mjolnir-qa 4.0.0 → 6.0.0

package/dist/cli.d.mts

@@ -60,6 +60,23 @@ type RuleCategory = (typeof RULE_CATEGORIES)[number];
  *        retried, or timed out in the report).
  * INVARIANT (structurally enforced): L3–L5 require runtime
  * corroboration — a static-only finding can never claim L4/L5.
+ *
+ * THREE LADDER VOCABULARIES now share this shape, and the letters are the
+ * only thing distinguishing them:
+ *
+ *   `L0`–`L5`  RUNTIME TRUST — how much a consumer can believe one finding.
+ *              Here.
+ *   `F0`–`F5`  FRAMEWORK SUPPORT — a hand-declared target per framework.
+ *              `FrameworkSupportLevel`, src/frameworks/framework-inventory.ts
+ *   `M0`–`M5`  CAPABILITY MATURITY — DERIVED from evidence, and the only
+ *              one of the three that is a measurement.
+ *              `Maturity`, src/v6/maturity.ts
+ *
+ * `tests/v6/maturity-vocabulary.spec.ts` holds the two vocabulary sets apart
+ * and fails if they ever share a member. `M` is the only DERIVED of the three,
+ * and that is the distinction worth remembering when reading a level out of a
+ * report: `F` and `L` are declarations about the world, `M` is a function of
+ * what this repository can demonstrate.
  */
 declare const TRUST_ORDER: readonly ["L0", "L1", "L2", "L3", "L4", "L5"];
 type TrustLevel = (typeof TRUST_ORDER)[number];
@@ -80,7 +97,13 @@ interface RuntimeCorroboration {
    * constrains TRUE-FLAKE derivation, which lives in the analysis, not
    * in the provenance label.
    */
-  source: "playwright-json" | "junit-xml" | "jest-json" | "vitest-json" | "playwright-trace" | "har";
+  source: "playwright-json" | "junit-xml" | "jest-json" | "vitest-json" | "playwright-trace" | "har" |
+  /**
+   * Visual Studio TRX (`dotnet test`). Added so .NET runs can corroborate at
+   * all — previously the union had no member a TRX source could inhabit, so a
+   * C# run was unrepresentable rather than merely unrecognised.
+   */
+  "dotnet-trx";
   /** Number of tests executed in the finding's file (any level). */
   testsExecuted: number;
   /**
@@ -202,14 +225,16 @@ interface Finding {
 /**
  * Mutation evidence (master plan P5, plan 1788853205786 — flag 6,
  * decision 8): provenance from a mutation-testing report
- * (`mjolnir mutation <report>`), stamped on matching findings.
+ * (a Stryker or Mutmut report — the `mutation` verb is retired in the
+ * v6 carve), stamped on matching findings.
  *
  * PROVENANCE IS NOT TRUTH: a survived mutant is code the suite would
  * not notice changing — evidence FOR a nearby finding, never a claim
- * the finding is "proven real". The E1→E2 consolidation is BY
- * DERIVATION and lives in src/mutation/derive.ts (documented in
- * docs/RULE-LIFECYCLE.md + the machine-contract docs). trustLevel never
- * rises from mutation evidence alone: nothing ran.
+ * the finding is "proven real". The E1→E2 consolidation was BY
+ * DERIVATION, and lived with the `mutation` verb the v6 carve removed;
+ * the rule is documented in docs/RULE-LIFECYCLE.md and the
+ * machine-contract docs. trustLevel never rises from mutation evidence
+ * alone: nothing ran.
  */
 interface MutationEvidence {
   /** Which mutation tool produced the report. */
@@ -383,12 +408,42 @@ interface ScanResult {
     durationMs: number;
     /**
      * Named reasons the scan stopped early (audit H-8): "deadline",
-     * "file-cap:<adapter>", "rule-loop-deadline". Present only when
-     * truncation actually happened — absence means the scan is whole.
+     * "file-cap:<adapter>", "rule-loop-deadline", "ast-budget-fallback".
+     * Present only when truncation actually happened — absence means the
+     * scan is whole.
+     *
+     * Open `string[]`, NOT a closed union: a producer may add a member
+     * without a schema bump. The cost of that choice is that a consumer
+     * asserting the EXACT set breaks on every new reason, so assertions
+     * here are containment assertions, never `toEqual([...])`.
+     *
+     * "ast-budget-fallback" specifically means the scan ran out of time
+     * before a file could be analyzed through its adapter's AST stage, and
+     * that file was analyzed by regex instead. It is a capability loss, not
+     * a speed trade, and the count of affected files is in `reasons` as
+     * "ast-budget-fallback-files:<n>".
      */
     truncationReasons?: string[];
     /** Canonical completion reasons, including scope and parser degradation. */
     reasons?: string[];
+    /**
+     * Per-reason counts of capability lost inside a `catch` that returned a
+     * clean default — the degradation ledger (`src/engine/degradation-ledger.ts`).
+     *
+     * Distinct from `truncationReasons`, which means the scan STOPPED, and
+     * from `reasons`, which is a flat string set. This one is structured and
+     * reason-coded so "the AST mask was unavailable for 3 files" and "3 files
+     * were skipped" cannot be confused. Each entry is ALSO surfaced in
+     * `reasons` as `degraded:<reason>:<count>`.
+     *
+     * Present only when at least one degradation happened; absence means the
+     * scan lost no capability to a swallowed error, OR the producer predates
+     * the ledger. A non-empty value always forces `partial: true`.
+     */
+    degradations?: Array<{
+      reason: string;
+      count: number;
+    }>;
     /**
      * Rule executions that threw and were swallowed by crash isolation
      * (audit R-9). 0 means no rule silently failed; absence means the
@@ -396,6 +451,45 @@ interface ScanResult {
      */
     rulesCrashed?: number;
     parseFallbacks?: number;
+    /**
+     * How much of the rule registry this scan could see.
+     *
+     * ORTHOGONAL TO `partial`, and that is the contract. `partial` means
+     * "this run lost something while doing it" and is what `scanExitCode`,
+     * SARIF `executionSuccessful` and generated-CI gating read. A rule
+     * removed from the set before the walk started never ran, so nothing
+     * about it was lost mid-run — and folding it into `partial` would make
+     * every ordinary non-`--strict` scan exit 2, at which point nobody
+     * reads the field.
+     *
+     * `PARTIAL` means at least one quarantined rule was withheld. It is the
+     * disclosure that `analysisStatus.rules: "complete"` cannot make: a
+     * scan can read every file it was given, parse all of them, crash no
+     * rule, and still have run 45 of 79 detectors.
+     */
+    coverageState?: "COMPLETE" | "PARTIAL";
+    /**
+     * Rules that ran, and rules withheld from the run. Their sum is the
+     * rule set this scan was offered; the registry total is in
+     * `coverageState`'s reason (`coverage:quarantine:<n>` in `reasons`).
+     */
+    rulesApplied?: number;
+    rulesWithheld?: number;
+    /**
+     * WHICH rules were withheld, when the count is non-zero.
+     *
+     * The count answers "how much of the registry did this scan not see";
+     * this answers "which". It exists because a consumer that has to
+     * classify one finding — lifecycle resolution must, because a
+     * quarantined rule that never ran cannot have fixed anything — cannot
+     * answer from a number. The count alone forced those consumers to
+     * claim what they could not know.
+     *
+     * Absent means the producer did not report the set. It does NOT mean
+     * nothing was withheld: `rulesWithheld` is the authority on that, and
+     * this field is only the disambiguator.
+     */
+    withheldRuleIds?: string[];
   };
   /**
    * Scoring model version stamped into the result (ENGINE-001). Allows
@@ -404,6 +498,22 @@ interface ScanResult {
    * this field.
    */
   scoringModelVersion?: string;
+  /**
+   * Why `score` is 99 when the scorer computed 100 (contract v2).
+   *
+   * Two sites clamp: a degraded scope, and a partial scan. The clamp itself
+   * is right — 100 is the strongest claim the scorer makes and neither
+   * condition permits it — but the RESULT was byte-identical to a genuine 99,
+   * so a reader could not distinguish "withheld to 99" from "scored 99"
+   * without reading the pipeline. The presentation surfaces render the
+   * reason rather than the bare number.
+   *
+   * Absent means the score is exactly what the scorer computed. The field
+   * lives on `ScanResult`, NOT inside `runIdentity`: it describes the score,
+   * and `runIdentity` is the machine anchor whose digest must not change
+   * because a presentation reason was added.
+   */
+  scoreClampReason?: "scope-degraded" | "partial-scan";
   /**
    * Scope Integrity block (product-gap master plan §7, R4c): the
    * claimed-vs-analyzed accounting. `scopeVerdict` is PROVEN only when
@@ -638,7 +748,7 @@ type Tier = "core" | "extended" | "quarantine";
 interface OverlapMeta {
   /** Rule IDs this rule can double-report on the same root cause. */
   overlapWith?: string[];
-  /** Tier rank for survivor resolution (missing = core). */
+  /** Tier rank for survivor resolution (missing = extended, see below). */
   tier?: Tier;
   /** RULES registry order for final tie-breaking. */
   order?: number;
@@ -709,7 +819,7 @@ interface ForensicsReport {
    * `playwright-trace`: one record per trace artifact (the per-test
    * trace convention), action-level facts only.
    */
-  source: "playwright-json" | "junit-xml" | "jest-json" | "vitest-json" | "playwright-trace" | "har";
+  source: "playwright-json" | "junit-xml" | "dotnet-trx" | "jest-json" | "vitest-json" | "playwright-trace" | "har";
   totalTests: number;
   failed: number;
   skipped: number;
@@ -757,6 +867,53 @@ declare class DependencyGraph {
   has(path: string): boolean;
 }
 //#endregion
+//#region src/engine/degradation-ledger.d.ts
+/**
+ * One ledger for every silent capability loss.
+ *
+ * The defect class this exists to kill is not a deprecation warning. It is a
+ * `catch` in a DETECTION path that swallows an error and returns a clean
+ * default, so the scan still reports `analysisComplete` while quietly running
+ * with less capability than the reader was promised. Fifteen such sites were
+ * verified in this tree; the AST-layer ones are the worst, because the layer
+ * they degrade is the one that keeps prose comments and sample strings from
+ * becoming false-positive findings.
+ *
+ * Two shapes, one rule. The precedent already in the tree is
+ * `parserRetryDegradationCount` (`src/engine/tree-sitter-ast.ts`): a counted,
+ * readable number rather than a swallowed exception. This generalizes it —
+ * every site records a REASON from the closed set below, and the scan result
+ * carries the per-reason counts, so "the parser failed" becomes
+ * "the AST mask was unavailable for 3 files".
+ *
+ * The ledger is APPEND-ONLY and process-scoped, which has one consequence
+ * worth stating because it is the security-relevant direction: `beginWindow`
+ * returns a MARKER, not an ownership claim. Two concurrent `runScan` calls in
+ * one process (there is a test that does exactly this,
+ * `tests/stress/concurrent-same-process.spec.ts`) each read the records
+ * appended after their own marker, so a degradation one scan records may be
+ * counted by the other. That can only ever OVER-count — a scan reporting a
+ * degradation that happened to a sibling is more cautious than the truth, and
+ * never less — so the failure direction is the honest one. The alternative,
+ * a sink threaded through every rule context, is a diff across every call site
+ * in the tree to fix a problem that cannot make a scan look better than it is.
+ */
+/**
+ * Every reason a detection path may lose capability.
+ *
+ * Closed on purpose: a `catch` site that wants a new reason has to add it
+ * here, which is the moment a reviewer sees the claim. `tests/contract/
+ * no-uncounted-degradation.spec.ts` reads this list and fails on any `catch`
+ * in a detection path that neither rethrows, records one of these, nor
+ * appears in its allowlist with a stated reason.
+ */
+declare const DEGRADATION_REASONS: readonly ["ast-parse-failed", "ast-mask-unavailable", "ast-range-scan-failed", "ci-workflow-listing-unreadable", "workspace-manifest-unreadable", "java-build-listing-unreadable", "rules-tree-listing-unreadable", "trend-record-unparseable", "explain-fixture-unreadable", "explain-workflow-parse-failed", "explain-rule-crash", "rule-doc-rule-crash", "rule-doc-fixture-unreadable", "rule-doc-workflow-parse-failed", "python-manifest-unreadable", "ast-grammar-unavailable", "ast-typescript-parse-failed", "workflow-parse-failed"];
+type DegradationReason = (typeof DEGRADATION_REASONS)[number];
+interface DegradationCount {
+  readonly reason: DegradationReason;
+  readonly count: number;
+}
+//#endregion
 //#region src/discovery/workspace.d.ts
 /**
  * Repository discovery (Sprint-Plan W1-03).
@@ -851,6 +1008,58 @@ interface StrategyJustification {
    */
   detail: string;
 }
+/**
+ * A declared, owned, expiring grant of core status.
+ *
+ * The 6.0 demotion emptied the core tier: no rule's 95% Wilson interval
+ * clears the 10% ceiling, the smallest observed `ciHigh` across 73 measured
+ * rules being 0.138. That is the corpus being too small, not the ceiling being
+ * wrong — moving 0.1 to 0.15 would admit a rule on 24 samples, which is tuning
+ * a threshold to fit data.
+ *
+ * So core is, for now, reachable only by a maintainer saying so in the open.
+ * This is that record. It is deliberately not a boolean: `corePromotion: true`
+ * would be indistinguishable from the silent override it replaces, and would
+ * carry no date on which the claim lapses.
+ */
+interface CorePromotion {
+  /**
+   * Why this rule is trusted before the corpus can support it. A structural
+   * argument ("a shared mutable across tests is a defect regardless of
+   * frequency") is legitimate; "seemed fine" is not, and the registry
+   * check rejects a rationale shorter than a sentence.
+   */
+  rationale: string;
+  /**
+   * A named human who owns this claim. Per P9: an unowned claim is not a
+   * claim, it is a default nobody chose.
+   */
+  owner: string;
+  /** ISO-8601 date the grant was made. */
+  grantedAt: string;
+  /**
+   * ISO-8601 date the grant lapses. On this date the rule resolves to
+   * `extended` unless the grant is re-justified — the record has to be
+   * renewed by a person, not held in place by not being looked at.
+   */
+  expiresOn: string;
+  /**
+   * What backs the rationale, beyond the rationale: corpus verdict ids, a
+   * contract path, an ADR.
+   *
+   * An empty list is ALLOWED, and the registry check does not demand one —
+   * because a genuine structural premise ("a mutable shared across tests is a
+   * defect regardless of frequency") has no corpus verdict behind it, and
+   * inventing a citation for one would make the field decorative.
+   *
+   * What an empty list is NOT is invisible: `docs/CORE-READINESS.md` reports a
+   * promotion with no evidence reference as `NEEDS-SAMPLES` in its note, so a
+   * human sees an uncited grant next to a rule that still owes the corpus
+   * samples. That is the honest handling — a judgement the tree cannot verify
+   * is labelled as one — rather than a field the check pretends to verify.
+   */
+  evidenceRefs: string[];
+}
 interface RuleMeta {
   /** Frozen public API — never reused (§18.4). */
   id: string;
@@ -885,7 +1094,7 @@ interface RuleMeta {
   /**
    * How detection works, as an enforced enum (plan §09.6/§12.1 — D6
    * closed). Free-text declarations were migrated to the enum in
-   * Phase 2; the registry ratchet (tests/rules.registry.spec.ts) makes
+   * Phase 2; the registry ratchet (tests/rules/registry.spec.ts) makes
    * omission or a bad value a CI failure, so new rules must declare it.
    */
   detectionStrategy?: DetectionStrategy;
@@ -899,17 +1108,99 @@ interface RuleMeta {
   /** First released version (semver). Immutable once set. */
   introduced?: string;
   /**
-   * Tier assignment (Phase 4 — Tempering Plan; measurement-dependent
-   * default per Verification Trust Evolution Plan §11.2 Step 2).
-   * - "core": ships in the default report (≤10% measured FP rate)
-   * - "extended": included by default, lower confidence (≤30% FP)
-   * - "quarantine": opt-in only via --strict (>30% FP or unmeasured)
+   * Tier assignment — a declared floor that may only ever TIGHTEN.
+   *
+   * Three floors decide a rule's effective tier, and they are not
+   * interchangeable. Measured over all 79 live rules (B0 dry-run, 2026-10-01):
+   *
+   *   - POINT ESTIMATE  — `fpRate <= 30%` -> extended, else quarantine.
+   *     The noise floor. Answers "does this ship by default?"
+   *   - INTERVAL        — `ciHigh <= 10%` -> core, `ciLow >= 50%` -> quarantine,
+   *     else extended. The evidence floor. Answers "does the evidence place it?"
+   *   - DECLARED (this field) — overrides both.
+   *
+   * B0 measured what the first two do to this registry, and the result is the
+   * reason this field exists rather than being deleted:
+   *
+   *   - The INTERVAL floor quarantines **exactly one** of the 79 rules:
+   *     `QA-ENV-001`, which was wrong 20 times out of 20. `ciLow >= 50%`
+   *     needs 15 of 20 false positives to fire, so the worst of the rest
+   *     (`QA-TEST-002`, 62%) clears neither bound.
+   *   - No rule derives CORE. `ciHigh <= 10%` needs n >= 35 with zero false
+   *     positives and the sampler caps at 20, where even 0/20 reads 16.1%.
+   *     The arithmetic is in `tests/rules/core-tier-reachability.spec.ts`.
+   *   - **34 rules declare `quarantine`, and 33 of them would be PROMOTED into
+   *     the default scan if this field were deleted** — every one of the 33
+   *     moves in the promoting direction and none moves the other way.
+   *
+   * So this field is a THIRD floor, stricter than both derivations, and for 33
+   * of the 34 quarantined rules it is the ONLY thing holding them out of a
+   * default scan. That is why deleting the declared tiers is not a refactor: it
+   * ships 33 quarantined detectors — including the six CI rules the README's
+   * caught-by-default table marks advisory — as ordinary findings.
+   *
+   * THE INVARIANT, enforced by the tightening law in
+   * `tests/rules/registry-ratchet.spec.ts` (not by
+   * `checkDeclaredTierMayOnlyTighten`, which does not exist — the first
+   * version of this comment named a function that was never written, which is
+   * the same defect as a spec pointing at a deleted file): a declared
+   * tier may only ever hold a rule DOWN. Quarantining a well-measured rule is
+   * permitted (conservative, costs a reader a `--strict` flag); shipping a
+   * badly-measured rule is not (it hands a user a finding the corpus says is
+   * wrong). B0 found zero rules loosening, but nothing made that structural —
+   * one hand-edit could have released `QA-TEST-002` at 62% observed FP, and
+   * every derived number in the tree would have agreed with it.
+   *
    * When omitted, the tier resolves measurement-dependently via
-   * `effectiveTier` (src/rules/measurement.ts): core for rules with a
-   * valid corpus measurement, extended (displayed PROVISIONAL)
-   * otherwise — an unmeasured rule can never default into core.
+   * `effectiveTier` (src/rules/measurement.ts) — extended when there is no
+   * valid measurement, so an unmeasured rule can never default into core.
    */
   tier?: "core" | "extended" | "quarantine";
+  /**
+   * A declared, OWNED, EXPIRING grant of core status for a rule the corpus
+   * cannot yet support.
+   *
+   * Required by `checkRegistry` for any rule declaring `tier: "core"` without
+   * a valid measurement — the anti-creep law's counterpart to the measurement
+   * criterion. Without it, a core claim is a human assertion rendered with a
+   * measurement's appearance, which is precisely the defect the 6.0 demotion
+   * removed: nineteen rules showed `tier: "core"`, `measured: true`,
+   * `fpRate: 0` while their 95% Wilson upper bounds ran 13.8%–40.4%.
+   *
+   * The fields are load-bearing:
+   *
+   *   - `owner` — a named human. Per P9 an unowned claim is not a claim.
+   *   - `expiresOn` — the claim decays to `extended` when it lapses. An
+   *     assertion that never expires is a tier, which is what this exists to
+   *     avoid.
+   *   - `evidenceRefs` — corpus IDs, contract paths, or an ADR. A rationale
+   *     with nothing behind it is a preference.
+   *
+   * A rule that HAS earned core by measurement does not need one: the
+   * measurement is the record, and a hand-written rationale beside it is a
+   * second source of truth for the same fact.
+   */
+  corePromotion?: CorePromotion;
+  /**
+   * A declared, OWNED, EXPIRING commitment about a QUARANTINED rule.
+   *
+   * Same shape as `corePromotion`, and for the same reason: 34 quarantined
+   * rules carry no `owner`, no `rationale` and no `expiresOn`, so nothing in
+   * the tree says who will re-measure them or when the quarantine lapses.
+   * The expiry date IS the exit condition — `CorePromotion` has no separate
+   * exit-condition field, and a message naming one would send the next
+   * person looking for a field the contract does not have.
+   * `src/rules/tier-evidence.ts` is the worked example of the pattern for the
+   * nineteen rules demoted in 6.0, and `docs/QUARANTINE-REMEDIATION.md` is the
+   * ledger for the rest — but a ledger nobody must update is a report.
+   *
+   * The difference from `corePromotion` is the direction. `corePromotion` says
+   * "this rule is trusted before the corpus can show it"; this says "this rule
+   * is NOT trusted yet, here is when that is re-decided". A rule in quarantine
+   * WITHOUT one is a rule whose quarantine is permanent by default, which is
+   * the outcome the tier exists to avoid.
+   */
+  quarantinePromotion?: CorePromotion;
   /**
    * Detector implementation revision (Verification Trust Evolution Plan
    * §07). Increment on ANY detection-logic change — pattern, scoping,
@@ -1275,6 +1566,18 @@ declare function loadConfig(root: string, options?: {
   /** Non-fatal notes (e.g. unknown rule IDs in severityOverrides). */
   warnings: string[];
 };
+//#endregion
+//#region src/lib/glob.d.ts
+/**
+ * Whether `path` matches `glob`, in the dialect documented above.
+ *
+ * Both sides are normalized to forward slashes first. Finding paths are already
+ * normalized by the walker, but a suppression `files` pattern written on
+ * Windows ("e2e\\x.spec.ts") compiled to a literal-backslash regex that could
+ * never match any finding — the suppression silently never applied, which is
+ * the defect that made the whole dialect worth unifying.
+ */
+declare function pathMatchesGlob$1(path: string, glob: string): boolean;
 declare namespace scan_pipeline_d_exports {
   export { AssembleScanResultInput, CliArgs, DiscoveryResult, EVIDENCE_OVERRIDES$1 as EVIDENCE_OVERRIDES, FileAnalysisResult, KNOWN_RULE_IDS$1 as KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID$1 as OVERLAP_META_BY_RULE_ID, PostScanResult, SUITE_INVALIDATING_RULE_IDS$1 as SUITE_INVALIDATING_RULE_IDS, ScanHooks, applyPostScanProcessing, assembleScanResult, buildUniversalRules$1 as buildUniversalRules, discoverAndParseRuntimeReport$1 as discoverAndParseRuntimeReport, discoverTestFilesPhase, fallbackWorkspace$1 as fallbackWorkspace, isValidFindingRecord$1 as isValidFindingRecord, pathMatchesGlob$1 as pathMatchesGlob, runFileAnalysisPhase, runScan$1 as runScan, selectAdapter, summarizeForensicVerdicts };
 }
@@ -1300,6 +1603,12 @@ declare function buildUniversalRules$1(root: string, strict?: boolean, opts?: {
     rules: number;
   }>;
   externalRules: QADoctorRule[];
+  /** Rules that ran, after the quarantine filter. */
+  rulesApplied: number;
+  /** Rules removed by the quarantine filter because `--strict` was absent. */
+  rulesWithheld: number;
+  /** The same rules, named. The count is the disclosure; this is the evidence. */
+  withheldRuleIds: string[];
 }>;
 /** Rule-declared evidence-level overrides (Honesty Core). */
 declare const EVIDENCE_OVERRIDES$1: ReadonlyMap<string, string>;
@@ -1314,21 +1623,60 @@ interface CliArgs {
   verbose: boolean;
   maxDurationMs: number;
   scopeChanged: boolean;
-  format: "terminal" | "json" | "sarif" | "mermaid" | "codequality";
+  /**
+   * The output shape.
+   *
+   * `trust-report` | `pr-comment` | `github-summary` are the v6 collapse's
+   * REPLACE arm (plan §3): they were separate verbs whose entire body was
+   * "scan, then render". They are render-only — the scan, the findings, the
+   * score and the exit code are identical under all of them, and under
+   * `terminal`, which is the property that lets a format be a flag.
+   */
+  format: "terminal" | "json" | "sarif" | "mermaid" | "codequality" | "trust-report" | "pr-comment" | "github-summary";
   /** --width override for terminal box/gauge wrapping (Sprint 5 Task 22). */
   width?: number;
   /** --ascii / --no-ascii override for shouldUseAscii()'s heuristic. */
   ascii?: boolean;
   /** --tone blunt: opt-in blunter messages (Sprint 9 Task 40). */
   tone?: "blunt";
-  /** --strict: include quarantine-tier rules in the scan (Phase 4). */
+  /**
+   * --include-warn (was --strict): include quarantine-tier rules in the scan
+   * (Phase 4). The internal name predates the 6.0 flag rename and names a scan
+   * option rather than a user-facing promise; renaming it would touch every
+   * call site for a rename no user would ever see.
+   */
   strict?: boolean;
+  /**
+   * Deprecated flag spellings used on this invocation, each with its
+   * replacement. Populated by the parser so the CLI can print the whole
+   * deprecation notice once, in one place, rather than each arm printing its
+   * own warning where a `--json` consumer would have to read stderr to find it.
+   */
+  deprecatedFlags?: Array<{
+    flag: string;
+    replacement: string;
+  }>;
   /** --base <ref>: base ref for --scope changed (audit H-10). */
   base?: string;
   /** --debug: print errors swallowed by crash isolation (audit R-9). */
   debug?: boolean;
   /** --record-milestones: let a scan write .mjolnir/stats.json (audit R-1). */
   recordMilestones?: boolean;
+  /**
+   * --save-baseline: write this scan's findings to `.mjolnir/baseline.json`
+   * so a LATER scan can say RESOLVED rather than reporting the same debt
+   * forever.
+   *
+   * This flag exists because the `baseline` verb was removed in the v6 carve
+   * and nothing replaced it. That left `ci verify` unable to leave its
+   * no-baseline arm for any user, and left three shipped messages — the
+   * verify digest, the MCP `verify` tool, and the agent instruction brief —
+   * naming a command that could not perform the action they described. A
+   * recovery instruction that does not recover is worse than no instruction:
+   * it costs the reader a round trip and teaches them that the tool's own
+   * guidance is unreliable.
+   */
+  saveBaseline?: boolean;
   /**
    * --cache: reuse per-file rule verdicts from the local content-addressed
    * cache (M5.2). Post-loop processing always re-runs; the cache only
@@ -1369,6 +1717,22 @@ interface CliArgs {
    * scan semantics and exit codes are unchanged (plan §5.6).
    */
   scoreOnly?: boolean;
+  /**
+   * `--require-full-coverage`: exit `EXIT_PARTIAL` when the quarantine
+   * filter withheld any rule, even though the scan itself was whole.
+   *
+   * Off by default, and the default is the point. Coverage-PARTIAL is the
+   * state of every ordinary scan — the quarantine tier is non-empty — so
+   * making it gate by default would exit 2 on nearly every run. The fix a
+   * user reaches for is `--strict`, which switches the quarantine ON, and
+   * then the flag has nothing left to check. A flag that inverts its own
+   * remedy is worse than no flag.
+   *
+   * The opt-in is for a project that has decided quarantined detectors must
+   * be live: then a withheld rule is a real loss of coverage and the run is
+   * inconclusive, exactly as a truncated walk is.
+   */
+  requireFullCoverage?: boolean;
   /**
    * Audit C2: --enable-plugins opens the plugin trust gate for THIS
    * invocation — npm-plugin and JS-module rule sources may load (and
@@ -1390,6 +1754,30 @@ interface CliArgs {
    * mode" (no monorepo analysis).
    */
   monorepo?: boolean;
+  /**
+   * --suppressions (v6 collapse, plan §3): print the suppression LEDGER and
+   * stop. A mode, not a verb.
+   *
+   * It is a mode because the ledger is a view of `mjolnir.config.json` and
+   * nothing else — a verb for it would be a command whose whole body is
+   * "read a file and print it", which is what a flag on the command that
+   * enforces the file is for. It reads the CWD, exactly as the retired verb
+   * did, so the one observable behaviour a script can depend on is unchanged.
+   */
+  suppressions?: boolean;
+  /**
+   * --suppression-gate (v6 collapse, plan §3): fail when a suppression is
+   * ungoverned — expired, reasonless, or covering a rule that no longer
+   * exists. Runs the scan first, because a governance judgement about a
+   * suppression needs the findings the suppression would have hidden.
+   */
+  suppressionGate?: boolean;
+  /**
+   * --policy (v6 collapse, plan §3): print the scoring policy in force and
+   * stop. A policy nobody can read is a policy nobody can check, and the
+   * scorer publishes one on purpose.
+   */
+  policy?: boolean;
 }
 interface ScanHooks {
   /** Invoked when a rule throws on a file (audit R-9). */
@@ -1425,20 +1813,6 @@ interface ScanHooks {
  * scanning a filesystem root.
  */
 declare function fallbackWorkspace$1(targetAbs: string): Workspace;
-/**
- * Minimal glob match for suppression `files` patterns, with gitignore
- * `**` semantics (bug-audit M5). Supports:
- *   "tests/**"             — everything inside tests/
- *   "tests" + "/**\/*.spec.ts" — any depth UNDER tests/ (including none) ending in .spec.ts
- *   "**" + "/*.spec.ts"    — any depth including root-level files
- *   "tests/foo.spec.ts"    — exact path
- *   "*" within a segment never crosses "/".
- *
- * Forward slashes only (findings always use normalized paths). `?`,
- * character classes and `!` negation are not metacharacters here — same
- * as before this rewrite.
- */
-declare function pathMatchesGlob$1(path: string, glob: string): boolean;
 /**
  * Plan §16 + WI-11: locate a runtime run report next to the scan
  * target, using the exact conventions the forensics ingestion already
@@ -1483,6 +1857,12 @@ interface FileAnalysisResult {
   parseFallbacks: number;
   scanned: number;
   analyzed: number;
+  /**
+   * Files that HAD an AST stage and lost it to the scan deadline, so they
+   * were analyzed by regex alone. Zero for every adapter that declares no
+   * `parseAst` — that is a capability envelope, not a downgrade.
+   */
+  astFallbackFiles: number;
 }
 declare function runFileAnalysisPhase(findings: Finding[], testFiles: string[], workspace: Workspace, activeRules: UniversalRule[], hooks: ScanHooks, cache: ScanCache, rulesDigest: string, deadline: number, truncationReasons: Set<string>, declarationsByFile: Map<string, number>, fileProvenance: Array<{
   path: string;
@@ -1530,6 +1910,24 @@ interface AssembleScanResultInput {
   scopeUnrecognized: number;
   parseFailed: number;
   parseFallbacks?: number;
+  /** Files that lost their AST stage to the scan deadline. See completion.ts. */
+  astFallbackFiles?: number;
+  /**
+   * Reason-coded capability losses recorded during this scan's window. See
+   * `src/engine/degradation-ledger.ts` for why the window is an index rather
+   * than an ownership claim.
+   */
+  degradations?: readonly DegradationCount[];
+  /**
+   * Rules removed from the run by the quarantine filter because `--strict`
+   * was absent. Threaded from the rule loader — the only site that knows
+   * the withheld set — into `coverageState`. Never an input to `partial`.
+   */
+  rulesWithheld?: number;
+  /** Rules withheld, named. See `buildUniversalRules`. */
+  withheldRuleIds?: string[];
+  /** Rules that actually ran. The denominator `rulesWithheld` is measured against. */
+  rulesApplied?: number;
   scanned: number;
   analyzed?: number;
   testFiles: string[];
@@ -1574,18 +1972,23 @@ declare function assembleScanResult(o: AssembleScanResultInput): ScanResult;
  * inherently async); `runRules` and every rule stay synchronous and
  * consume `ParsedFile.ast`. Callers await the returned promise.
  */
+/**
+ * Run one scan inside its own ts-morph Project scope.
+ *
+ * The wrapper is the whole fix. ts-morph's Project caches SourceFiles by path
+ * and `parseTsFile` calls `replaceWithText` on them, so a Project shared between
+ * two concurrent scans lets one rewrite the file the other is mid-rule on —
+ * which surfaced as three of four concurrent scans reporting
+ * `rulesCrashed: 4` and `rules: "partial"`, and therefore as two different
+ * machine-contract digests from one tree. See `src/engine/ts-ast.ts`.
+ *
+ * Async context propagates across `await`, so the scope covers the whole scan
+ * without threading a Project through every adapter.
+ */
 declare function runScan$1(args: CliArgs, hooks?: ScanHooks): Promise<ScanResult>;
 //#endregion
 //#region src/engine/version.d.ts
-/**
- * Engine version, as a leaf module: `runIdentity` (R4c) needs the engine
- * version inside scan-pipeline WITHOUT importing cli.ts (a cycle — cli
- * imports the pipeline). The literal follows the same discipline as
- * CLI_VERSION and SARIF's driver.version: kept in sync on release by
- * scripts/sync-sarif-version.cjs and guarded by the version-consistency
- * spec. cli.ts re-exports this as CLI_VERSION.
- */
-declare const ENGINE_VERSION = "4.0.0";
+declare const ENGINE_VERSION = "6.0.0";
 //#endregion
 //#region src/cli-io.d.ts
 /**
@@ -1601,6 +2004,23 @@ export declare const out: Output;
 export declare const err: Output;
 export declare function internalErrorMessage(err: unknown, emit: (s: string) => void, debug: boolean): void;
 //#endregion
+//#region src/claim-evidence.d.ts
+/**
+ * The gate level a command applies to its findings. `advisory` is the
+ * `--blocking none` posture: findings are reported and never gate.
+ */
+type GateLevel = "advisory" | "error" | "warning";
+//#endregion
+//#region src/commands/why.d.ts
+/**
+ * Testable why command core. Returns the process exit code.
+ * Live mode awaits the real scan; saved-report mode is synchronous.
+ */
+export declare function runWhyCommand(argv: string[], io?: {
+  out: Output;
+  err: Output;
+}): Promise<number>;
+//#endregion
 //#region src/cli-handlers.d.ts
 /**
  * Render scan output in the requested format.
@@ -1608,90 +2028,134 @@ export declare function internalErrorMessage(err: unknown, emit: (s: string) =>
  * Extracted from runScanCommand (Task 6) to reduce cyclomatic complexity.
  * Handles sarif, mermaid, codequality, json, and terminal (trust-report)
  * rendering. The caller handles first-run hint + milestones separately.
+ *
+ * The v6 collapse's REPLACE arm (plan §3) lands here: `trust-report`,
+ * `pr-comment` and `summary` were three verbs whose whole body was this
+ * function with one branch each. The renderers already existed; what was
+ * missing was a way to name them from the one verb a reader already knows.
+ *
+ * `--format trust-report` is the terminal render, which is why the `else`
+ * below is spelled `terminal` and not `trust-report`: naming a default after
+ * a flag that is also its value is a way to make the default untypeable.
  */
 export declare function renderScanOutput(result: Awaited<ReturnType<typeof runScan$1>>, args: CliArgs, target: string, io: {
   out: Output;
   err: Output;
-}): void;
+}, gate: GateLevel): void;
 export declare function runScanCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
-export declare function runTriageCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): number;
-export declare function runMutationCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-export declare function runBadgeCommand(argv: string[], io?: {
+export declare function runFixCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
-export declare function runDebtCommand(argv: string[], io?: {
+export declare function runVerifyCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
-export declare function runFixCommand(argv: string[], io?: {
+export declare function runPrCommentCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
-export declare function runCreateRuleCommand(argv: string[], io?: {
+export declare function runStatsCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): number;
-export declare function runImpactCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-export declare function runBaselineCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-export declare function runVerifyCommand(argv: string[], io?: {
+export declare function runHandoverCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
-export declare function runDiffCommand(argv: string[], io?: {
+export declare function runPwReportCommand(argv: string[], io?: {
   out: Output;
   err: Output;
-}): Promise<number>;
-export declare function runPrCommentCommand(argv: string[], io?: {
+}): number;
+export declare function runRulesCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
-export declare function runStatsCommand(argv: string[], io?: {
+/**
+ * `explain` ARMS — the v6 collapse's MOVE arm, group 2 (plan §3).
+ *
+ * `explain` is the question verb: what does this finding mean, and what else
+ * does it touch. Five capabilities were top-level verbs that all answer a
+ * variation of that question, and each is a flag here:
+ *
+ *   --list       the rule catalogue        (was `mjolnir explain --list`)
+ *   <file:line>  why this finding          (was `mjolnir explain <file:line>` — already
+ *                                           delegated by the subject form)
+ *   --callers    who calls this symbol     (was `mjolnir explain --callers`)
+ *   --plan       what to do next           (was `mjolnir explain --plan`)
+ *   --evidence   what really ran           (was the `triage` verb)
+ *   --playwright a Playwright run summary  (was `mjolnir explain --playwright`)
+ *
+ * The table is the same shape as `CI_SUBCOMMANDS`, and for the same reason: it
+ * is the single source the dispatcher reads AND the help renders from, so an
+ * arm that exists is documented and one that is documented exists.
+ *
+ * `--playwright` is INTERNAL in the plan and marked here as such. `pw-report`
+ * summarised a Playwright JSON run for a person reading CI output; the same
+ * information arrives through `--evidence` once it reads a report rather than
+ * a specific runner's format, and one flag that means "the run summary"
+ * whichever runner produced it beats two that mean it for one of them.
+ */
+/**
+ * `explain --evidence` — the runtime-evidence arm.
+ *
+ * The `triage` verb's body, verbatim in behaviour: read a real run, classify
+ * every test's verdict, and render the table plus the meeting artifact. The
+ * arm does not add anything, which is the point — the capability is the same
+ * one `src/forensics/triage.ts` and the MCP server already expose, and the
+ * reason the verb is retired is the reason the flag exists.
+ *
+ * `--json` and `--md` are the verb's own output selectors, preserved so a
+ * script written against them keeps working with one word changed.
+ *
+ * The one behaviour note: the report is written to `--flaky-md`'s path, which
+ * the verb also did, and the arm does not silently write a file into a
+ * directory a reader did not name. `--no-md` is still how you decline it.
+ */
+export declare function runEvidenceArm(argv: string[], io: {
   out: Output;
   err: Output;
 }): number;
-export declare function runHandoverCommand(argv: string[], io?: {
+export declare const EXPLAIN_ARMS: Record<string, {
+  summary: string;
+  status: "public" | "internal";
+  run: (argv: string[], io: {
+    out: Output;
+    err: Output;
+  }) => Promise<number> | number;
+}>;
+export declare function runExplainCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
-export declare function runInitCommand(argv: string[], io?: {
+export declare function runDoctorPlaywright(argv: string[], io?: {
   out: Output;
-  err: Output;
-}): number;
-export declare function runPwReportCommand(argv: string[], io?: {
+  err?: Output;
+}): Promise<number>;
+//#endregion
+//#region src/commands/milestone.d.ts
+export declare function runFrameworkMaturityCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): number;
-export declare function runForensicsCommand(argv: string[], io?: {
+export declare function runSuppressionGateCommand(argv: string[], io?: {
   out: Output;
   err: Output;
-}): number;
-export declare function runRulesCommand(argv: string[], io?: {
+}): Promise<number>;
+export declare function runCrossFileCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
-export declare function runExplainCommand(argv: string[], io?: {
+export declare function runEvidenceGraphCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
-export declare function runDoctorPlaywright(argv: string[], io?: {
+export declare function runCIIntegrityCommand(argv: string[], io?: {
   out: Output;
-  err?: Output;
+  err: Output;
 }): Promise<number>;
 //#endregion
 //#region src/commands/doctor-run.d.ts
@@ -1700,29 +2164,6 @@ export declare function runDoctorCommand(argv: string[], io?: {
   err: Output;
 }): number;
 //#endregion
-//#region src/commands/summary.d.ts
-/**
- * Testable summary command core. Returns the process exit code.
- * Streams: annotations → stdout (always; GitHub greps them), summary →
- * step-summary file when set unless --stdout. Unknown flags are a
- * usage error (exit 10) — a typo'd --stdout must not silently route
- * the summary to $GITHUB_STEP_SUMMARY.
- */
-export declare function runSummaryCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): number;
-//#endregion
-//#region src/commands/why.d.ts
-/**
- * Testable why command core. Returns the process exit code.
- * Live mode awaits the real scan; saved-report mode is synchronous.
- */
-export declare function runWhyCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-//#endregion
 //#region src/commands/handoff.d.ts
 /**
  * Testable handoff command core. Returns the process exit code.
@@ -1744,15 +2185,9 @@ export declare function runInstallCommand(argv: string[], io?: {
   err: Output;
 }, cwd?: string): number;
 //#endregion
-//#region src/commands/trust-report.d.ts
-export declare function runTrustReportCommand(argv: string[], io: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-//#endregion
 //#region src/commands/release-trust.d.ts
 /**
- * CLI verb: `mjolnir release-trust [--json] [repo-root]`.
+ * CLI verb: `mjolnir ci release-trust [--json] [repo-root]`.
  * Exit contract (frozen set): 0 verdict PASS · 1 verdict non-PASS ·
  * 2 no fixtures root (not an mjolnir checkout — BLOCKED context) ·
  * 10 usage error · 20 internal error.
@@ -1762,67 +2197,12 @@ export declare function runReleaseTrustCommand(argv: string[], io?: {
   err: Output;
 }): number;
 //#endregion
-//#region src/commands/business-case.d.ts
-/**
- * Entry point for `mjolnir business-case`.
- *
- * Flags:
- *   --incident-cost <n>  The cost of ONE false-green incident in your
- *                        organisation. Until you supply it, no dollar
- *                        figure is printed at all.
- *   --strict             Include quarantine-tier findings
- *
- * `--history` and `--projected` are GONE. Both promised arithmetic this
- * tool cannot do: `--history` claimed to estimate from actual scan
- * improvements while reading no history at all, and `--projected` divided
- * the total by six and called the quotient a monthly rate. A flag that
- * does not do what its help says is worse than no flag, because the help
- * is the promise.
- */
-export declare function runBusinessCaseCommand(argv: string[], io?: {
-  out: Output;
-  err?: Output;
-}): Promise<number>;
-//#endregion
-//#region src/commands/release-report.d.ts
-/**
- * CLI verb: `mjolnir release-report [--since <ref>] [--history <json>] [target]`.
- */
-export declare function runReleaseReportCommand(argv: string[], io: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-//#endregion
-//#region src/commands/report-playwright.d.ts
-export declare function runReportPlaywrightCommand(argv: string[], io: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-//#endregion
-//#region src/commands/trend.d.ts
-export declare function runTrendCommand(argv: string[], io: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-//#endregion
-//#region src/commands/exec-report.d.ts
-export declare function runExecReportCommand(argv: string[], io: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-//#endregion
 //#region src/commands/policy.d.ts
 export declare function runPolicyCommand(argv: string[], io: {
   out: Output;
   err: Output;
 }): Promise<number>;
 //#endregion
-//#region src/commands/quarantine.d.ts
-export declare function runQuarantineCommand(argv: string[], io: {
-  out: Output;
-  err: Output;
-}): number;
-//#endregion
 //#region src/commands/analyze.d.ts
 export declare function runAnalyzeCommand(argv: string[], io: {
   out: Output;
@@ -1835,53 +2215,17 @@ export declare function runCiAdapterCommand(argv: string[], io: {
   err: Output;
 }): number;
 //#endregion
-//#region src/commands/dashboard.d.ts
-export declare function runDashboardCommand(argv: string[], io: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-//#endregion
-//#region src/commands/enterprise.d.ts
-export declare function runEnterpriseCommand(argv: string[], io: {
-  out: Output;
-  err: Output;
-}): number;
-//#endregion
-//#region src/commands/maturity.d.ts
-export declare function runMaturityCommand(argv: string[], io: {
-  out: Output;
-  err: Output;
-}): number;
-//#endregion
-//#region src/commands/milestone.d.ts
-export declare function runFrameworkMaturityCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): number;
-export declare function runSuppressionGateCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-export declare function runCrossFileCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
+//#region src/commands/contract-verify.d.ts
 export declare function runContractVerifyCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
+//#endregion
+//#region src/commands/release-trend.d.ts
 export declare function runTrustTrendCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
-export declare function runEvidenceGraphCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-export declare function runCIIntegrityCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
 //#endregion
 //#region src/cli.d.ts
 export declare const runScan: typeof runScan$1, buildUniversalRules: typeof buildUniversalRules$1, fallbackWorkspace: typeof fallbackWorkspace$1, pathMatchesGlob: typeof pathMatchesGlob$1, isValidFindingRecord: typeof isValidFindingRecord$1, discoverAndParseRuntimeReport: typeof discoverAndParseRuntimeReport$1, KNOWN_RULE_IDS: ReadonlySet<string>, OVERLAP_META_BY_RULE_ID: ReadonlyMap<string, OverlapMeta>, EVIDENCE_OVERRIDES: ReadonlyMap<string, string>, SUITE_INVALIDATING_RULE_IDS: ReadonlySet<string>;
@@ -1897,7 +2241,7 @@ export declare const MAX_DURATION_MS = 3600000;
 export declare function parseArgs(argv: string[], onError?: (detail: UsageErrorDetail) => void): CliArgs | null;
 /** Hand-rolled Levenshtein distance (plan M2: no new dependencies). */
 export declare function levenshtein(a: string, b: string): number;
-/** Nearest known flags within distance ≤ 2, nearest first. */
+/** Nearest known flags within distance ≤ 2, nearest first. */
 export declare function nearestFlags(flag: string, max?: number): string[];
 /**
  * Friendly usage error (plan M2, exit 10 preserved): nearest-flag
@@ -1932,6 +2276,8 @@ export declare function validateScanTarget(target: string, err: Output): number
  * zero findings is exactly the case that turns a bug into a green build.
  */
 export declare function exitForFindings(findings: readonly Finding[], gate: "advisory" | "error" | "warning"): number;
+/** `mjolnir ci --help`, rendered from the table so it cannot drift. */
+export declare function renderCiSubcommandHelp(): string;
 /** Testable `ci install` handler. Returns the process exit code. */
 export declare function runCiInstall(argv: string[], io?: {
   out: Output;