mjolnir-qa 5.0.0 → 6.0.1

package/dist/cli.d.mts

@@ -1,78 +1,3 @@
-//#region src/v6/test-doubles.d.ts
-/** How serious the pattern is. Closed enum, so a renderer cannot invent a
- *  fourth severity at a call site. */
-declare const DOUBLE_RISKS: readonly ["NO_ASSERTION", "DOUBLE_ONLY", "DOUBLE_MIXED", "DOUBLE_SUBJECT"];
-type DoubleRisk = (typeof DOUBLE_RISKS)[number];
-interface DoubleFinding {
-  risk: DoubleRisk;
-  /** How many assertions there are in total. */
-  assertions: number;
-  /** How many are about a double. */
-  doubleAssertions: number;
-  /** How many carry real evidence about the code under test. */
-  substantiatingAssertions: number;
-  /** 0..1 — the share of assertions that prove nothing. */
-  hollowRatio: number;
-  /** The one-line statement a surface can render verbatim. */
-  statement: string;
-}
-/**
- * A roll-up across a suite. A suite is hollow when *no* test in it
- * substantiates anything — which is a different and stronger statement
- * than "some tests are hollow", and the one a user needs at the top of a
- * report.
- */
-declare function assessSuite(findings: readonly DoubleFinding[]): {
-  tests: number;
-  hollow: number;
-  substantiating: number;
-  hollowRatio: number;
-  verdict: "SUBSTANTIATED" | "PARTIALLY_HOLLOW" | "HOLLOW";
-};
-//#endregion
-//#region src/v6/tool-coverage.d.ts
-/** What the engine can do with a detected tool. Closed enum, so a
- *  renderer cannot invent a fifth state. */
-declare const TOOL_COVERAGE_STATES: readonly ["UNDERSTOOD", "DECLARED", "OUT_OF_SCOPE", "IGNORED"];
-type ToolCoverageState = (typeof TOOL_COVERAGE_STATES)[number];
-interface ToolCoverageEntry {
-  name: string;
-  state: ToolCoverageState;
-  /** The census category, when one applies. */
-  category: string | null;
-  /** The census entry id, when the engine has one. */
-  censusId: string | null;
-  /** What the cost of not handling it is, in one sentence. */
-  consequence: string;
-}
-interface BlindSpot {
-  id: string;
-  /** What the engine cannot see. */
-  blindTo: string;
-  /** Why it matters, in one sentence. */
-  consequence: string;
-}
-interface ToolCoverage {
-  /** Every QA tool the probe saw, with what the engine does about it. */
-  tools: readonly ToolCoverageEntry[];
-  counts: Readonly<Record<ToolCoverageState, number>>;
-  /** Tools the engine sees and cannot act on. */
-  unhandled: readonly ToolCoverageEntry[];
-  /**
-   * What the engine cannot see **through**, whether or not the tool is
-   * known. This is the part a user cannot infer, and the part that makes
-   * a green run mean something.
-   */
-  blindSpots: readonly BlindSpot[];
-  /** The double-analysis roll-up, when the caller supplied test data. */
-  suite: ReturnType<typeof assessSuite> | null;
-  /** One line a surface may render verbatim. */
-  statement: string;
-  /** Never a claim of completeness. */
-  complete: false;
-}
-//#endregion
-//#region src/types.d.ts
 /**
  * Mjolnir — canonical types (JSON contract v1, schemaVersion 1).
  *
@@ -134,6 +59,23 @@ type RuleCategory = (typeof RULE_CATEGORIES)[number];
  *        retried, or timed out in the report).
  * INVARIANT (structurally enforced): L3–L5 require runtime
  * corroboration — a static-only finding can never claim L4/L5.
+ *
+ * THREE LADDER VOCABULARIES now share this shape, and the letters are the
+ * only thing distinguishing them:
+ *
+ *   `L0`–`L5`  RUNTIME TRUST — how much a consumer can believe one finding.
+ *              Here.
+ *   `F0`–`F5`  FRAMEWORK SUPPORT — a hand-declared target per framework.
+ *              `FrameworkSupportLevel`, src/frameworks/framework-inventory.ts
+ *   `M0`–`M5`  CAPABILITY MATURITY — DERIVED from evidence, and the only
+ *              one of the three that is a measurement.
+ *              `Maturity`, src/v6/maturity.ts
+ *
+ * `tests/v6/maturity-vocabulary.spec.ts` holds the two vocabulary sets apart
+ * and fails if they ever share a member. `M` is the only DERIVED of the three,
+ * and that is the distinction worth remembering when reading a level out of a
+ * report: `F` and `L` are declarations about the world, `M` is a function of
+ * what this repository can demonstrate.
  */
 declare const TRUST_ORDER: readonly ["L0", "L1", "L2", "L3", "L4", "L5"];
 type TrustLevel = (typeof TRUST_ORDER)[number];
@@ -154,7 +96,13 @@ interface RuntimeCorroboration {
    * constrains TRUE-FLAKE derivation, which lives in the analysis, not
    * in the provenance label.
    */
-  source: "playwright-json" | "junit-xml" | "jest-json" | "vitest-json" | "playwright-trace" | "har";
+  source: "playwright-json" | "junit-xml" | "jest-json" | "vitest-json" | "playwright-trace" | "har" |
+  /**
+   * Visual Studio TRX (`dotnet test`). Added so .NET runs can corroborate at
+   * all — previously the union had no member a TRX source could inhabit, so a
+   * C# run was unrepresentable rather than merely unrecognised.
+   */
+  "dotnet-trx";
   /** Number of tests executed in the finding's file (any level). */
   testsExecuted: number;
   /**
@@ -276,14 +224,16 @@ interface Finding {
 /**
  * Mutation evidence (master plan P5, plan 1788853205786 — flag 6,
  * decision 8): provenance from a mutation-testing report
- * (`mjolnir mutation <report>`), stamped on matching findings.
+ * (a Stryker or Mutmut report — the `mutation` verb is retired in the
+ * v6 carve), stamped on matching findings.
  *
  * PROVENANCE IS NOT TRUTH: a survived mutant is code the suite would
  * not notice changing — evidence FOR a nearby finding, never a claim
- * the finding is "proven real". The E1→E2 consolidation is BY
- * DERIVATION and lives in src/mutation/derive.ts (documented in
- * docs/RULE-LIFECYCLE.md + the machine-contract docs). trustLevel never
- * rises from mutation evidence alone: nothing ran.
+ * the finding is "proven real". The E1→E2 consolidation was BY
+ * DERIVATION, and lived with the `mutation` verb the v6 carve removed;
+ * the rule is documented in docs/RULE-LIFECYCLE.md and the
+ * machine-contract docs. trustLevel never rises from mutation evidence
+ * alone: nothing ran.
  */
 interface MutationEvidence {
   /** Which mutation tool produced the report. */
@@ -500,6 +450,45 @@ interface ScanResult {
      */
     rulesCrashed?: number;
     parseFallbacks?: number;
+    /**
+     * How much of the rule registry this scan could see.
+     *
+     * ORTHOGONAL TO `partial`, and that is the contract. `partial` means
+     * "this run lost something while doing it" and is what `scanExitCode`,
+     * SARIF `executionSuccessful` and generated-CI gating read. A rule
+     * removed from the set before the walk started never ran, so nothing
+     * about it was lost mid-run — and folding it into `partial` would make
+     * every ordinary non-`--strict` scan exit 2, at which point nobody
+     * reads the field.
+     *
+     * `PARTIAL` means at least one quarantined rule was withheld. It is the
+     * disclosure that `analysisStatus.rules: "complete"` cannot make: a
+     * scan can read every file it was given, parse all of them, crash no
+     * rule, and still have run 45 of 79 detectors.
+     */
+    coverageState?: "COMPLETE" | "PARTIAL";
+    /**
+     * Rules that ran, and rules withheld from the run. Their sum is the
+     * rule set this scan was offered; the registry total is in
+     * `coverageState`'s reason (`coverage:quarantine:<n>` in `reasons`).
+     */
+    rulesApplied?: number;
+    rulesWithheld?: number;
+    /**
+     * WHICH rules were withheld, when the count is non-zero.
+     *
+     * The count answers "how much of the registry did this scan not see";
+     * this answers "which". It exists because a consumer that has to
+     * classify one finding — lifecycle resolution must, because a
+     * quarantined rule that never ran cannot have fixed anything — cannot
+     * answer from a number. The count alone forced those consumers to
+     * claim what they could not know.
+     *
+     * Absent means the producer did not report the set. It does NOT mean
+     * nothing was withheld: `rulesWithheld` is the authority on that, and
+     * this field is only the disambiguator.
+     */
+    withheldRuleIds?: string[];
   };
   /**
    * Scoring model version stamped into the result (ENGINE-001). Allows
@@ -508,6 +497,22 @@ interface ScanResult {
    * this field.
    */
   scoringModelVersion?: string;
+  /**
+   * Why `score` is 99 when the scorer computed 100 (contract v2).
+   *
+   * Two sites clamp: a degraded scope, and a partial scan. The clamp itself
+   * is right — 100 is the strongest claim the scorer makes and neither
+   * condition permits it — but the RESULT was byte-identical to a genuine 99,
+   * so a reader could not distinguish "withheld to 99" from "scored 99"
+   * without reading the pipeline. The presentation surfaces render the
+   * reason rather than the bare number.
+   *
+   * Absent means the score is exactly what the scorer computed. The field
+   * lives on `ScanResult`, NOT inside `runIdentity`: it describes the score,
+   * and `runIdentity` is the machine anchor whose digest must not change
+   * because a presentation reason was added.
+   */
+  scoreClampReason?: "scope-degraded" | "partial-scan";
   /**
    * Scope Integrity block (product-gap master plan §7, R4c): the
    * claimed-vs-analyzed accounting. `scopeVerdict` is PROVEN only when
@@ -533,18 +538,6 @@ interface ScanResult {
     /** The named scope reasons, present only when PARTIAL. */
     reasons?: string[];
   };
-  /**
-   * Tool coverage (v6): which QA tooling this scan actually saw, what the
-   * engine does about it, and what it is blind to.
-   *
-   * Present when the scan ran the ecosystem probe. Additive within
-   * schemaVersion 1; absent when the producer predates this field.
-   *
-   * complete is always false. A scan that could not see through a test
-   * double must never render as a scan with no blind spots, and that is
-   * the one claim a verification tool cannot make.
-   */
-  toolCoverage?: ToolCoverage;
   /**
    * Run Identity (R4c): the deterministic anchor binding verdict ←
    * evidence ← execution ← scope ← source ← rule(rev). Present when the
@@ -745,22 +738,16 @@ interface ForensicVerdictSummary {
   /** INCONCLUSIVE outcome count — a first-class result, not a failure. */
   inconclusive: number;
 }
-//#endregion
-//#region src/engine/tier-policy.d.ts
 type Tier = "core" | "extended" | "quarantine";
-//#endregion
-//#region src/engine/overlap-dedup.d.ts
 /** Per-rule metadata the dedup pass needs, built from RULES. */
 interface OverlapMeta {
   /** Rule IDs this rule can double-report on the same root cause. */
   overlapWith?: string[];
-  /** Tier rank for survivor resolution (missing = core). */
+  /** Tier rank for survivor resolution (missing = extended, see below). */
   tier?: Tier;
   /** RULES registry order for final tie-breaking. */
   order?: number;
 }
-//#endregion
-//#region src/forensics/classify.d.ts
 declare const FORENSIC_VERDICTS: readonly ["likely-real-defect", "environmental-failure", "infrastructure-failure", "flaky", "retry-dependent", "unstable-construction", "inconclusive"];
 type ForensicVerdict = (typeof FORENSIC_VERDICTS)[number];
 declare const EVIDENCE_STATES: readonly ["exists", "absent", "unsupported", "contradictory", "insufficient"];
@@ -775,8 +762,6 @@ interface ForensicClassification {
     construction: number;
   };
 }
-//#endregion
-//#region src/forensics/types.d.ts
 type RunStatus = "passed" | "failed" | "timedOut" | "skipped" | "interrupted";
 /** Derived per-test reliability facts. */
 interface TestVerdict {
@@ -825,7 +810,7 @@ interface ForensicsReport {
    * `playwright-trace`: one record per trace artifact (the per-test
    * trace convention), action-level facts only.
    */
-  source: "playwright-json" | "junit-xml" | "jest-json" | "vitest-json" | "playwright-trace" | "har";
+  source: "playwright-json" | "junit-xml" | "dotnet-trx" | "jest-json" | "vitest-json" | "playwright-trace" | "har";
   totalTests: number;
   failed: number;
   skipped: number;
@@ -847,80 +832,6 @@ interface ForensicsReport {
   /** Named reasons for incompleteness (e.g. "size-limit", "cumulative-size-limit", "parse-failure"). */
   incompleteReasons: string[];
 }
-//#endregion
-//#region src/engine/dependency-graph.d.ts
-/**
- * Dependency Graph (ECO-005).
- *
- * Parses package manifests (package.json, pyproject.toml, pom.xml) to
- * build a dependency graph. Supports transitive dependency resolution,
- * dependent lookup, and reachable-file computation from test files.
- */
-interface DependencyNode {
-  path: string;
-  dependencies: string[];
-}
-declare class DependencyGraph {
-  private readonly nodes;
-  addNode(node: DependencyNode): void;
-  getDependencies(path: string): string[];
-  getTransitiveDependencies(path: string): string[];
-  getDependents(path: string): string[];
-  get allPaths(): string[];
-  get size(): number;
-  /** Whether the graph knows this exact key. Reachability must not
-   *  treat "not in the graph" as "nothing to traverse" without saying so. */
-  has(path: string): boolean;
-}
-//#endregion
-//#region src/engine/degradation-ledger.d.ts
-/**
- * One ledger for every silent capability loss.
- *
- * The defect class this exists to kill is not a deprecation warning. It is a
- * `catch` in a DETECTION path that swallows an error and returns a clean
- * default, so the scan still reports `analysisComplete` while quietly running
- * with less capability than the reader was promised. Fifteen such sites were
- * verified in this tree; the AST-layer ones are the worst, because the layer
- * they degrade is the one that keeps prose comments and sample strings from
- * becoming false-positive findings.
- *
- * Two shapes, one rule. The precedent already in the tree is
- * `parserRetryDegradationCount` (`src/engine/tree-sitter-ast.ts`): a counted,
- * readable number rather than a swallowed exception. This generalizes it —
- * every site records a REASON from the closed set below, and the scan result
- * carries the per-reason counts, so "the parser failed" becomes
- * "the AST mask was unavailable for 3 files".
- *
- * The ledger is APPEND-ONLY and process-scoped, which has one consequence
- * worth stating because it is the security-relevant direction: `beginWindow`
- * returns a MARKER, not an ownership claim. Two concurrent `runScan` calls in
- * one process (there is a test that does exactly this,
- * `tests/stress/concurrent-same-process.spec.ts`) each read the records
- * appended after their own marker, so a degradation one scan records may be
- * counted by the other. That can only ever OVER-count — a scan reporting a
- * degradation that happened to a sibling is more cautious than the truth, and
- * never less — so the failure direction is the honest one. The alternative,
- * a sink threaded through every rule context, is a diff across every call site
- * in the tree to fix a problem that cannot make a scan look better than it is.
- */
-/**
- * Every reason a detection path may lose capability.
- *
- * Closed on purpose: a `catch` site that wants a new reason has to add it
- * here, which is the moment a reviewer sees the claim. `tests/contract/
- * no-uncounted-degradation.spec.ts` reads this list and fails on any `catch`
- * in a detection path that neither rethrows, records one of these, nor
- * appears in its allowlist with a stated reason.
- */
-declare const DEGRADATION_REASONS: readonly ["ast-parse-failed", "ast-mask-unavailable", "ast-range-scan-failed", "ci-workflow-listing-unreadable", "workspace-manifest-unreadable", "java-build-listing-unreadable", "rules-tree-listing-unreadable", "trend-record-unparseable", "explain-fixture-unreadable", "explain-workflow-parse-failed", "explain-rule-crash", "rule-doc-rule-crash", "rule-doc-fixture-unreadable", "rule-doc-workflow-parse-failed"];
-type DegradationReason = (typeof DEGRADATION_REASONS)[number];
-interface DegradationCount {
-  readonly reason: DegradationReason;
-  readonly count: number;
-}
-//#endregion
-//#region src/discovery/workspace.d.ts
 /**
  * Repository discovery (Sprint-Plan W1-03).
  * Finds project root, parses package.json, detects npm/yarn/pnpm workspaces.
@@ -934,26 +845,6 @@ interface Workspace {
   /** Glob patterns from the root package.json workspaces field. */
   workspaceGlobs: string[];
 }
-//#endregion
-//#region src/discovery/frameworks.d.ts
-/**
- * The catalogued frameworks whose detection is implemented today.
- *
- * Every entry must exist in the inventory — enforced by the parity spec, not
- * by comment.
- */
-declare const DETECTABLE_TEST_FRAMEWORKS: readonly ["jest", "vitest", "playwright"];
-/** The detection output type, in the inventory's vocabulary. */
-type DetectedFramework = (typeof DETECTABLE_TEST_FRAMEWORKS)[number];
-interface FrameworkInfo$1 {
-  /** Detected frameworks, as inventory ids. */
-  frameworks: DetectedFramework[];
-  /** True when no config evidence was found at all. */
-  unknown: boolean;
-}
-declare function detectFrameworks(ws: Workspace): FrameworkInfo$1;
-//#endregion
-//#region src/rules/rule.d.ts
 /**
  * How the rule's primary detection decision is made (Verification Trust
  * Evolution Plan §09.6/§12.1 — the enforced D6 enum, replacing free text):
@@ -1014,6 +905,58 @@ interface StrategyJustification {
    */
   detail: string;
 }
+/**
+ * A declared, owned, expiring grant of core status.
+ *
+ * The 6.0 demotion emptied the core tier: no rule's 95% Wilson interval
+ * clears the 10% ceiling, the smallest observed `ciHigh` across 73 measured
+ * rules being 0.138. That is the corpus being too small, not the ceiling being
+ * wrong — moving 0.1 to 0.15 would admit a rule on 24 samples, which is tuning
+ * a threshold to fit data.
+ *
+ * So core is, for now, reachable only by a maintainer saying so in the open.
+ * This is that record. It is deliberately not a boolean: `corePromotion: true`
+ * would be indistinguishable from the silent override it replaces, and would
+ * carry no date on which the claim lapses.
+ */
+interface CorePromotion {
+  /**
+   * Why this rule is trusted before the corpus can support it. A structural
+   * argument ("a shared mutable across tests is a defect regardless of
+   * frequency") is legitimate; "seemed fine" is not, and the registry
+   * check rejects a rationale shorter than a sentence.
+   */
+  rationale: string;
+  /**
+   * A named human who owns this claim. Per P9: an unowned claim is not a
+   * claim, it is a default nobody chose.
+   */
+  owner: string;
+  /** ISO-8601 date the grant was made. */
+  grantedAt: string;
+  /**
+   * ISO-8601 date the grant lapses. On this date the rule resolves to
+   * `extended` unless the grant is re-justified — the record has to be
+   * renewed by a person, not held in place by not being looked at.
+   */
+  expiresOn: string;
+  /**
+   * What backs the rationale, beyond the rationale: corpus verdict ids, a
+   * contract path, an ADR.
+   *
+   * An empty list is ALLOWED, and the registry check does not demand one —
+   * because a genuine structural premise ("a mutable shared across tests is a
+   * defect regardless of frequency") has no corpus verdict behind it, and
+   * inventing a citation for one would make the field decorative.
+   *
+   * What an empty list is NOT is invisible: `docs/CORE-READINESS.md` reports a
+   * promotion with no evidence reference as `NEEDS-SAMPLES` in its note, so a
+   * human sees an uncited grant next to a rule that still owes the corpus
+   * samples. That is the honest handling — a judgement the tree cannot verify
+   * is labelled as one — rather than a field the check pretends to verify.
+   */
+  evidenceRefs: string[];
+}
 interface RuleMeta {
   /** Frozen public API — never reused (§18.4). */
   id: string;
@@ -1048,7 +991,7 @@ interface RuleMeta {
   /**
    * How detection works, as an enforced enum (plan §09.6/§12.1 — D6
    * closed). Free-text declarations were migrated to the enum in
-   * Phase 2; the registry ratchet (tests/rules.registry.spec.ts) makes
+   * Phase 2; the registry ratchet (tests/rules/registry.spec.ts) makes
    * omission or a bad value a CI failure, so new rules must declare it.
    */
   detectionStrategy?: DetectionStrategy;
@@ -1062,17 +1005,99 @@ interface RuleMeta {
   /** First released version (semver). Immutable once set. */
   introduced?: string;
   /**
-   * Tier assignment (Phase 4 — Tempering Plan; measurement-dependent
-   * default per Verification Trust Evolution Plan §11.2 Step 2).
-   * - "core": ships in the default report (≤10% measured FP rate)
-   * - "extended": included by default, lower confidence (≤30% FP)
-   * - "quarantine": opt-in only via --strict (>30% FP or unmeasured)
+   * Tier assignment — a declared floor that may only ever TIGHTEN.
+   *
+   * Three floors decide a rule's effective tier, and they are not
+   * interchangeable. Measured over all 79 live rules (B0 dry-run, 2026-10-01):
+   *
+   *   - POINT ESTIMATE  — `fpRate <= 30%` -> extended, else quarantine.
+   *     The noise floor. Answers "does this ship by default?"
+   *   - INTERVAL        — `ciHigh <= 10%` -> core, `ciLow >= 50%` -> quarantine,
+   *     else extended. The evidence floor. Answers "does the evidence place it?"
+   *   - DECLARED (this field) — overrides both.
+   *
+   * B0 measured what the first two do to this registry, and the result is the
+   * reason this field exists rather than being deleted:
+   *
+   *   - The INTERVAL floor quarantines **exactly one** of the 79 rules:
+   *     `QA-ENV-001`, which was wrong 20 times out of 20. `ciLow >= 50%`
+   *     needs 15 of 20 false positives to fire, so the worst of the rest
+   *     (`QA-TEST-002`, 62%) clears neither bound.
+   *   - No rule derives CORE. `ciHigh <= 10%` needs n >= 35 with zero false
+   *     positives and the sampler caps at 20, where even 0/20 reads 16.1%.
+   *     The arithmetic is in `tests/rules/core-tier-reachability.spec.ts`.
+   *   - **34 rules declare `quarantine`, and 33 of them would be PROMOTED into
+   *     the default scan if this field were deleted** — every one of the 33
+   *     moves in the promoting direction and none moves the other way.
+   *
+   * So this field is a THIRD floor, stricter than both derivations, and for 33
+   * of the 34 quarantined rules it is the ONLY thing holding them out of a
+   * default scan. That is why deleting the declared tiers is not a refactor: it
+   * ships 33 quarantined detectors — including the six CI rules the README's
+   * caught-by-default table marks advisory — as ordinary findings.
+   *
+   * THE INVARIANT, enforced by the tightening law in
+   * `tests/rules/registry-ratchet.spec.ts` (not by
+   * `checkDeclaredTierMayOnlyTighten`, which does not exist — the first
+   * version of this comment named a function that was never written, which is
+   * the same defect as a spec pointing at a deleted file): a declared
+   * tier may only ever hold a rule DOWN. Quarantining a well-measured rule is
+   * permitted (conservative, costs a reader a `--strict` flag); shipping a
+   * badly-measured rule is not (it hands a user a finding the corpus says is
+   * wrong). B0 found zero rules loosening, but nothing made that structural —
+   * one hand-edit could have released `QA-TEST-002` at 62% observed FP, and
+   * every derived number in the tree would have agreed with it.
+   *
    * When omitted, the tier resolves measurement-dependently via
-   * `effectiveTier` (src/rules/measurement.ts): core for rules with a
-   * valid corpus measurement, extended (displayed PROVISIONAL)
-   * otherwise — an unmeasured rule can never default into core.
+   * `effectiveTier` (src/rules/measurement.ts) — extended when there is no
+   * valid measurement, so an unmeasured rule can never default into core.
    */
   tier?: "core" | "extended" | "quarantine";
+  /**
+   * A declared, OWNED, EXPIRING grant of core status for a rule the corpus
+   * cannot yet support.
+   *
+   * Required by `checkRegistry` for any rule declaring `tier: "core"` without
+   * a valid measurement — the anti-creep law's counterpart to the measurement
+   * criterion. Without it, a core claim is a human assertion rendered with a
+   * measurement's appearance, which is precisely the defect the 6.0 demotion
+   * removed: nineteen rules showed `tier: "core"`, `measured: true`,
+   * `fpRate: 0` while their 95% Wilson upper bounds ran 13.8%–40.4%.
+   *
+   * The fields are load-bearing:
+   *
+   *   - `owner` — a named human. Per P9 an unowned claim is not a claim.
+   *   - `expiresOn` — the claim decays to `extended` when it lapses. An
+   *     assertion that never expires is a tier, which is what this exists to
+   *     avoid.
+   *   - `evidenceRefs` — corpus IDs, contract paths, or an ADR. A rationale
+   *     with nothing behind it is a preference.
+   *
+   * A rule that HAS earned core by measurement does not need one: the
+   * measurement is the record, and a hand-written rationale beside it is a
+   * second source of truth for the same fact.
+   */
+  corePromotion?: CorePromotion;
+  /**
+   * A declared, OWNED, EXPIRING commitment about a QUARANTINED rule.
+   *
+   * Same shape as `corePromotion`, and for the same reason: 34 quarantined
+   * rules carry no `owner`, no `rationale` and no `expiresOn`, so nothing in
+   * the tree says who will re-measure them or when the quarantine lapses.
+   * The expiry date IS the exit condition — `CorePromotion` has no separate
+   * exit-condition field, and a message naming one would send the next
+   * person looking for a field the contract does not have.
+   * `src/rules/tier-evidence.ts` is the worked example of the pattern for the
+   * nineteen rules demoted in 6.0, and `docs/QUARANTINE-REMEDIATION.md` is the
+   * ledger for the rest — but a ledger nobody must update is a report.
+   *
+   * The difference from `corePromotion` is the direction. `corePromotion` says
+   * "this rule is trusted before the corpus can show it"; this says "this rule
+   * is NOT trusted yet, here is when that is re-decided". A rule in quarantine
+   * WITHOUT one is a rule whose quarantine is permanent by default, which is
+   * the outcome the tier exists to avoid.
+   */
+  quarantinePromotion?: CorePromotion;
   /**
    * Detector implementation revision (Verification Trust Evolution Plan
    * §07). Increment on ANY detection-logic change — pattern, scoping,
@@ -1181,14 +1206,6 @@ interface QADoctorRule extends RuleMeta {
   astQuery?: AstQueryHook;
   run: RuleFn;
 }
-//#endregion
-//#region src/discovery/ignores.d.ts
-/** An immutable, per-root resolved ignore matcher (audit R-8). */
-interface IgnoreMatcher {
-  isIgnored(relPath: string): boolean;
-}
-//#endregion
-//#region src/engine/adapter.d.ts
 /** Semantic operations a parsed file exposes to rules. */
 interface ParsedFile {
   path: string;
@@ -1212,98 +1229,6 @@ interface ParsedFile {
    */
   frameworkTags?: readonly string[];
 }
-interface FrameworkInfo {
-  frameworks: string[];
-  unknown: boolean;
-}
-/**
- * The result of the async parse stage (Verification Trust Evolution Plan
- * Phase 0.5, §10): an AST plus its explicit disposal path. The scan
- * pipeline calls `dispose()` exactly once per file, in a
- * finally-equivalent position that runs whether or not rules completed —
- * normal completion, rule crash, per-file budget expiry, or scan abort.
- */
-interface ParsedAst {
-  /** Consumed synchronously by rules via `ParsedFile.ast`. */
-  ast: unknown;
-  /** Release WASM/AST resources (`tree.delete()` for tree-sitter). */
-  dispose(): void;
-}
-interface ScanContext {
-  workspace: Workspace;
-  /** Absolute paths of discovered test files. */
-  testFiles: string[];
-  deadline: number;
-  /** Resolved per-scan ignore matcher (audit R-8) — no module globals. */
-  ignoreMatcher: IgnoreMatcher;
-  /** Called once per file that could not be read/analyzed. */
-  onSkippedFile: (reason: string) => void;
-  /**
-   * Called when discovery stops early (audit H-8): deadline expiry or
-   * the per-adapter file cap. The reason is named in analysisStatus.
-   */
-  onDiscoveryTruncated: (reason: string) => void;
-  /** Per-adapter discovery budget (audit H-8). One language can no
-   * longer consume the whole list and starve the others. */
-  maxFiles: number;
-  /** R4c Scope Integrity: counted matcher exclusions (optional — adapters
-   * whose discovery walks sharedWalk pass this through to the counters). */
-  onIgnored?: (path: string) => void;
-  /** R4c Scope Integrity: counted files no adapter claims (optional). */
-  onUnrecognized?: (path: string) => void;
-  /**
-   * Called when a rule throws on a file (audit R-9): crash isolation
-   * stays silent by default, but the scan counts it and `--debug`
-   * surfaces it.
-   */
-  onRuleCrash?: (ruleId: string, file: string, error: unknown) => void;
-}
-interface LanguageAdapter {
-  readonly id: string;
-  readonly extensions: readonly string[];
-  /** Human-readable patterns this adapter searches for (empty-state UX). */
-  readonly testFileGlobs: readonly string[];
-  /** Dependency/output directory names this adapter never enters. */
-  readonly dirSkips: readonly string[];
-  /** Canonical test-file check per ecosystem conventions. */
-  isTestFile(path: string): boolean;
-  detectFrameworks(root: string): FrameworkInfo;
-  discoverTestFiles(ctx: ScanContext): void;
-  /**
-   * Async parse stage (Verification Trust Evolution Plan Phase 0.5, §10):
-   * awaited by the scan pipeline between discovery and rule execution.
-   * `runRules` and every rule stay synchronous and consume the produced
-   * tree via `ParsedFile.ast` — the engine is NOT async end-to-end, only
-   * this one seam is (WASM grammar load is inherently async).
-   *
-   * Contract: resolve to a ParsedAst on success, `undefined` when this
-   * adapter has no AST layer (or parsing failed — rules fall back to the
-   * regex path either way). Never throws.
-   *
-   * May return the result directly as well as a promise: the ts-morph path
-   * (plan V5-021) is synchronous, and forcing it to allocate a promise per
-   * file would be a cost the shared seam has no business imposing. The
-   * pipeline awaits either form.
-   *
-   * Declared as a PROPERTY, not a method signature. A method signature
-   * promises a `this` binding that no adapter uses, and it makes every
-   * consumer that reads `adapter.parseAst` trip the unbound-method rule —
-   * which is a lint error that gets suppressed rather than a design that
-   * gets fixed, so the shape has to say what it means.
-   */
-  parseAst?: (file: ParsedFile) => ParsedAst | undefined | Promise<ParsedAst | undefined>;
-  /**
-   * Run all rules this adapter hosts against one file. `onCrash` is
-   * invoked when a rule throws (audit R-9) — the crash is still
-   * isolated, but never invisible. `budget` (audit P-1) stops rule
-   * execution mid-file when a single file is too expensive to analyze
-   * in full; the caller reports the skip honestly.
-   */
-  runRules(rules: readonly UniversalRule[], file: ParsedFile, emit: (f: Omit<Finding, "ruleId" | "category">, ruleId: string, category: string) => void, onCrash?: (ruleId: string, error: unknown) => void, budget?: {
-    deadline: number;
-    onExceeded: () => void;
-  }): void;
-}
 /**
  * A rule that declares which adapters it supports. Backward compatible:
  * legacy 'test-files' maps to ['typescript'], 'ci-workflows' to
@@ -1343,112 +1268,16 @@ interface UniversalRule {
   detectorRevision?: number;
   run(file: ParsedFile): Array<Omit<Finding, "ruleId" | "category">>;
 }
-//#endregion
-//#region src/engine/evidence-core.d.ts
-/**
- * The core's own version — stamped into every record's provenance so a
- * consumer can tell which normalization contract produced a record.
- * Bump ONLY on a semantic change to the normalization itself.
- */
-declare const EVIDENCE_CORE_VERSION = "evidence-core@1";
-/** Evidence source formats the core understands today (WI-17 adds trace.zip). */
-type EvidenceSource = ForensicsReport["source"];
-/** Normalized per-test runtime evidence (plan WI-2 field contract). */
-interface EvidenceRecord {
-  /** Where this evidence came from (format identity). */
-  source: EvidenceSource;
-  /** Ingested artifact identity — the report path the records derive from. */
-  artifact: string;
-  /** Test identity: file + title (+ declaration line when known). */
-  file: string;
-  title: string;
-  /** 1-based declaration line when the source carries one (JUnit: absent). */
-  line?: number;
-  /** Normalized execution status facts. */
-  status: {
-    /** Last attempt's outcome. */
-    final: RunStatus;
-    /** Failed at least once across attempts. */
-    failed: boolean;
-    /** Executed more than once. */
-    retried: boolean;
-    /** Passed only on attempt >= 2 (TRUE-FLAKE). */
-    passedOnRetry: boolean;
-    skipped: boolean;
-    /** Final attempt timed out. */
-    timedOut: boolean;
-  };
-  /** Number of attempts (retries = attempts − 1). */
-  attempts: number;
-  /** Total duration across attempts. */
-  durationMs: number;
-  /** Error messages, in report order. Empty: not captured by this source yet. */
-  errors: string[];
-  /** Attachment names/paths. Empty: not captured by this source yet (WI-17). */
-  attachments: string[];
-  /** Where the record came from and under which normalization contract. */
-  provenance: {
-    core: typeof EVIDENCE_CORE_VERSION;
-    ingest: "mjolnir.forensics";
-  };
-}
-//#endregion
-//#region src/engine/provenance.d.ts
-type FileProvenance = "unmarked" | "generated-marked" | "codegen-like";
-/** Classify one file's provenance. Pure. */
-declare function classifyProvenance(file: {
-  text: string;
-  codeText?: string;
-}): FileProvenance;
-//#endregion
-//#region src/engine/scan-cache.d.ts
-interface CacheStats {
-  hits: number;
-  misses: number;
-  /** Where the cache lives — reported so `--json` consumers can audit it. */
-  file: string;
-}
-interface ScanCache {
-  readonly stats: CacheStats;
-  lookup(key: string): Finding[] | undefined;
-  store(key: string, findings: Finding[], fileBudgetExceeded: boolean): void;
-  persist(): void;
-}
-//#endregion
-//#region src/config/config.d.ts
-interface IgnoreEntry {
-  ruleId: string;
-  files?: string[];
-  reason: string;
-  /** ISO date; omitted means the suppression has no expiry. */
-  expires?: string;
-}
-interface QADoctorConfig {
-  gate?: "advisory" | "error" | "warning";
-  /** Path globs to skip during discovery (see DEFAULT_IGNORES dialect). */
-  exclude?: string[];
-  severityOverrides?: Record<string, Severity>;
-  ignore?: IgnoreEntry[];
-}
-declare function loadConfig(root: string, options?: {
-  knownRuleIds?: ReadonlySet<string>;
-}): {
-  config: QADoctorConfig;
-  path: string | null;
-  /** Non-fatal notes (e.g. unknown rule IDs in severityOverrides). */
-  warnings: string[];
-};
-declare namespace scan_pipeline_d_exports {
-  export { AssembleScanResultInput, CliArgs, DiscoveryResult, EVIDENCE_OVERRIDES$1 as EVIDENCE_OVERRIDES, FileAnalysisResult, KNOWN_RULE_IDS$1 as KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID$1 as OVERLAP_META_BY_RULE_ID, PostScanResult, SUITE_INVALIDATING_RULE_IDS$1 as SUITE_INVALIDATING_RULE_IDS, ScanHooks, applyPostScanProcessing, assembleScanResult, buildUniversalRules$1 as buildUniversalRules, discoverAndParseRuntimeReport$1 as discoverAndParseRuntimeReport, discoverTestFilesPhase, fallbackWorkspace$1 as fallbackWorkspace, isValidFindingRecord$1 as isValidFindingRecord, pathMatchesGlob$1 as pathMatchesGlob, runFileAnalysisPhase, runScan$1 as runScan, selectAdapter, summarizeForensicVerdicts };
-}
-/** Registered rule IDs — used to warn on unknown severityOverrides keys (M4). */
-declare const KNOWN_RULE_IDS$1: ReadonlySet<string>;
 /**
- * R6 (Bug Map M-02): per-rule overlap metadata, built from RULES the
- * same way tierByRuleId is — `asUniversal` drops `overlapWith`, so the
- * dedup map must come from the registry directly.
+ * Whether `path` matches `glob`, in the dialect documented above.
+ *
+ * Both sides are normalized to forward slashes first. Finding paths are already
+ * normalized by the walker, but a suppression `files` pattern written on
+ * Windows ("e2e\\x.spec.ts") compiled to a literal-backslash regex that could
+ * never match any finding — the suppression silently never applied, which is
+ * the defect that made the whole dialect worth unifying.
  */
-declare const OVERLAP_META_BY_RULE_ID$1: ReadonlyMap<string, OverlapMeta>;
+declare function pathMatchesGlob$1(path: string, glob: string): boolean;
 declare function buildUniversalRules$1(root: string, strict?: boolean, opts?: {
   /** CLI trust-gate flag (`--enable-plugins`) for this scan. */
   enablePlugins?: boolean;
@@ -1463,35 +1292,73 @@ declare function buildUniversalRules$1(root: string, strict?: boolean, opts?: {
     rules: number;
   }>;
   externalRules: QADoctorRule[];
+  /** Rules that ran, after the quarantine filter. */
+  rulesApplied: number;
+  /** Rules removed by the quarantine filter because `--strict` was absent. */
+  rulesWithheld: number;
+  /** The same rules, named. The count is the disclosure; this is the evidence. */
+  withheldRuleIds: string[];
 }>;
-/** Rule-declared evidence-level overrides (Honesty Core). */
-declare const EVIDENCE_OVERRIDES$1: ReadonlyMap<string, string>;
-/**
- * Rules whose findings void the suite's pass claim (RuleMeta.suiteInvalidating).
- * Built from the registry so the scorer never has to import it.
- */
-declare const SUITE_INVALIDATING_RULE_IDS$1: ReadonlySet<string>;
 interface CliArgs {
   target: string;
   json: boolean;
   verbose: boolean;
   maxDurationMs: number;
   scopeChanged: boolean;
-  format: "terminal" | "json" | "sarif" | "mermaid" | "codequality";
+  /**
+   * The output shape.
+   *
+   * `trust-report` | `pr-comment` | `github-summary` are the v6 collapse's
+   * REPLACE arm (plan §3): they were separate verbs whose entire body was
+   * "scan, then render". They are render-only — the scan, the findings, the
+   * score and the exit code are identical under all of them, and under
+   * `terminal`, which is the property that lets a format be a flag.
+   */
+  format: "terminal" | "json" | "sarif" | "mermaid" | "codequality" | "trust-report" | "pr-comment" | "github-summary";
   /** --width override for terminal box/gauge wrapping (Sprint 5 Task 22). */
   width?: number;
   /** --ascii / --no-ascii override for shouldUseAscii()'s heuristic. */
   ascii?: boolean;
   /** --tone blunt: opt-in blunter messages (Sprint 9 Task 40). */
   tone?: "blunt";
-  /** --strict: include quarantine-tier rules in the scan (Phase 4). */
+  /**
+   * --include-warn (was --strict): include quarantine-tier rules in the scan
+   * (Phase 4). The internal name predates the 6.0 flag rename and names a scan
+   * option rather than a user-facing promise; renaming it would touch every
+   * call site for a rename no user would ever see.
+   */
   strict?: boolean;
+  /**
+   * Deprecated flag spellings used on this invocation, each with its
+   * replacement. Populated by the parser so the CLI can print the whole
+   * deprecation notice once, in one place, rather than each arm printing its
+   * own warning where a `--json` consumer would have to read stderr to find it.
+   */
+  deprecatedFlags?: Array<{
+    flag: string;
+    replacement: string;
+  }>;
   /** --base <ref>: base ref for --scope changed (audit H-10). */
   base?: string;
   /** --debug: print errors swallowed by crash isolation (audit R-9). */
   debug?: boolean;
   /** --record-milestones: let a scan write .mjolnir/stats.json (audit R-1). */
   recordMilestones?: boolean;
+  /**
+   * --save-baseline: write this scan's findings to `.mjolnir/baseline.json`
+   * so a LATER scan can say RESOLVED rather than reporting the same debt
+   * forever.
+   *
+   * This flag exists because the `baseline` verb was removed in the v6 carve
+   * and nothing replaced it. That left `ci verify` unable to leave its
+   * no-baseline arm for any user, and left three shipped messages — the
+   * verify digest, the MCP `verify` tool, and the agent instruction brief —
+   * naming a command that could not perform the action they described. A
+   * recovery instruction that does not recover is worse than no instruction:
+   * it costs the reader a round trip and teaches them that the tool's own
+   * guidance is unreliable.
+   */
+  saveBaseline?: boolean;
   /**
    * --cache: reuse per-file rule verdicts from the local content-addressed
    * cache (M5.2). Post-loop processing always re-runs; the cache only
@@ -1532,6 +1399,22 @@ interface CliArgs {
    * scan semantics and exit codes are unchanged (plan §5.6).
    */
   scoreOnly?: boolean;
+  /**
+   * `--require-full-coverage`: exit `EXIT_PARTIAL` when the quarantine
+   * filter withheld any rule, even though the scan itself was whole.
+   *
+   * Off by default, and the default is the point. Coverage-PARTIAL is the
+   * state of every ordinary scan — the quarantine tier is non-empty — so
+   * making it gate by default would exit 2 on nearly every run. The fix a
+   * user reaches for is `--strict`, which switches the quarantine ON, and
+   * then the flag has nothing left to check. A flag that inverts its own
+   * remedy is worse than no flag.
+   *
+   * The opt-in is for a project that has decided quarantined detectors must
+   * be live: then a withheld rule is a real loss of coverage and the run is
+   * inconclusive, exactly as a truncated walk is.
+   */
+  requireFullCoverage?: boolean;
   /**
    * Audit C2: --enable-plugins opens the plugin trust gate for THIS
    * invocation — npm-plugin and JS-module rule sources may load (and
@@ -1553,6 +1436,30 @@ interface CliArgs {
    * mode" (no monorepo analysis).
    */
   monorepo?: boolean;
+  /**
+   * --suppressions (v6 collapse, plan §3): print the suppression LEDGER and
+   * stop. A mode, not a verb.
+   *
+   * It is a mode because the ledger is a view of `mjolnir.config.json` and
+   * nothing else — a verb for it would be a command whose whole body is
+   * "read a file and print it", which is what a flag on the command that
+   * enforces the file is for. It reads the CWD, exactly as the retired verb
+   * did, so the one observable behaviour a script can depend on is unchanged.
+   */
+  suppressions?: boolean;
+  /**
+   * --suppression-gate (v6 collapse, plan §3): fail when a suppression is
+   * ungoverned — expired, reasonless, or covering a rule that no longer
+   * exists. Runs the scan first, because a governance judgement about a
+   * suppression needs the findings the suppression would have hidden.
+   */
+  suppressionGate?: boolean;
+  /**
+   * --policy (v6 collapse, plan §3): print the scoring policy in force and
+   * stop. A policy nobody can read is a policy nobody can check, and the
+   * scorer publishes one on purpose.
+   */
+  policy?: boolean;
 }
 interface ScanHooks {
   /** Invoked when a rule throws on a file (audit R-9). */
@@ -1588,20 +1495,6 @@ interface ScanHooks {
  * scanning a filesystem root.
  */
 declare function fallbackWorkspace$1(targetAbs: string): Workspace;
-/**
- * Minimal glob match for suppression `files` patterns, with gitignore
- * `**` semantics (bug-audit M5). Supports:
- *   "tests/**"             — everything inside tests/
- *   "tests" + "/**\/*.spec.ts" — any depth UNDER tests/ (including none) ending in .spec.ts
- *   "**" + "/*.spec.ts"    — any depth including root-level files
- *   "tests/foo.spec.ts"    — exact path
- *   "*" within a segment never crosses "/".
- *
- * Forward slashes only (findings always use normalized paths). `?`,
- * character classes and `!` negation are not metacharacters here — same
- * as before this rewrite.
- */
-declare function pathMatchesGlob$1(path: string, glob: string): boolean;
 /**
  * Plan §16 + WI-11: locate a runtime run report next to the scan
  * target, using the exact conventions the forensics ingestion already
@@ -1626,121 +1519,6 @@ declare function discoverAndParseRuntimeReport$1(scanRoot: string): {
  * caller) — never silently scored.
  */
 declare function isValidFindingRecord$1(f: unknown): f is Omit<Finding, "ruleId" | "category">;
-/**
- * Replace 7-way nested ternary with a linear probe.
- * Returns the adapter whose `isTestFile` matches the path, falling
- * back to the TypeScript adapter (the default language).
- */
-declare function selectAdapter(path: string): LanguageAdapter;
-interface DiscoveryResult {
-  testFiles: string[];
-  stagedSurface: boolean;
-}
-declare function discoverTestFilesPhase(workspace: Workspace, args: CliArgs, hooks: ScanHooks, scanRoot: Workspace, ctx: ScanContext): DiscoveryResult;
-interface FileAnalysisResult {
-  skippedFiles: number;
-  testFileCount: number;
-  testDeclarationCount: number;
-  rulesPartial: boolean;
-  parseFailed: number;
-  parseFallbacks: number;
-  scanned: number;
-  analyzed: number;
-  /**
-   * Files that HAD an AST stage and lost it to the scan deadline, so they
-   * were analyzed by regex alone. Zero for every adapter that declares no
-   * `parseAst` — that is a capability envelope, not a downgrade.
-   */
-  astFallbackFiles: number;
-}
-declare function runFileAnalysisPhase(findings: Finding[], testFiles: string[], workspace: Workspace, activeRules: UniversalRule[], hooks: ScanHooks, cache: ScanCache, rulesDigest: string, deadline: number, truncationReasons: Set<string>, declarationsByFile: Map<string, number>, fileProvenance: Array<{
-  path: string;
-  provenance: ReturnType<typeof classifyProvenance>;
-}>, onRuleCrash: (ruleId: string, file: string, error: unknown) => void): Promise<FileAnalysisResult>;
-interface PostScanResult {
-  testDeclarationCount: number;
-  scopeInfo: {
-    scope: "all" | "changed";
-    degraded?: string | undefined;
-  };
-  suppressionCount: number;
-  frameworks: ReturnType<typeof detectFrameworks>;
-  runtimeReportPath: string | undefined;
-  runtimeIncomplete: boolean;
-  /**
-   * The normalized evidence core (V5-011). Persisted rather than discarded,
-   * so every post-ingest projection reads records instead of re-parsing a
-   * report that may have changed underneath it.
-   */
-  evidenceRecords: EvidenceRecord[];
-  /** Aggregate forensic classifications from the ingested runtime report. */
-  forensicVerdicts: ForensicVerdictSummary | undefined;
-  config: ReturnType<typeof loadConfig>["config"];
-}
-/**
- * Summarize forensic classifications from an ingested runtime report
- * (plan §10.4, WAVE 5). Returns undefined when no verdict carries a
- * classification — the machine contract slot stays absent rather than
- * reporting all-zero counts.
- */
-declare function summarizeForensicVerdicts(report: ForensicsReport): ForensicVerdictSummary | undefined;
-declare function applyPostScanProcessing(findings: Finding[], workspace: Workspace, args: CliArgs, hooks: ScanHooks, scanRoot: Workspace, declarationsByFile: Map<string, number>, testDeclarationCount: number, tierByRuleId: Map<string, Tier>, REVISION_BY_RULE_ID: Map<string, number>): PostScanResult;
-interface AssembleScanResultInput {
-  findings: Finding[];
-  testFileCount: number;
-  testDeclarationCount: number;
-  declarationsByFile: Map<string, number>;
-  skippedFiles: number;
-  rulesCrashed: number;
-  truncationReasons: Set<string>;
-  discoveryTruncated: boolean;
-  rulesPartial: boolean;
-  scopeIgnored: number;
-  scopeUnrecognized: number;
-  parseFailed: number;
-  parseFallbacks?: number;
-  /** Files that lost their AST stage to the scan deadline. See completion.ts. */
-  astFallbackFiles?: number;
-  /**
-   * Reason-coded capability losses recorded during this scan's window. See
-   * `src/engine/degradation-ledger.ts` for why the window is an index rather
-   * than an ownership claim.
-   */
-  degradations?: readonly DegradationCount[];
-  scanned: number;
-  analyzed?: number;
-  testFiles: string[];
-  workspace: Workspace;
-  scanRoot: Workspace;
-  args: CliArgs;
-  hooks: ScanHooks;
-  cache: ScanCache;
-  REVISION_BY_RULE_ID: Map<string, number>;
-  pluginsLoaded: Array<{
-    name: string;
-    rules: number;
-  }>;
-  scopeInfo: {
-    scope: "all" | "changed";
-    degraded?: string | undefined;
-  };
-  suppressionCount: number;
-  frameworks: ReturnType<typeof detectFrameworks>;
-  runtimeReportPath: string | undefined;
-  runtimeIncomplete?: boolean;
-  evidenceRecords?: EvidenceRecord[];
-  forensicVerdicts: ForensicVerdictSummary | undefined;
-  config: ReturnType<typeof loadConfig>["config"];
-  fileProvenance: Array<{
-    path: string;
-    provenance: ReturnType<typeof classifyProvenance>;
-  }>;
-  started: number;
-  stagedSurface: boolean;
-  /** ECO-005: dependency graph built from project manifests. */
-  dependencyGraph?: DependencyGraph;
-}
-declare function assembleScanResult(o: AssembleScanResultInput): ScanResult;
 /**
  * Testable default scan path core. `hooks` lets callers observe
  * normally-invisible events (swallowed rule crashes) without changing
@@ -1751,20 +1529,21 @@ declare function assembleScanResult(o: AssembleScanResultInput): ScanResult;
  * inherently async); `runRules` and every rule stay synchronous and
  * consume `ParsedFile.ast`. Callers await the returned promise.
  */
-declare function runScan$1(args: CliArgs, hooks?: ScanHooks): Promise<ScanResult>;
-//#endregion
-//#region src/engine/version.d.ts
 /**
- * Engine version, as a leaf module: `runIdentity` (R4c) needs the engine
- * version inside scan-pipeline WITHOUT importing cli.ts (a cycle — cli
- * imports the pipeline). The literal follows the same discipline as
- * CLI_VERSION and SARIF's driver.version: kept in sync on release by
- * scripts/sync-sarif-version.cjs and guarded by the version-consistency
- * spec. cli.ts re-exports this as CLI_VERSION.
+ * Run one scan inside its own ts-morph Project scope.
+ *
+ * The wrapper is the whole fix. ts-morph's Project caches SourceFiles by path
+ * and `parseTsFile` calls `replaceWithText` on them, so a Project shared between
+ * two concurrent scans lets one rewrite the file the other is mid-rule on —
+ * which surfaced as three of four concurrent scans reporting
+ * `rulesCrashed: 4` and `rules: "partial"`, and therefore as two different
+ * machine-contract digests from one tree. See `src/engine/ts-ast.ts`.
+ *
+ * Async context propagates across `await`, so the scope covers the whole scan
+ * without threading a Project through every adapter.
  */
-declare const ENGINE_VERSION = "5.0.0";
-//#endregion
-//#region src/cli-io.d.ts
+declare function runScan$1(args: CliArgs, hooks?: ScanHooks): Promise<ScanResult>;
+declare const ENGINE_VERSION = "6.0.1";
 /**
  * Shared process IO sinks (certification-audit Phase 5, G6): the variadic
  * console sinks and the internal-error reporter lived in cli.ts, which
@@ -1777,63 +1556,51 @@ type Output = (...parts: unknown[]) => void;
 export declare const out: Output;
 export declare const err: Output;
 export declare function internalErrorMessage(err: unknown, emit: (s: string) => void, debug: boolean): void;
-//#endregion
-//#region src/cli-handlers.d.ts
+/**
+ * The gate level a command applies to its findings. `advisory` is the
+ * `--blocking none` posture: findings are reported and never gate.
+ */
+type GateLevel = "advisory" | "error" | "warning";
+/**
+ * Testable why command core. Returns the process exit code.
+ * Live mode awaits the real scan; saved-report mode is synchronous.
+ */
+export declare function runWhyCommand(argv: string[], io?: {
+  out: Output;
+  err: Output;
+}): Promise<number>;
 /**
  * Render scan output in the requested format.
  *
  * Extracted from runScanCommand (Task 6) to reduce cyclomatic complexity.
  * Handles sarif, mermaid, codequality, json, and terminal (trust-report)
  * rendering. The caller handles first-run hint + milestones separately.
+ *
+ * The v6 collapse's REPLACE arm (plan §3) lands here: `trust-report`,
+ * `pr-comment` and `summary` were three verbs whose whole body was this
+ * function with one branch each. The renderers already existed; what was
+ * missing was a way to name them from the one verb a reader already knows.
+ *
+ * `--format trust-report` is the terminal render, which is why the `else`
+ * below is spelled `terminal` and not `trust-report`: naming a default after
+ * a flag that is also its value is a way to make the default untypeable.
  */
 export declare function renderScanOutput(result: Awaited<ReturnType<typeof runScan$1>>, args: CliArgs, target: string, io: {
   out: Output;
   err: Output;
-}): void;
+}, gate: GateLevel): void;
 export declare function runScanCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
-export declare function runTriageCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): number;
-export declare function runMutationCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-export declare function runBadgeCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-export declare function runDebtCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
 export declare function runFixCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
-export declare function runCreateRuleCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): number;
-export declare function runImpactCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-export declare function runBaselineCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
 export declare function runVerifyCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
-export declare function runDiffCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
 export declare function runPrCommentCommand(argv: string[], io?: {
   out: Output;
   err: Output;
@@ -1846,22 +1613,67 @@ export declare function runHandoverCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
-export declare function runInitCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): number;
 export declare function runPwReportCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): number;
-export declare function runForensicsCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): number;
 export declare function runRulesCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
+/**
+ * `explain` ARMS — the v6 collapse's MOVE arm, group 2 (plan §3).
+ *
+ * `explain` is the question verb: what does this finding mean, and what else
+ * does it touch. Five capabilities were top-level verbs that all answer a
+ * variation of that question, and each is a flag here:
+ *
+ *   --list       the rule catalogue        (was `mjolnir explain --list`)
+ *   <file:line>  why this finding          (was `mjolnir explain <file:line>` — already
+ *                                           delegated by the subject form)
+ *   --callers    who calls this symbol     (was `mjolnir explain --callers`)
+ *   --plan       what to do next           (was `mjolnir explain --plan`)
+ *   --evidence   what really ran           (was the `triage` verb)
+ *   --playwright a Playwright run summary  (was `mjolnir explain --playwright`)
+ *
+ * The table is the same shape as `CI_SUBCOMMANDS`, and for the same reason: it
+ * is the single source the dispatcher reads AND the help renders from, so an
+ * arm that exists is documented and one that is documented exists.
+ *
+ * `--playwright` is INTERNAL in the plan and marked here as such. `pw-report`
+ * summarised a Playwright JSON run for a person reading CI output; the same
+ * information arrives through `--evidence` once it reads a report rather than
+ * a specific runner's format, and one flag that means "the run summary"
+ * whichever runner produced it beats two that mean it for one of them.
+ */
+/**
+ * `explain --evidence` — the runtime-evidence arm.
+ *
+ * The `triage` verb's body, verbatim in behaviour: read a real run, classify
+ * every test's verdict, and render the table plus the meeting artifact. The
+ * arm does not add anything, which is the point — the capability is the same
+ * one `src/forensics/triage.ts` and the MCP server already expose, and the
+ * reason the verb is retired is the reason the flag exists.
+ *
+ * `--json` and `--md` are the verb's own output selectors, preserved so a
+ * script written against them keeps working with one word changed.
+ *
+ * The one behaviour note: the report is written to `--flaky-md`'s path, which
+ * the verb also did, and the arm does not silently write a file into a
+ * directory a reader did not name. `--no-md` is still how you decline it.
+ */
+export declare function runEvidenceArm(argv: string[], io: {
+  out: Output;
+  err: Output;
+}): number;
+export declare const EXPLAIN_ARMS: Record<string, {
+  summary: string;
+  status: "public" | "internal";
+  run: (argv: string[], io: {
+    out: Output;
+    err: Output;
+  }) => Promise<number> | number;
+}>;
 export declare function runExplainCommand(argv: string[], io?: {
   out: Output;
   err: Output;
@@ -1870,37 +1682,30 @@ export declare function runDoctorPlaywright(argv: string[], io?: {
   out: Output;
   err?: Output;
 }): Promise<number>;
-//#endregion
-//#region src/commands/doctor-run.d.ts
-export declare function runDoctorCommand(argv: string[], io?: {
+export declare function runFrameworkMaturityCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): number;
-//#endregion
-//#region src/commands/summary.d.ts
-/**
- * Testable summary command core. Returns the process exit code.
- * Streams: annotations → stdout (always; GitHub greps them), summary →
- * step-summary file when set unless --stdout. Unknown flags are a
- * usage error (exit 10) — a typo'd --stdout must not silently route
- * the summary to $GITHUB_STEP_SUMMARY.
- */
-export declare function runSummaryCommand(argv: string[], io?: {
+export declare function runSuppressionGateCommand(argv: string[], io?: {
   out: Output;
   err: Output;
-}): number;
-//#endregion
-//#region src/commands/why.d.ts
-/**
- * Testable why command core. Returns the process exit code.
- * Live mode awaits the real scan; saved-report mode is synchronous.
- */
-export declare function runWhyCommand(argv: string[], io?: {
+}): Promise<number>;
+export declare function runCrossFileCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
-//#endregion
-//#region src/commands/handoff.d.ts
+export declare function runEvidenceGraphCommand(argv: string[], io?: {
+  out: Output;
+  err: Output;
+}): Promise<number>;
+export declare function runCIIntegrityCommand(argv: string[], io?: {
+  out: Output;
+  err: Output;
+}): Promise<number>;
+export declare function runDoctorCommand(argv: string[], io?: {
+  out: Output;
+  err: Output;
+}): number;
 /**
  * Testable handoff command core. Returns the process exit code.
  * `mjolnir handoff [mjolnir.json] [--category <cat>]... [--rules <ids>]`
@@ -1909,8 +1714,6 @@ export declare function runHandoffCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): number;
-//#endregion
-//#region src/commands/install-agents.d.ts
 /**
  * Testable install command core. Returns the process exit code.
  * `mjolnir install [--dry-run] [--force]` — probes the given cwd
@@ -1920,16 +1723,8 @@ export declare function runInstallCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }, cwd?: string): number;
-//#endregion
-//#region src/commands/trust-report.d.ts
-export declare function runTrustReportCommand(argv: string[], io: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-//#endregion
-//#region src/commands/release-trust.d.ts
 /**
- * CLI verb: `mjolnir release-trust [--json] [repo-root]`.
+ * CLI verb: `mjolnir ci release-trust [--json] [repo-root]`.
  * Exit contract (frozen set): 0 verdict PASS · 1 verdict non-PASS ·
  * 2 no fixtures root (not an mjolnir checkout — BLOCKED context) ·
  * 10 usage error · 20 internal error.
@@ -1938,111 +1733,18 @@ export declare function runReleaseTrustCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): number;
-//#endregion
-//#region src/commands/business-case.d.ts
-/**
- * Entry point for `mjolnir business-case`.
- *
- * Flags:
- *   --incident-cost <n>  The cost of ONE false-green incident in your
- *                        organisation. Until you supply it, no dollar
- *                        figure is printed at all.
- *   --strict             Include quarantine-tier findings
- *
- * `--history` and `--projected` are GONE. Both promised arithmetic this
- * tool cannot do: `--history` claimed to estimate from actual scan
- * improvements while reading no history at all, and `--projected` divided
- * the total by six and called the quotient a monthly rate. A flag that
- * does not do what its help says is worse than no flag, because the help
- * is the promise.
- */
-export declare function runBusinessCaseCommand(argv: string[], io?: {
-  out: Output;
-  err?: Output;
-}): Promise<number>;
-//#endregion
-//#region src/commands/release-report.d.ts
-/**
- * CLI verb: `mjolnir release-report [--since <ref>] [--history <json>] [target]`.
- */
-export declare function runReleaseReportCommand(argv: string[], io: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-//#endregion
-//#region src/commands/report-playwright.d.ts
-export declare function runReportPlaywrightCommand(argv: string[], io: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-//#endregion
-//#region src/commands/trend.d.ts
-export declare function runTrendCommand(argv: string[], io: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-//#endregion
-//#region src/commands/exec-report.d.ts
-export declare function runExecReportCommand(argv: string[], io: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-//#endregion
-//#region src/commands/policy.d.ts
 export declare function runPolicyCommand(argv: string[], io: {
   out: Output;
   err: Output;
 }): Promise<number>;
-//#endregion
-//#region src/commands/quarantine.d.ts
-export declare function runQuarantineCommand(argv: string[], io: {
-  out: Output;
-  err: Output;
-}): number;
-//#endregion
-//#region src/commands/analyze.d.ts
 export declare function runAnalyzeCommand(argv: string[], io: {
   out: Output;
   err: Output;
 }): number;
-//#endregion
-//#region src/commands/ci-adapter.d.ts
 export declare function runCiAdapterCommand(argv: string[], io: {
   out: Output;
   err: Output;
 }): number;
-//#endregion
-//#region src/commands/dashboard.d.ts
-export declare function runDashboardCommand(argv: string[], io: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-//#endregion
-//#region src/commands/enterprise.d.ts
-export declare function runEnterpriseCommand(argv: string[], io: {
-  out: Output;
-  err: Output;
-}): number;
-//#endregion
-//#region src/commands/maturity.d.ts
-export declare function runMaturityCommand(argv: string[], io: {
-  out: Output;
-  err: Output;
-}): number;
-//#endregion
-//#region src/commands/milestone.d.ts
-export declare function runFrameworkMaturityCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): number;
-export declare function runSuppressionGateCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-export declare function runCrossFileCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
 export declare function runContractVerifyCommand(argv: string[], io?: {
   out: Output;
   err: Output;
@@ -2051,16 +1753,6 @@ export declare function runTrustTrendCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
-export declare function runEvidenceGraphCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-export declare function runCIIntegrityCommand(argv: string[], io?: {
-  out: Output;
-  err: Output;
-}): Promise<number>;
-//#endregion
-//#region src/cli.d.ts
 export declare const runScan: typeof runScan$1, buildUniversalRules: typeof buildUniversalRules$1, fallbackWorkspace: typeof fallbackWorkspace$1, pathMatchesGlob: typeof pathMatchesGlob$1, isValidFindingRecord: typeof isValidFindingRecord$1, discoverAndParseRuntimeReport: typeof discoverAndParseRuntimeReport$1, KNOWN_RULE_IDS: ReadonlySet<string>, OVERLAP_META_BY_RULE_ID: ReadonlyMap<string, OverlapMeta>, EVIDENCE_OVERRIDES: ReadonlyMap<string, string>, SUITE_INVALIDATING_RULE_IDS: ReadonlySet<string>;
 /** A usage-error detail: the offending token, when one exists. */
 export interface UsageErrorDetail {
@@ -2109,6 +1801,8 @@ export declare function validateScanTarget(target: string, err: Output): number
  * zero findings is exactly the case that turns a bug into a green build.
  */
 export declare function exitForFindings(findings: readonly Finding[], gate: "advisory" | "error" | "warning"): number;
+/** `mjolnir ci --help`, rendered from the table so it cannot drift. */
+export declare function renderCiSubcommandHelp(): string;
 /** Testable `ci install` handler. Returns the process exit code. */
 export declare function runCiInstall(argv: string[], io?: {
   out: Output;
@@ -2135,6 +1829,5 @@ export declare function runHelpCommand(argv: string[], io?: {
   err: Output;
 }): number;
 export declare function isEntryPoint(): boolean;
-//#endregion
 export { ENGINE_VERSION as CLI_VERSION, type CliArgs, type Output, type ScanHooks };
 //# sourceMappingURL=cli.d.mts.map