugins) use stricter checks that throw descriptive errors.
+*/
+const MAX_JSON_BYTES = 16777216;
+function parseJsonFile(text, source, validate) {
+	if (Buffer.byteLength(text, "utf8") > MAX_JSON_BYTES) throw new Error(`JSON source exceeds the ${MAX_JSON_BYTES}-byte limit: ${source}`);
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch (err) {
+		throw new Error(`invalid JSON in ${source}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+	}
+	if (!validate(parsed)) throw new Error(`unexpected shape in ${source}`, { cause: parsed });
+	return parsed;
+}
+/**
+* Minimal validator: value is a plain object (not null, not array).
+* Sufficient for internal files (cache, hashes) where downstream
+* code already checks individual fields.
+*/
+function isRecord(v) {
+	try {
+		return typeof v === "object" && v !== null && !Array.isArray(v);
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/engine/candidate-binding.ts
+/**
+* Candidate binding (plan V5-010).
+*
+* Reads a candidate trust manifest and produces the immutable
+* `CandidateBinding` that a run identity is bound to. It also computes the
+* repository facts (commit, tree, lockfile digest) that the identity was
+* missing until this module existed.
+*
+* The law here is ABSENCE over invention. A manifest that is missing,
+* unreadable, or internally contradictory yields NO binding — not a partial
+* one. A consumer that can see "not bound" can refuse to trust the run; a
+* consumer handed a half-filled binding cannot tell what is missing, and will
+* trust the parts that are there.
+*/
+const CANDIDATE_MANIFEST_PATH = "candidate-trust-manifest.json";
+const SHA40 = /^[a-f0-9]{40}$/;
+const SHA256 = /^[a-f0-9]{64}$/;
+const STATES = ["WORKING_CANDIDATE", "RELEASE_CANDIDATE"];
+const AUTHORIZATION = ["NOT_AUTHORIZED", "AUTHORIZED"];
+function sha256File(path) {
+	try {
+		return createHash("sha256").update(readFileSync(path)).digest("hex");
+	} catch {
+		return;
+	}
+}
+/**
+* One git line, or nothing.
+*
+* Audit S1: the binary is the ABSOLUTE path `resolveGitPath()` found by
+* walking PATH itself, never the bare name. `bindRepository()` runs on every
+* scan (`scan-pipeline.ts`), and a bare `execFileSync("git", …)` lets a
+* `git.exe`/`git.bat`/`git.cmd` CHECKED INTO AN UNTRUSTED REPO hijack the
+* call on Windows, where CreateProcess searches the current directory before
+* PATH. The attacker then controls the `commit` and `tree` that land in
+* `runIdentity` and the evidence graph — the provenance a release decision
+* reads. This was the last bare-name exec left in `src/`; the invariant that
+* keeps it that way is `tests/contract/no-bare-process-exec.spec.ts`.
+*
+* The `-C <root>` shape (not `cwd`) matches every other hardened call site.
+* With no git on PATH at all, the answer is nothing — a scan of an unpacked
+* tarball has no commit, and its identity must say so rather than carrying a
+* placeholder that looks like provenance.
+*/
+function gitLine(root, args) {
+	const exe = resolveGitPath();
+	if (!exe) return void 0;
+	try {
+		const trimmed = execFileSync(exe, [
+			"-C",
+			root,
+			...args
+		], {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			],
+			windowsHide: true,
+			timeout: 15e3
+		}).trim();
+		return trimmed.length > 0 ? trimmed : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* The commit and tree the working tree is at. Both absent outside a
+* repository or with no commits — never substituted with a placeholder.
+*/
+function bindRepository(root) {
+	const commit = gitLine(root, ["rev-parse", "HEAD"]);
+	const tree = gitLine(root, ["rev-parse", "HEAD^{tree}"]);
+	const lockfile = sha256File(join(root, "package-lock.json"));
+	return {
+		...commit !== void 0 ? { commit } : {},
+		...tree !== void 0 ? { tree } : {},
+		...lockfile !== void 0 ? { lockfile } : {}
+	};
+}
+/**
+* Parse a candidate manifest into a binding, or return null when it cannot
+* honestly be bound.
+*
+* Null is returned for: no manifest, unreadable JSON, a missing or malformed
+* required field, or a state/authorization combination that cannot legally
+* exist (a WORKING_CANDIDATE carrying a commit, for example — the same
+* contradiction the release decision evaluator treats as BLOCKED).
+*/
+function parseCandidateBinding(raw) {
+	if (!isRecord(raw)) return null;
+	const identity = raw.identity;
+	if (!isRecord(identity)) return null;
+	const state = identity.state;
+	const candidateSha = identity.candidateSha;
+	const baseSha = identity.baseSha;
+	const packageSha256 = identity.packageSha256;
+	const lockfileSha256 = identity.lockfileSha256;
+	if (typeof state !== "string" || !STATES.includes(state)) return null;
+	if (typeof baseSha !== "string" || !SHA40.test(baseSha)) return null;
+	if (typeof packageSha256 !== "string" || !SHA256.test(packageSha256)) return null;
+	if (typeof lockfileSha256 !== "string" || !SHA256.test(lockfileSha256)) return null;
+	if (candidateSha !== null && (typeof candidateSha !== "string" || !SHA40.test(candidateSha))) return null;
+	const manifestId = raw.manifestId;
+	if (typeof manifestId !== "string" || manifestId.length === 0) return null;
+	const owner = typeof raw.owner === "string" ? raw.owner : "UNASSIGNED";
+	const authorization = raw.releaseAuthorizationState;
+	if (typeof authorization !== "string" || !AUTHORIZATION.includes(authorization)) return null;
+	if (state === "WORKING_CANDIDATE") {
+		if (candidateSha !== null) return null;
+		if (authorization !== "NOT_AUTHORIZED") return null;
+	} else if (candidateSha === null) return null;
+	return {
+		manifestId,
+		state,
+		candidateSha,
+		baseSha,
+		packageSha256,
+		lockfileSha256,
+		owner,
+		releaseAuthorizationState: authorization
 	};
 }
+/** Read and bind the manifest from a checkout, or null. */
+function readCandidateBinding(root, manifestPath = CANDIDATE_MANIFEST_PATH) {
+	try {
+		return parseCandidateBinding(JSON.parse(readFileSync(join(root, manifestPath), "utf8")));
+	} catch {
+		return null;
+	}
+}
 //#endregion
 //#region src/engine/version.ts
 /**
@@ -980,7 +1403,7 @@ function buildEvidenceGraph(parts) {
 * scripts/sync-sarif-version.cjs and guarded by the version-consistency
 * spec. cli.ts re-exports this as CLI_VERSION.
 */
-const ENGINE_VERSION = "3.0.0";
+const ENGINE_VERSION = "5.0.0";
 //#endregion
 //#region src/engine/contract-versions.ts
 /**
@@ -1109,9 +1532,12 @@ function discoverWorkspace(rootDir) {
 	const root = findProjectRoot(rootDir);
 	if (!root) return null;
 	let pkg = {};
-	try {
-		pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
-	} catch {}
+	const manifestPath = join(root, "package.json");
+	if (existsSync(manifestPath)) try {
+		pkg = JSON.parse(readFileSync(manifestPath, "utf8"));
+	} catch {
+		recordDegradation("workspace-manifest-unreadable");
+	}
 	const rawWorkspaces = pkg["workspaces"];
 	let globs = [];
 	if (Array.isArray(rawWorkspaces)) globs = rawWorkspaces.filter((w) => typeof w === "string");
@@ -1128,40 +1554,6 @@ function basename$1(p) {
 	return parts[parts.length - 1];
 }
 //#endregion
-//#region src/lib/safe-json.ts
-/**
-* Reusable safe-JSON parse-and-validate helper.
-*
-* Replaces the `JSON.parse(text) as T` pattern with a two-step process:
-*   1. Try/catch around JSON.parse (descriptive error on bad JSON)
-*   2. Runtime validation of the parsed shape (caller-supplied predicate)
-*
-* The `validate` predicate is intentionally lightweight — it checks the
-* expected shape exists rather than exhaustively type-guarding every field.
-* Internal files (cache, hashes) use `isRecord`; user-facing files
-* (config, plugins) use stricter checks that throw descriptive errors.
-*/
-const MAX_JSON_BYTES = 16777216;
-function parseJsonFile(text, source, validate) {
-	if (Buffer.byteLength(text, "utf8") > MAX_JSON_BYTES) throw new Error(`JSON source exceeds the ${MAX_JSON_BYTES}-byte limit: ${source}`);
-	let parsed;
-	try {
-		parsed = JSON.parse(text);
-	} catch (err) {
-		throw new Error(`invalid JSON in ${source}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
-	}
-	if (!validate(parsed)) throw new Error(`unexpected shape in ${source}`, { cause: parsed });
-	return parsed;
-}
-/**
-* Minimal validator: value is a plain object (not null, not array).
-* Sufficient for internal files (cache, hashes) where downstream
-* code already checks individual fields.
-*/
-function isRecord(v) {
-	return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-//#endregion
 //#region src/lib/fs-bounded.ts
 function closeQuiet(fd) {
 	try {
@@ -1388,20 +1780,15 @@ function validate(cfg, knownRuleIds) {
 	return warnings;
 }
 /**
-* Bug-audit QA-2026-08-30 QA-6: the 90-day policy in the README was only
-* applied at WRITE time by the `ignore` command — a hand-written entry
-* without `expires` stayed active forever, silently bypassing the
-* documented window.
+* Expiry is evaluated only from an explicit ISO `expires` date. A missing
+* date remains active and is reported as having no expiry. Config-file mtime
+* is never an expiry anchor.
 *
-* Audit S4 (remediation plan): the config-file MTIME is no longer an
-* expiry anchor. Anchoring the 90-day default at mtime meant ANY edit to
-* mjolnir.config.json — a reformat, an unrelated key, a `touch` — reset
-* the 90-day window for EVERY hand-authored entry: suppressions could be
-* extended indefinitely without touching their own fields. The expiry is
-* now the entry's explicit `expires` date alone; an entry without one
-* stays active and is honestly labeled "(no expiry set)" in the
-* suppressions report. Hand-authored entries should declare `expires` at
-* creation (README §Configuration documents the shape).
+* `now` defaults to the current instant so existing callers stay correct, but
+* a verdict function that reads the clock invisibly is a verdict nobody can
+* test at a boundary. `tests/contract/deterministic-clock.spec.ts` audits
+* `src/config/**` for a call site that supplies its own `new Date()` instead
+* of threading one through.
 */
 function isSuppressionActive(ign, now = /* @__PURE__ */ new Date()) {
 	if (!ign.expires) return true;
@@ -1684,7 +2071,33 @@ function sharedWalk(options) {
 *
 * When nothing is detectable we report `unknown` and the scanner analyzes
 * all test-looking files — stated honestly in output rather than guessed.
+*
+* ## One ID space (plan V5-024)
+*
+* This detector used to declare its own `TestFramework` union of three
+* literals while `src/frameworks/framework-inventory.ts` catalogued fourteen
+* framework ids. Two vocabularies for one concept is how a support matrix
+* starts disagreeing with what the tool actually detects: a framework can be
+* catalogued as OFFICIAL_PARTIAL and never once be emitted by the code that
+* claims to detect it.
+*
+* So the ids here are `FrameworkId`s — the inventory's own vocabulary — and
+* `DETECTABLE_TEST_FRAMEWORKS` is the subset this detector can actually
+* resolve from a checkout. That subset is the HONEST limit of detection, and
+* `detectableVsCatalogued()` reports the remainder rather than letting a
+* three-item list read as the whole catalog.
+*/
+/**
+* The catalogued frameworks whose detection is implemented today.
+*
+* Every entry must exist in the inventory — enforced by the parity spec, not
+* by comment.
 */
+const DETECTABLE_TEST_FRAMEWORKS = [
+	"jest",
+	"vitest",
+	"playwright"
+];
 const CONFIG_FILES = {
 	jest: [
 		"jest.config.ts",
@@ -1703,7 +2116,7 @@ const CONFIG_FILES = {
 };
 function detectFrameworks(ws) {
 	const found = /* @__PURE__ */ new Set();
-	for (const fw of Object.keys(CONFIG_FILES)) if (CONFIG_FILES[fw].some((f) => existsSync(join(ws.root, f)))) found.add(fw);
+	for (const fw of DETECTABLE_TEST_FRAMEWORKS) if (CONFIG_FILES[fw].some((f) => existsSync(join(ws.root, f)))) found.add(fw);
 	if (!found.has("jest") && ws.packageJson["jest"] !== void 0) found.add("jest");
 	const deps = {
 		...ws.packageJson["dependencies"],
@@ -1725,11 +2138,7 @@ function detectFrameworks(ws) {
 		};
 	}
 	return {
-		frameworks: [
-			"jest",
-			"vitest",
-			"playwright"
-		].filter((f) => found.has(f)),
+		frameworks: DETECTABLE_TEST_FRAMEWORKS.filter((f) => found.has(f)),
 		unknown: false
 	};
 }
@@ -1746,6 +2155,13 @@ function detectFrameworks(ws) {
 * byte-identical — a score shift is a regression, not an improvement.
 */
 let project = null;
+/**
+* The shared ts-morph project.
+*
+* Exported so an adapter's `dispose()` can evict the file it parsed: ts-morph
+* caches by file path, so without eviction a long scan holds every parsed
+* SourceFile until the process exits (plan V5-021).
+*/
 function getProject() {
 	if (!project) project = new Project({
 		useInMemoryFileSystem: true,
@@ -1773,6 +2189,7 @@ function parseTsFile(file) {
 		}
 		return p.createSourceFile(file.path, file.text);
 	} catch {
+		recordDegradation("ast-parse-failed");
 		return;
 	}
 }
@@ -1828,6 +2245,7 @@ function commentAndStringRanges(ctx) {
 		}
 		return ranges;
 	} catch {
+		recordDegradation("ast-range-scan-failed");
 		return [];
 	}
 }
@@ -1875,6 +2293,7 @@ function getCodeOnlyText(file) {
 		for (const r of ranges) for (let i = r.start; i < r.end && i < chars.length; i++) if (chars[i] !== "\n" && chars[i] !== "\r") chars[i] = " ";
 		return chars.join("");
 	} catch {
+		recordDegradation("ast-mask-unavailable");
 		return file.text;
 	}
 }
@@ -2259,7 +2678,45 @@ function frameworkFilterApplies(rule, file) {
 	return rule.frameworks.some((f) => tags.includes(f));
 }
 //#endregion
-//#region src/adapters/typescript.ts
+//#region src/engine/shared-run-rules.ts
+/**
+* Run ONE rule with crash isolation, and return what it produced.
+*
+* This is the block that was copy-pasted into all seven language adapters:
+*
+*   try { for (const f of rule.run(x)) emit(f, rule.id, rule.category); }
+*   catch (error) { onCrash?.(rule.id, error); }
+*
+* Extracting it is worth doing for one reason beyond line count. Crash
+* isolation is the mechanism that lets a third-party or experimental
+* detector fail without ending a scan, and it is the mechanism the whole
+* `rulesCrashed` count depends on. Seven copies means seven chances to
+* write `catch {}` and lose the count, and `tests/contract/
+* no-uncounted-degradation.spec.ts` can only audit what it can see.
+*
+* `null` means the rule CRASHED, which is not the same as an empty array:
+* an empty array is the rule abstaining, and the adapters skip emission for
+* both but the distinction is why the caller must not conflate them.
+*
+* Deliberately NOT extracted: the per-adapter filter chain and the budget
+* check. Those genuinely differ — the TypeScript adapter injects an AST,
+* framework tags, a lazy `codeText` getter, `appliesTo` scoping, config-only
+* gating and `configGateMatches`, and it ABORTS the whole file on budget
+* exhaustion where `runRulesShared` only `continue`s to the next rule.
+* Routing every adapter through `runRulesShared` as written would silently
+* change which rules run and when, which is precisely the unmeasured claim
+* this program exists to delete. This helper takes the part they share.
+*/
+function runRuleIsolated(rule, file, onCrash) {
+	try {
+		return rule.run(file);
+	} catch (error) {
+		onCrash?.(rule.id, error);
+		return null;
+	}
+}
+//#endregion
+//#region src/adapters/typescript.ts
 /**
 * TypeScript/JavaScript adapter (R1).
 * Wraps the proven regex-based engine behind the LanguageAdapter
@@ -2272,7 +2729,36 @@ function frameworkFilterApplies(rule, file) {
 * "cypress", `@jest/globals` → "jest", `vitest` → "vitest". Config
 * gating is rule-declared (`configFiles`), not hard-coded here.
 */
-const TEST_FILE_RE = /\.(?:test|spec)\.(?:js|jsx|ts|tsx|mjs|cjs)$|\.cy\.(?:js|jsx|ts|tsx)$/;
+/**
+* `.test.` / `.spec.` filenames, plus the Cypress `.cy.` convention.
+*
+* `mts` and `cts` are TypeScript's Node-native ESM/CJS extensions. They were
+* missing here, and the omission was invisible in the worst way — not a wrong
+* answer, but an ABSENCE.
+*
+* Reproduced: a repo containing two byte-identical tests, one at
+* `tests/control.spec.ts` and one at `tests/slow.spec.mts`, each with a
+* `QA-TEST-004` hard sleep:
+*
+*   discovered: 1, analyzed: 1, unrecognized: 1, scopeVerdict: "PARTIAL"
+*
+* The `.ts` test produced the finding. The `.mts` test produced nothing at
+* all — it was never scanned, so every rule that could have caught it was
+* silent on it, with no finding, no low-evidence note, and no indication that
+* a test file had been skipped. A test scanner that cannot see a whole file
+* extension has a false green that is invisible by construction: the reader
+* has nothing to distrust, because there is nothing there.
+*
+* The corroboration that this was an oversight rather than a decision sits
+* four lines below: PW_CONFIG_RE already accepted `cts`. The config regex knew
+* about the Node-native extensions; the test-file regex did not.
+*
+* `discovery/scan-adapters.ts:isUnrecognizedSourceCandidate` already counted
+* these paths as uncovered surface, so the scope accounting had been reporting
+* the hole the whole time — it was being read as a known limitation rather than
+* as a defect.
+*/
+const TEST_FILE_RE = /\.(?:test|spec)\.(?:js|jsx|ts|tsx|mjs|cjs|mts|cts)$|\.cy\.(?:js|jsx|ts|tsx)$/;
 /**
 * Fallback config list for `configOnly` rules that do not declare
 * `configFiles` (the legacy playwright.config.* gating, preserved
@@ -2379,11 +2865,42 @@ const typescriptAdapter = {
 			fixtureDirMemo: /* @__PURE__ */ new Map()
 		});
 	},
+	/**
+	* The ONE AST seam (plan V5-021).
+	*
+	* This adapter used to parse inside `runRules`, on the synchronous path,
+	* while Java and C# exposed the async `parseAst` hook. Two seams meant two
+	* sets of consequences, both of them bad:
+	*
+	*   - the pipeline computes `wantsAst` as `adapter.parseAst !== undefined`,
+	*     so a TypeScript file never took the AST path through the pipeline at
+	*     all, and its parse failures were invisible to the pipeline's
+	*     fallback counters;
+	*   - nothing called `dispose()` for the ts-morph path, so a scan held
+	*     every parsed SourceFile for its whole lifetime.
+	*
+	* Parsing now happens here, once, through the same contract every other
+	* adapter uses. `dispose()` drops this file's SourceFile from the shared
+	* project; ts-morph caches per file path, so removing it is what keeps
+	* memory proportional to one file rather than to the whole scan.
+	*/
+	parseAst(file) {
+		const sourceFile = parseTsFile(file);
+		if (sourceFile === void 0) return void 0;
+		return {
+			ast: sourceFile,
+			dispose: () => {
+				try {
+					getProject().removeSourceFile(sourceFile);
+				} catch {}
+			}
+		};
+	},
 	runRules(rules, file, emit, onCrash, budget) {
-		const withAst = {
+		const withAst = file.ast === void 0 ? {
 			...file,
 			ast: parseTsFile(file)
-		};
+		} : file;
 		const withTags = {
 			...withAst,
 			frameworkTags: frameworkTagsFromImports(withAst.text)
@@ -2408,11 +2925,9 @@ const typescriptAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run(enriched)) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, enriched, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -2440,6 +2955,7 @@ function loadWorkspaceShim(root) {
 			workspaceGlobs: []
 		};
 	} catch {
+		recordDegradation("workspace-manifest-unreadable");
 		return null;
 	}
 }
@@ -2794,11 +3310,9 @@ const pythonAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run(enriched)) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, enriched, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	},
 	async parseAst(file) {
@@ -2951,11 +3465,9 @@ const javaAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run(enriched)) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, enriched, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -3109,11 +3621,9 @@ const csharpAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run(enriched)) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, enriched, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -3291,6 +3801,7 @@ const githubActionsAdapter = {
 		try {
 			entries = readdirSync(wfDir);
 		} catch {
+			recordDegradation("ci-workflow-listing-unreadable");
 			return;
 		}
 		for (const name of entries) {
@@ -3331,15 +3842,13 @@ const githubActionsAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run({
-					path: file.path,
-					text: file.text,
-					ast: doc
-				})) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, {
+				path: file.path,
+				text: file.text,
+				ast: doc
+			}, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -3649,15 +4158,13 @@ const azurePipelinesAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run({
-					path: file.path,
-					text: file.text,
-					ast: doc
-				})) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, {
+				path: file.path,
+				text: file.text,
+				ast: doc
+			}, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -3728,14 +4235,12 @@ const jenkinsAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run({
-					path: file.path,
-					text: file.text
-				})) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, {
+				path: file.path,
+				text: file.text
+			}, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -3802,9 +4307,37 @@ function discoverAllTestFiles(ctx, languageAdapters, buckets, fixtureDirMemo) {
 		}
 	});
 }
+/**
+* Would ignoring this file have removed it from the scanned surface?
+*
+* The bug this fixes, reproduced: a repo containing a real test file plus
+* `vendor.min.js` and `pnpm-lock.yaml` reported
+*
+*   discovered: 1, analyzed: 1, ignored: 2, scopeVerdict: "PARTIAL"
+*
+* Every discovered test file HAD been analyzed. The surface was complete. But
+* DEFAULT_IGNORES matches minified bundles and lockfiles, and the ignored
+* counter accepted any path with a source extension — so a minified bundle and
+* a lockfile downgraded a finished scan to "unverified".
+*
+* That is not a conservative bias, it is a broken signal. The terminal tells
+* the reader "some files were not analyzed, so the surface is unverified" —
+* which was false. And because minified bundles and lockfiles exist in
+* essentially every real repository, a PROVEN scan was unreachable in
+* practice, so the corpus regression guard failed 23 of 37 repositories on
+* exactly this. A gate that cannot pass teaches people to ignore it.
+*
+* The asymmetry is the tell. `isUnrecognizedSourceCandidate` below applies a
+* test-relevance test before counting a file; this one did not. Both count
+* against the same verdict, so both must ask the same question.
+*
+* An ignored file that IS a test file still downgrades the verdict. That is
+* the case the honesty law exists for, and this does not touch it.
+*/
 function isScopeRelevantIgnored(path) {
 	const name = path.replaceAll("\\", "/").split("/").pop() ?? path;
-	return /\.(?:[cm]?[jt]sx?|py|java|cs|ya?ml|min\.js)$/i.test(name);
+	if (!/\.(?:[cm]?[jt]sx?|py|java|cs|ya?ml|min\.js)$/i.test(name)) return false;
+	return isKnownTestFile(path);
 }
 function isUnrecognizedSourceCandidate(path) {
 	const normalized = path.replaceAll("\\", "/");
@@ -3871,82 +4404,6 @@ const SEARCHED_FOR = [
 	}
 ];
 //#endregion
-//#region src/scope/git-resolve.ts
-/**
-* Absolute-path git resolution (audit S1).
-*
-* `execFileSync("git", …)` resolves through PATH — including the CWD on
-* Windows (CreateProcess searches the current directory before PATH for
-* extension-less names depending on NoDefaultCurrentDirectoryInExePath).
-* Scanning an UNTRUSTED repo therefore let a checked-in `git.exe` (or
-* `git.bat`/`git.cmd`) hijack Mjölnir's own git invocations: the attacker
-* controls the diff output, the merge-base decision, and
-* `--scope changed`'s "what is new" answer — the exact data CI gates on.
-*
-* The fix: resolve git ONCE per process to an ABSOLUTE path by walking
-* the PATH directly (never consulting the CWD), verify the candidate is
-* an existing file, and pass that path to execFileSync. Resolution is
-* memoized; a failure to find a real git anywhere on PATH is recorded
-* and callers degrade without invoking a bare name.
-*/
-let resolvedGit = void 0;
-/**
-* The absolute path of the git binary Mjölnir will invoke, or null when
-* PATH carries no executable `git` at all. Callers must degrade without
-* invoking a bare name.
-*/
-function resolveGitPath() {
-	if (resolvedGit !== void 0) return resolvedGit;
-	const candidates = [process.platform === "win32" ? "git.exe" : "git"];
-	if (process.platform === "win32") {
-		const pathExt = process.env["PATHEXT"]?.split(";").filter(Boolean) ?? [];
-		for (const ext of pathExt) candidates.push(`git${ext.toLowerCase()}`);
-	}
-	const pathValue = process.env["PATH"] ?? "";
-	for (const dir of pathValue.split(delimiter)) {
-		if (dir === "") continue;
-		if (!isAbsolute(dir)) continue;
-		for (const candidate of candidates) {
-			const full = join(dir, candidate);
-			try {
-				if (existsSync(full)) {
-					resolvedGit = full;
-					return resolvedGit;
-				}
-			} catch {}
-		}
-	}
-	`${pathValue.length}`;
-	resolvedGit = null;
-	return resolvedGit;
-}
-/**
-* Run git with the S1-resolved absolute binary path. Returns stdout, or
-* null when git is missing or the command fails — the same contract as
-* the previous inline `git()` helpers, with the hijack surface closed.
-*/
-function runGit(root, args) {
-	const exe = resolveGitPath();
-	if (!exe) return null;
-	try {
-		return execFileSync(exe, [
-			"-C",
-			root,
-			...args
-		], {
-			encoding: "utf8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			],
-			timeout: 15e3
-		});
-	} catch {
-		return null;
-	}
-}
-//#endregion
 //#region src/scope/changed.ts
 /**
 * Changed-scope engine (Sprint-Plan W6, Product-MVP §9 `--scope changed`).
@@ -7691,7 +8148,6 @@ const pyBareTruthinessAssert = defineRule({
 		const re = /^[ \t]*assert\s+([A-Za-z_][\w.]*(?:\([^()]*\))?)[ \t]*$/gm;
 		const predicateRe = /^(?:(?:any|all|isinstance)\s*\(|[\w.]*\.(?:startswith|endswith|exists|isdir|isfile|islink|ismount|check|isdigit|isalpha|isalnum|isnumeric|isdecimal|isspace|islower|isupper|istitle|isidentifier|isprintable|isascii)\s*\(|re\.(?:match|search|fullmatch)\s*\()/;
 		const isGuardFollowedByRealUse = (text, matchIndex, target) => {
-			const root = target.split(".")[0];
 			const lineEnd = text.indexOf("\n", matchIndex);
 			if (lineEnd === -1) return false;
 			const lines = text.slice(lineEnd + 1).split("\n");
@@ -7701,8 +8157,11 @@ const pyBareTruthinessAssert = defineRule({
 				if (/^\s*def\s/.test(l) && window.length > 0) break;
 				window.push(l);
 			}
-			const usesRoot = new RegExp(`\\b${root}\\b`);
-			return window.some((l) => usesRoot.test(l));
+			const root = target.match(/^[a-z_]\w*/i)?.[0];
+			if (!root) return false;
+			return window.some((line) => {
+				return (line.match(/[a-z_]\w*/gi) ?? []).some((token) => token === root);
+			});
 		};
 		let m;
 		while ((m = re.exec(text)) !== null) {
@@ -11426,6 +11885,53 @@ const RETIRED_RULE_IDS = [
 	"QA-CS-111"
 ];
 //#endregion
+//#region src/lib/compare.ts
+/**
+* Order that does not depend on who is asking.
+*
+* `String.prototype.localeCompare` with no locale argument resolves against
+* the PROCESS's default locale — the ICU collation chosen by `LANG`,
+* `LC_ALL` or the OS. So a sort written as
+* `[...xs].sort((a, b) => a.localeCompare(b))` produces a different order on
+* a developer's `de_DE` machine than on an en-US CI runner. For a display
+* list that is a nuisance; for anything that reaches a hash, a cache key, a
+* digest or a machine contract it is a correctness bug, because the same
+* repository then produces two different fingerprints.
+*
+* Two comparators, one per kind of site:
+*
+*   compareCodePoints — pure UTF-16 code-unit order. Identical everywhere,
+*   independent of ICU version, and already what `Array.prototype.sort`
+*   defaults to. Use for every value that reaches a fingerprint, a digest,
+*   a cache key, or a contract, and for any ordering with no human-facing
+*   reason to be pretty.
+*
+*   compareLocalized(locale) — the same collator, PINNED to a named locale
+*   instead of inheriting the environment, for a surface that genuinely
+*   wants readable order (a table of rule titles, a Mermaid legend). Pinned
+*   rather than removed because a reader-facing list of "Test / Logic /
+*   Mock" should not be ordered by code unit.
+*
+* A bare `localeCompare` with no second argument in `src/` is a defect and
+* `tests/contract/deterministic-ordering.spec.ts` fails the build on it.
+*/
+/** Code-unit order. Locale-free, ICU-free, and the Array.sort default. */
+function compareCodePoints(a, b) {
+	if (a === b) return 0;
+	return a < b ? -1 : 1;
+}
+/**
+* A readable-order comparator pinned to `locale`.
+*
+* The pin is the point: `a.localeCompare(b)` reads the environment, and the
+* environment is a machine setting, not a property of the code. Callers that
+* want stable output ask for a named locale and get the same answer on every
+* machine that ships the same ICU data.
+*/
+function compareLocalized(locale) {
+	return (a, b) => a.localeCompare(b, locale);
+}
+//#endregion
 //#region src/scorer/scorer.ts
 /**
 * Transparent scorer (Product-MVP §8).
@@ -11482,7 +11988,7 @@ function computeDimensions(findings) {
 		deductions.set(f.category, deductions.get(f.category) + deductionFor(f));
 	}
 	for (const dim of byCategory.values()) dim.score = Math.max(0, 100 - deductions.get(dim.category));
-	return [...byCategory.values()].sort((a, b) => a.category.localeCompare(b.category));
+	return [...byCategory.values()].sort((a, b) => compareCodePoints(a.category, b.category));
 }
 /**
 * Deduction-mass ceilings (product-gap-remediation master plan P2,
@@ -11705,6 +12211,22 @@ function normalizeOne(report, artifact, v) {
 function buildEvidenceRecords(report, artifact) {
 	return report.verdicts.map((v) => normalizeOne(report, artifact, v)).sort(compareEvidenceRecords);
 }
+function countEvidence(records) {
+	const counts = {
+		total: records.length,
+		failed: 0,
+		flaky: 0,
+		skipped: 0,
+		timedOut: 0
+	};
+	for (const r of records) {
+		if (r.status.failed) counts.failed++;
+		if (r.status.passedOnRetry) counts.flaky++;
+		if (r.status.skipped) counts.skipped++;
+		if (r.status.timedOut) counts.timedOut++;
+	}
+	return counts;
+}
 //#endregion
 //#region src/engine/provenance.ts
 const GENERATED_HEADER_RE = /^\s*(?:\/\/|#|\/\*)\s*(?:auto[- ]?generated|generated by|do not edit)/i;
@@ -11908,7 +12430,7 @@ function groupByRootCause(findings) {
 function correlateFindings(findings) {
 	const conclusions = [];
 	const rootCauseGroups = groupByRootCause(findings);
-	for (const [rootCause, group] of Array.from(rootCauseGroups.entries()).sort((a, b) => a[0].localeCompare(b[0]))) {
+	for (const [rootCause, group] of Array.from(rootCauseGroups.entries()).sort((a, b) => compareLocalized("en")(a[0], b[0]))) {
 		if (group.length < 2) continue;
 		const findingIds = group.map((f) => f.findingId ?? f.ruleId);
 		conclusions.push({
@@ -11920,7 +12442,7 @@ function correlateFindings(findings) {
 		});
 	}
 	const fileGroups = groupByFile(findings);
-	for (const [file, group] of Array.from(fileGroups.entries()).sort((a, b) => a[0].localeCompare(b[0]))) {
+	for (const [file, group] of Array.from(fileGroups.entries()).sort((a, b) => compareCodePoints(a[0], b[0]))) {
 		if (group.length < 2) continue;
 		const alreadyConvergent = /* @__PURE__ */ new Set();
 		for (const c of conclusions) if (c.conclusionType === "CONVERGENT") for (const id of c.findingIds) alreadyConvergent.add(id);
@@ -11992,6 +12514,11 @@ var DependencyGraph = class {
 	get size() {
 		return this.nodes.size;
 	}
+	/** Whether the graph knows this exact key. Reachability must not
+	*  treat "not in the graph" as "nothing to traverse" without saying so. */
+	has(path) {
+		return this.nodes.has(path);
+	}
 };
 function parsePackageJson(filePath) {
 	if (!existsSync(filePath)) return void 0;
@@ -12079,20 +12606,40 @@ function parseManifest(filePath) {
 	if (filePath.endsWith("pom.xml")) return parsePomXml(filePath);
 }
 /**
-* Given a set of starting files (e.g. test files), return all files
-* transitively reachable through the dependency graph.
+* Given a set of starting files (e.g. test files), return the files
+* transitively reachable through the dependency graph, plus an honest
+* account of what could not be resolved.
+*
+* KNOWN LIMITATION (BW-022, still open): the graph is keyed by manifest path
+* and this query is given source paths, so today `unresolvedStarts` is
+* normally every input. The traversal itself is correct for a graph whose
+* keys are the paths being queried — which is what the unit tests build, and
+* which is why they passed while production did nothing. Fixing the seam
+* means giving a file a resolvable owning manifest and deciding impact's
+* direction (dependents, not dependencies), which is a design change, not a
+* patch. Until then this function reports that it resolved nothing instead
+* of implying otherwise.
 */
 function getReachableFiles(fromFiles, graph) {
 	const reachable = /* @__PURE__ */ new Set();
+	const unresolvedStarts = [];
 	const stack = [...fromFiles];
 	while (stack.length > 0) {
 		const current = stack.pop();
 		if (current === void 0) continue;
 		if (reachable.has(current)) continue;
-		reachable.add(current);
+		if (graph.has(current)) reachable.add(current);
+		else if (fromFiles.includes(current)) {
+			unresolvedStarts.push(current);
+			continue;
+		}
 		for (const dep of graph.getDependencies(current)) if (!reachable.has(dep)) stack.push(dep);
 	}
-	return [...reachable].sort();
+	return {
+		reachable: [...reachable].sort(),
+		unresolvedStarts: unresolvedStarts.sort(),
+		resolvedAny: unresolvedStarts.length < fromFiles.length
+	};
 }
 //#endregion
 //#region src/engine/incremental-analysis.ts
@@ -12132,739 +12679,935 @@ function isIncrementalSafe(changedFiles) {
 	};
 }
 //#endregion
-//#region src/engine/monorepo-analysis.ts
-const WORTHY_THRESHOLD = 80;
-const NEEDS_WORK_THRESHOLD = 50;
-function verdictOf(score) {
-	if (score === null) return "fail";
-	if (score >= WORTHY_THRESHOLD) return "pass";
-	if (score >= NEEDS_WORK_THRESHOLD) return "warn";
-	return "fail";
-}
-function hasBlocker(findings) {
-	return findings.some((f) => f.severity === "error");
-}
+//#region src/brand/tokens.ts
 /**
-* Aggregate per-package results into an overall verdict.
+* The single source of brand truth.
 *
-* Worst-package propagation: if ANY package has a blocker (error-severity
-* finding) or a failing score, the overall result fails regardless of
-* strategy. This is the safety net — a single poisoned package must not
-* hide behind averaging.
+* Every colour, typeface and motion constant Mjölnir shows a human —
+* terminal, README SVGs, demo video, website, docs, badges — resolves to
+* a value in this file. Nothing else may define one.
+*
+* WHY THIS EXISTS. Before it, the palette existed in six independent
+* copies: `site/.vitepress/theme/styles/vars.css`, `NORSE` in
+* `src/reporter/theme.ts`, `scripts/readme-svg.ts`,
+* `scripts/video/terminal-page.ts`, `scripts/generate-readme-architecture.ts`
+* and the table in `assets/brand/README.md`. Exactly one pair of those
+* was guarded (site-doctor Check 8, doc ↔ vars.css). The unguarded edges
+* are where the shipped surfaces drifted apart: the terminal and the site
+* disagreed on six semantic roles, the architecture diagram invented its
+* own neutral ramp, and the README badges still carried a palette retired
+* two releases earlier. `scripts/brand-doctor.mjs` now checks every edge
+* against this file.
+*
+* PURITY. Pure data. No I/O, no rendering, no environment access, no
+* imports, no logic. Consumers convert (hex → ANSI triplet, hex → CSS)
+* themselves. Same reason `presentation.ts` is pure: it makes the whole
+* thing golden-testable and safe to ship inside the npm package, where
+* it costs a few hundred bytes and replaces values the package already
+* carried anyway.
+*
+* DERIVATION. The palette is the one derived from the logo in PR #20
+* (brushed steel and forge gold under an aurora, over midnight iron).
+* Where the terminal disagreed with it, the terminal converges — see
+* `PENDING_TERMINAL` below. Full rationale: `assets/brand/README.md`.
+*
+* ACCESSIBILITY. Every foreground token in `BRAND` meets WCAG AA
+* (≥ 4.5:1) against every surface token it is allowed to sit on. That is
+* not a claim, it is `brand-doctor` rule 8, which computes the ratios.
+* The weakest legal pairing is `steelDim` on `ink800` at 5.00:1.
 */
-function analyzeMonorepo(packages, config) {
-	const results = packages.map((p) => ({
-		...p,
-		verdict: hasBlocker(p.findings) ? "fail" : verdictOf(p.score)
-	}));
-	if (results.length === 0) return {
-		packages: results,
-		overallScore: null,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy
-	};
-	const blockerPkg = results.find((r) => r.verdict === "fail" || hasBlocker(r.findings));
-	if (blockerPkg) return {
-		packages: results,
-		overallScore: blockerPkg.score,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy,
-		blockerPackage: blockerPkg.packageName
-	};
-	switch (config.weightingStrategy) {
-		case "worst-package": return worstPackageAggregation(results, config);
-		case "average": return averageAggregation(results, config);
-		case "configurable": return configurableAggregation(results, config);
-	}
-}
-function worstPackageAggregation(results, config) {
-	const firstResult = results[0];
-	if (firstResult === void 0) return {
-		packages: results,
-		overallScore: null,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy
-	};
-	let worst = firstResult;
-	for (const r of results) if ((r.score ?? 0) < (worst.score ?? 0)) worst = r;
-	return {
-		packages: results,
-		overallScore: worst.score,
-		overallVerdict: worst.verdict,
-		strategy: config.weightingStrategy,
-		...worst.verdict === "fail" ? { blockerPackage: worst.packageName } : {}
-	};
-}
-function averageAggregation(results, config) {
-	const scored = results.filter((r) => r.score !== null);
-	if (scored.length === 0) return {
-		packages: results,
-		overallScore: null,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy
-	};
-	const avg = scored.reduce((sum, r) => sum + (r.score ?? 0), 0) / scored.length;
-	return {
-		packages: results,
-		overallScore: Math.round(avg),
-		overallVerdict: verdictOf(Math.round(avg)),
-		strategy: config.weightingStrategy
-	};
-}
-function configurableAggregation(results, config) {
-	const weights = config.packageWeights ?? {};
-	let totalWeight = 0;
-	let weightedSum = 0;
-	for (const r of results) {
-		const w = weights[r.packageName] ?? 1;
-		totalWeight += w;
-		weightedSum += (r.score ?? 0) * w;
-	}
-	if (totalWeight === 0) return {
-		packages: results,
-		overallScore: null,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy
-	};
-	const score = Math.round(weightedSum / totalWeight);
-	return {
-		packages: results,
-		overallScore: score,
-		overallVerdict: verdictOf(score),
-		strategy: config.weightingStrategy
-	};
-}
-//#endregion
-//#region src/lib/fs-atomic.ts
 /**
-* Atomic file writes (audit S9).
+* The two brand hues plus the neutral they sit on.
 *
-* Every durability-critical write in Mjölnir (baseline, stats, badge,
-* TRIAGE.md, scaffolded rule files) used to hand-roll
-* `writeFileSync(path, data)` — a crash mid-write left a TRUNCATED file
-* at the real path, and a subsequent read (diff, badge endpoint) served
-* confident nonsense from it.
+* GOLD IS SCARCE. It means forged / certified / earned / decisive — the
+* primary mark, the FORGED state, one call to action. It is not a paint
+* bucket: gold as default text, default border or default heading is a
+* brand-doctor finding, not a style choice.
 *
-* `writeFileAtomic` writes to a temp sibling, then RENAMES. On the same
-* volume rename is atomic: readers see either the complete old file or
-* the complete new file, never a half-written one. The temp name is
-* created with `wx` (exclusive) so concurrent writers cannot interleave,
-* stale temps are cleaned up on failure, and on Windows the rename is
-* retried briefly because a concurrent reader can hold the destination
-* open (EBUSY/EPERM).
+* AURORA is verification energy — the secondary, and the hue that marks
+* the runtime half of the trust ladder.
 */
-function atomicTempPath(path) {
-	return `${path}.mjolnir-${process.pid}-${Date.now()}-${randomBytes(4).toString("hex")}.tmp`;
-}
+const BRAND = {
+	gold: "#C19A34",
+	goldBright: "#E6BD57",
+	goldHot: "#F4DC9C",
+	/** Pressed / deepest gold — the only step dark enough to carry white. */
+	goldDeep: "#A5811C",
+	aurora: "#37ABBD",
+	auroraBright: "#45C1D4",
+	auroraCyan: "#5CBDE0",
+	/** The aurora's outer curtains: atmosphere and section identity only,
+	* never a verdict or a status. */
+	auroraGreen: "#5FD6A4",
+	auroraViolet: "#9D8CF5",
+	steel: "#C8CBCF",
+	steelDim: "#8B939D"
+};
 /**
-* Atomically replace `path` with `data`.
+* Midnight iron. One ramp, four steps, darkest first.
+*
+* `terminal` and `terminalBar` share one tone deliberately: the window's
+* only seam is a hairline ring and an inset shadow, never a second fill.
+* `chromeDot` is the three window dots — see the note on
+* `PENDING_TERMINAL.chromeDots` for why they are no longer red/amber/green.
 */
-function writeFileAtomic(path, data, opts = {}) {
-	const dir = dirname(path);
-	if (opts.mkdirs !== false && !existsSync(dir)) mkdirSync(dir, { recursive: true });
-	const tmp = atomicTempPath(path);
-	let fd;
-	try {
-		fd = openSync(tmp, "wx", opts.mode ?? 420);
-		writeSync(fd, data, null, opts.encoding ?? "utf8");
-	} finally {
-		if (fd !== void 0) closeSync(fd);
-	}
-	try {
-		renameWithWindowsRetry(tmp, path);
-	} catch (err) {
-		try {
-			if (existsSync(tmp)) unlinkSync(tmp);
-		} catch {}
-		throw err;
-	}
-}
+const SURFACE = {
+	ink950: "#0A1119",
+	ink900: "#0C1420",
+	ink850: "#111A29",
+	ink800: "#18243A",
+	/** Raised panel (cards, elevated surfaces). */
+	panel: "#141F33",
+	/** Soft fill (inline code, quiet chips). */
+	soft: "#1A2740",
+	/** Terminal body — the deepest tone, so a terminal reads as recessed. */
+	terminal: "#0A1119",
+	/** Terminal title bar — the same tone; the seam is shadow, not colour. */
+	terminalBar: "#0A1119",
+	/** The three window dots. One neutral, not a traffic light. */
+	chromeDot: "#18243A"
+};
+const TEXT = {
+	primary: "#EAEEF5",
+	secondary: "#ABB6C6",
+	muted: "#8B939D",
+	/** Ink for text set ON gold (buttons, the FORGED chip). 7.17:1 on `gold`. */
+	onGold: "#0A1119"
+};
 /**
-* renameSync retry loop for Windows: a concurrent reader (another scan,
-* a badge endpoint, an editor) holding the destination open makes
-* rename fail with EBUSY/EPERM. A short bounded retry closes the race
-* without turning an atomic swap into a partial write.
+* Non-score status. `ok` is the one green in the system and it is NOT a
+* score colour — it survives only for contexts with no worthiness
+* meaning ("autofix applied", "analysis complete"). A green score would
+* say "your software is fine", which is the exact claim this product
+* refuses to make.
+*/
+const STATUS = {
+	ok: "#4FB477",
+	info: "#5CC4E0",
+	warning: "#E6BD57",
+	error: "#EC6B66"
+};
+/**
+* The four ScoreState bands plus the unmeasured state. Band thresholds
+* and runes live in `src/reporter/presentation.ts`, which stays free of
+* colour — it emits a palette KEY and each surface resolves it here.
 *
-* Internal contract test hook: the platform check keeps this loop off
-* the POSIX hot path; on win32 the EBUSY/EPERM arms are exercised by
-* the fs-atomic-retry spec (mocked renameSync).
+* `unmeasured` is steel-dim on purpose. UNKNOWN is a legitimate answer,
+* not a failure: colouring it red would make "we did not measure this"
+* look like "this is broken", which is precisely the dishonesty the
+* north-star law exists to prevent.
 */
-const RENAME_RETRIES = 8;
-const RENAME_RETRY_DELAY_MS = 25;
-/** Synchronous sleep that does not spin the CPU. */
-function sleepSync(ms) {
-	try {
-		Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-	} catch {
-		const until = Date.now() + ms;
-		while (Date.now() < until);
-	}
-}
-function renameWithWindowsRetry(from, to) {
-	for (let attempt = 0;; attempt++) try {
-		renameSync(from, to);
-		return;
-	} catch (err) {
-		const code = err?.code;
-		if (process.platform === "win32" && (code === "EBUSY" || code === "EPERM") && attempt < RENAME_RETRIES) {
-			sleepSync(RENAME_RETRY_DELAY_MS);
-			continue;
-		}
-		throw err;
-	}
-}
-const STALE_TEMP_AGE_MS = 864e5;
-const TEMP_PID_RE = /^.+\.mjolnir-([1-9]\d{0,9})-(\d{13})-[0-9a-f]{8}\.tmp$/;
-function sweepStaleTempFiles(dir) {
-	let swept = 0;
-	let entries;
-	try {
-		entries = readdirSync(dir);
-	} catch {
-		return 0;
-	}
-	const cutoff = Date.now() - STALE_TEMP_AGE_MS;
-	for (const entry of entries) {
-		const match = TEMP_PID_RE.exec(entry);
-		if (!match || Number(match[2]) > cutoff) continue;
-		const path = join(dir, entry);
-		try {
-			const stat = lstatSync(path);
-			if (!stat.isFile() || stat.mtimeMs > cutoff) continue;
-			if (pidAlive(Number(match[1]))) continue;
-			unlinkSync(path);
-			swept++;
-		} catch {
-			continue;
-		}
-	}
-	return swept;
-}
-function pidAlive(pid) {
-	if (!Number.isSafeInteger(pid) || pid <= 0 || pid > 2147483647) return true;
-	if (pid === process.pid) return true;
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch (err) {
-		return err?.code !== "ESRCH";
-	}
-}
-//#endregion
-//#region src/engine/scan-cache.ts
+const SCORE = {
+	critical: "#EC6B66",
+	warning: "#E6BD57",
+	trusted: "#5CC4E0",
+	forged: "#F4DC9C",
+	unmeasured: "#8B939D"
+};
 /**
-* Local incremental scan cache (Beta-to-Stable 1.0 plan, M5.2 / A-2).
+* E0 → E1 → E2 is a certainty ramp, and it is deliberately HUE-FREE.
 *
-* Content-addressed, local-only verdict cache: `--cache` reuses the
-* per-file rule outputs of a previous scan when the file's bytes AND the
-* active rule set are unchanged, and invalidates everything else. The
-* key is `sha256(fileText) + rulesDigest` + the file's own identity
-* (repo-relative path + adapter id + parse mode — audit C1/W9), where
-* the rules digest folds
-* in every active rule's id + `detectorRevision ?? 1` (the existing
-* stale-measurement machinery — Verification Trust Evolution Plan §07 —
-* reused as the cache invalidation signal, per A-2) plus a source hash
-* of each external plugin/local rule's `run` function, so a plugin that
-* changes code without bumping its revision still misses.
+* Evidence level says how sure we are, not whether the news is good. A
+* deterministic proof (E2) is a defect we are certain about — painting
+* it gold or green would read as an achievement. So certainty is carried
+* by brightness alone, and the *shape* does the real work:
 *
-* Privacy posture: the cache lives under `<repo>/.mjolnir/cache/`, is
-* gitignored, never leaves the machine, and this module performs zero
-* network I/O — fs and crypto only (asserted by the privacy spec).
+*     E0  open ring        observation, no weight
+*     E1  half-filled      pattern evidence, half weight
+*     E2  sealed           deterministic proof, full weight
 *
-* Only raw rule-loop outputs are cached. Everything after the loop
-* (severity overrides, suppressions, overlap dedup, evidence stamping,
-* tier policy, runtime corroboration, scoring) re-runs on every scan,
-* so a cached scan is byte-equivalent to a fresh one by construction.
+* Colour never carries this alone (R11): the geometry is the signal and
+* survives `--ascii`, `NO_COLOR` and monochrome print.
 */
-const CACHE_VERSION = 2;
-/** Entry cap: a monorepo-scale suite stays far below this; bounded file. */
-const MAX_ENTRIES$1 = 4096;
+const EVIDENCE = {
+	e0: "#8B939D",
+	e1: "#ABB6C6",
+	e2: "#EAEEF5"
+};
 /**
-* Audit M5: total byte budget. The old cap counted only ENTRIES, so
-* 4096 files × ~100KB of findings each could still produce a
-* multi-hundred-MB writeFileSync on persist. The budget bounds the
-* serialized size; the newest entries win (real LRU-by-use).
-*/
-const MAX_TOTAL_BYTES = 33554432;
-const MAX_FINDINGS_PER_ENTRY = 1e4;
-function isCachedFinding(value) {
-	if (!isRecord(value)) return false;
-	return typeof value["ruleId"] === "string" && typeof value["category"] === "string" && typeof value["severity"] === "string" && typeof value["confidence"] === "string" && typeof value["findingType"] === "string" && typeof value["file"] === "string" && Number.isSafeInteger(value["line"]) && Number.isSafeInteger(value["column"]) && typeof value["message"] === "string" && typeof value["why"] === "string" && typeof value["fix"] === "string";
+* L0–L5, and the most important boundary in the product.
+*
+* L0–L2 are STATIC: the neutral steel ramp, brightening to the static
+* ceiling at L2. L3–L5 require a real run, and the hue changes to aurora
+* exactly there. The boundary is a hue break, not a gradient step,
+* because it is a change of kind and not of degree — a static-only
+* finding can never climb past L2, however confident it is.
+*
+* Every surface that draws the ladder must draw that break.
+*/
+const TRUST = {
+	l0: "#8B939D",
+	l1: "#ABB6C6",
+	l2: "#C8CBCF",
+	l3: "#37ABBD",
+	l4: "#45C1D4",
+	l5: "#5CC4E0"
+};
+const TINT = {
+	gold: {
+		fill: "#F6EBCC",
+		stroke: "#7A5F16",
+		text: "#4A3A0E"
+	},
+	aurora: {
+		fill: "#D9F0F4",
+		stroke: "#1F6F7C",
+		text: "#10353C"
+	},
+	error: {
+		fill: "#FADEDD",
+		stroke: "#A83A35",
+		text: "#4E1B19"
+	},
+	/** The unmeasured / unknown state. Neutral, never the error tint. */
+	neutral: {
+		fill: "#E4E7EB",
+		stroke: "#5C646E",
+		text: "#262B31"
+	},
+	ok: {
+		fill: "#DCF0E4",
+		stroke: "#276B45",
+		text: "#163A26"
+	}
+};
+/**
+* The score bands as the badge Mjölnir itself generates renders them.
+*
+* These are DEEPER than the score tokens on purpose, and it is not a
+* style preference: shields.io sets the message text in white and gives
+* you no say in it. `score.forged` (#F4DC9C) under white text measures
+* 1.35:1 — an unreadable badge, shipped to look on-brand. The brand's
+* own deep steps put every band between 4.9 and 6.3:1.
+*
+* What they replace was worse than off-brand, it was wrong:
+*
+*   band        was              rendered as        white-on   now       white-on
+*   ────────────────────────────────────────────────────────────────────────────
+*   0-49        `red`            #dd4343            4.24       #A83A35   6.32
+*   50-79       `yellow`         #d8b800            1.95       #7A5F16   6.04
+*   80-99       `important`      #ea7233  ORANGE    3.02       #1F6F7C   5.80
+*   100         `success`        #44bb00  GREEN     2.51       #8A6D1E   4.90
+*   unmeasured  `lightgrey`      #939393            3.07       #5C646E   5.99
+*
+* Two of those were defects, not preferences. `success` is green, and
+* green is not a score colour here — a 100 badge said "your software is
+* fine", which is the one claim this product refuses to make. And
+* `important` is ORANGE, not the blue-family colour the code's own
+* comment claimed for eight releases: every WORTHY badge ever rendered
+* showed the trusted band in a warning colour. Nobody had resolved a
+* shields name to a value and looked.
+*
+* Values are hex without `#`, the form shields.io's endpoint takes.
+* `A83A35`, `7A5F16`, `1F6F7C` and `5C646E` are the `TINT` strokes —
+* the same deep steps the mermaid diagrams use, for the same reason.
+* `8A6D1E` is the gold the brand document already named as the light
+* FORGED gradient's start.
+*/
+const BADGE_BAND = {
+	critical: "A83A35",
+	warning: "7A5F16",
+	trusted: "1F6F7C",
+	forged: "8A6D1E",
+	unmeasured: "5C646E"
+};
+SURFACE.ink950, SURFACE.ink900, SURFACE.ink850, SURFACE.ink800, BRAND.steel, BRAND.steelDim, BRAND.gold, BRAND.goldBright, BRAND.goldHot, BRAND.aurora, BRAND.auroraBright, BRAND.auroraCyan, BRAND.auroraGreen, BRAND.auroraViolet;
+SCORE.trusted, SCORE.forged, SCORE.warning, SCORE.critical, STATUS.info, TEXT.onGold, STATUS.ok, EVIDENCE.e0, EVIDENCE.e1, EVIDENCE.e2, TRUST.l0, TRUST.l1, TRUST.l2, TRUST.l3, TRUST.l4, TRUST.l5;
+EVIDENCE.e0, EVIDENCE.e1, EVIDENCE.e2;
+const RUNG_MEANINGS = [
+	"observation only",
+	"heuristic static",
+	"deterministic static",
+	"the finding's file executed",
+	"the finding's test executed",
+	"the run verdict corroborates"
+];
+const RUNG_COLORS = [
+	TRUST.l0,
+	TRUST.l1,
+	TRUST.l2,
+	TRUST.l3,
+	TRUST.l4,
+	TRUST.l5
+];
+const TRUST_RUNGS = RUNG_MEANINGS.map((meaning, i) => ({
+	level: `L${i}`,
+	meaning,
+	runtime: i >= 3,
+	color: RUNG_COLORS[i]
+}));
+//#endregion
+//#region src/reporter/presentation.ts
+/**
+* presentation.ts — the one place a presentation DECISION is made.
+*
+* BITTERSWEET `BW-030a`. Before this module the same decision was written
+* down four different times and every surface drifted:
+*
+*   - score bands: `score-state.ts` (50/80), `dashboard.ts` (50/60),
+*     `handover.ts` (50/90), `mermaid.ts` (50/80), `monorepo-analysis.ts`
+*     (50/80);
+*   - the evidence descriptor: `terminal.ts` returned the full
+*     `[E2 · deterministic · measured FP 8% · n=14 · trust L3]` while
+*     `evidence-tag.ts` — which called itself the "single definition
+*     site" — returned four bare words and defaulted a missing level to
+*     `E2`, the STRONGEST one;
+*   - the score bar: `theme.ts:scoreGauge` plus four private reimplementations.
+*
+* THE ONE RULE OF THIS MODULE: it owns decisions, never data and never
+* I/O. It reads a `Finding` / a score number / a `Palette` and returns
+* the word, band, threshold or descriptor to print. It opens no file,
+* touches no clock, spawns no process and formats no HTML document. If a
+* second responsibility appears here, split it in the same change.
+*
+* Pure: the same input always yields the same output, so every decision
+* is golden-testable and two runs of the same scan cannot disagree.
+*
+* Layout note — the threshold LITERALS stay physically here rather than in
+* a registry object so that `site/scripts/gen-report.mjs`, which parses
+* `score >= N` branches out of this file to build the site's band ruler,
+* keeps parsing one canonical file. `SCORE_THRESHOLDS` is derived from
+* those literals; it is the nameable form, not a second copy of them.
+*/
+/**
+* What a surface prints when a number was never measured.
+*
+* The bug this replaces: `testDeclarationCount ?? 0` rendered
+* "0 tests analyzed in 0 files" for a producer that simply did not
+* measure. A zero is a CLAIM — it says the count was taken and found
+* nothing. Absent means nobody looked. `dashboard.ts` already modelled
+* this correctly for frameworks (`frameworkCount: null` → "unknown");
+* its sibling `trust-report.ts` did not, so the same repo produced two
+* artifacts that disagreed about whether a measurement existed.
+*/
+const UNMEASURED = "unknown — not measured";
+/**
+* Render a count for a human surface: the number when it was measured,
+* `unknown — not measured` when it was not. Never `0` for an absent
+* measurement.
+*/
+function countOrUnknown(value, unit) {
+	if (value === void 0) return UNMEASURED;
+	return unit === void 0 ? String(value) : `${value} ${unit}`;
 }
-function isCacheFile(value) {
-	if (!isRecord(value) || value["version"] !== CACHE_VERSION) return false;
-	const entries = value["entries"];
-	if (!isRecord(entries) || Object.keys(entries).length > MAX_ENTRIES$1) return false;
-	return Object.values(entries).every((entry) => isRecord(entry) && Array.isArray(entry["findings"]) && entry["findings"].length <= MAX_FINDINGS_PER_ENTRY && entry["findings"].every(isCachedFinding));
+/**
+* The machine-surface counterpart: an unmeasured count is `null`, which
+* JSON has a word for, rather than `0`, which does not. Used by the
+* trust-report JSON artifact; the scan machine contract
+* (`engine/machine-contract.ts`) is drift-locked and untouched.
+*/
+function countOrNull(value) {
+	return value ?? null;
 }
-/** sha256 hex of a string — the only hash this module needs. */
-function sha256(text) {
-	return createHash("sha256").update(text).digest("hex");
+/**
+* The "Tests analyzed" cell, shared by every human surface that shows it.
+*
+* Three renderers had this line written out separately, identically, and
+* all three rendered `testDeclarationCount ?? 0` — "0 tests analyzed in 0
+* files" — for a producer that never measured a declaration at all. Two
+* of them are the *sibling* artifacts for the same scan (the PR comment
+* and the trust report), so the same run told a reviewer both "0 tests
+* analyzed" and "no tests found".
+*
+* Declared-but-file-count-absent (and the reverse) are reported honestly
+* rather than filled in from each other.
+*/
+function testsAnalyzedCell(declarations, files) {
+	if (declarations === void 0 && files === void 0) return UNMEASURED;
+	const declText = countOrUnknown(declarations);
+	if (files === void 0) return `${declText} in unknown files`;
+	return `${declText} in ${files} ${files === 1 ? "file" : "files"}`;
+}
+const HEADLINES = {
+	critical: "The hammer is cracked — {n} findings break its edge.",
+	warning: "The hammer holds — but {n} findings weigh it down.",
+	trusted: "Held in worthy hands — {n} findings remain.",
+	forged: "Static score 100 — no findings on the analyzed surface.",
+	unmeasured: "No tests found — the hammer cannot be weighed."
+};
+const RUNES = {
+	critical: "ᚲ",
+	warning: "ᚦ",
+	trusted: "ᛏ",
+	forged: "ᛟ",
+	unmeasured: "ᛁ"
+};
+/**
+* The named form of the band boundaries. `report:honesty` /
+* `thresholds:parity` assert that no surface outside this module
+* re-invents a boundary; a consumer that genuinely needs one names it
+* here rather than typing the number.
+*/
+const SCORE_THRESHOLDS = {
+	/** Below this is `critical`. */
+	criticalBelow: 50,
+	/** At or above this is `trusted`. */
+	trustedAtOrAbove: 80,
+	/** The one score that is `forged`. */
+	forgedAt: 100
+};
+/**
+* Band mapping — the one mapping, every consumer: <50 critical,
+* 50–79 warning, 80–99 trusted, 100 forged, null unmeasured.
+*/
+function deriveScoreState(score) {
+	if (score === null) return {
+		score: null,
+		band: "unmeasured",
+		verdict: "UNWORTHY",
+		color: "dim",
+		powerLevel: 0,
+		headline: HEADLINES.unmeasured,
+		rune: RUNES.unmeasured
+	};
+	if (score >= SCORE_THRESHOLDS.forgedAt) return {
+		score,
+		band: "forged",
+		verdict: "FORGED",
+		color: "forged",
+		powerLevel: score,
+		headline: HEADLINES.forged,
+		rune: RUNES.forged
+	};
+	if (score >= 80) return {
+		score,
+		band: "trusted",
+		verdict: "WORTHY",
+		color: "trusted",
+		powerLevel: score,
+		headline: HEADLINES.trusted,
+		rune: RUNES.trusted
+	};
+	if (score >= 50) return {
+		score,
+		band: "warning",
+		verdict: "NEEDS WORK",
+		color: "warning",
+		powerLevel: score,
+		headline: HEADLINES.warning,
+		rune: RUNES.warning
+	};
+	return {
+		score,
+		band: "critical",
+		verdict: "UNWORTHY",
+		color: "error",
+		powerLevel: score,
+		headline: HEADLINES.critical,
+		rune: RUNES.critical
+	};
+}
+/** Substitute a findings count into a headline template. Pure text
+* helper so every surface formats identically. */
+function headlineFor(state, findings) {
+	return state.headline.replace("{n}", String(findings));
+}
+/**
+* Contract-stable three-band verdict (property-locked in
+* tests/scoring-precision.spec.ts). Delegates to the ScoreState model —
+* 100 keeps returning WORTHY here; the FORGED premium treatment lives
+* in the dedicated block, not in this public mapping.
+*
+* The `FORGED → WORTHY` collapse is a DOCUMENTED PROJECTION that
+* preserves the three-band public contract, not a divergence to be
+* "fixed": a consumer reading the verdict word must not be able to tell
+* a 100 from a 99, because the 100 carries no runtime evidence and the
+* score alone never earned it.
+*/
+function verdictFor(score) {
+	const verdict = deriveScoreState(score).verdict;
+	return verdict === "FORGED" ? "WORTHY" : verdict;
+}
+const EVIDENCE_KIND = {
+	E0: "observation",
+	E1: "heuristic",
+	E2: "deterministic"
+};
+/**
+* The effective evidence level of a finding.
+*
+* The `?? deriveEvidenceLevel(...)` fallback IS the fix for BW-101. The
+* deleted `evidence-tag.ts` defaulted a missing level to `E2` — the
+* strongest claim the product can make — which is the exact inverse of
+* its own principle: absent evidence is not proof, so it is derived
+* conservatively from the finding's own type and confidence.
+*/
+function evidenceLevelOf(f) {
+	return f.evidenceLevel ?? deriveEvidenceLevel(f.findingType, f.confidence);
+}
+/** What the runtime report actually vouched for, in the product's words. */
+function runtimeLabel(f) {
+	const c = f.runtimeCorroboration;
+	if (c === void 0) return null;
+	if (c.level === "defect") return "defect corroborated";
+	if (c.level === "test") return "test executed";
+	return "file executed";
+}
+/**
+* The canonical evidence descriptor — `[E2 · deterministic · measured FP
+* 8% · n=14 · trust L3 · runtime: file executed]`.
+*
+* This is the version `terminal.ts` already shipped, promoted to the one
+* definition site. The HTML and markdown surfaces now gain the measured
+* false-positive rate, the sample size, the trust rung and what runtime
+* corroborated — they used to show four bare words that a reader could
+* mistake for the whole evidence story.
+*
+* Every clause is conditional on the finding actually carrying that
+* evidence. Nothing here is ever defaulted into existence.
+*/
+function evidenceTag(f) {
+	const level = evidenceLevelOf(f);
+	let tag = `${level} · ${EVIDENCE_KIND[level]}`;
+	if (f.measuredFpRate !== void 0) {
+		tag += ` · measured FP ${Math.round(f.measuredFpRate * 100)}%`;
+		if (f.measuredFpN !== void 0) tag += ` · n=${f.measuredFpN}`;
+	}
+	if (f.trustLevel !== void 0) tag += ` · trust ${f.trustLevel}`;
+	const runtime = runtimeLabel(f);
+	if (runtime !== null) tag += ` · runtime: ${runtime}`;
+	return `[${tag}]`;
+}
+//#endregion
+//#region src/engine/monorepo-analysis.ts
+/**
+* Package verdict, derived from the one ScoreState band model (BW-104).
+* These two constants used to be a private copy of the band boundaries;
+* the numeric vocabulary here is a different projection of the same bands
+* — "pass" is trusted or forged, "warn" is warning, "fail" is critical or
+* unmeasurable — so the boundaries are read, never retyped.
+*/
+function verdictOf(score) {
+	if (score === null) return "fail";
+	const band = deriveScoreState(score).band;
+	if (band === "forged" || band === "trusted") return "pass";
+	return band === "warning" ? "warn" : "fail";
+}
+function hasBlocker(findings) {
+	return findings.some((f) => f.severity === "error");
+}
+/**
+* Aggregate per-package results into an overall verdict.
+*
+* Worst-package propagation: if ANY package has a blocker (error-severity
+* finding) or a failing score, the overall result fails regardless of
+* strategy. This is the safety net — a single poisoned package must not
+* hide behind averaging.
+*/
+function analyzeMonorepo(packages, config) {
+	const results = packages.map((p) => ({
+		...p,
+		verdict: hasBlocker(p.findings) ? "fail" : verdictOf(p.score)
+	}));
+	if (results.length === 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	const blockerPkg = results.find((r) => r.verdict === "fail" || hasBlocker(r.findings));
+	if (blockerPkg) return {
+		packages: results,
+		overallScore: blockerPkg.score,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy,
+		blockerPackage: blockerPkg.packageName
+	};
+	switch (config.weightingStrategy) {
+		case "worst-package": return worstPackageAggregation(results, config);
+		case "average": return averageAggregation(results, config);
+		case "configurable": return configurableAggregation(results, config);
+	}
+}
+function worstPackageAggregation(results, config) {
+	const firstResult = results[0];
+	if (firstResult === void 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	let worst = firstResult;
+	for (const r of results) if ((r.score ?? 0) < (worst.score ?? 0)) worst = r;
+	return {
+		packages: results,
+		overallScore: worst.score,
+		overallVerdict: worst.verdict,
+		strategy: config.weightingStrategy,
+		...worst.verdict === "fail" ? { blockerPackage: worst.packageName } : {}
+	};
+}
+function averageAggregation(results, config) {
+	const scored = results.filter((r) => r.score !== null);
+	if (scored.length === 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	const avg = scored.reduce((sum, r) => sum + (r.score ?? 0), 0) / scored.length;
+	return {
+		packages: results,
+		overallScore: Math.round(avg),
+		overallVerdict: verdictOf(Math.round(avg)),
+		strategy: config.weightingStrategy
+	};
+}
+function configurableAggregation(results, config) {
+	const weights = config.packageWeights ?? {};
+	let totalWeight = 0;
+	let weightedSum = 0;
+	for (const r of results) {
+		const w = weights[r.packageName] ?? 1;
+		totalWeight += w;
+		weightedSum += (r.score ?? 0) * w;
+	}
+	if (totalWeight === 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	const score = Math.round(weightedSum / totalWeight);
+	return {
+		packages: results,
+		overallScore: score,
+		overallVerdict: verdictOf(score),
+		strategy: config.weightingStrategy
+	};
 }
+//#endregion
+//#region src/lib/fs-atomic.ts
 /**
-* Digest of the active rule set: id + effective detectorRevision for
-* every rule (sorted for determinism), plus a content hash of all rule
-* source files. The directory-tree hash catches changes to ANY file
-* under src/rules/ — same-file helpers, cross-module imports, shared
-* utilities — without needing to trace the import graph. This is the
-* only reliable way to detect helper function changes in a bundled
-* ESM codebase where String(fn) doesn't reveal transitive dependencies.
+* Atomic file writes (audit S9).
+*
+* Every durability-critical write in Mjölnir (baseline, stats, badge,
+* TRIAGE.md, scaffolded rule files) used to hand-roll
+* `writeFileSync(path, data)` — a crash mid-write left a TRUNCATED file
+* at the real path, and a subsequent read (diff, badge endpoint) served
+* confident nonsense from it.
+*
+* `writeFileAtomic` writes to a temp sibling, then RENAMES. On the same
+* volume rename is atomic: readers see either the complete old file or
+* the complete new file, never a half-written one. The temp name is
+* created with `wx` (exclusive) so concurrent writers cannot interleave,
+* stale temps are cleaned up on failure, and on Windows the rename is
+* retried briefly because a concurrent reader can hold the destination
+* open (EBUSY/EPERM).
 */
-function computeRulesDigest(rules) {
-	const parts = rules.map((r) => `${r.id}:${r.detectorRevision ?? 1}`).sort();
-	const rulesDirHash = hashRulesSourceTree(rules);
-	return sha256(parts.join("|") + "\0" + rulesDirHash);
+function atomicTempPath(path) {
+	return `${path}.mjolnir-${process.pid}-${Date.now()}-${randomBytes(4).toString("hex")}.tmp`;
 }
 /**
-* Hash all .ts files under src/rules/ (when the first rule's modulePath
-* reveals the project root). Falls back to per-rule function source
-* hashing when the directory cannot be resolved.
+* Atomically replace `path` with `data`.
+*
+* Accepts binary payloads as well as text: base-tree materialization in
+* `impact` writes git blobs, and a writer that only takes strings forces those
+* call sites back to the non-atomic path rather than keeping them contained.
 */
-function hashRulesSourceTree(rules) {
-	const firstPath = rules.find((r) => r.modulePath)?.modulePath;
-	if (!firstPath) return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
-	const idx = firstPath.replace(/\\/g, "/").indexOf("/src/rules/");
-	if (idx < 0) return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
-	const rulesDir = firstPath.replace(/\\/g, "/").slice(0, idx + 11);
+function writeFileAtomic(path, data, opts = {}) {
+	const dir = dirname(path);
+	if (opts.mkdirs !== false && !existsSync(dir)) mkdirSync(dir, { recursive: true });
+	const tmp = atomicTempPath(path);
+	let fd;
 	try {
-		const hash = createHash("sha256");
-		hashDir(rulesDir, hash, 0);
-		return hash.digest("hex").slice(0, 16);
-	} catch {
-		return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
+		fd = openSync(tmp, "wx", opts.mode ?? 420);
+		if (typeof data === "string") writeSync(fd, data, null, opts.encoding ?? "utf8");
+		else writeSync(fd, data);
+	} finally {
+		if (fd !== void 0) closeSync(fd);
 	}
-}
-function hashDir(dir, hash, depth) {
-	if (depth > 8) return;
-	let entries;
 	try {
-		entries = readdirSync(dir, { withFileTypes: true });
-	} catch {
-		return;
-	}
-	entries.sort((a, b) => a.name.localeCompare(b.name));
-	for (const entry of entries) {
-		if (entry.name === "node_modules" || entry.name === ".git") continue;
-		const full = join(dir, entry.name);
-		if (entry.isDirectory()) hashDir(full, hash, depth + 1);
-		else if (entry.isFile() && /\.tsx?$/.test(entry.name)) try {
-			hash.update(entry.name);
-			hash.update(readFileSync(full));
+		renameWithWindowsRetry(tmp, path);
+	} catch (err) {
+		try {
+			if (existsSync(tmp)) unlinkSync(tmp);
 		} catch {}
+		throw err;
 	}
 }
 /**
-* Content-addressed key for one file's rule-loop verdicts.
+* renameSync retry loop for Windows: a concurrent reader (another scan,
+* a badge endpoint, an editor) holding the destination open makes
+* rename fail with EBUSY/EPERM. A short bounded retry closes the race
+* without turning an atomic swap into a partial write.
 *
-* Audit C1: the key MUST identify the verdict's producer, not just the
-* bytes — two files with byte-identical text (a copied spec, a generated
-* snapshot) previously shared one entry, and the first file's cached
-* findings were re-emitted for the second with the wrong `file` stamp.
-* The key therefore folds in the repo-relative path AND the adapter id,
-* plus a parse-mode token (audit W9): a file whose analysis degraded to
-* the regex fallback (or skipped the AST path) must not collide with a
-* fully-AST-analyzed verdict for the same bytes — the fallback output
-* belongs only to the fallback mode.
-*/
-function fileCacheKey(rulesDigest, fileText, identity) {
-	const parseMode = identity.parseMode ?? "ast";
-	return sha256(`${CACHE_VERSION}\u0000${rulesDigest}\u0000${identity.relPath}\u0000${identity.adapterId}\u0000${parseMode}\u0000${fileText}`);
-}
-/** No-op cache used when --cache is absent: zero stats, zero I/O. */
-const disabledScanCache = {
-	stats: {
-		hits: 0,
-		misses: 0,
-		file: ""
-	},
-	lookup: () => void 0,
-	store: () => {},
-	persist: () => {}
-};
-/**
-* Opens (and lazily creates) `<root>/.mjolnir/cache/scan-v<CACHE_VERSION>.json`. A
-* corrupt, hostile or future-versioned cache file degrades to a cold
-* cache — never fails the scan.
+* Internal contract test hook: the platform check keeps this loop off
+* the POSIX hot path; on win32 the EBUSY/EPERM arms are exercised by
+* the fs-atomic-retry spec (mocked renameSync).
 */
-function createScanCache(root) {
-	const dir = join(root, ".mjolnir", "cache");
-	const file = join(dir, `scan-v${CACHE_VERSION}.json`);
-	let entries = {};
-	let dirty = false;
-	const entryBytes = /* @__PURE__ */ new Map();
-	let totalBytes = 0;
+const RENAME_RETRIES = 8;
+const RENAME_RETRY_DELAY_MS = 25;
+/** Synchronous sleep that does not spin the CPU. */
+function sleepSync(ms) {
 	try {
-		if (existsSync(file)) {
-			const stat = lstatSync(file);
-			if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_TOTAL_BYTES) throw new Error("invalid cache file");
-			entries = parseJsonFile(readFileSync(file, "utf8"), file, isCacheFile).entries;
-			for (const [k, v] of Object.entries(entries)) {
-				const size = Buffer.byteLength(JSON.stringify(v), "utf8") + k.length + 4;
-				entryBytes.set(k, size);
-				totalBytes += size;
-			}
-			if (totalBytes > MAX_TOTAL_BYTES) throw new Error("cache byte budget exceeded");
+		Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+	} catch {
+		const until = Date.now() + ms;
+		while (Date.now() < until);
+	}
+}
+function renameWithWindowsRetry(from, to) {
+	for (let attempt = 0;; attempt++) try {
+		renameSync(from, to);
+		return;
+	} catch (err) {
+		const code = err?.code;
+		if (process.platform === "win32" && (code === "EBUSY" || code === "EPERM") && attempt < RENAME_RETRIES) {
+			sleepSync(RENAME_RETRY_DELAY_MS);
+			continue;
 		}
+		throw err;
+	}
+}
+const STALE_TEMP_AGE_MS = 864e5;
+const TEMP_PID_RE = /^.+\.mjolnir-([1-9]\d{0,9})-(\d{13})-[0-9a-f]{8}\.tmp$/;
+function sweepStaleTempFiles(dir) {
+	let swept = 0;
+	let entries;
+	try {
+		entries = readdirSync(dir);
 	} catch {
-		entries = {};
-		entryBytes.clear();
-		totalBytes = 0;
+		return 0;
 	}
-	return {
-		stats: {
-			hits: 0,
-			misses: 0,
-			file
-		},
-		lookup(key) {
-			const entry = entries[key];
-			if (!entry) {
-				this.stats.misses++;
-				return;
-			}
-			this.stats.hits++;
-			delete entries[key];
-			entries[key] = entry;
-			return structuredClone(entry.findings);
-		},
-		store(key, findings, fileBudgetExceeded) {
-			if (fileBudgetExceeded) return;
-			if (findings.length > MAX_FINDINGS_PER_ENTRY) return;
-			const entryJson = JSON.stringify(findings);
-			const newBytes = Buffer.byteLength(entryJson, "utf8") + key.length + 4;
-			if (newBytes > MAX_TOTAL_BYTES) return;
-			const replacedBytes = entryBytes.get(key) ?? 0;
-			delete entries[key];
-			entries[key] = { findings: structuredClone(findings) };
-			entryBytes.set(key, newBytes);
-			totalBytes = totalBytes - replacedBytes + newBytes;
-			let count = Object.keys(entries).length;
-			while ((count > MAX_ENTRIES$1 || totalBytes > MAX_TOTAL_BYTES) && count > 1) {
-				const oldest = Object.keys(entries)[0];
-				totalBytes -= entryBytes.get(oldest);
-				delete entries[oldest];
-				entryBytes.delete(oldest);
-				count--;
-			}
-			dirty = true;
-		},
-		persist() {
-			if (!dirty) return;
-			try {
-				mkdirSync(dir, { recursive: true });
-				writeFileAtomic(file, JSON.stringify({
-					version: CACHE_VERSION,
-					entries
-				}), { encoding: "utf8" });
-			} catch {}
+	const cutoff = Date.now() - STALE_TEMP_AGE_MS;
+	for (const entry of entries) {
+		const match = TEMP_PID_RE.exec(entry);
+		if (!match || Number(match[2]) > cutoff) continue;
+		const path = join(dir, entry);
+		try {
+			const stat = lstatSync(path);
+			if (!stat.isFile() || stat.mtimeMs > cutoff) continue;
+			if (pidAlive(Number(match[1]))) continue;
+			unlinkSync(path);
+			swept++;
+		} catch {
+			continue;
 		}
-	};
+	}
+	return swept;
+}
+function pidAlive(pid) {
+	if (!Number.isSafeInteger(pid) || pid <= 0 || pid > 2147483647) return true;
+	if (pid === process.pid) return true;
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (err) {
+		return err?.code !== "ESRCH";
+	}
 }
 //#endregion
-//#region src/brand/tokens.ts
-/**
-* The single source of brand truth.
-*
-* Every colour, typeface and motion constant Mjölnir shows a human —
-* terminal, README SVGs, demo video, website, docs, badges — resolves to
-* a value in this file. Nothing else may define one.
-*
-* WHY THIS EXISTS. Before it, the palette existed in six independent
-* copies: `site/.vitepress/theme/styles/vars.css`, `NORSE` in
-* `src/reporter/theme.ts`, `scripts/readme-svg.ts`,
-* `scripts/video/terminal-page.ts`, `scripts/generate-readme-architecture.ts`
-* and the table in `assets/brand/README.md`. Exactly one pair of those
-* was guarded (site-doctor Check 8, doc ↔ vars.css). The unguarded edges
-* are where the shipped surfaces drifted apart: the terminal and the site
-* disagreed on six semantic roles, the architecture diagram invented its
-* own neutral ramp, and the README badges still carried a palette retired
-* two releases earlier. `scripts/brand-doctor.mjs` now checks every edge
-* against this file.
-*
-* PURITY. Pure data. No I/O, no rendering, no environment access, no
-* imports, no logic. Consumers convert (hex → ANSI triplet, hex → CSS)
-* themselves. Same reason `score-state.ts` is pure: it makes the whole
-* thing golden-testable and safe to ship inside the npm package, where
-* it costs a few hundred bytes and replaces values the package already
-* carried anyway.
-*
-* DERIVATION. The palette is the one derived from the logo in PR #20
-* (brushed steel and forge gold under an aurora, over midnight iron).
-* Where the terminal disagreed with it, the terminal converges — see
-* `PENDING_TERMINAL` below. Full rationale: `assets/brand/README.md`.
-*
-* ACCESSIBILITY. Every foreground token in `BRAND` meets WCAG AA
-* (≥ 4.5:1) against every surface token it is allowed to sit on. That is
-* not a claim, it is `brand-doctor` rule 8, which computes the ratios.
-* The weakest legal pairing is `steelDim` on `ink800` at 5.00:1.
-*/
+//#region src/engine/scan-cache.ts
 /**
-* The two brand hues plus the neutral they sit on.
+* Local incremental scan cache (Beta-to-Stable 1.0 plan, M5.2 / A-2).
 *
-* GOLD IS SCARCE. It means forged / certified / earned / decisive — the
-* primary mark, the FORGED state, one call to action. It is not a paint
-* bucket: gold as default text, default border or default heading is a
-* brand-doctor finding, not a style choice.
+* Content-addressed, local-only verdict cache: `--cache` reuses the
+* per-file rule outputs of a previous scan when the file's bytes AND the
+* active rule set are unchanged, and invalidates everything else. The
+* key is `sha256(fileText) + rulesDigest` + the file's own identity
+* (repo-relative path + adapter id + parse mode — audit C1/W9), where
+* the rules digest folds
+* in every active rule's id + `detectorRevision ?? 1` (the existing
+* stale-measurement machinery — Verification Trust Evolution Plan §07 —
+* reused as the cache invalidation signal, per A-2) plus a source hash
+* of each external plugin/local rule's `run` function, so a plugin that
+* changes code without bumping its revision still misses.
 *
-* AURORA is verification energy — the secondary, and the hue that marks
-* the runtime half of the trust ladder.
-*/
-const BRAND = {
-	gold: "#C19A34",
-	goldBright: "#E6BD57",
-	goldHot: "#F4DC9C",
-	/** Pressed / deepest gold — the only step dark enough to carry white. */
-	goldDeep: "#A5811C",
-	aurora: "#37ABBD",
-	auroraBright: "#45C1D4",
-	auroraCyan: "#5CBDE0",
-	/** The aurora's outer curtains: atmosphere and section identity only,
-	* never a verdict or a status. */
-	auroraGreen: "#5FD6A4",
-	auroraViolet: "#9D8CF5",
-	steel: "#C8CBCF",
-	steelDim: "#8B939D"
-};
-/**
-* Midnight iron. One ramp, four steps, darkest first.
+* Privacy posture: the cache lives under `<repo>/.mjolnir/cache/`, is
+* gitignored, never leaves the machine, and this module performs zero
+* network I/O — fs and crypto only (asserted by the privacy spec).
 *
-* `terminal` and `terminalBar` share one tone deliberately: the window's
-* only seam is a hairline ring and an inset shadow, never a second fill.
-* `chromeDot` is the three window dots — see the note on
-* `PENDING_TERMINAL.chromeDots` for why they are no longer red/amber/green.
-*/
-const SURFACE = {
-	ink950: "#0A1119",
-	ink900: "#0C1420",
-	ink850: "#111A29",
-	ink800: "#18243A",
-	/** Raised panel (cards, elevated surfaces). */
-	panel: "#141F33",
-	/** Soft fill (inline code, quiet chips). */
-	soft: "#1A2740",
-	/** Terminal body — the deepest tone, so a terminal reads as recessed. */
-	terminal: "#0A1119",
-	/** Terminal title bar — the same tone; the seam is shadow, not colour. */
-	terminalBar: "#0A1119",
-	/** The three window dots. One neutral, not a traffic light. */
-	chromeDot: "#18243A"
-};
-const TEXT = {
-	primary: "#EAEEF5",
-	secondary: "#ABB6C6",
-	muted: "#8B939D",
-	/** Ink for text set ON gold (buttons, the FORGED chip). 7.17:1 on `gold`. */
-	onGold: "#0A1119"
-};
-/**
-* Non-score status. `ok` is the one green in the system and it is NOT a
-* score colour — it survives only for contexts with no worthiness
-* meaning ("autofix applied", "analysis complete"). A green score would
-* say "your software is fine", which is the exact claim this product
-* refuses to make.
+* Only raw rule-loop outputs are cached. Everything after the loop
+* (severity overrides, suppressions, overlap dedup, evidence stamping,
+* tier policy, runtime corroboration, scoring) re-runs on every scan,
+* so a cached scan is byte-equivalent to a fresh one by construction.
 */
-const STATUS = {
-	ok: "#4FB477",
-	info: "#5CC4E0",
-	warning: "#E6BD57",
-	error: "#EC6B66"
-};
+const CACHE_VERSION = 2;
+/** Entry cap: a monorepo-scale suite stays far below this; bounded file. */
+const MAX_ENTRIES$1 = 4096;
 /**
-* The four ScoreState bands plus the unmeasured state. Band thresholds
-* and runes live in `src/reporter/score-state.ts`, which stays free of
-* colour — it emits a palette KEY and each surface resolves it here.
-*
-* `unmeasured` is steel-dim on purpose. UNKNOWN is a legitimate answer,
-* not a failure: colouring it red would make "we did not measure this"
-* look like "this is broken", which is precisely the dishonesty the
-* north-star law exists to prevent.
+* Audit M5: total byte budget. The old cap counted only ENTRIES, so
+* 4096 files × ~100KB of findings each could still produce a
+* multi-hundred-MB writeFileSync on persist. The budget bounds the
+* serialized size; the newest entries win (real LRU-by-use).
 */
-const SCORE = {
-	critical: "#EC6B66",
-	warning: "#E6BD57",
-	trusted: "#5CC4E0",
-	forged: "#F4DC9C",
-	unmeasured: "#8B939D"
-};
+const MAX_TOTAL_BYTES = 33554432;
+const MAX_FINDINGS_PER_ENTRY = 1e4;
+function isCachedFinding(value) {
+	if (!isRecord(value)) return false;
+	return typeof value["ruleId"] === "string" && typeof value["category"] === "string" && typeof value["severity"] === "string" && typeof value["confidence"] === "string" && typeof value["findingType"] === "string" && typeof value["file"] === "string" && Number.isSafeInteger(value["line"]) && Number.isSafeInteger(value["column"]) && typeof value["message"] === "string" && typeof value["why"] === "string" && typeof value["fix"] === "string";
+}
+function isCacheFile(value) {
+	if (!isRecord(value) || value["version"] !== CACHE_VERSION) return false;
+	const entries = value["entries"];
+	if (!isRecord(entries) || Object.keys(entries).length > MAX_ENTRIES$1) return false;
+	return Object.values(entries).every((entry) => isRecord(entry) && Array.isArray(entry["findings"]) && entry["findings"].length <= MAX_FINDINGS_PER_ENTRY && entry["findings"].every(isCachedFinding));
+}
+/** sha256 hex of a string — the only hash this module needs. */
+function sha256(text) {
+	return createHash("sha256").update(text).digest("hex");
+}
 /**
-* E0 → E1 → E2 is a certainty ramp, and it is deliberately HUE-FREE.
-*
-* Evidence level says how sure we are, not whether the news is good. A
-* deterministic proof (E2) is a defect we are certain about — painting
-* it gold or green would read as an achievement. So certainty is carried
-* by brightness alone, and the *shape* does the real work:
-*
-*     E0  open ring        observation, no weight
-*     E1  half-filled      pattern evidence, half weight
-*     E2  sealed           deterministic proof, full weight
-*
-* Colour never carries this alone (R11): the geometry is the signal and
-* survives `--ascii`, `NO_COLOR` and monochrome print.
+* Digest of the active rule set: id + effective detectorRevision for
+* every rule (sorted for determinism), plus a content hash of all rule
+* source files. The directory-tree hash catches changes to ANY file
+* under src/rules/ — same-file helpers, cross-module imports, shared
+* utilities — without needing to trace the import graph. This is the
+* only reliable way to detect helper function changes in a bundled
+* ESM codebase where String(fn) doesn't reveal transitive dependencies.
 */
-const EVIDENCE = {
-	e0: "#8B939D",
-	e1: "#ABB6C6",
-	e2: "#EAEEF5"
-};
+function computeRulesDigest(rules) {
+	const parts = rules.map((r) => `${r.id}:${r.detectorRevision ?? 1}`).sort();
+	const rulesDirHash = hashRulesSourceTree(rules);
+	return sha256(parts.join("|") + "\0" + rulesDirHash);
+}
 /**
-* L0–L5, and the most important boundary in the product.
-*
-* L0–L2 are STATIC: the neutral steel ramp, brightening to the static
-* ceiling at L2. L3–L5 require a real run, and the hue changes to aurora
-* exactly there. The boundary is a hue break, not a gradient step,
-* because it is a change of kind and not of degree — a static-only
-* finding can never climb past L2, however confident it is.
-*
-* Every surface that draws the ladder must draw that break.
+* Hash all .ts files under src/rules/ (when the first rule's modulePath
+* reveals the project root). Falls back to per-rule function source
+* hashing when the directory cannot be resolved.
 */
-const TRUST = {
-	l0: "#8B939D",
-	l1: "#ABB6C6",
-	l2: "#C8CBCF",
-	l3: "#37ABBD",
-	l4: "#45C1D4",
-	l5: "#5CC4E0"
-};
-const TINT = {
-	gold: {
-		fill: "#F6EBCC",
-		stroke: "#7A5F16",
-		text: "#4A3A0E"
-	},
-	aurora: {
-		fill: "#D9F0F4",
-		stroke: "#1F6F7C",
-		text: "#10353C"
-	},
-	error: {
-		fill: "#FADEDD",
-		stroke: "#A83A35",
-		text: "#4E1B19"
-	},
-	/** The unmeasured / unknown state. Neutral, never the error tint. */
-	neutral: {
-		fill: "#E4E7EB",
-		stroke: "#5C646E",
-		text: "#262B31"
-	},
-	ok: {
-		fill: "#DCF0E4",
-		stroke: "#276B45",
-		text: "#163A26"
+function hashRulesSourceTree(rules) {
+	const firstPath = rules.find((r) => r.modulePath)?.modulePath;
+	if (!firstPath) return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
+	const idx = firstPath.replace(/\\/g, "/").indexOf("/src/rules/");
+	if (idx < 0) return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
+	const rulesDir = firstPath.replace(/\\/g, "/").slice(0, idx + 11);
+	try {
+		const hash = createHash("sha256");
+		hashDir(rulesDir, hash, 0);
+		return hash.digest("hex").slice(0, 16);
+	} catch {
+		return sha256(rules.map((r) => String(r.run)).join("\0")).slice(0, 16);
+	}
+}
+function hashDir(dir, hash, depth) {
+	if (depth > 8) return;
+	let entries;
+	try {
+		entries = readdirSync(dir, { withFileTypes: true });
+	} catch {
+		recordDegradation("rules-tree-listing-unreadable");
+		return;
 	}
-};
+	entries.sort((a, b) => compareCodePoints(a.name, b.name));
+	for (const entry of entries) {
+		if (entry.name === "node_modules" || entry.name === ".git") continue;
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) hashDir(full, hash, depth + 1);
+		else if (entry.isFile() && /\.tsx?$/.test(entry.name)) try {
+			hash.update(entry.name);
+			hash.update(readFileSync(full));
+		} catch {}
+	}
+}
 /**
-* The score bands as the badge Mjölnir itself generates renders them.
-*
-* These are DEEPER than the score tokens on purpose, and it is not a
-* style preference: shields.io sets the message text in white and gives
-* you no say in it. `score.forged` (#F4DC9C) under white text measures
-* 1.35:1 — an unreadable badge, shipped to look on-brand. The brand's
-* own deep steps put every band between 4.9 and 6.3:1.
-*
-* What they replace was worse than off-brand, it was wrong:
-*
-*   band        was              rendered as        white-on   now       white-on
-*   ────────────────────────────────────────────────────────────────────────────
-*   0-49        `red`            #dd4343            4.24       #A83A35   6.32
-*   50-79       `yellow`         #d8b800            1.95       #7A5F16   6.04
-*   80-99       `important`      #ea7233  ORANGE    3.02       #1F6F7C   5.80
-*   100         `success`        #44bb00  GREEN     2.51       #8A6D1E   4.90
-*   unmeasured  `lightgrey`      #939393            3.07       #5C646E   5.99
-*
-* Two of those were defects, not preferences. `success` is green, and
-* green is not a score colour here — a 100 badge said "your software is
-* fine", which is the one claim this product refuses to make. And
-* `important` is ORANGE, not the blue-family colour the code's own
-* comment claimed for eight releases: every WORTHY badge ever rendered
-* showed the trusted band in a warning colour. Nobody had resolved a
-* shields name to a value and looked.
+* Content-addressed key for one file's rule-loop verdicts.
 *
-* Values are hex without `#`, the form shields.io's endpoint takes.
-* `A83A35`, `7A5F16`, `1F6F7C` and `5C646E` are the `TINT` strokes —
-* the same deep steps the mermaid diagrams use, for the same reason.
-* `8A6D1E` is the gold the brand document already named as the light
-* FORGED gradient's start.
+* Audit C1: the key MUST identify the verdict's producer, not just the
+* bytes — two files with byte-identical text (a copied spec, a generated
+* snapshot) previously shared one entry, and the first file's cached
+* findings were re-emitted for the second with the wrong `file` stamp.
+* The key therefore folds in the repo-relative path AND the adapter id,
+* plus a parse-mode token (audit W9): a file whose analysis degraded to
+* the regex fallback (or skipped the AST path) must not collide with a
+* fully-AST-analyzed verdict for the same bytes — the fallback output
+* belongs only to the fallback mode.
 */
-const BADGE_BAND = {
-	critical: "A83A35",
-	warning: "7A5F16",
-	trusted: "1F6F7C",
-	forged: "8A6D1E",
-	unmeasured: "5C646E"
-};
-SURFACE.ink950, SURFACE.ink900, SURFACE.ink850, SURFACE.ink800, BRAND.steel, BRAND.steelDim, BRAND.gold, BRAND.goldBright, BRAND.goldHot, BRAND.aurora, BRAND.auroraBright, BRAND.auroraCyan, BRAND.auroraGreen, BRAND.auroraViolet;
-SCORE.trusted, SCORE.forged, SCORE.warning, SCORE.critical, STATUS.info, TEXT.onGold, STATUS.ok, EVIDENCE.e0, EVIDENCE.e1, EVIDENCE.e2, TRUST.l0, TRUST.l1, TRUST.l2, TRUST.l3, TRUST.l4, TRUST.l5;
-//#endregion
-//#region src/reporter/score-state.ts
-const HEADLINES = {
-	critical: "The hammer is cracked — {n} findings break its edge.",
-	warning: "The hammer holds — but {n} findings weigh it down.",
-	trusted: "Held in worthy hands — {n} findings remain.",
-	forged: "Static score 100 — no findings on the analyzed surface.",
-	unmeasured: "No tests found — the hammer cannot be weighed."
-};
-const RUNES = {
-	critical: "ᚲ",
-	warning: "ᚦ",
-	trusted: "ᛏ",
-	forged: "ᛟ",
-	unmeasured: "ᛁ"
+function fileCacheKey(rulesDigest, fileText, identity) {
+	const parseMode = identity.parseMode ?? "ast";
+	return sha256(`${CACHE_VERSION}\u0000${rulesDigest}\u0000${identity.relPath}\u0000${identity.adapterId}\u0000${parseMode}\u0000${fileText}`);
+}
+/** No-op cache used when --cache is absent: zero stats, zero I/O. */
+const disabledScanCache = {
+	stats: {
+		hits: 0,
+		misses: 0,
+		file: ""
+	},
+	lookup: () => void 0,
+	store: () => {},
+	persist: () => {}
 };
-/** Band mapping (the one mapping, three consumers): <50 critical, 50–79
-* warning, 80–99 trusted, 100 forged, null unmeasured. */
-function deriveScoreState(score) {
-	if (score === null) return {
-		score: null,
-		band: "unmeasured",
-		verdict: "UNWORTHY",
-		color: "dim",
-		powerLevel: 0,
-		headline: HEADLINES.unmeasured,
-		rune: RUNES.unmeasured
-	};
-	if (score >= 100) return {
-		score,
-		band: "forged",
-		verdict: "FORGED",
-		color: "forged",
-		powerLevel: score,
-		headline: HEADLINES.forged,
-		rune: RUNES.forged
-	};
-	if (score >= 80) return {
-		score,
-		band: "trusted",
-		verdict: "WORTHY",
-		color: "trusted",
-		powerLevel: score,
-		headline: HEADLINES.trusted,
-		rune: RUNES.trusted
-	};
-	if (score >= 50) return {
-		score,
-		band: "warning",
-		verdict: "NEEDS WORK",
-		color: "warning",
-		powerLevel: score,
-		headline: HEADLINES.warning,
-		rune: RUNES.warning
-	};
+/**
+* Opens (and lazily creates) `<root>/.mjolnir/cache/scan-v<CACHE_VERSION>.json`. A
+* corrupt, hostile or future-versioned cache file degrades to a cold
+* cache — never fails the scan.
+*/
+function createScanCache(root) {
+	const dir = join(root, ".mjolnir", "cache");
+	const file = join(dir, `scan-v${CACHE_VERSION}.json`);
+	let entries = {};
+	let dirty = false;
+	const entryBytes = /* @__PURE__ */ new Map();
+	let totalBytes = 0;
+	try {
+		if (existsSync(file)) {
+			const stat = lstatSync(file);
+			if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_TOTAL_BYTES) throw new Error("invalid cache file");
+			entries = parseJsonFile(readFileSync(file, "utf8"), file, isCacheFile).entries;
+			for (const [k, v] of Object.entries(entries)) {
+				const size = Buffer.byteLength(JSON.stringify(v), "utf8") + k.length + 4;
+				entryBytes.set(k, size);
+				totalBytes += size;
+			}
+			if (totalBytes > MAX_TOTAL_BYTES) throw new Error("cache byte budget exceeded");
+		}
+	} catch {
+		entries = {};
+		entryBytes.clear();
+		totalBytes = 0;
+	}
 	return {
-		score,
-		band: "critical",
-		verdict: "UNWORTHY",
-		color: "error",
-		powerLevel: score,
-		headline: HEADLINES.critical,
-		rune: RUNES.critical
+		stats: {
+			hits: 0,
+			misses: 0,
+			file
+		},
+		lookup(key) {
+			const entry = entries[key];
+			if (!entry) {
+				this.stats.misses++;
+				return;
+			}
+			this.stats.hits++;
+			delete entries[key];
+			entries[key] = entry;
+			return structuredClone(entry.findings);
+		},
+		store(key, findings, fileBudgetExceeded) {
+			if (fileBudgetExceeded) return;
+			if (findings.length > MAX_FINDINGS_PER_ENTRY) return;
+			const entryJson = JSON.stringify(findings);
+			const newBytes = Buffer.byteLength(entryJson, "utf8") + key.length + 4;
+			if (newBytes > MAX_TOTAL_BYTES) return;
+			const replacedBytes = entryBytes.get(key) ?? 0;
+			delete entries[key];
+			entries[key] = { findings: structuredClone(findings) };
+			entryBytes.set(key, newBytes);
+			totalBytes = totalBytes - replacedBytes + newBytes;
+			let count = Object.keys(entries).length;
+			while ((count > MAX_ENTRIES$1 || totalBytes > MAX_TOTAL_BYTES) && count > 1) {
+				const oldest = Object.keys(entries)[0];
+				totalBytes -= entryBytes.get(oldest);
+				delete entries[oldest];
+				entryBytes.delete(oldest);
+				count--;
+			}
+			dirty = true;
+		},
+		persist() {
+			if (!dirty) return;
+			try {
+				mkdirSync(dir, { recursive: true });
+				writeFileAtomic(file, JSON.stringify({
+					version: CACHE_VERSION,
+					entries
+				}), { encoding: "utf8" });
+			} catch {}
+		}
 	};
 }
-/** Substitute a findings count into a headline template. Pure text
-* helper so every surface formats identically. */
-function headlineFor(state, findings) {
-	return state.headline.replace("{n}", String(findings));
-}
 //#endregion
 //#region src/reporter/theme.ts
 /**
@@ -12880,8 +13623,8 @@ function headlineFor(state, findings) {
 *
 * Symbols always accompany color (color-blind safe, R11).
 *
-* Score-state colors come from ScoreState (score-state.ts) — the single
-* source of truth shared with the badge and (P2) the web.
+* Score-state colors come from ScoreState (presentation.ts) — the single
+* source of truth shared with the badge, the dashboard and the site.
 *
 * Terminal robustness (Master-Stabilization-Plan Sprint 5 Task 22):
 * box-drawing/gauge helpers accept an explicit width so callers can
@@ -13058,14 +13801,11 @@ function padTo(s, width) {
 */
 function scoreGauge(score, p, width = 30, ascii = false) {
 	const filled = Math.round(score / 100 * width);
-	const color = gaugeColor(score, p);
+	const color = gaugeColorForBand(deriveScoreState(score).band, p);
 	if (ascii) return color("#".repeat(filled)) + ".".repeat(Math.max(0, width - filled));
 	const head = filled > 0 && filled < width ? "▓" : "";
 	return color("█".repeat(Math.max(0, filled - (head ? 1 : 0)))) + color(head) + "░".repeat(width - filled);
 }
-function gaugeColor(score, p) {
-	return gaugeColorForBand(deriveScoreState(score).band, p);
-}
 /**
 * The single band → palette-key mapping, delegated from ScoreState so
 * gauge, verdict and badge colors can never disagree again.
@@ -14220,7 +14960,7 @@ function runForensics(target, options = {}) {
 		const base = stat.isFile() ? dirname(target) : target;
 		flakyMdPath = join(base, "FLAKY.md");
 		try {
-			writeFileSync(flakyMdPath, renderFlakyMd(report));
+			writeFileAtomic(flakyMdPath, renderFlakyMd(report));
 		} catch {
 			flakyMdPath = void 0;
 		}
@@ -14328,11 +15068,11 @@ function listFiles(dir) {
 * `mjolnir suppressions` — every suppression stays visible.
 */
 const ui = plainContext();
-function loadSuppressions(root) {
+function loadSuppressions(root, now = /* @__PURE__ */ new Date()) {
 	const { config } = loadConfig(root);
 	const entries = (config.ignore ?? []).map((ign) => ({
 		...ign,
-		status: isSuppressionActive(ign, /* @__PURE__ */ new Date()) ? "active" : "expired"
+		status: isSuppressionActive(ign, now) ? "active" : "expired"
 	}));
 	return {
 		total: entries.length,
@@ -15101,6 +15841,7 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 	let rulesPartial = false;
 	let parseFailed = 0;
 	let parseFallbacks = 0;
+	let astFallbackFiles = 0;
 	let scanned = 0;
 	let analyzed = 0;
 	for (const path of testFiles) {
@@ -15126,8 +15867,6 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 			skippedFiles++;
 			continue;
 		}
-		let fileBudgetExceeded = false;
-		let fileRuleFailed = false;
 		const relPath = relative(workspace.root, path).replaceAll("\\", "/");
 		if (!isCiAdapter) {
 			const lang = {
@@ -15146,6 +15885,10 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 			});
 		}
 		const wantsAst = adapter.parseAst !== void 0 && Date.now() <= deadline;
+		if (adapter.parseAst !== void 0 && !wantsAst) {
+			truncationReasons.add("ast-budget-fallback");
+			astFallbackFiles++;
+		}
 		const identity = (mode) => ({
 			relPath,
 			adapterId: adapter.id,
@@ -15153,79 +15896,106 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 		});
 		let cacheKey = fileCacheKey(rulesDigest, text, identity(wantsAst ? "ast" : "regex"));
 		const cachedFindings = cache.lookup(cacheKey);
-		if (cachedFindings) {
-			for (const f of cachedFindings) findings.push(f);
-			analyzed++;
-			continue;
-		}
-		hooks.onProgress?.({
-			phase: "parse",
-			done: scanned,
-			total: testFiles.length,
-			detail: relPath
-		});
-		const parsedFile = {
-			path: relPath,
-			text
-		};
-		let parsed;
-		const findingsStart = findings.length;
-		try {
-			if (adapter.parseAst && wantsAst) {
-				hooks.onProgress?.({
-					phase: "rules",
-					done: scanned,
-					total: testFiles.length,
-					detail: relPath
-				});
-				parsed = await adapter.parseAst(parsedFile);
-			}
-			const actualMode = parsed ? "ast" : "regex";
-			if (wantsAst && actualMode === "regex") {
-				parseFallbacks++;
-				cacheKey = fileCacheKey(rulesDigest, text, identity(actualMode));
-				const fallbackFindings = cache.lookup(cacheKey);
-				if (fallbackFindings) {
-					for (const f of fallbackFindings) findings.push(f);
-					analyzed++;
-					continue;
+		const executor = createExecutor("sequential", 1, async (job) => {
+			if (job.cacheHit !== void 0) return {
+				path: job.path,
+				status: "CACHE_HIT",
+				findings: [...job.cacheHit],
+				parseFallback: false
+			};
+			let parseFallback = false;
+			let fileRuleFailed = false;
+			let fileBudgetExceeded = false;
+			let parsedAst;
+			try {
+				if (adapter.parseAst && job.wantsAst) {
+					hooks.onProgress?.({
+						phase: "rules",
+						done: scanned,
+						total: testFiles.length,
+						detail: job.path
+					});
+					parsedAst = await adapter.parseAst({
+						path: job.path,
+						text: job.text
+					});
 				}
-			}
-			const fileForRules = parsed ? {
-				...parsedFile,
-				ast: parsed.ast
-			} : parsedFile;
-			adapter.runRules(activeRules, fileForRules, (f, ruleId, category) => {
-				if (!isValidFindingRecord(f)) {
-					fileRuleFailed = true;
-					onRuleCrash?.(ruleId, relPath, /* @__PURE__ */ new Error(`malformed finding record rejected (severity/line/message must be present, severity ∈ error|warning|info): ${JSON.stringify(f)}`));
-					return;
+				const actualMode = parsedAst ? "ast" : "regex";
+				if (job.wantsAst && actualMode === "regex") {
+					parseFallback = true;
+					parseFallbacks++;
+					cacheKey = fileCacheKey(rulesDigest, job.text, identity(actualMode));
+					const fallbackFindings = cache.lookup(cacheKey);
+					if (fallbackFindings) return {
+						path: job.path,
+						status: "CACHE_HIT",
+						findings: [...fallbackFindings],
+						parseFallback: true
+					};
 				}
-				findings.push({
-					...f,
-					ruleId,
-					category
+				const fileForRules = parsedAst ? {
+					path: job.path,
+					text: job.text,
+					ast: parsedAst.ast
+				} : {
+					path: job.path,
+					text: job.text
+				};
+				const produced = [];
+				adapter.runRules(activeRules, fileForRules, (f, ruleId, category) => {
+					if (!isValidFindingRecord(f)) {
+						fileRuleFailed = true;
+						onRuleCrash?.(ruleId, job.path, /* @__PURE__ */ new Error(`malformed finding record rejected (severity/line/message must be present, severity ∈ error|warning|info): ${JSON.stringify(f)}`));
+						return;
+					}
+					produced.push({
+						...f,
+						ruleId,
+						category
+					});
+				}, (ruleId, error) => {
+					fileRuleFailed = true;
+					onRuleCrash?.(ruleId, job.path, error);
+				}, {
+					deadline: Math.min(deadline, Date.now() + LIMITS$1.maxFileAnalysisMs),
+					onExceeded: () => {
+						rulesPartial = true;
+						skippedFiles++;
+						truncationReasons.add("file-budget");
+						fileBudgetExceeded = true;
+					}
 				});
-			}, (ruleId, error) => {
-				fileRuleFailed = true;
-				onRuleCrash?.(ruleId, relPath, error);
-			}, {
-				deadline: Math.min(deadline, Date.now() + LIMITS$1.maxFileAnalysisMs),
-				onExceeded: () => {
-					rulesPartial = true;
-					skippedFiles++;
-					truncationReasons.add("file-budget");
-					fileBudgetExceeded = true;
-				}
-			});
-			if (!fileRuleFailed && !fileBudgetExceeded) analyzed++;
-			if (!fileRuleFailed) cache.store(cacheKey, findings.slice(findingsStart), fileBudgetExceeded);
-		} catch {
-			if (wantsAst) parseFallbacks++;
-			skippedFiles++;
-			parseFailed++;
-		} finally {
-			parsed?.dispose();
+				if (!fileRuleFailed && !fileBudgetExceeded) analyzed++;
+				if (!fileRuleFailed) cache.store(cacheKey, produced, fileBudgetExceeded);
+				return {
+					path: job.path,
+					status: "OK",
+					findings: produced,
+					parseFallback
+				};
+			} catch {
+				if (job.wantsAst) parseFallbacks++;
+				skippedFiles++;
+				parseFailed++;
+				return {
+					path: job.path,
+					status: "FAILED",
+					findings: [],
+					parseFallback
+				};
+			} finally {
+				parsedAst?.dispose();
+			}
+		});
+		const outcome = (await executeFiles([{
+			path: relPath,
+			text,
+			wantsAst,
+			...cachedFindings !== void 0 ? { cacheHit: cachedFindings } : {}
+		}], executor))[0];
+		if (outcome?.status === "CACHE_HIT" || outcome?.status === "OK") {
+			for (const f of outcome.findings) findings.push(f);
+			if (cachedFindings !== void 0 && outcome.status === "CACHE_HIT") analyzed++;
 		}
 	}
 	return {
@@ -15236,7 +16006,8 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 		parseFailed,
 		parseFallbacks,
 		scanned,
-		analyzed
+		analyzed,
+		astFallbackFiles
 	};
 }
 /**
@@ -15316,12 +16087,16 @@ function applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, dec
 	const runtimeReportPath = discoveredReport?.path;
 	const runtimeIncomplete = discoveredReport !== void 0 && discoveredReport.report.analysisComplete !== true;
 	let forensicVerdicts;
+	let evidenceRecords = [];
 	if (discoveredReport && discoveredReport.report.analysisComplete === true) try {
-		buildEvidenceRecords(discoveredReport.report, discoveredReport.path);
+		evidenceRecords = buildEvidenceRecords(discoveredReport.report, discoveredReport.path);
 		stampRuntimeCorroboration(findings, discoveredReport.report, workspace.root);
 		forensicVerdicts = summarizeForensicVerdicts(discoveredReport.report);
-	} catch {}
+	} catch {
+		evidenceRecords = [];
+	}
 	return {
+		evidenceRecords,
 		testDeclarationCount,
 		scopeInfo,
 		suppressionCount,
@@ -15460,10 +16235,14 @@ function assembleScanResult(o) {
 		scopeUnrecognized: o.scopeUnrecognized,
 		parseFailed: o.parseFailed,
 		parseFallbacks: o.parseFallbacks ?? 0,
+		...o.astFallbackFiles !== void 0 ? { astFallbackFiles: o.astFallbackFiles } : {},
+		...o.degradations !== void 0 ? { degradations: o.degradations } : {},
 		...o.scopeInfo.degraded !== void 0 ? { scopeDegraded: o.scopeInfo.degraded } : {},
 		...o.runtimeIncomplete !== void 0 ? { runtimeIncomplete: o.runtimeIncomplete } : {},
 		identityIncomplete
 	});
+	const repository = bindRepository(o.scanRoot.root);
+	const candidate = readCandidateBinding(o.scanRoot.root);
 	const runIdentity = buildRunIdentity({
 		files: inputSnapshot,
 		rules: [...o.REVISION_BY_RULE_ID.entries()].map(([id, detectorRevision]) => ({
@@ -15476,9 +16255,17 @@ function assembleScanResult(o) {
 		trustModelVersion: TRUST_MODEL_VERSION,
 		scoringModelVersion: SCORING_MODEL_VERSION,
 		frameworkSupportMatrixVersion: FRAMEWORK_SUPPORT_MATRIX_VERSION,
-		evidenceSchemaVersions: [1]
+		evidenceSchemaVersions: [1],
+		...repository,
+		...candidate !== null ? { candidate } : {}
+	});
+	const evidenceGraph = buildEvidenceGraph({
+		runId: runIdentity,
+		...candidate !== null ? { candidate: {
+			manifestId: candidate.manifestId,
+			candidateSha: candidate.candidateSha
+		} } : {}
 	});
-	const evidenceGraph = buildEvidenceGraph({ runId: runIdentity });
 	const hasTests = o.testFileCount > 0 && o.testDeclarationCount > 0;
 	const suiteInvalidatedBy = [...new Set(o.findings.filter((f) => SUITE_INVALIDATING_RULE_IDS.has(f.ruleId)).map((f) => f.ruleId))].sort();
 	const finalScore = hasTests ? completion.partial && scopeAdjustedTotal >= 100 ? 99 : scopeAdjustedTotal : null;
@@ -15488,6 +16275,11 @@ function assembleScanResult(o) {
 		scopeIntegrity,
 		runIdentity,
 		evidenceGraph,
+		evidence: {
+			records: o.evidenceRecords ?? [],
+			counts: countEvidence(o.evidenceRecords ?? []),
+			artifact: o.runtimeReportPath ?? null
+		},
 		score: finalScore,
 		...hasTests ? {} : { reason: "no-tests-found" },
 		frameworks: o.frameworks.frameworks,
@@ -15563,13 +16355,15 @@ function assembleScanResult(o) {
 */
 async function runScan(args, hooks = {}) {
 	const started = Date.now();
+	const degradationWindow = beginDegradationWindow();
 	const requestedDuration = Number.isFinite(args.maxDurationMs) ? args.maxDurationMs : DEFAULT_MAX_DURATION_MS;
 	const deadline = started + Math.min(Math.max(1, requestedDuration), MAX_DURATION_MS);
 	const discovered = discoverWorkspace(args.target);
 	const targetAbs = resolve(args.target);
 	const scanRoot = discovered && discovered.root !== targetAbs && targetAbs.startsWith(discovered.root + sep) ? {
 		...discovered,
-		root: targetAbs
+		root: targetAbs,
+		packageJson: {}
 	} : discovered ?? fallbackWorkspace(targetAbs);
 	const workspace = scanRoot;
 	if (args.verbose) hooks.onConfigWarning?.(`verbose: scan root (config/ignore anchor): ${workspace.root}`);
@@ -15654,6 +16448,7 @@ async function runScan(args, hooks = {}) {
 	rulesPartial = analysis.rulesPartial;
 	parseFailed = analysis.parseFailed;
 	const parseFallbacks = analysis.parseFallbacks;
+	const astFallbackFiles = analysis.astFallbackFiles;
 	const scanned = analysis.scanned;
 	const analyzed = analysis.analyzed;
 	const postScan = applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, declarationsByFile, testDeclarationCount, tierByRuleId, REVISION_BY_RULE_ID);
@@ -15672,6 +16467,8 @@ async function runScan(args, hooks = {}) {
 		scopeUnrecognized,
 		parseFailed,
 		parseFallbacks,
+		astFallbackFiles,
+		degradations: summarizeDegradations(degradationsSince(degradationWindow)),
 		scanned,
 		analyzed,
 		testFiles,
@@ -15699,4 +16496,6 @@ async function runScan(args, hooks = {}) {
 	return result;
 }
 //#endregion
-export { correlateFindings as $, plainContext as A, parseJsonFile as At, shouldUseAscii as B, isValidCategory as Bt, runForensics as C, globToRegExp as Ct, nextStep as D, loadConfig as Dt, buildFooter as E, isSuppressionActive as Et, padTo as F, QA_IMPACT_LABELS as Ft, EVIDENCE as G, deriveScoreState as H, palette as I, RULE_CATEGORIES as It, atomicTempPath as J, TINT as K, sanitizeData as L, SEVERITY_ORDER as Lt, severityIcon as M, buildEvidenceGraph as Mt, box as N, MEASURED_FP as Nt, okIcon as O, readFileBounded as Ot, measure as P, DEDUCTIONS as Pt, getReachableFiles as Q, scoreGauge as R, deriveEvidenceLevel as Rt, renderSuppressions as S, createIgnoreMatcher as St, FLAKE_GLYPH as T, ConfigValidationError as Tt, headlineFor as U, wrapText as V, BADGE_BAND as W, writeFileAtomic as X, sweepStaleTempFiles as Y, buildDependencyGraph as Z, summarizeForensicVerdicts as _, computeCodeText as _t, applyPostScanProcessing as a, massCeiling as at, loadLocalRules as b, DEFAULT_IGNORE_MATCHER as bt, discoverAndParseRuntimeReport as c, getRule as ct, isValidFindingRecord as d, SCAN_ADAPTERS as dt, classifyProvenance as et, pathMatchesGlob as f, SEARCHED_FOR as ft, selectAdapter as g, parseYamlGuarded as gt, scan_pipeline_exports as h, parseWorkflow as ht, SUITE_INVALIDATING_RULE_IDS as i, deductionFor as it, sectionHeader as j, ENGINE_VERSION as jt, panel as k, isRecord as kt, discoverTestFilesPhase as l, resolveGitPath as lt, runScan as m, parseAzurePipeline as mt, KNOWN_RULE_IDS as n, capForTier as nt, assembleScanResult as o, RETIRED_RULE_IDS as ot, runFileAnalysisPhase as p, isAzurePipelineFixture as pt, TRUST as q, OVERLAP_META_BY_RULE_ID as r, computeDimensions as rt, buildUniversalRules as s, RULES as st, EVIDENCE_OVERRIDES as t, computeAgenticProfile as tt, fallbackWorkspace as u, runGit as ut, pluginsGateOpen as v, parseTsFile as vt, sanitizeErrorText as w, isLintFixtureDir as wt, loadSuppressions as x, LIMITS$1 as xt, renderGateNotice as y, detectFrameworks as yt, shouldColorize as z, isAdvisoryFinding as zt };
+export { BADGE_BAND as $, plainContext as A, ConfigValidationError as At, shouldUseAscii as B, MEASURED_FP as Bt, runForensics as C, parseTsFile as Ct, nextStep as D, createIgnoreMatcher as Dt, buildFooter as E, LIMITS$1 as Et, padTo as F, isRecord as Ft, countOrNull as G, DEDUCTIONS as Gt, atomicTempPath as H, degradationsSince as Ht, palette as I, parseJsonFile as It, evidenceTag as J, SEVERITY_ORDER as Jt, deriveScoreState as K, QA_IMPACT_LABELS as Kt, sanitizeData as L, resolveGitPath as Lt, severityIcon as M, loadConfig as Mt, box as N, readFileBounded as Nt, okIcon as O, globToRegExp as Ot, measure as P, ENGINE_VERSION as Pt, TRUST_RUNGS as Q, isValidCategory as Qt, scoreGauge as R, runGit as Rt, renderSuppressions as S, computeCodeText as St, FLAKE_GLYPH as T, DEFAULT_IGNORE_MATCHER as Tt, sweepStaleTempFiles as U, recordDegradation as Ut, wrapText as V, beginDegradationWindow as Vt, writeFileAtomic as W, summarizeDegradations as Wt, testsAnalyzedCell as X, deriveEvidenceLevel as Xt, headlineFor as Y, TRUST_ORDER as Yt, verdictFor as Z, isAdvisoryFinding as Zt, summarizeForensicVerdicts as _, SEARCHED_FOR as _t, applyPostScanProcessing as a, correlateFindings as at, loadLocalRules as b, parseWorkflow as bt, discoverAndParseRuntimeReport as c, capForTier as ct, isValidFindingRecord as d, massCeiling as dt, SCORE as et, pathMatchesGlob as f, compareCodePoints as ft, selectAdapter as g, SCAN_ADAPTERS as gt, scan_pipeline_exports as h, getRule as ht, SUITE_INVALIDATING_RULE_IDS as i, getReachableFiles as it, sectionHeader as j, isSuppressionActive as jt, panel as k, isLintFixtureDir as kt, discoverTestFilesPhase as l, computeDimensions as lt, runScan as m, RULES as mt, KNOWN_RULE_IDS as n, TINT as nt, assembleScanResult as o, classifyProvenance as ot, runFileAnalysisPhase as p, RETIRED_RULE_IDS as pt, evidenceLevelOf as q, RULE_CATEGORIES as qt, OVERLAP_META_BY_RULE_ID as r, buildDependencyGraph as rt, buildUniversalRules as s, computeAgenticProfile as st, EVIDENCE_OVERRIDES as t, STATUS as tt, fallbackWorkspace as u, deductionFor as ut, pluginsGateOpen as v, isAzurePipelineFixture as vt, sanitizeErrorText as w, detectFrameworks as wt, loadSuppressions as x, parseYamlGuarded as xt, renderGateNotice as y, parseAzurePipeline as yt, shouldColorize as z, buildEvidenceGraph as zt };
+
+//# sourceMappingURL=scan-pipeline-DT8DWAMl.mjs.map