mjolnir-qa 6.0.0 → 6.0.1

package/dist/mcp/stdio.mjs

@@ -2,7 +2,7 @@ import { createRequire } from "node:module";
 import { createInterface } from "node:readline";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { createHash, randomBytes } from "node:crypto";
-import { closeSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, statSync, unlinkSync, writeSync } from "node:fs";
+import { closeSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, statSync, unlinkSync, writeSync } from "node:fs";
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { execFileSync } from "node:child_process";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -12,7 +12,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { Language, Parser } from "web-tree-sitter";
 import { parse } from "yaml";
 import { inflateRawSync } from "node:zlib";
-//#region src/types.ts
+// src/types.ts
 /** Severity ladder. Order matters for sorting and gating. */
 const SEVERITY_ORDER = [
 	"error",
@@ -99,8 +99,7 @@ const DEDUCTIONS = {
 	warning: 3,
 	info: 1
 };
-//#endregion
-//#region src/engine/completion.ts
+// src/engine/completion.ts
 function deriveCompletion(input) {
 	const truncationReasons = [...new Set(input.truncationReasons)].sort();
 	const degradations = [...input.degradations ?? []].sort((a, b) => a.reason < b.reason ? -1 : a.reason > b.reason ? 1 : 0);
@@ -142,8 +141,7 @@ function deriveCompletion(input) {
 		}
 	};
 }
-//#endregion
-//#region src/engine/degradation-ledger.ts
+// src/engine/degradation-ledger.ts
 /**
 * Append-only. Records are never edited and never removed by a recording
 * site; a reader takes a window, and the window is defined by index, so
@@ -179,8 +177,7 @@ function summarizeDegradations(window) {
 		count
 	})).sort((a, b) => a.reason < b.reason ? -1 : a.reason > b.reason ? 1 : 0);
 }
-//#endregion
-//#region src/engine/runtime-corroboration.ts
+// src/engine/runtime-corroboration.ts
 /**
 * Stamp runtime corroboration + trust levels onto findings (mutates in
 * place, the same contract as stampEvidenceLevels). Returns the number
@@ -262,8 +259,7 @@ function deriveTrustLevel(finding, corroboration) {
 	if (corroboration.level === "test") return "L4";
 	return "L3";
 }
-//#endregion
-//#region src/rules/measured-fp.generated.ts
+// src/rules/measured-fp.generated.ts
 const MEASURED_FP = {
 	"QA-CI-001": {
 		fpRate: .105,
@@ -777,8 +773,7 @@ const MEASURED_FP = {
 		ciHigh: .4343
 	}
 };
-//#endregion
-//#region src/engine/trust-summary.ts
+// src/engine/trust-summary.ts
 /**
 * Trust level of the summary — the BEST trust level any finding in the
 * scan reached. Static-only findings settle at L2 (deriveTrustLevel's
@@ -902,8 +897,7 @@ function buildTrustSummary(result, declarationsByFile) {
 		ceilingReasons: reasons
 	};
 }
-//#endregion
-//#region src/governance/run-mode.ts
+// src/governance/run-mode.ts
 /**
 * Which mode a run is in, and how the other one is reached.
 *
@@ -954,8 +948,7 @@ function resolveRunMode(input) {
 	if (declared === "local-only" || declared === "hosted") return declared;
 	throw new Error(`${HOSTED_MODE_FLAG}=${String(declared)} is not a run mode. Expected "hosted" or "local-only". Falling back to a default here would let a mistyped flag look like a deliberate choice.`);
 }
-//#endregion
-//#region src/engine/run-identity.ts
+// src/engine/run-identity.ts
 /**
 * Run Identity (product-gap master plan §7, plan 1789009691197 R4c) —
 * the deterministic binding that anchors every trust claim to its
@@ -1084,8 +1077,7 @@ function buildEvidenceGraph(parts) {
 		} } : {}
 	};
 }
-//#endregion
-//#region src/engine/file-executor.ts
+// src/engine/file-executor.ts
 function cacheHitOutcome(job) {
 	return {
 		path: job.path,
@@ -1176,8 +1168,7 @@ function createExecutor(name, concurrency, runOne) {
 		execute: runOne
 	};
 }
-//#endregion
-//#region src/scope/git-resolve.ts
+// src/scope/git-resolve.ts
 /**
 * Absolute-path git resolution (audit S1).
 *
@@ -1252,8 +1243,7 @@ function runGit(root, args) {
 		return null;
 	}
 }
-//#endregion
-//#region src/lib/safe-json.ts
+// src/lib/safe-json.ts
 /**
 * Reusable safe-JSON parse-and-validate helper.
 *
@@ -1290,8 +1280,7 @@ function isRecord(v) {
 		return false;
 	}
 }
-//#endregion
-//#region src/engine/candidate-binding.ts
+// src/engine/candidate-binding.ts
 /**
 * Candidate binding (plan V5-010).
 *
@@ -1424,18 +1413,17 @@ function readCandidateBinding(root, manifestPath = CANDIDATE_MANIFEST_PATH) {
 		return null;
 	}
 }
-//#endregion
-//#region src/engine/version.ts
+// src/engine/version.ts
 /**
 * Engine version, as a leaf module: `runIdentity` (R4c) needs the engine
 * version inside scan-pipeline WITHOUT importing cli.ts (a cycle — cli
 * imports the pipeline). The literal follows the same discipline as
 * CLI_VERSION and SARIF's driver.version: kept in sync on release by
-* scripts/archive/sync-sarif-version.cjs (archived; superseded by the release
-* workflow's own version stamping) and guarded by the version-consistency
+* `npm run version:surface:sync` (this file is an identity surface) and
+* guarded by the version-consistency
 * spec. cli.ts re-exports this as CLI_VERSION.
 */
-const ENGINE_VERSION = "6.0.0";
+const ENGINE_VERSION = "6.0.1";
 resolveBuildId();
 /**
 * The decision, with the process boundary already behind `runGit`.
@@ -1475,16 +1463,7 @@ function resolveBuildId() {
 	};
 	return buildIdFrom(runGit);
 }
-//#endregion
-//#region src/engine/contract-versions.ts
-/**
-* Versioned contract registry (VERSION-001).
-*
-* Single source of truth for every version constant the engine exposes
-* to consumers (run identity, evidence graph, machine contract).
-* Constants are `as const` — literal types flow into the identity
-* surface without widening.
-*/
+// src/engine/contract-versions.ts
 const TRUST_MODEL_VERSION = "1.0.0";
 /**
 * 2.0.0 (ADR 0014): the core tier carries an evidence FLOOR. A core rule's
@@ -1496,8 +1475,7 @@ const TRUST_MODEL_VERSION = "1.0.0";
 */
 const SCORING_MODEL_VERSION = "2.0.0";
 const FRAMEWORK_SUPPORT_MATRIX_VERSION = "1.0.0";
-//#endregion
-//#region src/discovery/evidence-discovery.ts
+// src/discovery/evidence-discovery.ts
 /**
 * Zero-config evidence discovery (Mega MVP Master Plan v3.1 §26 WI-11).
 *
@@ -1589,8 +1567,7 @@ function discoverEvidenceCandidates(scanRoot) {
 	}
 	return out.sort((a, b) => a.depth - b.depth || (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
 }
-//#endregion
-//#region src/discovery/workspace.ts
+// src/discovery/workspace.ts
 /**
 * Repository discovery (Sprint-Plan W1-03).
 * Finds project root, parses package.json, detects npm/yarn/pnpm workspaces.
@@ -1637,8 +1614,7 @@ function basename$1(p) {
 	const parts = p.split(/[\\/]/);
 	return parts[parts.length - 1];
 }
-//#endregion
-//#region src/lib/fs-bounded.ts
+// src/lib/fs-bounded.ts
 function closeQuiet(fd) {
 	try {
 		closeSync(fd);
@@ -1690,8 +1666,7 @@ function readFileBounded(path, maxBytes) {
 		if (fd !== void 0) closeQuiet(fd);
 	}
 }
-//#endregion
-//#region src/config/config-schema.ts
+// src/config/config-schema.ts
 const VALID_GATES = /* @__PURE__ */ new Set([
 	"advisory",
 	"error",
@@ -1761,8 +1736,7 @@ function validateConfigSchema(config) {
 		errors
 	};
 }
-//#endregion
-//#region src/config/config.ts
+// src/config/config.ts
 /**
 * Config file support (Sprint-Plan W7, Product-MVP §27 + GAP-F).
 * Zero-config preserved: config presence never changes detection
@@ -1896,8 +1870,7 @@ function applySeverityOverrides(findings, cfg) {
 		if (override && SEVERITY_ORDER.includes(override)) f.severity = override;
 	}
 }
-//#endregion
-//#region src/lib/compare.ts
+// src/lib/compare.ts
 /**
 * Order that does not depend on who is asking.
 *
@@ -1943,8 +1916,7 @@ function compareCodePoints(a, b) {
 function compareLocalized(locale) {
 	return (a, b) => a.localeCompare(b, locale);
 }
-//#endregion
-//#region src/lib/glob.ts
+// src/lib/glob.ts
 /**
 * The shared segment compiler: a glob to a regex BODY, with no anchors.
 *
@@ -1998,8 +1970,7 @@ function anyDepthGlobRegExp(glob) {
 function pathMatchesGlob(path, glob) {
 	return anchoredGlobRegExp(glob).test(path.replaceAll("\\", "/"));
 }
-//#endregion
-//#region src/discovery/ignores.ts
+// src/discovery/ignores.ts
 /**
 * Ignore resolution (Product-MVP.txt R1 — Tier-1 launch blocker).
 *
@@ -2155,8 +2126,7 @@ function isLintFixtureDir(absoluteDir) {
 		return false;
 	}
 }
-//#endregion
-//#region src/discovery/shared-walk.ts
+// src/discovery/shared-walk.ts
 /**
 * Shared directory walker (audit P-2).
 *
@@ -2219,8 +2189,7 @@ function sharedWalk(options) {
 	};
 	walk(options.root);
 }
-//#endregion
-//#region src/discovery/frameworks.ts
+// src/discovery/frameworks.ts
 /**
 * Framework detection via config resolution (Sprint-Plan W3-01, R8).
 *
@@ -2303,8 +2272,7 @@ function detectFrameworks(ws) {
 		unknown: false
 	};
 }
-//#endregion
-//#region src/engine/ts-ast.ts
+// src/engine/ts-ast.ts
 /**
 * AST precision layer (Upgrade-Plan-v3 Phase 3).
 *
@@ -2503,8 +2471,7 @@ function getCodeOnlyText(file) {
 function resetTsMorphProject() {
 	looseProject = null;
 }
-//#endregion
-//#region src/engine/code-text.ts
+// src/engine/code-text.ts
 /**
 * Code-only text masking (Phase 1 — Tempering Plan).
 *
@@ -2864,8 +2831,7 @@ function getCodeTextForCounting(text, language) {
 function blankRange(chars, start, end) {
 	for (let i = start; i < end && i < chars.length; i++) if (chars[i] !== "\n" && chars[i] !== "\r") chars[i] = " ";
 }
-//#endregion
-//#region src/engine/adapter.ts
+// src/engine/adapter.ts
 /**
 * The §15.1 framework filter, shared by every language adapter: a rule
 * that declares `frameworks` runs on a file only when the file carries
@@ -2879,8 +2845,7 @@ function frameworkFilterApplies(rule, file) {
 	if (tags === void 0 || tags.length === 0) return true;
 	return rule.frameworks.some((f) => tags.includes(f));
 }
-//#endregion
-//#region src/engine/shared-run-rules.ts
+// src/engine/shared-run-rules.ts
 /**
 * Run ONE rule with crash isolation, and return what it produced.
 *
@@ -2917,8 +2882,7 @@ function runRuleIsolated(rule, file, onCrash) {
 		return null;
 	}
 }
-//#endregion
-//#region src/adapters/typescript.ts
+// src/adapters/typescript.ts
 /**
 * TypeScript/JavaScript adapter (R1).
 * Wraps the proven regex-based engine behind the LanguageAdapter
@@ -3171,8 +3135,7 @@ function loadWorkspaceShim(root) {
 		return null;
 	}
 }
-//#endregion
-//#region src/engine/tree-sitter-ast.ts
+// src/engine/tree-sitter-ast.ts
 /**
 * Tree-sitter WASM AST layer for Java and C# — Sprint 8 Task 36
 * (Master-Stabilization-Plan.md).
@@ -3391,8 +3354,7 @@ async function releaseTreeSitterResources() {
 		} catch {}
 	}
 }
-//#endregion
-//#region src/adapters/python.ts
+// src/adapters/python.ts
 /**
 * Python/pytest adapter (Upgrade-Plan-v2 R2).
 *
@@ -3550,8 +3512,7 @@ const pythonAdapter = {
 function readText$2(p) {
 	return readFileSync(p, "utf8");
 }
-//#endregion
-//#region src/adapters/java.ts
+// src/adapters/java.ts
 /**
 * Java/JUnit adapter (Upgrade-Plan-v3 Phase 4).
 *
@@ -3717,8 +3678,7 @@ function javaFileTags(file) {
 function readText$1(path) {
 	return readFileSync(path, "utf8");
 }
-//#endregion
-//#region src/adapters/csharp.ts
+// src/adapters/csharp.ts
 /**
 * C#/.NET adapter (Upgrade-Plan-v3 Phase 5).
 *
@@ -3874,8 +3834,7 @@ function csharpFileTags(file) {
 function readText(path) {
 	return readFileSync(path, "utf8");
 }
-//#endregion
-//#region src/discovery/yaml-guards.ts
+// src/discovery/yaml-guards.ts
 /**
 * Shared hostile-YAML guards (product-gap master plan P3 common law —
 * `azure-pipelines.yml` detection rides the same YAML machinery as the
@@ -3944,8 +3903,7 @@ function enforceDepthCap(value, max, depthMessage = GENERIC_LABELS.depthMessage)
 		});
 	}
 }
-//#endregion
-//#region src/discovery/workflow-parser.ts
+// src/discovery/workflow-parser.ts
 /**
 * Safe GitHub Actions workflow parser (Phase 0.3, W4-03 debt).
 *
@@ -3991,8 +3949,7 @@ function parseWorkflow(text) {
 	}
 	return { jobs };
 }
-//#endregion
-//#region src/adapters/github-actions.ts
+// src/adapters/github-actions.ts
 /**
 * GitHub Actions adapter (R1).
 * Owns workflow discovery and safe-YAML parsing; CI rules consume the
@@ -4077,8 +4034,7 @@ const githubActionsAdapter = {
 };
 var WorkflowParseSkipped = class extends Error {};
 const LIMITS_MAX_BYTES$2 = 1048576;
-//#endregion
-//#region src/discovery/azure-pipeline-parser.ts
+// src/discovery/azure-pipeline-parser.ts
 /**
 * Safe Azure DevOps pipeline parser (product-gap master plan P3b).
 *
@@ -4312,8 +4268,7 @@ function isAzurePipelineFixture(normalizedPath) {
 	const base = normalizedPath.replaceAll("\\", "/").split("/").pop() ?? "";
 	return AZURE_PIPELINE_FILENAMES_SET.has(base);
 }
-//#endregion
-//#region src/adapters/azure-pipelines.ts
+// src/adapters/azure-pipelines.ts
 /**
 * Azure DevOps pipeline adapter (product-gap master plan P3b).
 * Owns `azure-pipelines.yml` discovery (repo root, the platform's
@@ -4393,8 +4348,7 @@ const azurePipelinesAdapter = {
 };
 var AzureParseSkipped = class extends Error {};
 const LIMITS_MAX_BYTES$1 = 1048576;
-//#endregion
-//#region src/adapters/jenkins.ts
+// src/adapters/jenkins.ts
 /**
 * Jenkins adapter (product-gap master plan P3c).
 * The root `Jenkinsfile` is a TEXT-target file kind: declarative and
@@ -4468,8 +4422,7 @@ const jenkinsAdapter = {
 	}
 };
 const LIMITS_MAX_BYTES = 1048576;
-//#endregion
-//#region src/discovery/scan-adapters.ts
+// src/discovery/scan-adapters.ts
 /**
 * The canonical adapter registry (audits H-6/H-9).
 *
@@ -4606,8 +4559,7 @@ function isInsideSkippedDir(root, absPath, skipNames) {
 	return relative(root, absPath).replaceAll("\\", "/").split("/").slice(0, -1).some((seg) => skipNames.includes(seg));
 }
 typescriptAdapter.testFileGlobs, pythonAdapter.testFileGlobs, javaAdapter.testFileGlobs, csharpAdapter.testFileGlobs, githubActionsAdapter.testFileGlobs, azurePipelinesAdapter.testFileGlobs, jenkinsAdapter.testFileGlobs;
-//#endregion
-//#region src/scope/changed.ts
+// src/scope/changed.ts
 /**
 * Changed-scope engine (Sprint-Plan W6, Product-MVP §9 `--scope changed`).
 *
@@ -4850,8 +4802,7 @@ function computeStagedFiles(root) {
 	if (raw === null) return null;
 	return raw.split("\0").filter((s) => s.length > 0);
 }
-//#endregion
-//#region src/rules/rule.ts
+// src/rules/rule.ts
 /**
 * Invoke an `astQuery` hook with the mandatory-fallback contract: no
 * hook or no AST on the context resolves to `undefined` (→ regex
@@ -4864,8 +4815,7 @@ function tryAstQuery(hook, ctx) {
 function defineRule(rule) {
 	return rule;
 }
-//#endregion
-//#region src/rules/shared/positions.ts
+// src/rules/shared/positions.ts
 /**
 * Shared position helpers (Phase 6 — Tempering Plan).
 * One lineAt, one colAt, one matchBrace. The other 79 copies are dead.
@@ -4910,8 +4860,7 @@ function lineAt(text, index) {
 function colAt(text, index) {
 	return index - (index <= 0 ? -1 : text.lastIndexOf("\n", index - 1));
 }
-//#endregion
-//#region src/rules/test/qa-test-001-focused-test.ts
+// src/rules/test/qa-test-001-focused-test.ts
 /**
 * QA-TEST-001 — Focused test committed (`fit`/`fdescribe`/`.only`).
 * Severity: error · Confidence: high · deterministic-defect
@@ -4977,8 +4926,7 @@ const focusedTestCommitted = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/test/qa-test-002-skipped-test.ts
+// src/rules/test/qa-test-002-skipped-test.ts
 /**
 * QA-TEST-002 — Skipped test (`it.skip`, `xit`, `test.skip`, `describe.skip`).
 * Severity: warning · Confidence: high · deterministic-defect
@@ -5034,8 +4982,7 @@ const skippedTest = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/shared/masking.ts
+// src/rules/shared/masking.ts
 /** True when the offset was blanked in codeText (inside a string or comment). */
 function isMasked(ctx, index) {
 	const mask = ctx.codeText;
@@ -5096,8 +5043,7 @@ function isInsideEmbeddedCode(ctx, index) {
 	const hasCallSyntax = /\w\s*\(/.test(inner);
 	return hasNestedQuote && hasCallSyntax;
 }
-//#endregion
-//#region src/rules/test/qa-test-003-no-assertions.ts
+// src/rules/test/qa-test-003-no-assertions.ts
 /**
 * QA-TEST-003 — Test with no assertions.
 * Severity: error · Confidence: high · deterministic-defect
@@ -5175,8 +5121,7 @@ function matchBrace$2(text, open) {
 	}
 	return -1;
 }
-//#endregion
-//#region src/rules/test/qa-test-004-hard-sleep.ts
+// src/rules/test/qa-test-004-hard-sleep.ts
 /**
 * QA-TEST-004 — Hard sleep (`sleep()`, `waitForTimeout()`, `setTimeout` as wait).
 * Severity: warning · Confidence: high · deterministic-defect
@@ -5241,8 +5186,7 @@ const hardSleep = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/test/qa-test-006-retry-abuse.ts
+// src/rules/test/qa-test-006-retry-abuse.ts
 /**
 * QA-TEST-006 — Retry abuse in test config.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -5308,8 +5252,7 @@ const retryAbuse = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/test/qa-test-010-empty-body.ts
+// src/rules/test/qa-test-010-empty-body.ts
 /**
 * QA-TEST-010 — Empty test body.
 * Severity: error · Confidence: high · deterministic-defect
@@ -5364,8 +5307,7 @@ const emptyTestBody = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/quality/qa-tqual-002-tautological.ts
+// src/rules/quality/qa-tqual-002-tautological.ts
 /**
 * QA-TQUAL-002 — Tautological assertion.
 * Severity: error · Confidence: high · deterministic-defect
@@ -5442,8 +5384,7 @@ const tautologicalAssertion = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/quality/qa-tqual-009-promise-assertion.ts
+// src/rules/quality/qa-tqual-009-promise-assertion.ts
 /**
 * QA-TQUAL-009 — Unawaited assertion inside a promise chain.
 * Severity: error · Confidence: high · deterministic-defect
@@ -5613,8 +5554,7 @@ function matchParen$2(text, open) {
 	}
 	return -1;
 }
-//#endregion
-//#region src/rules/quality/qa-tqual-011-commented-out.ts
+// src/rules/quality/qa-tqual-011-commented-out.ts
 /**
 * QA-TQUAL-011 — Commented-out tests.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -5727,8 +5667,7 @@ function commentRanges(ctx) {
 	}
 	return ranges;
 }
-//#endregion
-//#region src/rules/playwright/qa-pw-002-unawaited-assertion.ts
+// src/rules/playwright/qa-pw-002-unawaited-assertion.ts
 /**
 * QA-PW-002 — Missing `await` on a Playwright locator assertion.
 * Severity: error · Confidence: high · deterministic-defect
@@ -5873,8 +5812,7 @@ function runRegexFallback(text, path) {
 	});
 	return findings;
 }
-//#endregion
-//#region src/rules/playwright/qa-pw-003-debug-artifacts.ts
+// src/rules/playwright/qa-pw-003-debug-artifacts.ts
 /**
 * QA-PW-003 — Committed `page.pause()` or `test.only()` in e2e specs.
 * Severity: error · Confidence: high · deterministic-defect
@@ -5926,8 +5864,7 @@ const committedDebugArtifacts = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-004-brittle-selectors.ts
+// src/rules/playwright/qa-pw-004-brittle-selectors.ts
 /**
 * QA-PW-004 — Brittle CSS/XPath selectors vs role-based locators.
 * Severity: warning · Confidence: medium · heuristic-risk
@@ -6019,8 +5956,7 @@ function stripComments(ctx) {
 	} catch {}
 	return ctx.text.replace(/\/\/[^\n]*/g, (cm) => " ".repeat(cm.length));
 }
-//#endregion
-//#region src/rules/ci/verification-gate.ts
+// src/rules/ci/verification-gate.ts
 /**
 * Shared "is this shell command a verification gate?" matcher for the QA-CI
 * rules. A gate is a command whose failure MUST fail the job — test runners,
@@ -6060,8 +5996,7 @@ const VERIFICATION_GATE_RE = new RegExp([
 function looksLikeVerificationGate(cmd) {
 	return VERIFICATION_GATE_RE.test(cmd);
 }
-//#endregion
-//#region src/rules/ci/azure-gates.ts
+// src/rules/ci/azure-gates.ts
 /** Discriminator: the Azure parser is the only one emitting `platform`. */
 function isAzurePipelineDoc(ast) {
 	return typeof ast === "object" && ast !== null && ast.platform === "azure-pipelines";
@@ -6145,8 +6080,7 @@ function locateAzureJobKey(text, job, keyName) {
 	if (m) return lineAt(text, m.index);
 	return 1;
 }
-//#endregion
-//#region src/rules/ci/qa-ci-001-continue-on-error.ts
+// src/rules/ci/qa-ci-001-continue-on-error.ts
 /**
 * QA-CI-001 — `continue-on-error: true` masks a failing job.
 * Severity: error · Confidence: high · deterministic-defect
@@ -6374,8 +6308,7 @@ function describeAzureStep(step) {
 	if (step.task) return step.task;
 	return "step";
 }
-//#endregion
-//#region src/rules/ci/qa-ci-002-swallowed-exit.ts
+// src/rules/ci/qa-ci-002-swallowed-exit.ts
 /**
 * QA-CI-002 — `|| true` swallows a command's exit code.
 * Severity: error · Confidence: high · deterministic-defect
@@ -6430,8 +6363,7 @@ const swallowedExitCode = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/ci/qa-ci-007-retry-masking.ts
+// src/rules/ci/qa-ci-007-retry-masking.ts
 /**
 * QA-CI-007 — Retry masking test failures.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -6582,8 +6514,7 @@ function azureArm$1(ctx, doc, findings) {
 		});
 	}
 }
-//#endregion
-//#region src/rules/ci/qa-ci-005-report-never-generated.ts
+// src/rules/ci/qa-ci-005-report-never-generated.ts
 /**
 * QA-CI-005 — Report consumed but never generated.
 * Severity: error · Confidence: high · deterministic-defect
@@ -6741,8 +6672,7 @@ function findJobConsumerLine(text, jobName, consumerRe) {
 	const anywhere = new RegExp(consumerRe.source, "i").exec(text);
 	return anywhere ? lineAt(text, anywhere.index) : 1;
 }
-//#endregion
-//#region src/rules/ci/jenkins-gates.ts
+// src/rules/ci/jenkins-gates.ts
 /**
 * Jenkinsfile block scanner for the QA-CI Jenkins arms (product-gap
 * master plan P3c). Jenkinsfiles are Groovy text — "no new language
@@ -6988,8 +6918,7 @@ function textIsVerificationGate(text) {
 function lineOfOffset(text, offset) {
 	return lineAt(text, offset);
 }
-//#endregion
-//#region src/rules/ci/qa-ci-008-always-success.ts
+// src/rules/ci/qa-ci-008-always-success.ts
 /**
 * QA-CI-008 — Always-success step at the end of a job.
 * Severity: error · Confidence: high · deterministic-defect
@@ -7163,8 +7092,7 @@ function jenkinsArm$1(ctx, findings) {
 		});
 	}
 }
-//#endregion
-//#region src/rules/ci/qa-ci-009-exit-code.ts
+// src/rules/ci/qa-ci-009-exit-code.ts
 /**
 * QA-CI-009 — Test command does not propagate exit code.
 * Severity: error · Confidence: high · deterministic-defect
@@ -7299,8 +7227,7 @@ function jenkinsArm(ctx, findings) {
 		});
 	}
 }
-//#endregion
-//#region src/rules/ci/qa-ci-010-non-blocking.ts
+// src/rules/ci/qa-ci-010-non-blocking.ts
 /**
 * QA-CI-010 — Required test job is non-blocking for branch protection.
 * Severity: error · Confidence: medium · deterministic-defect
@@ -7383,8 +7310,7 @@ function findLine(text, re) {
 function escapeRe(s) {
 	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-//#endregion
-//#region src/rules/ci/qa-ci-013-can-never-fail.ts
+// src/rules/ci/qa-ci-013-can-never-fail.ts
 /**
 * QA-CI-013 — Verification stage/job conditioned so it can never fail the
 * pipeline (product-gap master plan P3b).
@@ -7488,8 +7414,7 @@ const canNeverFailGate = defineRule({
 function jobHasGate(job) {
 	return (job.steps ?? []).some((s) => s !== void 0 && stepIsVerificationGate$1(s));
 }
-//#endregion
-//#region src/rules/ci/qa-ci-014-swallowed-verification.ts
+// src/rules/ci/qa-ci-014-swallowed-verification.ts
 /**
 * QA-CI-014 — try/catch swallowing a verification-stage failure without
 * rethrow or failure-marking (product-gap master plan P3c).
@@ -7546,8 +7471,7 @@ const swallowedVerificationFailure = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/python/qa-py-003-no-assertions.ts
+// src/rules/python/qa-py-003-no-assertions.ts
 /**
 * QA-PY-003 — Test function with no assertions.
 * Severity: error · Confidence: high · deterministic-defect
@@ -7668,8 +7592,7 @@ function extractBlock$1(text, afterColon) {
 	const lineEnd = rest.indexOf("\n", firstIdx);
 	return lineEnd === -1 ? rest : rest.slice(0, lineEnd);
 }
-//#endregion
-//#region src/rules/python/qa-py-005-hard-sleep.ts
+// src/rules/python/qa-py-005-hard-sleep.ts
 /**
 * QA-PY-005 — time.sleep() in tests.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -7716,8 +7639,7 @@ const pyHardSleep = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/python/qa-py-002-skipped-test.ts
+// src/rules/python/qa-py-002-skipped-test.ts
 /**
 * QA-PY-002 — Skipped test (`@pytest.mark.skip`, `xfail` non-strict).
 * Severity: warning · Confidence: high · deterministic-defect
@@ -7777,8 +7699,7 @@ const pySkippedTest = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/python/qa-py-012-tautological.ts
+// src/rules/python/qa-py-012-tautological.ts
 /**
 * QA-PY-012 — Tautological assertion (`assert True`, `assert x == x`).
 * Severity: error · Confidence: high · deterministic-defect
@@ -7833,8 +7754,7 @@ const pyTautological = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/python/qa-py-001-focused-test.ts
+// src/rules/python/qa-py-001-focused-test.ts
 /**
 * QA-PY-001 — Focused test committed.
 * Severity: error · Confidence: high · deterministic-defect
@@ -7888,8 +7808,7 @@ const pyFocusedTest = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/engine/jv-cs-ast.ts
+// src/engine/jv-cs-ast.ts
 /** Narrow the loose `ast` seam back to a tree-sitter Tree. */
 function getTreeSitterTree(ast) {
 	if (!(ast instanceof Object) || !("rootNode" in ast)) return void 0;
@@ -8093,8 +8012,7 @@ function isHelperIdiom(name) {
 	}
 	return false;
 }
-//#endregion
-//#region src/engine/python-ast.ts
+// src/engine/python-ast.ts
 function getPythonTree(ast) {
 	return getTreeSitterTree(ast);
 }
@@ -8179,8 +8097,7 @@ function pythonWithRaisesBlocks(tree) {
 	});
 	return out;
 }
-//#endregion
-//#region src/rules/python/qa-py-007-raises-without-match.ts
+// src/rules/python/qa-py-007-raises-without-match.ts
 /**
 * QA-PY-007 — pytest.raises without match.
 * Severity: warning · Confidence: medium · heuristic-risk
@@ -8307,8 +8224,7 @@ function astArm(ctx, tree) {
 	}
 	return findings;
 }
-//#endregion
-//#region src/rules/python/qa-py-009-commented-out.ts
+// src/rules/python/qa-py-009-commented-out.ts
 /**
 * QA-PY-009 — Commented-out tests.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -8355,8 +8271,7 @@ const pyCommentedOutTest = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/python/qa-py-004-bare-truthiness.ts
+// src/rules/python/qa-py-004-bare-truthiness.ts
 /**
 * QA-PY-004 — Bare truthiness assert on complex object.
 * Severity: warning · Confidence: medium · heuristic-risk
@@ -8435,8 +8350,7 @@ const pyBareTruthinessAssert = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/python/qa-py-011-mutable-fixture.ts
+// src/rules/python/qa-py-011-mutable-fixture.ts
 /**
 * QA-PY-011 — Mutable fixture shared across tests.
 * Severity: warning · Confidence: medium · heuristic-risk
@@ -8487,8 +8401,7 @@ const pyMutableFixture = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-101-wait-for-timeout.ts
+// src/rules/playwright/qa-pw-101-wait-for-timeout.ts
 /**
 * QA-PW-101 — waitForTimeout() anywhere.
 * Severity: error · Confidence: high · deterministic-defect
@@ -8535,8 +8448,7 @@ const pwWaitForTimeout = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-102-wait-load.ts
+// src/rules/playwright/qa-pw-102-wait-load.ts
 /**
 * QA-PW-102 — waitForEvent('load') / waitForLoadState('load') instead of
 * web-first assertions.
@@ -8590,8 +8502,7 @@ const pwWaitForLoadEvent = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-113-deep-frames.ts
+// src/rules/playwright/qa-pw-113-deep-frames.ts
 /**
 * QA-PW-113 — frameLocator chains > 2 deep.
 * Severity: warning · Confidence: medium · heuristic-risk
@@ -8641,8 +8552,7 @@ const pwDeepFrameLocator = defineRule({
 function count(fragment) {
 	return fragment.match(/frameLocator\s*\(/g).length;
 }
-//#endregion
-//#region src/rules/playwright/qa-pw-117-serial.ts
+// src/rules/playwright/qa-pw-117-serial.ts
 /**
 * QA-PW-117 — test.describe.serial without justification comment.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -8696,8 +8606,7 @@ const pwSerialNoJustification = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-121-config-retries.ts
+// src/rules/playwright/qa-pw-121-config-retries.ts
 /**
 * QA-PW-121 — playwright.config: retries >= 3 or workers = 0.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -8762,8 +8671,7 @@ const pwConfigRetryAbuse = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-122-no-trace.ts
+// src/rules/playwright/qa-pw-122-no-trace.ts
 /**
 * QA-PW-122 — No trace capture on retry in playwright.config.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -8812,8 +8720,7 @@ const pwNoTraceOnRetry = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-124-project-split.ts
+// src/rules/playwright/qa-pw-124-project-split.ts
 /**
 * QA-PW-124 — Projects defined but no smoke/regression split.
 * Severity: info · Confidence: high · deterministic-defect
@@ -8875,8 +8782,7 @@ const pwNoProjectSplit = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-104-trial-click.ts
+// src/rules/playwright/qa-pw-104-trial-click.ts
 /**
 * QA-PW-104 — `{ trial: true }` misuse — check-then-act race.
 * Severity: warning · Confidence: medium · heuristic-risk
@@ -8922,8 +8828,7 @@ const pwTrialMisuse = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-116-storage-state.ts
+// src/rules/playwright/qa-pw-116-storage-state.ts
 /**
 * QA-PW-116 — storageState reuse without expiry strategy.
 * Severity: warning · Confidence: medium · heuristic-risk
@@ -8969,8 +8874,7 @@ const pwStorageStateNoExpiry = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-125-global-setup.ts
+// src/rules/playwright/qa-pw-125-global-setup.ts
 /**
 * QA-PW-125 — globalSetup mutating shared external state.
 * Severity: warning · Confidence: medium · heuristic-risk
@@ -9028,8 +8932,7 @@ const pwGlobalSetupSharedState = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-115-shared-page.ts
+// src/rules/playwright/qa-pw-115-shared-page.ts
 /**
 * QA-PW-115 — Shared `page` across parallel tests without isolation.
 * Severity: warning · Confidence: medium · heuristic-risk
@@ -9077,8 +8980,7 @@ const pwSharedPage = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-140.ts
+// src/rules/playwright/qa-pw-140.ts
 /**
 * QA-PW-140 — Screenshot without maxDiffPixelRatio.
 *
@@ -9152,8 +9054,7 @@ function matchParen(text, open) {
 	}
 	return -1;
 }
-//#endregion
-//#region src/rules/playwright/qa-pw-123-hardcoded-url.ts
+// src/rules/playwright/qa-pw-123-hardcoded-url.ts
 /**
 * QA-PW-123 — Hardcoded baseURL in specs.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -9201,8 +9102,7 @@ const hardcodedBaseUrl = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/quality/qa-env-001-env-coupling.ts
+// src/rules/quality/qa-env-001-env-coupling.ts
 /**
 * QA-ENV-001 — "Works On My Machine" detector core (Tier 5 #24).
 * Environment coupling in test files: fixed ports, OS paths,
@@ -9269,8 +9169,7 @@ const envCoupling = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-141-retry-no-triage.ts
+// src/rules/playwright/qa-pw-141-retry-no-triage.ts
 /**
 * QA-PW-141 — playwright.config retries set high enough to mask flakes.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -9327,8 +9226,7 @@ const pwRetryMaskingNoForensics = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-142-blanket-route.ts
+// src/rules/playwright/qa-pw-142-blanket-route.ts
 /**
 * QA-PW-142 — page.route() blanket-mocking instead of scoped intercepts.
 * Severity: warning · Confidence: medium · heuristic-risk
@@ -9383,8 +9281,7 @@ const pwBlanketRouteMock = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-143-no-artifacts.ts
+// src/rules/playwright/qa-pw-143-no-artifacts.ts
 /**
 * QA-PW-143 — No screenshot/video artifact capture on failure.
 * Severity: info · Confidence: high · deterministic-defect
@@ -9437,8 +9334,7 @@ const pwNoFailureArtifacts = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-144-single-browser.ts
+// src/rules/playwright/qa-pw-144-single-browser.ts
 /**
 * QA-PW-144 — Single-browser project matrix (no cross-browser coverage).
 * Severity: info · Confidence: high · deterministic-defect
@@ -9500,8 +9396,7 @@ const pwSingleBrowserMatrix = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-146-css-locator.ts
+// src/rules/playwright/qa-pw-146-css-locator.ts
 /**
 * QA-PW-146 — CSS/XPath string selector where Playwright's locator
 * standard expects a normalized locator (plan §17.3).
@@ -9580,8 +9475,7 @@ const pwLocatorNormalize = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-147-codegen-artifact.ts
+// src/rules/playwright/qa-pw-147-codegen-artifact.ts
 /**
 * QA-PW-147 — Playwright codegen artifact left unedited (plan §17.1).
 * Severity: info · Confidence: medium · observation
@@ -9640,8 +9534,7 @@ const pwCodegenArtifact = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/python/qa-py-101-sync-async-mix.ts
+// src/rules/python/qa-py-101-sync-async-mix.ts
 /**
 * QA-PY-101 — Playwright-Python: sync API in async test (or vice versa).
 * Severity: warning · Confidence: high · deterministic-defect
@@ -9690,8 +9583,7 @@ const pyPwSyncAsyncMix = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/python/qa-py-103-wait-for-timeout.ts
+// src/rules/python/qa-py-103-wait-for-timeout.ts
 /**
 * QA-PY-103 — Playwright-Python: wait_for_timeout() as synchronization.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -9738,8 +9630,7 @@ const pyPwWaitForTimeout = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/python/qa-py-105-pw-no-assertions.ts
+// src/rules/python/qa-py-105-pw-no-assertions.ts
 /**
 * QA-PY-105 — Playwright-Python: no assertion in Playwright test.
 * Severity: error · Confidence: high · deterministic-defect
@@ -9819,8 +9710,7 @@ function extractBlock(text, afterColon) {
 	const lineEnd = rest.indexOf("\n", firstContent.index);
 	return lineEnd === -1 ? rest : rest.slice(0, lineEnd);
 }
-//#endregion
-//#region src/rules/java/qa-jv-101-disabled-test.ts
+// src/rules/java/qa-jv-101-disabled-test.ts
 /**
 * QA-JV-101 — @Disabled test without justification.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -9874,8 +9764,7 @@ const jvDisabledTest = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/java/qa-jv-103-no-assertions.ts
+// src/rules/java/qa-jv-103-no-assertions.ts
 /**
 * QA-JV-103 — Test method without assertions.
 * Severity: error · Confidence: high · deterministic-defect
@@ -10032,8 +9921,7 @@ function matchBrace$1(text, open) {
 	}
 	return -1;
 }
-//#endregion
-//#region src/engine/qa-model.ts
+// src/engine/qa-model.ts
 /**
 * Extract the semantic model for one parsed file. Resolves undefined
 * when the language has no extractor or the parse stage produced no
@@ -10576,8 +10464,7 @@ function extractPythonModel(file) {
 		nodes
 	};
 }
-//#endregion
-//#region src/rules/java/qa-jv-105-wait-for-timeout.ts
+// src/rules/java/qa-jv-105-wait-for-timeout.ts
 /**
 * QA-JV-105 — waitForTimeout / hardcoded navigation waits.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -10662,8 +10549,7 @@ const jvWaitForTimeout = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/csharp/qa-cs-101-skipped-test.ts
+// src/rules/csharp/qa-cs-101-skipped-test.ts
 /**
 * QA-CS-101 — [Ignore]/[Skip] test without justification.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -10727,8 +10613,7 @@ const csSkippedTest = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/csharp/qa-cs-103-no-assertions.ts
+// src/rules/csharp/qa-cs-103-no-assertions.ts
 /**
 * QA-CS-103 — Test method without assertions.
 * Severity: error · Confidence: high · deterministic-defect
@@ -10762,7 +10647,6 @@ const csSkippedTest = defineRule({
 * Deep-diffing those requires symbol semantics Mjölnir deliberately does
 * not promise for C# (plan §13.4).
 */
-/** Helper/verification idiom: verify/check/assert-prefixed names. */
 const WHY$5 = "Without an assertion the test can only fail by throwing — it cannot detect behavioral regressions.";
 const FIX$4 = "Add an assertion on the expected outcome, or remove the test.";
 function makeFinding(path, position, name) {
@@ -10926,8 +10810,7 @@ function matchBrace(text, open) {
 	}
 	return -1;
 }
-//#endregion
-//#region src/rules/csharp/qa-cs-105-wait-for-timeout.ts
+// src/rules/csharp/qa-cs-105-wait-for-timeout.ts
 /**
 * QA-CS-105 — Playwright-.NET: WaitForTimeoutAsync hard sleep.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -11015,8 +10898,7 @@ const csWaitForTimeout = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/cypress/qa-cyp-001-cy-wait.ts
+// src/rules/cypress/qa-cyp-001-cy-wait.ts
 /**
 * QA-CYP-001 — Fixed `cy.wait(n)` (hard-coded wait).
 * Severity: warning · Confidence: high · deterministic-defect
@@ -11095,8 +10977,7 @@ function isCypressFile(ctx) {
 	if (/\.cy\.[jt]sx?$/.test(ctx.path)) return true;
 	return /\bcy\s*\./.test(ctx.codeText ?? ctx.text);
 }
-//#endregion
-//#region src/rules/cypress/qa-cyp-002-focused-test.ts
+// src/rules/cypress/qa-cyp-002-focused-test.ts
 /**
 * QA-CYP-002 — Focused test (`.only`).
 * Severity: error · Confidence: high · deterministic-defect
@@ -11159,8 +11040,7 @@ const cypFocusedTest = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/cypress/qa-cyp-003-config-security.ts
+// src/rules/cypress/qa-cyp-003-config-security.ts
 /**
 * QA-CYP-003 — Cypress config disables `chromeWebSecurity`.
 * Severity: error · Confidence: high · deterministic-defect
@@ -11230,8 +11110,7 @@ const cypConfigSecurity = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/selenium/qa-se-sleep-lookup.ts
+// src/rules/selenium/qa-se-sleep-lookup.ts
 /**
 * Selenium sleep-then-interact rules (Verification Trust Evolution Plan
 * §15.3 — "Selenium implicit-wait abuse / missing WebDriverWait",
@@ -11382,8 +11261,7 @@ const sePythonSleepLookup = defineRule({
 		return sleepBeforeLookup(ctx, PY_SLEEP_RE, PY_LOOKUP_RE, "QA-SE-003");
 	}
 });
-//#endregion
-//#region src/rules/shared/family.ts
+// src/rules/shared/family.ts
 /**
 * Cross-language pattern rule family generator (Phase 6 — Tempering Plan).
 *
@@ -11449,8 +11327,7 @@ function definePatternFamily(opts) {
 		}
 	}));
 }
-//#endregion
-//#region src/rules/families/hard-sleep.ts
+// src/rules/families/hard-sleep.ts
 /**
 * Hard-sleep family (Phase 6 — Tempering Plan).
 * Java: Thread.sleep(), C#: Thread.Sleep() / Task.Delay()
@@ -11601,8 +11478,7 @@ const hardSleepFamily = definePatternFamily({
 		fix: "Use `await Assertions.Expect(locator).ToBeVisibleAsync()` or locator.WaitForAsync()."
 	}]
 });
-//#endregion
-//#region src/rules/families/network-idle.ts
+// src/rules/families/network-idle.ts
 /**
 * Network-idle family (Phase 6 — Tempering Plan).
 * All three language variants of waitForLoadState(networkidle).
@@ -11663,8 +11539,7 @@ const networkIdleFamily = definePatternFamily({
 		}
 	]
 });
-//#endregion
-//#region src/rules/families/hardcoded-url.ts
+// src/rules/families/hardcoded-url.ts
 /**
 * Hardcoded-URL family (Phase 6 — Tempering Plan).
 * Detects absolute URLs in navigation/request calls across languages.
@@ -11714,8 +11589,7 @@ const hardcodedUrlFamily = definePatternFamily({
 		fix: "Use `--base-url` / `base_url` fixture, or `os.environ[...]`."
 	}]
 });
-//#endregion
-//#region src/rules/families/shared-page.ts
+// src/rules/families/shared-page.ts
 /**
 * Shared-page family (Phase 6 — Tempering Plan).
 * Detects static/module-level Page/Browser instances shared across tests.
@@ -11776,8 +11650,7 @@ const sharedPageFamily = definePatternFamily({
 		}
 	]
 });
-//#endregion
-//#region src/rules/families/brittle-selectors.ts
+// src/rules/families/brittle-selectors.ts
 /**
 * Brittle-selectors family (Phase 6 — Tempering Plan).
 * Detects XPath/structural CSS selectors across Java, C#, Python.
@@ -11889,8 +11762,7 @@ const brittleSelectorsFamily = [
 		}
 	], "Prefer role-based locators (`get_by_role(...)`) or data-testid attributes.")
 ];
-//#endregion
-//#region src/rules/families/retry-masking.ts
+// src/rules/families/retry-masking.ts
 /**
 * Retry-masking family (Phase 6 — Tempering Plan).
 * Detects retry annotations/attributes that mask flaky tests.
@@ -12010,8 +11882,7 @@ const retryMaskingFamily = [defineRule({
 		return findings;
 	}
 })];
-//#endregion
-//#region src/rules/index.ts
+// src/rules/index.ts
 const RULES = [
 	focusedTestCommitted,
 	skippedTest,
@@ -12092,8 +11963,7 @@ const RULES = [
 function getRule(id) {
 	return RULES.find((r) => r.id === id);
 }
-//#endregion
-//#region src/lib/wilson.ts
+// src/lib/wilson.ts
 /**
 * 95% Wilson score interval on a proportion (plan §20.2).
 *
@@ -12203,8 +12073,7 @@ function effectiveTier(rule) {
 	if (rule.tier !== void 0) return rule.tier;
 	return measurementTier(rule);
 }
-//#endregion
-//#region src/scorer/scorer.ts
+// src/scorer/scorer.ts
 /**
 * Transparent scorer (Product-MVP §8).
 * score = 100 − Σ(severity deductions), floor 0.
@@ -12356,9 +12225,9 @@ function countTestDeclarations(text, codeText) {
 	const source = codeText ?? text;
 	const patterns = [
 		/\b(?:it|test)(?:\.\w+)*\s*(?:\(|`)/g,
-		/^\s*(?:async\s+)?def\s+test_\w*/gm,
-		/^\s*@Test\b/gm,
-		/^\s*\[(?:Test|Fact|Theory|TestMethod)\b/gm
+		/^[ \t]*(?:async[ \t]+)?def[ \t]+test_\w*/gm,
+		/^[ \t]*@Test\b/gm,
+		/^[ \t]*\[(?:Test|Fact|Theory|TestMethod)\b/gm
 	];
 	let count = 0;
 	for (const re of patterns) {
@@ -12367,8 +12236,7 @@ function countTestDeclarations(text, codeText) {
 	}
 	return count;
 }
-//#endregion
-//#region src/engine/rule-runner.ts
+// src/engine/rule-runner.ts
 /**
 * Legacy appliesTo → adapter id mapping.
 *
@@ -12407,8 +12275,7 @@ function asUniversal(rule) {
 		}
 	};
 }
-//#endregion
-//#region src/engine/tier-policy.ts
+// src/engine/tier-policy.ts
 /**
 * Tier policy (audit H-1): the declared tier is authoritative over a
 * rule's severity and evidence claims.
@@ -12510,8 +12377,7 @@ function enforceTierPolicy(findings, tierByRuleId) {
 		if (EVIDENCE_RANK$1[effective] < EVIDENCE_RANK$1[floor.evidenceLevel]) f.evidenceLevel = floor.evidenceLevel;
 	}
 }
-//#endregion
-//#region src/engine/evidence-core.ts
+// src/engine/evidence-core.ts
 /**
 * The core's own version — stamped into every record's provenance so a
 * consumer can tell which normalization contract produced a record.
@@ -12578,8 +12444,7 @@ function countEvidence(records) {
 	}
 	return counts;
 }
-//#endregion
-//#region src/engine/provenance.ts
+// src/engine/provenance.ts
 const GENERATED_HEADER_RE = /^\s*(?:\/\/|#|\/\*)\s*(?:auto[- ]?generated|generated by|do not edit)/i;
 /**
 * Codegen fingerprint: the recorder names its first test exactly
@@ -12620,8 +12485,7 @@ function computeAgenticProfile(files, findings) {
 		note: "Static provenance markers only (generated-file headers, Playwright codegen default titles). Absence of a marker does not prove human authorship; healed and MCP-edited files without markers are indistinguishable from hand-written ones. Provenance never changes scoring or evidence — authorship is metadata, not trust."
 	};
 }
-//#endregion
-//#region src/engine/overlap-dedup.ts
+// src/engine/overlap-dedup.ts
 const TIER_RANK = {
 	core: 0,
 	extended: 1,
@@ -12716,8 +12580,7 @@ function dropOrderBefore(a, b, metaByRuleId) {
 	if (ranksBefore(b, a, metaByRuleId)) return true;
 	return (a.column ?? Number.MAX_SAFE_INTEGER) < (b.column ?? Number.MAX_SAFE_INTEGER);
 }
-//#endregion
-//#region src/engine/finding-identity.ts
+// src/engine/finding-identity.ts
 /**
 * Correlation identity for before/after comparison: ruleId + file +
 * message, deliberately EXCLUDING line — a source edit that shifts a
@@ -12726,8 +12589,7 @@ function dropOrderBefore(a, b, metaByRuleId) {
 function findingFingerprint(f) {
 	return `${f.ruleId}\u0000${f.file}\u0000${f.message}`;
 }
-//#endregion
-//#region src/engine/correlation-engine.ts
+// src/engine/correlation-engine.ts
 const EVIDENCE_RANK = {
 	E0: 0,
 	E1: 1,
@@ -12857,8 +12719,7 @@ function correlateFindings(findings) {
 	});
 	return conclusions;
 }
-//#endregion
-//#region src/engine/dependency-graph.ts
+// src/engine/dependency-graph.ts
 /**
 * Dependency Graph (ECO-005).
 *
@@ -12995,8 +12856,7 @@ function parseManifest(filePath) {
 	if (filePath.endsWith("pyproject.toml")) return parsePyprojectToml(filePath);
 	if (filePath.endsWith("pom.xml")) return parsePomXml(filePath);
 }
-//#endregion
-//#region src/engine/incremental-analysis.ts
+// src/engine/incremental-analysis.ts
 /**
 * Semantic inputs that affect the full scan beyond individual file content.
 * If any of these changed, an incremental run is NOT safe — a full scan
@@ -13032,8 +12892,7 @@ function isIncrementalSafe(changedFiles) {
 		reasons
 	};
 }
-//#endregion
-//#region src/brand/tokens.ts
+// src/brand/tokens.ts
 /**
 * The single source of brand truth.
 *
@@ -13319,8 +13178,7 @@ function deriveScoreState(score) {
 		rune: RUNES.critical
 	};
 }
-//#endregion
-//#region src/engine/monorepo-analysis.ts
+// src/engine/monorepo-analysis.ts
 /**
 * Package verdict, derived from the one ScoreState band model (BW-104).
 * These two constants used to be a private copy of the band boundaries;
@@ -13427,8 +13285,7 @@ function configurableAggregation(results, config) {
 		strategy: config.weightingStrategy
 	};
 }
-//#endregion
-//#region src/lib/fs-atomic.ts
+// src/lib/fs-atomic.ts
 /**
 * Atomic file writes (audit S9).
 *
@@ -13511,8 +13368,7 @@ function renameWithWindowsRetry(from, to) {
 		throw err;
 	}
 }
-//#endregion
-//#region src/engine/scan-cache.ts
+// src/engine/scan-cache.ts
 /**
 * Local incremental scan cache (Beta-to-Stable 1.0 plan, M5.2 / A-2).
 *
@@ -13722,8 +13578,7 @@ function createScanCache(root) {
 		}
 	};
 }
-//#endregion
-//#region src/reporter/theme.ts
+// src/reporter/theme.ts
 /**
 * Norse-forge theme system. Pure string-in → string-out helpers.
 * Respects NO_COLOR and non-TTY via `palette(isTTY)` — every renderer
@@ -13823,8 +13678,7 @@ function rgb([r, g, b]) {
 function palette(enabled) {
 	return enabled ? on : off;
 }
-//#endregion
-//#region src/reporter/ui.ts
+// src/reporter/ui.ts
 /**
 * Neutral context for direct calls (tests, library use) and as the
 * safe default when a command runner is invoked without wiring: no
@@ -13849,8 +13703,7 @@ function sectionHeader(title, ui) {
 	const glyph = ui.ascii ? "=" : "▍";
 	return `  ${ui.p.accent(`${glyph} ${title}`)}`;
 }
-//#endregion
-//#region src/forensics/classify.ts
+// src/forensics/classify.ts
 /**
 * Strong-signal marker tables. Kept deliberately narrow: a marker here
 * is a named family fact, not a vibe. Unknown text yields no signal —
@@ -13970,8 +13823,7 @@ function classifyForensicVerdict(signals) {
 		signals: signalCounts
 	};
 }
-//#endregion
-//#region src/forensics/analyze.ts
+// src/forensics/analyze.ts
 const ui$5 = plainContext();
 const MAX_RECORDS = 1e5;
 function analyze(records, source) {
@@ -14134,8 +13986,7 @@ function renderFlakyMd(report) {
 	lines.push("");
 	return lines.join("\n");
 }
-//#endregion
-//#region src/forensics/evidence-hygiene.ts
+// src/forensics/evidence-hygiene.ts
 /**
 * Evidence hygiene — secret redaction + control-char sanitization
 * (ENGINE-012).
@@ -14197,8 +14048,7 @@ function sanitizeErrorText(text, options) {
 	if (result.length > maxLength) result = result.slice(0, maxLength) + `[truncated at ${maxLength} chars]`;
 	return result;
 }
-//#endregion
-//#region src/forensics/trace.ts
+// src/forensics/trace.ts
 /**
 * Playwright trace ingester (product-gap master plan §9 R5 / WI-17).
 *
@@ -14391,8 +14241,7 @@ function parseTraceArtifact(bytes, artifactName) {
 	const { actions } = parseTraceNdjson(text);
 	return traceActionsToRecord(actions, artifactName);
 }
-//#endregion
-//#region src/forensics/parse-jest-json.ts
+// src/forensics/parse-jest-json.ts
 function toStatus$2(raw) {
 	switch (raw) {
 		case "passed": return "passed";
@@ -14452,8 +14301,7 @@ function parseJestJson(json) {
 	}
 	return out;
 }
-//#endregion
-//#region src/forensics/parse-junit.ts
+// src/forensics/parse-junit.ts
 const MAX_INPUT$1 = 20971520;
 function decodeEntities$1(s) {
 	return s.replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&quot;", "\"").replaceAll("&apos;", "'").replaceAll("&#39;", "'").replaceAll("&amp;", "&");
@@ -14495,14 +14343,25 @@ function parseJunitXml(xml) {
 		const skipped = /<skipped\b/i.test(inner);
 		const errors = [];
 		if (failed) {
-			const failRe = /<(?:failure|error)\b([^>]*)>([\s\S]*?)<\/(?:failure|error)\s*>/gi;
-			let failMatch;
-			while ((failMatch = failRe.exec(inner)) !== null) {
-				const attrsStr = failMatch[1] ?? "";
+			const openRe = /<(?:failure|error)\b/gi;
+			const endRe = /<\/(?:failure|error)\s*>/gi;
+			let open;
+			while ((open = openRe.exec(inner)) !== null) {
+				const gt = inner.indexOf(">", open.index);
+				if (gt === -1) break;
+				const attrsStr = inner.slice(open.index, gt);
+				if (attrsStr.endsWith("/")) {
+					openRe.lastIndex = gt + 1;
+					continue;
+				}
+				endRe.lastIndex = gt + 1;
+				const end = endRe.exec(inner);
+				if (end === null) break;
 				const msgAttr = /\smessage\s*=\s*"([^"]*)"/i.exec(attrsStr)?.[1];
 				if (msgAttr) errors.push(sanitizeErrorText(decodeEntities$1(msgAttr)));
-				const body = failMatch[2]?.trim();
+				const body = inner.slice(gt + 1, end.index).trim();
 				if (body && body !== msgAttr) errors.push(sanitizeErrorText(decodeEntities$1(body)));
+				openRe.lastIndex = end.index + end[0].length;
 			}
 			const selfCloseRe = /<(?:failure|error)\b([^>]*)\/>/gi;
 			let scMatch;
@@ -14526,8 +14385,7 @@ function parseJunitXml(xml) {
 	}
 	return out;
 }
-//#endregion
-//#region src/forensics/parse-trx.ts
+// src/forensics/parse-trx.ts
 const MAX_INPUT = 20971520;
 function decodeEntities(s) {
 	return s.replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&quot;", "\"").replaceAll("&apos;", "'").replaceAll("&#39;", "'").replaceAll("&amp;", "&");
@@ -14638,11 +14496,24 @@ function parseTrxXml(xml) {
 		if (id !== void 0 && name !== void 0) byTestId.set(id, name);
 	}
 	const records = [];
-	const resultRe = /<UnitTestResult\b([^>]*)>([\s\S]{0,4000}?)(?=<UnitTestResult\b|<\/Results>)/gi;
-	let m;
-	while ((m = resultRe.exec(xml)) !== null) {
-		const attrs = m[1] ?? "";
-		const inner = m[2] ?? "";
+	const startRe = /<UnitTestResult\b/gi;
+	const starts = [];
+	let s;
+	while ((s = startRe.exec(xml)) !== null) {
+		starts.push(s.index);
+		if (starts.length > 2e5) break;
+	}
+	const resultsEnd = xml.search(/<\/Results>/i);
+	for (let i = 0; i < starts.length; i++) {
+		const start = starts[i];
+		const tagEnd = xml.indexOf(">", start);
+		if (tagEnd === -1) break;
+		const selfClosing = xml[tagEnd - 1] === "/";
+		const attrs = xml.slice(start + 15, selfClosing ? tagEnd - 1 : tagEnd);
+		const next = starts[i + 1] ?? -1;
+		let bodyEnd = next === -1 ? xml.length : next;
+		if (resultsEnd > tagEnd && resultsEnd < bodyEnd) bodyEnd = resultsEnd;
+		const inner = selfClosing ? "" : xml.slice(tagEnd + 1, bodyEnd);
 		const testName = attr(attrs, "testName") ?? attr(attrs, "testId");
 		if (testName === void 0) continue;
 		const attempt = {
@@ -14650,7 +14521,8 @@ function parseTrxXml(xml) {
 			status: mapTrxOutcome(attr(attrs, "outcome")),
 			durationMs: parseDuration(attr(attrs, "duration"))
 		};
-		const error = messageOf(inner, 0);
+		const messageAt = inner.search(/<Message\b/i);
+		const error = messageAt === -1 ? void 0 : messageOf(inner, messageAt);
 		records.push({
 			file: "unknown",
 			title: testName,
@@ -14662,8 +14534,7 @@ function parseTrxXml(xml) {
 	}
 	return records;
 }
-//#endregion
-//#region src/forensics/parse-playwright-json.ts
+// src/forensics/parse-playwright-json.ts
 const MAX_DEPTH = 32;
 function toStatus$1(raw) {
 	switch (raw) {
@@ -14728,8 +14599,7 @@ function parsePlaywrightJson(json) {
 	walk(root, 0);
 	return out;
 }
-//#endregion
-//#region src/forensics/parse-vitest-json.ts
+// src/forensics/parse-vitest-json.ts
 function toStatus(raw) {
 	switch (raw) {
 		case "passed": return "passed";
@@ -14783,8 +14653,7 @@ function parseVitestJson(json) {
 	}
 	return out;
 }
-//#endregion
-//#region src/forensics/parse-har.ts
+// src/forensics/parse-har.ts
 const MAX_ENTRIES = 2e4;
 function sanitizeTitleUrl(url) {
 	try {
@@ -14869,8 +14738,7 @@ function parseHarJsonDetailed(json) {
 		truncated
 	};
 }
-//#endregion
-//#region src/forensics/run.ts
+// src/forensics/run.ts
 /**
 * Runtime evidence entry point (R4) — the library behind `explain
 * --evidence`. The `forensics` verb is retired in the v6 carve; this module
@@ -15161,8 +15029,7 @@ function loadSuppressions(root, now = /* @__PURE__ */ new Date()) {
 		entries
 	};
 }
-//#endregion
-//#region src/plugins/reserved-prefixes.ts
+// src/plugins/reserved-prefixes.ts
 /**
 * Core-owned rule-ID prefixes that external rule sources (npm plugins,
 * JS modules, JSON manifests) may never claim — one shared law.
@@ -15192,8 +15059,7 @@ function isReservedPrefix(ruleId) {
 	const upper = ruleId.toUpperCase();
 	return RESERVED_PREFIXES.some((p) => upper.startsWith(p));
 }
-//#endregion
-//#region src/plugins/load.ts
+// src/plugins/load.ts
 /**
 * Plugin API (Upgrade-Plan-v3 Phase 6, tier-2 item #1).
 *
@@ -15299,8 +15165,7 @@ function loadPlugins(root, gateOpen = false) {
 	}
 	return result;
 }
-//#endregion
-//#region src/plugins/local-rules.ts
+// src/plugins/local-rules.ts
 /**
 * Local plugin/rule contract (Verification Trust Evolution Plan §18 —
 * Local Extensibility).
@@ -15612,8 +15477,7 @@ async function loadModuleRules(path, result) {
 		result.rules.push(rule);
 	}
 }
-//#endregion
-//#region src/plugins/trust-gate.ts
+// src/plugins/trust-gate.ts
 /**
 * Plugin trust gate (audit-remediation-master-plan.md, locked decision C2).
 *
@@ -15649,8 +15513,7 @@ function renderGateNotice(skipped) {
 	lines.push("To run them, re-run with --enable-plugins (or set MJOLNIR_ENABLE_PLUGINS=1).", "Declarative JSON rule manifests (mjolnir-rules/*.json) are unaffected — they execute no code.");
 	return lines.join("\n");
 }
-//#endregion
-//#region src/engine/scan-pipeline.ts
+// src/engine/scan-pipeline.ts
 /**
 * Canonical scan pipeline (M6 — blueprint §9.2).
 *
@@ -15710,9 +15573,10 @@ async function buildUniversalRules(root, strict, opts = {}) {
 	for (const p of plugins) for (const r of p.rules) if (r.tier) tierByRuleId.set(r.id, r.tier);
 	for (const r of local.rules) if (r.tier) tierByRuleId.set(r.id, r.tier);
 	let rules = [...UNIVERSAL_RULES, ...externalRules];
-	const withheldRuleIds = rules.filter((r) => tierByRuleId.get(r.id) === "quarantine").map((r) => r.id).sort();
+	const quarantined = rules.filter((r) => tierByRuleId.get(r.id) === "quarantine").map((r) => r.id).sort();
+	const withheldRuleIds = strict ? [] : quarantined;
 	if (!strict) rules = rules.filter((r) => tierByRuleId.get(r.id) !== "quarantine");
-	const rulesWithheld = strict ? 0 : withheldRuleIds.length;
+	const rulesWithheld = withheldRuleIds.length;
 	const rulesApplied = rules.length;
 	const pluginMeta = [...plugins.map((p) => ({
 		name: p.name,
@@ -16109,12 +15973,28 @@ function applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, dec
 	const runtimeIncomplete = discoveredReport !== void 0 && discoveredReport.report.analysisComplete !== true;
 	let forensicVerdicts;
 	let evidenceRecords = [];
-	if (discoveredReport && discoveredReport.report.analysisComplete === true) try {
-		evidenceRecords = buildEvidenceRecords(discoveredReport.report, discoveredReport.path);
-		stampRuntimeCorroboration(findings, discoveredReport.report, workspace.root);
-		forensicVerdicts = summarizeForensicVerdicts(discoveredReport.report);
-	} catch {
-		evidenceRecords = [];
+	if (discoveredReport && discoveredReport.report.analysisComplete === true) {
+		const before = findings.map((f) => ({
+			runtimeCorroboration: f.runtimeCorroboration,
+			trustLevel: f.trustLevel
+		}));
+		try {
+			const records = buildEvidenceRecords(discoveredReport.report, discoveredReport.path);
+			stampRuntimeCorroboration(findings, discoveredReport.report, workspace.root);
+			forensicVerdicts = summarizeForensicVerdicts(discoveredReport.report);
+			evidenceRecords = records;
+		} catch {
+			findings.forEach((f, i) => {
+				const prev = before[i];
+				if (prev?.runtimeCorroboration === void 0) delete f.runtimeCorroboration;
+				else f.runtimeCorroboration = prev.runtimeCorroboration;
+				if (prev?.trustLevel === void 0) delete f.trustLevel;
+				else f.trustLevel = prev.trustLevel;
+			});
+			forensicVerdicts = void 0;
+			evidenceRecords = [];
+			recordDegradation("runtime-corroboration-failed");
+		}
 	}
 	return {
 		evidenceRecords,
@@ -16547,8 +16427,7 @@ async function runScanInProject(args, hooks = {}) {
 	resetTsMorphProject();
 	return result;
 }
-//#endregion
-//#region src/cli-io.ts
+// src/cli-io.ts
 /**
 * The ONE error-to-message derivation in `src/`.
 *
@@ -16707,8 +16586,7 @@ function buildMachineContract(result) {
 		...result.forensicVerdicts !== void 0 ? { forensicVerdicts: result.forensicVerdicts } : {}
 	};
 }
-//#endregion
-//#region src/commands/fixture-example.ts
+// src/commands/fixture-example.ts
 /**
 * Shared example-fixture selection for `mjolnir explain` (explain.ts)
 * and the generated rule docs (rule-docs.ts) — one chooser so both
@@ -16809,8 +16687,7 @@ function explainRule(ruleId, fixturesRoot) {
 		exampleFixtureRelPath: relative(fixturesRoot, fixturePath).replaceAll("\\", "/")
 	};
 }
-//#endregion
-//#region src/engine/resolution.ts
+// src/engine/resolution.ts
 /** Correlation identity (v1-compatible): ruleId\0file\0message. */
 const fingerprint$1 = findingFingerprint;
 /**
@@ -16961,8 +16838,7 @@ function diffAgainstBaseline(result, baseline) {
 		unchangedCount
 	};
 }
-//#endregion
-//#region src/commands/verify.ts
+// src/commands/verify.ts
 /**
 * `mjolnir ci verify` — the agent-loop digest (product-gap-remediation
 * master plan P7, plan 1788853205786 — flag agent, decision 6).
@@ -17109,8 +16985,7 @@ function renderTriageWorkflowJson(report) {
 		rows: workflowRows(report)
 	}, null, 2) + "\n";
 }
-//#endregion
-//#region src/commands/pw-report.ts
+// src/commands/pw-report.ts
 const ui = plainContext();
 function summarizePwRun(report) {
 	const slowest = [...report.verdicts].sort((a, b) => b.totalDurationMs - a.totalDurationMs).slice(0, 5).map((v) => ({
@@ -17144,8 +17019,7 @@ function renderPwRunSummary(s) {
 	}
 	return lines.join("\n");
 }
-//#endregion
-//#region src/mcp/server.ts
+// src/mcp/server.ts
 /**
 * MCP stdio transport (blueprint §21 — Phase 4, PURE TRANSPORT).
 *
@@ -17163,7 +17037,10 @@ function renderPwRunSummary(s) {
 * - parameter size caps; ONE scan in flight (serialized queue) reusing
 *   the pipeline's own budgets; zero network (no fetches anywhere); no
 *   shell execution beyond Mjölnir's own verbs.
-* - filesystem boundary = scan target + `.mjolnir/` (same as CLI).
+* - filesystem boundary: the tools are read-only, and with no further
+*   configuration they accept any path the parent process passes (the
+*   parent is the trust boundary). `MJOLNIR_WORKSPACE_ROOT` confines every
+*   path argument to that directory, symlinks resolved.
 * - the plugin trust gate applies unchanged (--enable-plugins is NOT
 *   exposed over MCP: tools run with the gate CLOSED unless the server
 *   was started with MJOLNIR_ENABLE_PLUGINS=1 in its own environment).
@@ -17173,12 +17050,27 @@ const MAX_PARAM_BYTES = 65536;
 const MAX_DURATION_MS = 36e5;
 const DEFAULT_MAX_DURATION_MS = 6e5;
 const PROTOCOL_VERSION = "2025-06-18";
-const CONFIGURED_ROOT = process.env.MJOLNIR_WORKSPACE_ROOT ? resolve(process.env.MJOLNIR_WORKSPACE_ROOT) : null;
+/** The real path of `p`, or its lexical resolution when it does not exist. */
+function realOrResolved(p) {
+	try {
+		return realpathSync.native(resolve(p));
+	} catch {
+		return resolve(p);
+	}
+}
+/**
+* The optional workspace root. When set, every path argument must resolve
+* INSIDE it after symlinks are followed.
+*
+* Unset is open by design and is documented that way in the header: the MCP
+* tools are read-only and the stdio parent is the trust boundary. Setting
+* `MJOLNIR_WORKSPACE_ROOT` is how a host confines them.
+*/
+const CONFIGURED_ROOT = process.env.MJOLNIR_WORKSPACE_ROOT ? realOrResolved(process.env.MJOLNIR_WORKSPACE_ROOT) : null;
 function isPathAllowed(path) {
 	if (!CONFIGURED_ROOT) return true;
-	const candidate = resolve(path);
-	const rel = relative(CONFIGURED_ROOT, candidate);
-	return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+	const rel = relative(CONFIGURED_ROOT, realOrResolved(path));
+	return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
 }
 /** JSON-RPC error codes (subset used here). */
 const MCP_ERRORS = {
@@ -17655,8 +17547,7 @@ async function handleMcpMessage(msg) {
 		}
 	};
 }
-//#endregion
-//#region src/mcp/transport.ts
+// src/mcp/transport.ts
 /**
 * MCP stdio transport loop (blueprint §21 — the framing around the
 * pure-transport server).
@@ -17753,8 +17644,7 @@ async function handleStdioLine(line, write) {
 	}
 	write(`${JSON.stringify(response)}\n`);
 }
-//#endregion
-//#region src/integrations/sentry.ts
+// src/integrations/sentry.ts
 /**
 * Sentry crash reporting — opt-in, and inert unless a DSN is configured.
 *
@@ -17880,8 +17770,7 @@ async function flushSentry(timeoutMs = FLUSH_TIMEOUT_MS) {
 		return false;
 	}
 }
-//#endregion
-//#region src/mcp/stdio.ts
+// src/mcp/stdio.ts
 /**
 * The standalone MCP stdio binary (blueprint §21), built to
 * `dist/mcp/stdio.mjs` and run by `npm run mcp`.
@@ -17906,7 +17795,6 @@ runStdioTransport(process.stdin, process.stdout).then(() => process.exit(0)).cat
 	process.stderr.write(`mjolnir mcp fatal: ${err instanceof Error ? err.message : err}\n`);
 	process.exitCode = 20;
 });
-//#endregion
 export {};
 
 //# sourceMappingURL=stdio.mjs.map