mjolnir-qa 6.0.0 → 6.1.0

package/dist/cli.mjs

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import { createRequire } from "node:module";
-import { accessSync, chmodSync, closeSync, constants, copyFileSync, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { accessSync, appendFileSync, chmodSync, closeSync, constants, copyFileSync, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import process$1 from "node:process";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -17,7 +16,18 @@ import { createInterface } from "node:readline";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { isDeepStrictEqual } from "node:util";
 import { tmpdir } from "node:os";
-//#region src/types.ts
+// \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+// src/types.ts
 /** Severity ladder. Order matters for sorting and gating. */
 const SEVERITY_ORDER$1 = [
 	"error",
@@ -146,8 +156,7 @@ const DEDUCTIONS = {
 	warning: 3,
 	info: 1
 };
-//#endregion
-//#region src/claim-evidence.ts
+// src/claim-evidence.ts
 /**
 * The one place a rendered surface decides whether it may claim "clean".
 *
@@ -204,8 +213,7 @@ function scanExitCode(input) {
 	if (input.gate === "advisory") return 0;
 	return input.findings.some((f) => isAtGate(f, input.gate, input.isAdvisory)) ? 1 : 0;
 }
-//#endregion
-//#region src/engine/completion.ts
+// src/engine/completion.ts
 function deriveCompletion(input) {
 	const truncationReasons = [...new Set(input.truncationReasons)].sort();
 	const degradations = [...input.degradations ?? []].sort((a, b) => a.reason < b.reason ? -1 : a.reason > b.reason ? 1 : 0);
@@ -247,8 +255,7 @@ function deriveCompletion(input) {
 		}
 	};
 }
-//#endregion
-//#region src/engine/degradation-ledger.ts
+// src/engine/degradation-ledger.ts
 /**
 * Append-only. Records are never edited and never removed by a recording
 * site; a reader takes a window, and the window is defined by index, so
@@ -284,8 +291,7 @@ function summarizeDegradations(window) {
 		count
 	})).sort((a, b) => a.reason < b.reason ? -1 : a.reason > b.reason ? 1 : 0);
 }
-//#endregion
-//#region src/engine/runtime-corroboration.ts
+// src/engine/runtime-corroboration.ts
 /**
 * Stamp runtime corroboration + trust levels onto findings (mutates in
 * place, the same contract as stampEvidenceLevels). Returns the number
@@ -301,7 +307,8 @@ function stampRuntimeCorroboration(findings, report, scanRoot) {
 		let n = p.replace(/\\/g, "/");
 		if (scanRoot) {
 			const root = scanRoot.replace(/\\/g, "/").replace(/\/?$/, "/");
-			if (n.startsWith(root)) n = n.slice(root.length);
+			const head = n.slice(0, root.length);
+			if (/^[a-z]:\//i.test(root) ? head.toLowerCase() === root.toLowerCase() : head === root) n = n.slice(root.length);
 		}
 		return n.replace(/^\.\//, "").replace(/^\/+/, "");
 	};
@@ -367,8 +374,7 @@ function deriveTrustLevel(finding, corroboration) {
 	if (corroboration.level === "test") return "L4";
 	return "L3";
 }
-//#endregion
-//#region src/rules/measured-fp.generated.ts
+// src/rules/measured-fp.generated.ts
 const MEASURED_FP = {
 	"QA-CI-001": {
 		fpRate: .105,
@@ -1429,8 +1435,7 @@ const MEASURED_FP_RAW = {
 		ciHigh: .4343
 	}
 };
-//#endregion
-//#region src/engine/trust-summary.ts
+// src/engine/trust-summary.ts
 /**
 * Trust level of the summary — the BEST trust level any finding in the
 * scan reached. Static-only findings settle at L2 (deriveTrustLevel's
@@ -1554,8 +1559,7 @@ function buildTrustSummary(result, declarationsByFile) {
 		ceilingReasons: reasons
 	};
 }
-//#endregion
-//#region src/governance/run-mode.ts
+// src/governance/run-mode.ts
 /**
 * Which mode a run is in, and how the other one is reached.
 *
@@ -1606,8 +1610,7 @@ function resolveRunMode(input) {
 	if (declared === "local-only" || declared === "hosted") return declared;
 	throw new Error(`${HOSTED_MODE_FLAG}=${String(declared)} is not a run mode. Expected "hosted" or "local-only". Falling back to a default here would let a mistyped flag look like a deliberate choice.`);
 }
-//#endregion
-//#region src/engine/run-identity.ts
+// src/engine/run-identity.ts
 /**
 * Run Identity (product-gap master plan §7, plan 1789009691197 R4c) —
 * the deterministic binding that anchors every trust claim to its
@@ -1736,8 +1739,7 @@ function buildEvidenceGraph(parts) {
 		} } : {}
 	};
 }
-//#endregion
-//#region src/engine/file-executor.ts
+// src/engine/file-executor.ts
 function cacheHitOutcome(job) {
 	return {
 		path: job.path,
@@ -1828,8 +1830,7 @@ function createExecutor(name, concurrency, runOne) {
 		execute: runOne
 	};
 }
-//#endregion
-//#region src/scope/git-resolve.ts
+// src/scope/git-resolve.ts
 /**
 * Absolute-path git resolution (audit S1).
 *
@@ -1904,8 +1905,7 @@ function runGit(root, args) {
 		return null;
 	}
 }
-//#endregion
-//#region src/lib/safe-json.ts
+// src/lib/safe-json.ts
 /**
 * Reusable safe-JSON parse-and-validate helper.
 *
@@ -1942,8 +1942,7 @@ function isRecord(v) {
 		return false;
 	}
 }
-//#endregion
-//#region src/engine/candidate-binding.ts
+// src/engine/candidate-binding.ts
 /**
 * Candidate binding (plan V5-010).
 *
@@ -2076,18 +2075,17 @@ function readCandidateBinding(root, manifestPath = CANDIDATE_MANIFEST_PATH) {
 		return null;
 	}
 }
-//#endregion
-//#region src/engine/version.ts
+// src/engine/version.ts
 /**
 * Engine version, as a leaf module: `runIdentity` (R4c) needs the engine
 * version inside scan-pipeline WITHOUT importing cli.ts (a cycle — cli
 * imports the pipeline). The literal follows the same discipline as
 * CLI_VERSION and SARIF's driver.version: kept in sync on release by
-* scripts/archive/sync-sarif-version.cjs (archived; superseded by the release
-* workflow's own version stamping) and guarded by the version-consistency
+* `npm run version:surface:sync` (this file is an identity surface) and
+* guarded by the version-consistency
 * spec. cli.ts re-exports this as CLI_VERSION.
 */
-const ENGINE_VERSION = "6.0.0";
+const ENGINE_VERSION = "6.1.0";
 /**
 * Build identity — WHICH BUILD IS RUNNING, as distinct from WHICH RELEASE IS
 * PUBLISHED.
@@ -2148,16 +2146,7 @@ function resolveBuildId() {
 	};
 	return buildIdFrom(runGit);
 }
-//#endregion
-//#region src/engine/contract-versions.ts
-/**
-* Versioned contract registry (VERSION-001).
-*
-* Single source of truth for every version constant the engine exposes
-* to consumers (run identity, evidence graph, machine contract).
-* Constants are `as const` — literal types flow into the identity
-* surface without widening.
-*/
+// src/engine/contract-versions.ts
 const TRUST_MODEL_VERSION = "1.0.0";
 /**
 * 2.0.0 (ADR 0014): the core tier carries an evidence FLOOR. A core rule's
@@ -2169,8 +2158,7 @@ const TRUST_MODEL_VERSION = "1.0.0";
 */
 const SCORING_MODEL_VERSION = "2.0.0";
 const FRAMEWORK_SUPPORT_MATRIX_VERSION = "1.0.0";
-//#endregion
-//#region src/discovery/evidence-discovery.ts
+// src/discovery/evidence-discovery.ts
 /**
 * Zero-config evidence discovery (Mega MVP Master Plan v3.1 §26 WI-11).
 *
@@ -2262,8 +2250,7 @@ function discoverEvidenceCandidates(scanRoot) {
 	}
 	return out.sort((a, b) => a.depth - b.depth || (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
 }
-//#endregion
-//#region src/discovery/workspace.ts
+// src/discovery/workspace.ts
 /**
 * Repository discovery (Sprint-Plan W1-03).
 * Finds project root, parses package.json, detects npm/yarn/pnpm workspaces.
@@ -2310,8 +2297,7 @@ function basename$1(p) {
 	const parts = p.split(/[\\/]/);
 	return parts[parts.length - 1];
 }
-//#endregion
-//#region src/lib/fs-bounded.ts
+// src/lib/fs-bounded.ts
 function closeQuiet(fd) {
 	try {
 		closeSync(fd);
@@ -2363,8 +2349,7 @@ function readFileBounded(path, maxBytes) {
 		if (fd !== void 0) closeQuiet(fd);
 	}
 }
-//#endregion
-//#region src/config/config-schema.ts
+// src/config/config-schema.ts
 const VALID_GATES = /* @__PURE__ */ new Set([
 	"advisory",
 	"error",
@@ -2427,15 +2412,18 @@ function validateConfigSchema(config) {
 		}
 	}
 	if (cfg["plugins"] !== void 0) {
-		if (cfg["plugins"] === null || typeof cfg["plugins"] !== "object") errors.push("plugins must be an object or array");
+		if (!Array.isArray(cfg["plugins"])) errors.push(`plugins must be an array of package names or { "package": "<name>" } objects, got ${typeof cfg["plugins"]}`);
+		else for (let i = 0; i < cfg["plugins"].length; i++) {
+			const entry = cfg["plugins"][i];
+			if (!(typeof entry === "string" || entry !== null && typeof entry === "object" && !Array.isArray(entry) && typeof entry["package"] === "string")) errors.push(`plugins[${i}] must be a package name or { "package": "<name>" }, got ${JSON.stringify(entry)}`);
+		}
 	}
 	return {
 		valid: errors.length === 0,
 		errors
 	};
 }
-//#endregion
-//#region src/config/config.ts
+// src/config/config.ts
 /**
 * Config file support (Sprint-Plan W7, Product-MVP §27 + GAP-F).
 * Zero-config preserved: config presence never changes detection
@@ -2493,7 +2481,7 @@ function loadConfig(root, options = {}) {
 			return {
 				config: parsed,
 				path: p,
-				warnings: validate(parsed, options.knownRuleIds)
+				warnings: validate(parsed, options.knownRuleIds, options.now, name)
 			};
 		} catch (err) {
 			const msg = err.message;
@@ -2506,7 +2494,7 @@ function loadConfig(root, options = {}) {
 		warnings: []
 	};
 }
-function validate(cfg, knownRuleIds) {
+function validate(cfg, knownRuleIds, now = /* @__PURE__ */ new Date(), fileName = "mjolnir.config.json") {
 	const warnings = [];
 	const schemaResult = validateConfigSchema(cfg);
 	if (!schemaResult.valid) throw new Error(schemaResult.errors.join("; "));
@@ -2526,10 +2514,10 @@ function validate(cfg, knownRuleIds) {
 			if (!Array.isArray(ign.files)) throw new Error(`ignore for ${ign.ruleId}: "files" must be an array of glob strings, got ${typeof ign.files}`);
 			for (const g of ign.files) if (typeof g !== "string") throw new Error(`ignore for ${ign.ruleId}: "files" entries must be strings, got ${typeof g} (${JSON.stringify(g)})`);
 		}
-		if (ign.expires !== void 0 && Number.isNaN(new Date(ign.expires).getTime())) throw new Error(`ignore for ${ign.ruleId}: "expires" must be an ISO date, got "${ign.expires}"`);
-		if (ign.expires !== void 0 && !Number.isNaN(new Date(ign.expires).getTime()) && new Date(ign.expires).getTime() < Date.now()) warnings.push(`warning: ignore for ${ign.ruleId} has expired (expires "${ign.expires}") — the entry is kept but currently inactive.`);
+		if (ign.expires !== void 0 && Number.isNaN(utcMidnight(ign.expires))) throw new Error(`ignore for ${ign.ruleId}: "expires" must be an ISO date (YYYY-MM-DD), got "${ign.expires}"`);
+		if (ign.expires !== void 0 && !isSuppressionActive(ign, now)) warnings.push(`warning: ignore for ${ign.ruleId} has expired (expires "${ign.expires}") — the entry is kept but currently inactive.`);
 	}
-	for (const key of Object.keys(cfg)) if (!KNOWN_CONFIG_KEYS.has(key)) warnings.push(`warning: mjolnir.config.json has an unknown top-level key "${key}" — ignored (typo? see README §Configuration).`);
+	for (const key of Object.keys(cfg)) if (!KNOWN_CONFIG_KEYS.has(key)) warnings.push(`warning: ${fileName} has an unknown top-level key "${key}" — ignored (typo? see README §Configuration).`);
 	if (cfg.exclude !== void 0) {
 		if (!Array.isArray(cfg.exclude)) throw new Error(`exclude must be an array of strings, got ${typeof cfg.exclude}`);
 		for (const p of cfg.exclude) if (typeof p !== "string") throw new Error(`exclude entries must be strings, got ${typeof p} (${JSON.stringify(p)})`);
@@ -2551,12 +2539,22 @@ function isSuppressionActive(ign, now = /* @__PURE__ */ new Date()) {
 	if (!ign.expires) return true;
 	return utcMidnight(ign.expires) > utcMidnightOf(now);
 }
-/** UTC-midnight timestamp of an ISO date string (YYYY-MM-DD). */
+/**
+* UTC-midnight timestamp of an ISO calendar date (YYYY-MM-DD), or NaN.
+*
+* NaN for anything that is not a real calendar day, so a load-time check and
+* the active/expired verdict share one parser and cannot disagree.
+*/
 function utcMidnight(isoDate) {
-	if (!/^\d{4}-\d{2}-\d{2}$/.test(isoDate)) return NaN;
 	const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(isoDate);
 	if (!m) return NaN;
-	return Date.UTC(Number(m[1]), Number(m[2]) - 1, Number(m[3]));
+	const year = Number(m[1]);
+	const month = Number(m[2]) - 1;
+	const day = Number(m[3]);
+	const t = Date.UTC(year, month, day);
+	const back = new Date(t);
+	if (back.getUTCFullYear() !== year || back.getUTCMonth() !== month || back.getUTCDate() !== day) return NaN;
+	return t;
 }
 /** UTC-midnight timestamp of a Date (calendar day, timezone-independent). */
 function utcMidnightOf(d) {
@@ -2569,8 +2567,7 @@ function applySeverityOverrides(findings, cfg) {
 		if (override && SEVERITY_ORDER$1.includes(override)) f.severity = override;
 	}
 }
-//#endregion
-//#region src/lib/compare.ts
+// src/lib/compare.ts
 /**
 * Order that does not depend on who is asking.
 *
@@ -2616,8 +2613,7 @@ function compareCodePoints(a, b) {
 function compareLocalized(locale) {
 	return (a, b) => a.localeCompare(b, locale);
 }
-//#endregion
-//#region src/lib/glob.ts
+// src/lib/glob.ts
 /**
 * The shared segment compiler: a glob to a regex BODY, with no anchors.
 *
@@ -2671,8 +2667,7 @@ function anyDepthGlobRegExp(glob) {
 function pathMatchesGlob$1(path, glob) {
 	return anchoredGlobRegExp(glob).test(path.replaceAll("\\", "/"));
 }
-//#endregion
-//#region src/discovery/ignores.ts
+// src/discovery/ignores.ts
 /**
 * Ignore resolution (Product-MVP.txt R1 — Tier-1 launch blocker).
 *
@@ -2829,8 +2824,7 @@ function isLintFixtureDir(absoluteDir) {
 		return false;
 	}
 }
-//#endregion
-//#region src/discovery/shared-walk.ts
+// src/discovery/shared-walk.ts
 /**
 * Shared directory walker (audit P-2).
 *
@@ -2893,8 +2887,7 @@ function sharedWalk(options) {
 	};
 	walk(options.root);
 }
-//#endregion
-//#region src/frameworks/framework-inventory.ts
+// src/frameworks/framework-inventory.ts
 const FRAMEWORK_INVENTORY = [
 	{
 		frameworkId: "playwright",
@@ -3095,8 +3088,7 @@ const FRAMEWORK_INVENTORY = [
 function getFrameworkById(frameworkId) {
 	return FRAMEWORK_INVENTORY.find((f) => f.frameworkId === frameworkId);
 }
-//#endregion
-//#region src/discovery/frameworks.ts
+// src/discovery/frameworks.ts
 /**
 * Framework detection via config resolution (Sprint-Plan W3-01, R8).
 *
@@ -3179,8 +3171,7 @@ function detectFrameworks(ws) {
 		unknown: false
 	};
 }
-//#endregion
-//#region src/engine/ts-ast.ts
+// src/engine/ts-ast.ts
 /**
 * AST precision layer (Upgrade-Plan-v3 Phase 3).
 *
@@ -3379,8 +3370,7 @@ function getCodeOnlyText(file) {
 function resetTsMorphProject() {
 	looseProject = null;
 }
-//#endregion
-//#region src/engine/code-text.ts
+// src/engine/code-text.ts
 /**
 * Code-only text masking (Phase 1 — Tempering Plan).
 *
@@ -3740,8 +3730,7 @@ function getCodeTextForCounting(text, language) {
 function blankRange(chars, start, end) {
 	for (let i = start; i < end && i < chars.length; i++) if (chars[i] !== "\n" && chars[i] !== "\r") chars[i] = " ";
 }
-//#endregion
-//#region src/engine/adapter.ts
+// src/engine/adapter.ts
 /**
 * The §15.1 framework filter, shared by every language adapter: a rule
 * that declares `frameworks` runs on a file only when the file carries
@@ -3755,8 +3744,7 @@ function frameworkFilterApplies(rule, file) {
 	if (tags === void 0 || tags.length === 0) return true;
 	return rule.frameworks.some((f) => tags.includes(f));
 }
-//#endregion
-//#region src/engine/shared-run-rules.ts
+// src/engine/shared-run-rules.ts
 /**
 * Run ONE rule with crash isolation, and return what it produced.
 *
@@ -3793,8 +3781,7 @@ function runRuleIsolated(rule, file, onCrash) {
 		return null;
 	}
 }
-//#endregion
-//#region src/adapters/typescript.ts
+// src/adapters/typescript.ts
 /**
 * TypeScript/JavaScript adapter (R1).
 * Wraps the proven regex-based engine behind the LanguageAdapter
@@ -4047,8 +4034,7 @@ function loadWorkspaceShim(root) {
 		return null;
 	}
 }
-//#endregion
-//#region src/engine/tree-sitter-ast.ts
+// src/engine/tree-sitter-ast.ts
 /**
 * Tree-sitter WASM AST layer for Java and C# — Sprint 8 Task 36
 * (Master-Stabilization-Plan.md).
@@ -4267,8 +4253,7 @@ async function releaseTreeSitterResources() {
 		} catch {}
 	}
 }
-//#endregion
-//#region src/adapters/python.ts
+// src/adapters/python.ts
 /**
 * Python/pytest adapter (Upgrade-Plan-v2 R2).
 *
@@ -4426,8 +4411,7 @@ const pythonAdapter = {
 function readText$2(p) {
 	return readFileSync(p, "utf8");
 }
-//#endregion
-//#region src/adapters/java.ts
+// src/adapters/java.ts
 /**
 * Java/JUnit adapter (Upgrade-Plan-v3 Phase 4).
 *
@@ -4495,7 +4479,9 @@ const javaAdapter = {
 				const artifact = /<artifactId>([^<]+)<\/artifactId>/.exec(block[0])?.[1] ?? "";
 				for (const { re, tag } of JAVA_ARTIFACT_TAGS) if (re.test(artifact)) frameworks.add(tag);
 			}
-		} catch {}
+		} catch {
+			recordDegradation("java-manifest-unreadable");
+		}
 		for (const gradle of ["build.gradle", "build.gradle.kts"]) {
 			const path = join(root, gradle);
 			if (!existsSync(path)) continue;
@@ -4505,7 +4491,9 @@ const javaAdapter = {
 					const artifact = m[1].split(":")[1];
 					for (const { re, tag } of JAVA_ARTIFACT_TAGS) if (artifact !== void 0 && re.test(artifact)) frameworks.add(tag);
 				}
-			} catch {}
+			} catch {
+				recordDegradation("java-manifest-unreadable");
+			}
 		}
 		if (frameworks.size === 0) return {
 			frameworks: [],
@@ -4593,8 +4581,7 @@ function javaFileTags(file) {
 function readText$1(path) {
 	return readFileSync(path, "utf8");
 }
-//#endregion
-//#region src/adapters/csharp.ts
+// src/adapters/csharp.ts
 /**
 * C#/.NET adapter (Upgrade-Plan-v3 Phase 5).
 *
@@ -4664,9 +4651,13 @@ const csharpAdapter = {
 						const pkg = m[1];
 						for (const { re, tag } of CS_PACKAGE_TAGS) if (re.test(pkg)) frameworks.add(tag);
 					}
-				} catch {}
+				} catch {
+					recordDegradation("csharp-project-unreadable");
+				}
 			}
-		} catch {}
+		} catch {
+			recordDegradation("csharp-project-unreadable");
+		}
 		if (frameworks.size === 0) return {
 			frameworks: [],
 			unknown: true
@@ -4750,8 +4741,7 @@ function csharpFileTags(file) {
 function readText(path) {
 	return readFileSync(path, "utf8");
 }
-//#endregion
-//#region src/discovery/yaml-guards.ts
+// src/discovery/yaml-guards.ts
 /**
 * Shared hostile-YAML guards (product-gap master plan P3 common law —
 * `azure-pipelines.yml` detection rides the same YAML machinery as the
@@ -4820,8 +4810,7 @@ function enforceDepthCap(value, max, depthMessage = GENERIC_LABELS.depthMessage)
 		});
 	}
 }
-//#endregion
-//#region src/discovery/workflow-parser.ts
+// src/discovery/workflow-parser.ts
 /**
 * Safe GitHub Actions workflow parser (Phase 0.3, W4-03 debt).
 *
@@ -4867,8 +4856,7 @@ function parseWorkflow(text) {
 	}
 	return { jobs };
 }
-//#endregion
-//#region src/adapters/github-actions.ts
+// src/adapters/github-actions.ts
 /**
 * GitHub Actions adapter (R1).
 * Owns workflow discovery and safe-YAML parsing; CI rules consume the
@@ -4953,8 +4941,7 @@ const githubActionsAdapter = {
 };
 var WorkflowParseSkipped = class extends Error {};
 const LIMITS_MAX_BYTES$2 = 1048576;
-//#endregion
-//#region src/discovery/azure-pipeline-parser.ts
+// src/discovery/azure-pipeline-parser.ts
 /**
 * Safe Azure DevOps pipeline parser (product-gap master plan P3b).
 *
@@ -5188,8 +5175,7 @@ function isAzurePipelineFixture(normalizedPath) {
 	const base = normalizedPath.replaceAll("\\", "/").split("/").pop() ?? "";
 	return AZURE_PIPELINE_FILENAMES_SET.has(base);
 }
-//#endregion
-//#region src/adapters/azure-pipelines.ts
+// src/adapters/azure-pipelines.ts
 /**
 * Azure DevOps pipeline adapter (product-gap master plan P3b).
 * Owns `azure-pipelines.yml` discovery (repo root, the platform's
@@ -5269,8 +5255,7 @@ const azurePipelinesAdapter = {
 };
 var AzureParseSkipped = class extends Error {};
 const LIMITS_MAX_BYTES$1 = 1048576;
-//#endregion
-//#region src/adapters/jenkins.ts
+// src/adapters/jenkins.ts
 /**
 * Jenkins adapter (product-gap master plan P3c).
 * The root `Jenkinsfile` is a TEXT-target file kind: declarative and
@@ -5344,8 +5329,7 @@ const jenkinsAdapter = {
 	}
 };
 const LIMITS_MAX_BYTES = 1048576;
-//#endregion
-//#region src/discovery/scan-adapters.ts
+// src/discovery/scan-adapters.ts
 /**
 * The canonical adapter registry (audits H-6/H-9).
 *
@@ -5519,8 +5503,7 @@ const SEARCHED_FOR = [
 		globs: jenkinsAdapter.testFileGlobs
 	}
 ];
-//#endregion
-//#region src/scope/changed.ts
+// src/scope/changed.ts
 /**
 * Changed-scope engine (Sprint-Plan W6, Product-MVP §9 `--scope changed`).
 *
@@ -5625,6 +5608,7 @@ function computeChangedScope(root, baseBranch) {
 		...untrackedSet
 	])].sort();
 	const changed = {};
+	const fullyChanged = /* @__PURE__ */ new Set();
 	const batchDiff = (args, files) => {
 		const perFile = /* @__PURE__ */ new Map();
 		if (files.length === 0) return perFile;
@@ -5676,7 +5660,8 @@ function computeChangedScope(root, baseBranch) {
 		if (untrackedSet.has(file)) {
 			const all = allLinesOf(root, file);
 			if (all === null) {
-				changed[file] = new Set(Array.from({ length: LIMITS_MAX_LINES }, (_, i) => i + 1));
+				fullyChanged.add(file);
+				changed[file] = lines;
 				continue;
 			}
 			for (const l of all) lines.add(l);
@@ -5685,11 +5670,10 @@ function computeChangedScope(root, baseBranch) {
 	}
 	return {
 		changed,
+		...fullyChanged.size > 0 ? { fullyChanged } : {},
 		degraded: false
 	};
 }
-/** Sentinel size for "fully changed" — bounded, mirrors LIMITS.maxFileBytes scale. */
-const LIMITS_MAX_LINES = 1e6;
 /** Every 1-based line number of an untracked file (it is all new). */
 function allLinesOf(root, file) {
 	const full = join(root, file);
@@ -5739,6 +5723,7 @@ function parseChangedLines(diff) {
 function filterToChanged(findings, diff) {
 	if (diff.degraded) return findings;
 	return findings.filter((f) => {
+		if (diff.fullyChanged?.has(f.file)) return true;
 		const lines = diff.changed[f.file];
 		if (!lines) return false;
 		for (let l = Math.max(1, f.line - 3); l <= f.line; l++) if (lines.has(l)) return true;
@@ -5763,8 +5748,7 @@ function computeStagedFiles(root) {
 	if (raw === null) return null;
 	return raw.split("\0").filter((s) => s.length > 0);
 }
-//#endregion
-//#region src/rules/rule.ts
+// src/rules/rule.ts
 /**
 * Invoke an `astQuery` hook with the mandatory-fallback contract: no
 * hook or no AST on the context resolves to `undefined` (→ regex
@@ -5777,8 +5761,7 @@ function tryAstQuery(hook, ctx) {
 function defineRule(rule) {
 	return rule;
 }
-//#endregion
-//#region src/rules/shared/positions.ts
+// src/rules/shared/positions.ts
 /**
 * Shared position helpers (Phase 6 — Tempering Plan).
 * One lineAt, one colAt, one matchBrace. The other 79 copies are dead.
@@ -5823,8 +5806,7 @@ function lineAt(text, index) {
 function colAt(text, index) {
 	return index - (index <= 0 ? -1 : text.lastIndexOf("\n", index - 1));
 }
-//#endregion
-//#region src/rules/test/qa-test-001-focused-test.ts
+// src/rules/test/qa-test-001-focused-test.ts
 /**
 * QA-TEST-001 — Focused test committed (`fit`/`fdescribe`/`.only`).
 * Severity: error · Confidence: high · deterministic-defect
@@ -5890,8 +5872,7 @@ const focusedTestCommitted = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/test/qa-test-002-skipped-test.ts
+// src/rules/test/qa-test-002-skipped-test.ts
 /**
 * QA-TEST-002 — Skipped test (`it.skip`, `xit`, `test.skip`, `describe.skip`).
 * Severity: warning · Confidence: high · deterministic-defect
@@ -5947,8 +5928,7 @@ const skippedTest = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/shared/masking.ts
+// src/rules/shared/masking.ts
 /** True when the offset was blanked in codeText (inside a string or comment). */
 function isMasked(ctx, index) {
 	const mask = ctx.codeText;
@@ -6009,8 +5989,7 @@ function isInsideEmbeddedCode(ctx, index) {
 	const hasCallSyntax = /\w\s*\(/.test(inner);
 	return hasNestedQuote && hasCallSyntax;
 }
-//#endregion
-//#region src/rules/test/qa-test-003-no-assertions.ts
+// src/rules/test/qa-test-003-no-assertions.ts
 /**
 * QA-TEST-003 — Test with no assertions.
 * Severity: error · Confidence: high · deterministic-defect
@@ -6088,8 +6067,7 @@ function matchBrace$2(text, open) {
 	}
 	return -1;
 }
-//#endregion
-//#region src/rules/test/qa-test-004-hard-sleep.ts
+// src/rules/test/qa-test-004-hard-sleep.ts
 /**
 * QA-TEST-004 — Hard sleep (`sleep()`, `waitForTimeout()`, `setTimeout` as wait).
 * Severity: warning · Confidence: high · deterministic-defect
@@ -6154,8 +6132,7 @@ const hardSleep = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/test/qa-test-006-retry-abuse.ts
+// src/rules/test/qa-test-006-retry-abuse.ts
 /**
 * QA-TEST-006 — Retry abuse in test config.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -6221,8 +6198,7 @@ const retryAbuse = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/test/qa-test-010-empty-body.ts
+// src/rules/test/qa-test-010-empty-body.ts
 /**
 * QA-TEST-010 — Empty test body.
 * Severity: error · Confidence: high · deterministic-defect
@@ -6277,8 +6253,7 @@ const emptyTestBody = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/quality/qa-tqual-002-tautological.ts
+// src/rules/quality/qa-tqual-002-tautological.ts
 /**
 * QA-TQUAL-002 — Tautological assertion.
 * Severity: error · Confidence: high · deterministic-defect
@@ -6355,8 +6330,7 @@ const tautologicalAssertion = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/quality/qa-tqual-009-promise-assertion.ts
+// src/rules/quality/qa-tqual-009-promise-assertion.ts
 /**
 * QA-TQUAL-009 — Unawaited assertion inside a promise chain.
 * Severity: error · Confidence: high · deterministic-defect
@@ -6526,8 +6500,7 @@ function matchParen$2(text, open) {
 	}
 	return -1;
 }
-//#endregion
-//#region src/rules/quality/qa-tqual-011-commented-out.ts
+// src/rules/quality/qa-tqual-011-commented-out.ts
 /**
 * QA-TQUAL-011 — Commented-out tests.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -6640,8 +6613,7 @@ function commentRanges(ctx) {
 	}
 	return ranges;
 }
-//#endregion
-//#region src/rules/playwright/qa-pw-002-unawaited-assertion.ts
+// src/rules/playwright/qa-pw-002-unawaited-assertion.ts
 /**
 * QA-PW-002 — Missing `await` on a Playwright locator assertion.
 * Severity: error · Confidence: high · deterministic-defect
@@ -6786,8 +6758,7 @@ function runRegexFallback(text, path) {
 	});
 	return findings;
 }
-//#endregion
-//#region src/rules/playwright/qa-pw-003-debug-artifacts.ts
+// src/rules/playwright/qa-pw-003-debug-artifacts.ts
 /**
 * QA-PW-003 — Committed `page.pause()` or `test.only()` in e2e specs.
 * Severity: error · Confidence: high · deterministic-defect
@@ -6839,8 +6810,7 @@ const committedDebugArtifacts = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-004-brittle-selectors.ts
+// src/rules/playwright/qa-pw-004-brittle-selectors.ts
 /**
 * QA-PW-004 — Brittle CSS/XPath selectors vs role-based locators.
 * Severity: warning · Confidence: medium · heuristic-risk
@@ -6932,8 +6902,7 @@ function stripComments(ctx) {
 	} catch {}
 	return ctx.text.replace(/\/\/[^\n]*/g, (cm) => " ".repeat(cm.length));
 }
-//#endregion
-//#region src/rules/ci/verification-gate.ts
+// src/rules/ci/verification-gate.ts
 /**
 * Shared "is this shell command a verification gate?" matcher for the QA-CI
 * rules. A gate is a command whose failure MUST fail the job — test runners,
@@ -6973,8 +6942,7 @@ const VERIFICATION_GATE_RE = new RegExp([
 function looksLikeVerificationGate(cmd) {
 	return VERIFICATION_GATE_RE.test(cmd);
 }
-//#endregion
-//#region src/rules/ci/azure-gates.ts
+// src/rules/ci/azure-gates.ts
 /** Discriminator: the Azure parser is the only one emitting `platform`. */
 function isAzurePipelineDoc(ast) {
 	return typeof ast === "object" && ast !== null && ast.platform === "azure-pipelines";
@@ -7058,8 +7026,7 @@ function locateAzureJobKey(text, job, keyName) {
 	if (m) return lineAt(text, m.index);
 	return 1;
 }
-//#endregion
-//#region src/rules/ci/qa-ci-001-continue-on-error.ts
+// src/rules/ci/qa-ci-001-continue-on-error.ts
 /**
 * QA-CI-001 — `continue-on-error: true` masks a failing job.
 * Severity: error · Confidence: high · deterministic-defect
@@ -7287,8 +7254,7 @@ function describeAzureStep(step) {
 	if (step.task) return step.task;
 	return "step";
 }
-//#endregion
-//#region src/rules/ci/qa-ci-002-swallowed-exit.ts
+// src/rules/ci/qa-ci-002-swallowed-exit.ts
 /**
 * QA-CI-002 — `|| true` swallows a command's exit code.
 * Severity: error · Confidence: high · deterministic-defect
@@ -7343,8 +7309,7 @@ const swallowedExitCode = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/ci/qa-ci-007-retry-masking.ts
+// src/rules/ci/qa-ci-007-retry-masking.ts
 /**
 * QA-CI-007 — Retry masking test failures.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -7495,8 +7460,7 @@ function azureArm$1(ctx, doc, findings) {
 		});
 	}
 }
-//#endregion
-//#region src/rules/ci/qa-ci-005-report-never-generated.ts
+// src/rules/ci/qa-ci-005-report-never-generated.ts
 /**
 * QA-CI-005 — Report consumed but never generated.
 * Severity: error · Confidence: high · deterministic-defect
@@ -7654,8 +7618,7 @@ function findJobConsumerLine(text, jobName, consumerRe) {
 	const anywhere = new RegExp(consumerRe.source, "i").exec(text);
 	return anywhere ? lineAt(text, anywhere.index) : 1;
 }
-//#endregion
-//#region src/rules/ci/jenkins-gates.ts
+// src/rules/ci/jenkins-gates.ts
 /**
 * Jenkinsfile block scanner for the QA-CI Jenkins arms (product-gap
 * master plan P3c). Jenkinsfiles are Groovy text — "no new language
@@ -7901,8 +7864,7 @@ function textIsVerificationGate(text) {
 function lineOfOffset(text, offset) {
 	return lineAt(text, offset);
 }
-//#endregion
-//#region src/rules/ci/qa-ci-008-always-success.ts
+// src/rules/ci/qa-ci-008-always-success.ts
 /**
 * QA-CI-008 — Always-success step at the end of a job.
 * Severity: error · Confidence: high · deterministic-defect
@@ -8076,8 +8038,7 @@ function jenkinsArm$1(ctx, findings) {
 		});
 	}
 }
-//#endregion
-//#region src/rules/ci/qa-ci-009-exit-code.ts
+// src/rules/ci/qa-ci-009-exit-code.ts
 /**
 * QA-CI-009 — Test command does not propagate exit code.
 * Severity: error · Confidence: high · deterministic-defect
@@ -8212,8 +8173,7 @@ function jenkinsArm(ctx, findings) {
 		});
 	}
 }
-//#endregion
-//#region src/rules/ci/qa-ci-010-non-blocking.ts
+// src/rules/ci/qa-ci-010-non-blocking.ts
 /**
 * QA-CI-010 — Required test job is non-blocking for branch protection.
 * Severity: error · Confidence: medium · deterministic-defect
@@ -8296,8 +8256,7 @@ function findLine(text, re) {
 function escapeRe(s) {
 	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-//#endregion
-//#region src/rules/ci/qa-ci-013-can-never-fail.ts
+// src/rules/ci/qa-ci-013-can-never-fail.ts
 /**
 * QA-CI-013 — Verification stage/job conditioned so it can never fail the
 * pipeline (product-gap master plan P3b).
@@ -8401,8 +8360,7 @@ const canNeverFailGate = defineRule({
 function jobHasGate(job) {
 	return (job.steps ?? []).some((s) => s !== void 0 && stepIsVerificationGate$1(s));
 }
-//#endregion
-//#region src/rules/ci/qa-ci-014-swallowed-verification.ts
+// src/rules/ci/qa-ci-014-swallowed-verification.ts
 /**
 * QA-CI-014 — try/catch swallowing a verification-stage failure without
 * rethrow or failure-marking (product-gap master plan P3c).
@@ -8459,8 +8417,7 @@ const swallowedVerificationFailure = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/python/qa-py-003-no-assertions.ts
+// src/rules/python/qa-py-003-no-assertions.ts
 /**
 * QA-PY-003 — Test function with no assertions.
 * Severity: error · Confidence: high · deterministic-defect
@@ -8581,8 +8538,7 @@ function extractBlock$1(text, afterColon) {
 	const lineEnd = rest.indexOf("\n", firstIdx);
 	return lineEnd === -1 ? rest : rest.slice(0, lineEnd);
 }
-//#endregion
-//#region src/rules/python/qa-py-005-hard-sleep.ts
+// src/rules/python/qa-py-005-hard-sleep.ts
 /**
 * QA-PY-005 — time.sleep() in tests.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -8629,8 +8585,7 @@ const pyHardSleep = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/python/qa-py-002-skipped-test.ts
+// src/rules/python/qa-py-002-skipped-test.ts
 /**
 * QA-PY-002 — Skipped test (`@pytest.mark.skip`, `xfail` non-strict).
 * Severity: warning · Confidence: high · deterministic-defect
@@ -8690,8 +8645,7 @@ const pySkippedTest = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/python/qa-py-012-tautological.ts
+// src/rules/python/qa-py-012-tautological.ts
 /**
 * QA-PY-012 — Tautological assertion (`assert True`, `assert x == x`).
 * Severity: error · Confidence: high · deterministic-defect
@@ -8746,8 +8700,7 @@ const pyTautological = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/python/qa-py-001-focused-test.ts
+// src/rules/python/qa-py-001-focused-test.ts
 /**
 * QA-PY-001 — Focused test committed.
 * Severity: error · Confidence: high · deterministic-defect
@@ -8801,8 +8754,7 @@ const pyFocusedTest = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/engine/jv-cs-ast.ts
+// src/engine/jv-cs-ast.ts
 /** Narrow the loose `ast` seam back to a tree-sitter Tree. */
 function getTreeSitterTree(ast) {
 	if (!(ast instanceof Object) || !("rootNode" in ast)) return void 0;
@@ -9006,8 +8958,7 @@ function isHelperIdiom(name) {
 	}
 	return false;
 }
-//#endregion
-//#region src/engine/python-ast.ts
+// src/engine/python-ast.ts
 function getPythonTree(ast) {
 	return getTreeSitterTree(ast);
 }
@@ -9092,8 +9043,7 @@ function pythonWithRaisesBlocks(tree) {
 	});
 	return out;
 }
-//#endregion
-//#region src/rules/python/qa-py-007-raises-without-match.ts
+// src/rules/python/qa-py-007-raises-without-match.ts
 /**
 * QA-PY-007 — pytest.raises without match.
 * Severity: warning · Confidence: medium · heuristic-risk
@@ -9220,8 +9170,7 @@ function astArm(ctx, tree) {
 	}
 	return findings;
 }
-//#endregion
-//#region src/rules/python/qa-py-009-commented-out.ts
+// src/rules/python/qa-py-009-commented-out.ts
 /**
 * QA-PY-009 — Commented-out tests.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -9268,8 +9217,7 @@ const pyCommentedOutTest = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/python/qa-py-004-bare-truthiness.ts
+// src/rules/python/qa-py-004-bare-truthiness.ts
 /**
 * QA-PY-004 — Bare truthiness assert on complex object.
 * Severity: warning · Confidence: medium · heuristic-risk
@@ -9348,8 +9296,7 @@ const pyBareTruthinessAssert = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/python/qa-py-011-mutable-fixture.ts
+// src/rules/python/qa-py-011-mutable-fixture.ts
 /**
 * QA-PY-011 — Mutable fixture shared across tests.
 * Severity: warning · Confidence: medium · heuristic-risk
@@ -9400,8 +9347,7 @@ const pyMutableFixture = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-101-wait-for-timeout.ts
+// src/rules/playwright/qa-pw-101-wait-for-timeout.ts
 /**
 * QA-PW-101 — waitForTimeout() anywhere.
 * Severity: error · Confidence: high · deterministic-defect
@@ -9448,8 +9394,7 @@ const pwWaitForTimeout = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-102-wait-load.ts
+// src/rules/playwright/qa-pw-102-wait-load.ts
 /**
 * QA-PW-102 — waitForEvent('load') / waitForLoadState('load') instead of
 * web-first assertions.
@@ -9503,8 +9448,7 @@ const pwWaitForLoadEvent = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-113-deep-frames.ts
+// src/rules/playwright/qa-pw-113-deep-frames.ts
 /**
 * QA-PW-113 — frameLocator chains > 2 deep.
 * Severity: warning · Confidence: medium · heuristic-risk
@@ -9554,8 +9498,7 @@ const pwDeepFrameLocator = defineRule({
 function count(fragment) {
 	return fragment.match(/frameLocator\s*\(/g).length;
 }
-//#endregion
-//#region src/rules/playwright/qa-pw-117-serial.ts
+// src/rules/playwright/qa-pw-117-serial.ts
 /**
 * QA-PW-117 — test.describe.serial without justification comment.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -9609,8 +9552,7 @@ const pwSerialNoJustification = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-121-config-retries.ts
+// src/rules/playwright/qa-pw-121-config-retries.ts
 /**
 * QA-PW-121 — playwright.config: retries >= 3 or workers = 0.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -9675,8 +9617,7 @@ const pwConfigRetryAbuse = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-122-no-trace.ts
+// src/rules/playwright/qa-pw-122-no-trace.ts
 /**
 * QA-PW-122 — No trace capture on retry in playwright.config.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -9725,8 +9666,7 @@ const pwNoTraceOnRetry = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-124-project-split.ts
+// src/rules/playwright/qa-pw-124-project-split.ts
 /**
 * QA-PW-124 — Projects defined but no smoke/regression split.
 * Severity: info · Confidence: high · deterministic-defect
@@ -9788,8 +9728,7 @@ const pwNoProjectSplit = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-104-trial-click.ts
+// src/rules/playwright/qa-pw-104-trial-click.ts
 /**
 * QA-PW-104 — `{ trial: true }` misuse — check-then-act race.
 * Severity: warning · Confidence: medium · heuristic-risk
@@ -9835,8 +9774,7 @@ const pwTrialMisuse = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-116-storage-state.ts
+// src/rules/playwright/qa-pw-116-storage-state.ts
 /**
 * QA-PW-116 — storageState reuse without expiry strategy.
 * Severity: warning · Confidence: medium · heuristic-risk
@@ -9882,8 +9820,7 @@ const pwStorageStateNoExpiry = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-125-global-setup.ts
+// src/rules/playwright/qa-pw-125-global-setup.ts
 /**
 * QA-PW-125 — globalSetup mutating shared external state.
 * Severity: warning · Confidence: medium · heuristic-risk
@@ -9941,8 +9878,7 @@ const pwGlobalSetupSharedState = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-115-shared-page.ts
+// src/rules/playwright/qa-pw-115-shared-page.ts
 /**
 * QA-PW-115 — Shared `page` across parallel tests without isolation.
 * Severity: warning · Confidence: medium · heuristic-risk
@@ -9990,8 +9926,7 @@ const pwSharedPage = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-140.ts
+// src/rules/playwright/qa-pw-140.ts
 /**
 * QA-PW-140 — Screenshot without maxDiffPixelRatio.
 *
@@ -10065,8 +10000,7 @@ function matchParen(text, open) {
 	}
 	return -1;
 }
-//#endregion
-//#region src/rules/playwright/qa-pw-123-hardcoded-url.ts
+// src/rules/playwright/qa-pw-123-hardcoded-url.ts
 /**
 * QA-PW-123 — Hardcoded baseURL in specs.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -10114,8 +10048,7 @@ const hardcodedBaseUrl = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/quality/qa-env-001-env-coupling.ts
+// src/rules/quality/qa-env-001-env-coupling.ts
 /**
 * QA-ENV-001 — "Works On My Machine" detector core (Tier 5 #24).
 * Environment coupling in test files: fixed ports, OS paths,
@@ -10182,8 +10115,7 @@ const envCoupling = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-141-retry-no-triage.ts
+// src/rules/playwright/qa-pw-141-retry-no-triage.ts
 /**
 * QA-PW-141 — playwright.config retries set high enough to mask flakes.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -10240,8 +10172,7 @@ const pwRetryMaskingNoForensics = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-142-blanket-route.ts
+// src/rules/playwright/qa-pw-142-blanket-route.ts
 /**
 * QA-PW-142 — page.route() blanket-mocking instead of scoped intercepts.
 * Severity: warning · Confidence: medium · heuristic-risk
@@ -10296,8 +10227,7 @@ const pwBlanketRouteMock = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-143-no-artifacts.ts
+// src/rules/playwright/qa-pw-143-no-artifacts.ts
 /**
 * QA-PW-143 — No screenshot/video artifact capture on failure.
 * Severity: info · Confidence: high · deterministic-defect
@@ -10350,8 +10280,7 @@ const pwNoFailureArtifacts = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-144-single-browser.ts
+// src/rules/playwright/qa-pw-144-single-browser.ts
 /**
 * QA-PW-144 — Single-browser project matrix (no cross-browser coverage).
 * Severity: info · Confidence: high · deterministic-defect
@@ -10413,8 +10342,7 @@ const pwSingleBrowserMatrix = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-146-css-locator.ts
+// src/rules/playwright/qa-pw-146-css-locator.ts
 /**
 * QA-PW-146 — CSS/XPath string selector where Playwright's locator
 * standard expects a normalized locator (plan §17.3).
@@ -10493,8 +10421,7 @@ const pwLocatorNormalize = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/playwright/qa-pw-147-codegen-artifact.ts
+// src/rules/playwright/qa-pw-147-codegen-artifact.ts
 /**
 * QA-PW-147 — Playwright codegen artifact left unedited (plan §17.1).
 * Severity: info · Confidence: medium · observation
@@ -10553,8 +10480,7 @@ const pwCodegenArtifact = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/python/qa-py-101-sync-async-mix.ts
+// src/rules/python/qa-py-101-sync-async-mix.ts
 /**
 * QA-PY-101 — Playwright-Python: sync API in async test (or vice versa).
 * Severity: warning · Confidence: high · deterministic-defect
@@ -10603,8 +10529,7 @@ const pyPwSyncAsyncMix = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/python/qa-py-103-wait-for-timeout.ts
+// src/rules/python/qa-py-103-wait-for-timeout.ts
 /**
 * QA-PY-103 — Playwright-Python: wait_for_timeout() as synchronization.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -10651,8 +10576,7 @@ const pyPwWaitForTimeout = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/python/qa-py-105-pw-no-assertions.ts
+// src/rules/python/qa-py-105-pw-no-assertions.ts
 /**
 * QA-PY-105 — Playwright-Python: no assertion in Playwright test.
 * Severity: error · Confidence: high · deterministic-defect
@@ -10732,8 +10656,7 @@ function extractBlock(text, afterColon) {
 	const lineEnd = rest.indexOf("\n", firstContent.index);
 	return lineEnd === -1 ? rest : rest.slice(0, lineEnd);
 }
-//#endregion
-//#region src/rules/java/qa-jv-101-disabled-test.ts
+// src/rules/java/qa-jv-101-disabled-test.ts
 /**
 * QA-JV-101 — @Disabled test without justification.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -10787,8 +10710,7 @@ const jvDisabledTest = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/java/qa-jv-103-no-assertions.ts
+// src/rules/java/qa-jv-103-no-assertions.ts
 /**
 * QA-JV-103 — Test method without assertions.
 * Severity: error · Confidence: high · deterministic-defect
@@ -10945,8 +10867,7 @@ function matchBrace$1(text, open) {
 	}
 	return -1;
 }
-//#endregion
-//#region src/engine/qa-model.ts
+// src/engine/qa-model.ts
 /**
 * Extract the semantic model for one parsed file. Resolves undefined
 * when the language has no extractor or the parse stage produced no
@@ -11489,8 +11410,7 @@ function extractPythonModel(file) {
 		nodes
 	};
 }
-//#endregion
-//#region src/rules/java/qa-jv-105-wait-for-timeout.ts
+// src/rules/java/qa-jv-105-wait-for-timeout.ts
 /**
 * QA-JV-105 — waitForTimeout / hardcoded navigation waits.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -11575,8 +11495,7 @@ const jvWaitForTimeout = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/csharp/qa-cs-101-skipped-test.ts
+// src/rules/csharp/qa-cs-101-skipped-test.ts
 /**
 * QA-CS-101 — [Ignore]/[Skip] test without justification.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -11640,8 +11559,7 @@ const csSkippedTest = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/csharp/qa-cs-103-no-assertions.ts
+// src/rules/csharp/qa-cs-103-no-assertions.ts
 /**
 * QA-CS-103 — Test method without assertions.
 * Severity: error · Confidence: high · deterministic-defect
@@ -11675,7 +11593,6 @@ const csSkippedTest = defineRule({
 * Deep-diffing those requires symbol semantics Mjölnir deliberately does
 * not promise for C# (plan §13.4).
 */
-/** Helper/verification idiom: verify/check/assert-prefixed names. */
 const WHY$5 = "Without an assertion the test can only fail by throwing — it cannot detect behavioral regressions.";
 const FIX$4 = "Add an assertion on the expected outcome, or remove the test.";
 function makeFinding(path, position, name) {
@@ -11839,8 +11756,7 @@ function matchBrace(text, open) {
 	}
 	return -1;
 }
-//#endregion
-//#region src/rules/csharp/qa-cs-105-wait-for-timeout.ts
+// src/rules/csharp/qa-cs-105-wait-for-timeout.ts
 /**
 * QA-CS-105 — Playwright-.NET: WaitForTimeoutAsync hard sleep.
 * Severity: warning · Confidence: high · deterministic-defect
@@ -11928,8 +11844,7 @@ const csWaitForTimeout = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/cypress/qa-cyp-001-cy-wait.ts
+// src/rules/cypress/qa-cyp-001-cy-wait.ts
 /**
 * QA-CYP-001 — Fixed `cy.wait(n)` (hard-coded wait).
 * Severity: warning · Confidence: high · deterministic-defect
@@ -12008,8 +11923,7 @@ function isCypressFile(ctx) {
 	if (/\.cy\.[jt]sx?$/.test(ctx.path)) return true;
 	return /\bcy\s*\./.test(ctx.codeText ?? ctx.text);
 }
-//#endregion
-//#region src/rules/cypress/qa-cyp-002-focused-test.ts
+// src/rules/cypress/qa-cyp-002-focused-test.ts
 /**
 * QA-CYP-002 — Focused test (`.only`).
 * Severity: error · Confidence: high · deterministic-defect
@@ -12072,8 +11986,7 @@ const cypFocusedTest = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/cypress/qa-cyp-003-config-security.ts
+// src/rules/cypress/qa-cyp-003-config-security.ts
 /**
 * QA-CYP-003 — Cypress config disables `chromeWebSecurity`.
 * Severity: error · Confidence: high · deterministic-defect
@@ -12143,8 +12056,7 @@ const cypConfigSecurity = defineRule({
 		return findings;
 	}
 });
-//#endregion
-//#region src/rules/selenium/qa-se-sleep-lookup.ts
+// src/rules/selenium/qa-se-sleep-lookup.ts
 /**
 * Selenium sleep-then-interact rules (Verification Trust Evolution Plan
 * §15.3 — "Selenium implicit-wait abuse / missing WebDriverWait",
@@ -12295,8 +12207,7 @@ const sePythonSleepLookup = defineRule({
 		return sleepBeforeLookup(ctx, PY_SLEEP_RE, PY_LOOKUP_RE, "QA-SE-003");
 	}
 });
-//#endregion
-//#region src/rules/shared/family.ts
+// src/rules/shared/family.ts
 /**
 * Cross-language pattern rule family generator (Phase 6 — Tempering Plan).
 *
@@ -12362,8 +12273,7 @@ function definePatternFamily(opts) {
 		}
 	}));
 }
-//#endregion
-//#region src/rules/families/hard-sleep.ts
+// src/rules/families/hard-sleep.ts
 /**
 * Hard-sleep family (Phase 6 — Tempering Plan).
 * Java: Thread.sleep(), C#: Thread.Sleep() / Task.Delay()
@@ -12514,8 +12424,7 @@ const hardSleepFamily = definePatternFamily({
 		fix: "Use `await Assertions.Expect(locator).ToBeVisibleAsync()` or locator.WaitForAsync()."
 	}]
 });
-//#endregion
-//#region src/rules/families/network-idle.ts
+// src/rules/families/network-idle.ts
 /**
 * Network-idle family (Phase 6 — Tempering Plan).
 * All three language variants of waitForLoadState(networkidle).
@@ -12576,8 +12485,7 @@ const networkIdleFamily = definePatternFamily({
 		}
 	]
 });
-//#endregion
-//#region src/rules/families/hardcoded-url.ts
+// src/rules/families/hardcoded-url.ts
 /**
 * Hardcoded-URL family (Phase 6 — Tempering Plan).
 * Detects absolute URLs in navigation/request calls across languages.
@@ -12627,8 +12535,7 @@ const hardcodedUrlFamily = definePatternFamily({
 		fix: "Use `--base-url` / `base_url` fixture, or `os.environ[...]`."
 	}]
 });
-//#endregion
-//#region src/rules/families/shared-page.ts
+// src/rules/families/shared-page.ts
 /**
 * Shared-page family (Phase 6 — Tempering Plan).
 * Detects static/module-level Page/Browser instances shared across tests.
@@ -12689,8 +12596,7 @@ const sharedPageFamily = definePatternFamily({
 		}
 	]
 });
-//#endregion
-//#region src/rules/families/brittle-selectors.ts
+// src/rules/families/brittle-selectors.ts
 /**
 * Brittle-selectors family (Phase 6 — Tempering Plan).
 * Detects XPath/structural CSS selectors across Java, C#, Python.
@@ -12802,8 +12708,7 @@ const brittleSelectorsFamily = [
 		}
 	], "Prefer role-based locators (`get_by_role(...)`) or data-testid attributes.")
 ];
-//#endregion
-//#region src/rules/families/retry-masking.ts
+// src/rules/families/retry-masking.ts
 /**
 * Retry-masking family (Phase 6 — Tempering Plan).
 * Detects retry annotations/attributes that mask flaky tests.
@@ -12923,8 +12828,7 @@ const retryMaskingFamily = [defineRule({
 		return findings;
 	}
 })];
-//#endregion
-//#region src/rules/index.ts
+// src/rules/index.ts
 const RULES = [
 	focusedTestCommitted,
 	skippedTest,
@@ -13046,8 +12950,7 @@ const RETIRED_RULE_IDS = [
 	"QA-JV-111",
 	"QA-CS-111"
 ];
-//#endregion
-//#region src/lib/wilson.ts
+// src/lib/wilson.ts
 /**
 * 95% Wilson score interval on a proportion (plan §20.2).
 *
@@ -13170,8 +13073,7 @@ function isProvisional(rule) {
 function isRetiredRule(ruleId) {
 	return RETIRED_RULE_IDS.includes(ruleId);
 }
-//#endregion
-//#region src/scorer/scorer.ts
+// src/scorer/scorer.ts
 /**
 * Transparent scorer (Product-MVP §8).
 * score = 100 − Σ(severity deductions), floor 0.
@@ -13323,9 +13225,9 @@ function countTestDeclarations(text, codeText) {
 	const source = codeText ?? text;
 	const patterns = [
 		/\b(?:it|test)(?:\.\w+)*\s*(?:\(|`)/g,
-		/^\s*(?:async\s+)?def\s+test_\w*/gm,
-		/^\s*@Test\b/gm,
-		/^\s*\[(?:Test|Fact|Theory|TestMethod)\b/gm
+		/^[ \t]*(?:async[ \t]+)?def[ \t]+test_\w*/gm,
+		/^[ \t]*@Test\b/gm,
+		/^[ \t]*\[(?:Test|Fact|Theory|TestMethod)\b/gm
 	];
 	let count = 0;
 	for (const re of patterns) {
@@ -13334,8 +13236,7 @@ function countTestDeclarations(text, codeText) {
 	}
 	return count;
 }
-//#endregion
-//#region src/engine/rule-runner.ts
+// src/engine/rule-runner.ts
 /**
 * Legacy appliesTo → adapter id mapping.
 *
@@ -13374,8 +13275,7 @@ function asUniversal(rule) {
 		}
 	};
 }
-//#endregion
-//#region src/engine/tier-policy.ts
+// src/engine/tier-policy.ts
 /**
 * Tier policy (audit H-1): the declared tier is authoritative over a
 * rule's severity and evidence claims.
@@ -13515,8 +13415,7 @@ function enforceTierPolicy(findings, tierByRuleId) {
 		if (EVIDENCE_RANK$1[effective] < EVIDENCE_RANK$1[floor.evidenceLevel]) f.evidenceLevel = floor.evidenceLevel;
 	}
 }
-//#endregion
-//#region src/engine/evidence-core.ts
+// src/engine/evidence-core.ts
 /**
 * The core's own version — stamped into every record's provenance so a
 * consumer can tell which normalization contract produced a record.
@@ -13583,8 +13482,7 @@ function countEvidence(records) {
 	}
 	return counts;
 }
-//#endregion
-//#region src/engine/provenance.ts
+// src/engine/provenance.ts
 const GENERATED_HEADER_RE = /^\s*(?:\/\/|#|\/\*)\s*(?:auto[- ]?generated|generated by|do not edit)/i;
 /**
 * Codegen fingerprint: the recorder names its first test exactly
@@ -13625,8 +13523,7 @@ function computeAgenticProfile(files, findings) {
 		note: "Static provenance markers only (generated-file headers, Playwright codegen default titles). Absence of a marker does not prove human authorship; healed and MCP-edited files without markers are indistinguishable from hand-written ones. Provenance never changes scoring or evidence — authorship is metadata, not trust."
 	};
 }
-//#endregion
-//#region src/engine/overlap-dedup.ts
+// src/engine/overlap-dedup.ts
 const TIER_RANK = {
 	core: 0,
 	extended: 1,
@@ -13721,8 +13618,7 @@ function dropOrderBefore(a, b, metaByRuleId) {
 	if (ranksBefore(b, a, metaByRuleId)) return true;
 	return (a.column ?? Number.MAX_SAFE_INTEGER) < (b.column ?? Number.MAX_SAFE_INTEGER);
 }
-//#endregion
-//#region src/engine/finding-identity.ts
+// src/engine/finding-identity.ts
 /**
 * Finding Identity (ENGINE-002): deterministic, stable fingerprints for
 * deduplication, correlation, and lifecycle tracking across scans.
@@ -13761,8 +13657,7 @@ function codeQualityFingerprint(f) {
 function findingId(f) {
 	return `${findingFingerprint(f)}\u0000${f.line}\u0000${f.column}`;
 }
-//#endregion
-//#region src/engine/correlation-engine.ts
+// src/engine/correlation-engine.ts
 const EVIDENCE_RANK = {
 	E0: 0,
 	E1: 1,
@@ -13892,8 +13787,7 @@ function correlateFindings(findings) {
 	});
 	return conclusions;
 }
-//#endregion
-//#region src/engine/dependency-graph.ts
+// src/engine/dependency-graph.ts
 /**
 * Dependency Graph (ECO-005).
 *
@@ -14066,8 +13960,7 @@ function getReachableFiles(fromFiles, graph) {
 		resolvedAny: unresolvedStarts.length < fromFiles.length
 	};
 }
-//#endregion
-//#region src/engine/incremental-analysis.ts
+// src/engine/incremental-analysis.ts
 /**
 * Semantic inputs that affect the full scan beyond individual file content.
 * If any of these changed, an incremental run is NOT safe — a full scan
@@ -14103,8 +13996,7 @@ function isIncrementalSafe(changedFiles) {
 		reasons
 	};
 }
-//#endregion
-//#region src/brand/tokens.ts
+// src/brand/tokens.ts
 /**
 * The single source of brand truth.
 *
@@ -14339,8 +14231,7 @@ RUNG_MEANINGS.map((meaning, i) => ({
 	runtime: i >= 3,
 	color: RUNG_COLORS[i]
 }));
-//#endregion
-//#region src/reporter/presentation.ts
+// src/reporter/presentation.ts
 /**
 * presentation.ts — the one place a presentation DECISION is made.
 *
@@ -14562,8 +14453,7 @@ function evidenceTag(f) {
 	if (runtime !== null) tag += ` · runtime: ${runtime}`;
 	return `[${tag}]`;
 }
-//#endregion
-//#region src/engine/monorepo-analysis.ts
+// src/engine/monorepo-analysis.ts
 /**
 * Package verdict, derived from the one ScoreState band model (BW-104).
 * These two constants used to be a private copy of the band boundaries;
@@ -14670,8 +14560,7 @@ function configurableAggregation(results, config) {
 		strategy: config.weightingStrategy
 	};
 }
-//#endregion
-//#region src/lib/fs-atomic.ts
+// src/lib/fs-atomic.ts
 /**
 * Atomic file writes (audit S9).
 *
@@ -14791,8 +14680,7 @@ function pidAlive(pid) {
 		return err?.code !== "ESRCH";
 	}
 }
-//#endregion
-//#region src/engine/scan-cache.ts
+// src/engine/scan-cache.ts
 /**
 * Local incremental scan cache (Beta-to-Stable 1.0 plan, M5.2 / A-2).
 *
@@ -14892,7 +14780,9 @@ function hashDir(dir, hash, depth) {
 		else if (entry.isFile() && /\.tsx?$/.test(entry.name)) try {
 			hash.update(entry.name);
 			hash.update(readFileSync(full));
-		} catch {}
+		} catch {
+			recordDegradation("rules-tree-file-unreadable");
+		}
 	}
 }
 /**
@@ -15002,8 +14892,7 @@ function createScanCache(root) {
 		}
 	};
 }
-//#endregion
-//#region src/reporter/theme.ts
+// src/reporter/theme.ts
 /**
 * Norse-forge theme system. Pure string-in → string-out helpers.
 * Respects NO_COLOR and non-TTY via `palette(isTTY)` — every renderer
@@ -15212,8 +15101,7 @@ function gaugeColorForBand(band, p) {
 	if (band === "unmeasured") return p.dim;
 	return band === "warning" ? p.warning : p.error;
 }
-//#endregion
-//#region src/reporter/ui.ts
+// src/reporter/ui.ts
 /**
 * Neutral context for direct calls (tests, library use) and as the
 * safe default when a command runner is invoked without wiring: no
@@ -15302,8 +15190,7 @@ function formatDuration(ms) {
 	if (ms === void 0) return "?";
 	return ms >= 1e3 ? `${(ms / 1e3).toFixed(1)}s` : `${ms}ms`;
 }
-//#endregion
-//#region src/forensics/classify.ts
+// src/forensics/classify.ts
 /**
 * Strong-signal marker tables. Kept deliberately narrow: a marker here
 * is a named family fact, not a vibe. Unknown text yields no signal —
@@ -15423,8 +15310,7 @@ function classifyForensicVerdict(signals) {
 		signals: signalCounts
 	};
 }
-//#endregion
-//#region src/forensics/analyze.ts
+// src/forensics/analyze.ts
 const ui$11 = plainContext();
 const MAX_RECORDS = 1e5;
 function analyze(records, source) {
@@ -15587,8 +15473,7 @@ function renderFlakyMd(report) {
 	lines.push("");
 	return lines.join("\n");
 }
-//#endregion
-//#region src/forensics/evidence-hygiene.ts
+// src/forensics/evidence-hygiene.ts
 /**
 * Evidence hygiene — secret redaction + control-char sanitization
 * (ENGINE-012).
@@ -15650,8 +15535,7 @@ function sanitizeErrorText(text, options) {
 	if (result.length > maxLength) result = result.slice(0, maxLength) + `[truncated at ${maxLength} chars]`;
 	return result;
 }
-//#endregion
-//#region src/forensics/trace.ts
+// src/forensics/trace.ts
 /**
 * Playwright trace ingester (product-gap master plan §9 R5 / WI-17).
 *
@@ -15844,8 +15728,7 @@ function parseTraceArtifact(bytes, artifactName) {
 	const { actions } = parseTraceNdjson(text);
 	return traceActionsToRecord(actions, artifactName);
 }
-//#endregion
-//#region src/forensics/parse-jest-json.ts
+// src/forensics/parse-jest-json.ts
 function toStatus$2(raw) {
 	switch (raw) {
 		case "passed": return "passed";
@@ -15905,8 +15788,7 @@ function parseJestJson(json) {
 	}
 	return out;
 }
-//#endregion
-//#region src/forensics/parse-junit.ts
+// src/forensics/parse-junit.ts
 const MAX_INPUT$1 = 20971520;
 function decodeEntities$1(s) {
 	return s.replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&quot;", "\"").replaceAll("&apos;", "'").replaceAll("&#39;", "'").replaceAll("&amp;", "&");
@@ -15948,14 +15830,25 @@ function parseJunitXml(xml) {
 		const skipped = /<skipped\b/i.test(inner);
 		const errors = [];
 		if (failed) {
-			const failRe = /<(?:failure|error)\b([^>]*)>([\s\S]*?)<\/(?:failure|error)\s*>/gi;
-			let failMatch;
-			while ((failMatch = failRe.exec(inner)) !== null) {
-				const attrsStr = failMatch[1] ?? "";
+			const openRe = /<(?:failure|error)\b/gi;
+			const endRe = /<\/(?:failure|error)\s*>/gi;
+			let open;
+			while ((open = openRe.exec(inner)) !== null) {
+				const gt = inner.indexOf(">", open.index);
+				if (gt === -1) break;
+				const attrsStr = inner.slice(open.index, gt);
+				if (attrsStr.endsWith("/")) {
+					openRe.lastIndex = gt + 1;
+					continue;
+				}
+				endRe.lastIndex = gt + 1;
+				const end = endRe.exec(inner);
+				if (end === null) break;
 				const msgAttr = /\smessage\s*=\s*"([^"]*)"/i.exec(attrsStr)?.[1];
 				if (msgAttr) errors.push(sanitizeErrorText(decodeEntities$1(msgAttr)));
-				const body = failMatch[2]?.trim();
+				const body = inner.slice(gt + 1, end.index).trim();
 				if (body && body !== msgAttr) errors.push(sanitizeErrorText(decodeEntities$1(body)));
+				openRe.lastIndex = end.index + end[0].length;
 			}
 			const selfCloseRe = /<(?:failure|error)\b([^>]*)\/>/gi;
 			let scMatch;
@@ -15979,8 +15872,7 @@ function parseJunitXml(xml) {
 	}
 	return out;
 }
-//#endregion
-//#region src/forensics/parse-trx.ts
+// src/forensics/parse-trx.ts
 const MAX_INPUT = 20971520;
 function decodeEntities(s) {
 	return s.replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&quot;", "\"").replaceAll("&apos;", "'").replaceAll("&#39;", "'").replaceAll("&amp;", "&");
@@ -16091,11 +15983,24 @@ function parseTrxXml(xml) {
 		if (id !== void 0 && name !== void 0) byTestId.set(id, name);
 	}
 	const records = [];
-	const resultRe = /<UnitTestResult\b([^>]*)>([\s\S]{0,4000}?)(?=<UnitTestResult\b|<\/Results>)/gi;
-	let m;
-	while ((m = resultRe.exec(xml)) !== null) {
-		const attrs = m[1] ?? "";
-		const inner = m[2] ?? "";
+	const startRe = /<UnitTestResult\b/gi;
+	const starts = [];
+	let s;
+	while ((s = startRe.exec(xml)) !== null) {
+		starts.push(s.index);
+		if (starts.length > 2e5) break;
+	}
+	const resultsEnd = xml.search(/<\/Results>/i);
+	for (let i = 0; i < starts.length; i++) {
+		const start = starts[i];
+		const tagEnd = xml.indexOf(">", start);
+		if (tagEnd === -1) break;
+		const selfClosing = xml[tagEnd - 1] === "/";
+		const attrs = xml.slice(start + 15, selfClosing ? tagEnd - 1 : tagEnd);
+		const next = starts[i + 1] ?? -1;
+		let bodyEnd = next === -1 ? xml.length : next;
+		if (resultsEnd > tagEnd && resultsEnd < bodyEnd) bodyEnd = resultsEnd;
+		const inner = selfClosing ? "" : xml.slice(tagEnd + 1, bodyEnd);
 		const testName = attr(attrs, "testName") ?? attr(attrs, "testId");
 		if (testName === void 0) continue;
 		const attempt = {
@@ -16103,7 +16008,8 @@ function parseTrxXml(xml) {
 			status: mapTrxOutcome(attr(attrs, "outcome")),
 			durationMs: parseDuration(attr(attrs, "duration"))
 		};
-		const error = messageOf(inner, 0);
+		const messageAt = inner.search(/<Message\b/i);
+		const error = messageAt === -1 ? void 0 : messageOf(inner, messageAt);
 		records.push({
 			file: "unknown",
 			title: testName,
@@ -16115,8 +16021,7 @@ function parseTrxXml(xml) {
 	}
 	return records;
 }
-//#endregion
-//#region src/forensics/parse-playwright-json.ts
+// src/forensics/parse-playwright-json.ts
 const MAX_DEPTH = 32;
 function toStatus$1(raw) {
 	switch (raw) {
@@ -16181,8 +16086,7 @@ function parsePlaywrightJson(json) {
 	walk(root, 0);
 	return out;
 }
-//#endregion
-//#region src/forensics/parse-vitest-json.ts
+// src/forensics/parse-vitest-json.ts
 function toStatus(raw) {
 	switch (raw) {
 		case "passed": return "passed";
@@ -16236,8 +16140,7 @@ function parseVitestJson(json) {
 	}
 	return out;
 }
-//#endregion
-//#region src/forensics/parse-har.ts
+// src/forensics/parse-har.ts
 const MAX_ENTRIES = 2e4;
 function sanitizeTitleUrl(url) {
 	try {
@@ -16322,8 +16225,7 @@ function parseHarJsonDetailed(json) {
 		truncated
 	};
 }
-//#endregion
-//#region src/forensics/run.ts
+// src/forensics/run.ts
 /**
 * Runtime evidence entry point (R4) — the library behind `explain
 * --evidence`. The `forensics` verb is retired in the v6 carve; this module
@@ -16488,13 +16390,15 @@ function runForensics(target, options = {}) {
 		report.incompleteReasons = [.../* @__PURE__ */ new Set([...report.incompleteReasons, ...incompleteReasons])];
 	}
 	let flakyMdPath;
+	let flakyMdWriteError;
 	if ((options.writeFlakyMd ?? true) && report.totalTests > 0) {
 		const base = stat.isFile() ? dirname(target) : target;
 		flakyMdPath = join(base, "FLAKY.md");
 		try {
 			writeFileAtomic(flakyMdPath, renderFlakyMd(report));
-		} catch {
+		} catch (e) {
 			flakyMdPath = void 0;
+			flakyMdWriteError = e instanceof Error ? e.message : String(e);
 		}
 	}
 	return {
@@ -16502,7 +16406,7 @@ function runForensics(target, options = {}) {
 		output: [
 			renderLeaderboard(report),
 			"",
-			flakyMdPath !== void 0 ? renderFlakyMdHint() : report.totalTests === 0 && (report.totalNetworkObservations ?? 0) > 0 && options.writeFlakyMd !== false ? "FLAKY.md was not written — network observations do not establish test outcomes." : renderFlakyMdNotWritten(options)
+			flakyMdPath !== void 0 ? renderFlakyMdHint() : report.totalTests === 0 && (report.totalNetworkObservations ?? 0) > 0 && options.writeFlakyMd !== false ? "FLAKY.md was not written — network observations do not establish test outcomes." : renderFlakyMdNotWritten(options, flakyMdWriteError)
 		].join("\n"),
 		flakyMdPath
 	};
@@ -16511,9 +16415,10 @@ function renderFlakyMdHint() {
 	return "Full details in FLAKY.md (committed artifact).";
 }
 /** Honest fallback for every case where FLAKY.md was NOT written (M2). */
-function renderFlakyMdNotWritten(options) {
+function renderFlakyMdNotWritten(options, writeError) {
 	if (options.writeFlakyMd === false) return "FLAKY.md not written (--no-flaky-md).";
-	return "FLAKY.md was not written — nothing recognized to report (or the target directory is not writable).";
+	if (writeError !== void 0) return `FLAKY.md could not be written: ${writeError}`;
+	return "FLAKY.md was not written — nothing recognized to report.";
 }
 /**
 * R5: the trace artifact's test identity. The per-test trace convention
@@ -16600,8 +16505,7 @@ function listFiles(dir) {
 	walk(dir, 0);
 	return out.map((p) => p);
 }
-//#endregion
-//#region src/config/suppressions.ts
+// src/config/suppressions.ts
 /**
 * Suppression governance (Sprint-Plan W7, Product-MVP §12).
 * `mjolnir scan --suppressions` — every suppression stays visible.
@@ -16638,8 +16542,7 @@ function renderSuppressions(report) {
 	lines.push("");
 	return lines.join("\n");
 }
-//#endregion
-//#region src/plugins/reserved-prefixes.ts
+// src/plugins/reserved-prefixes.ts
 /**
 * Core-owned rule-ID prefixes that external rule sources (npm plugins,
 * JS modules, JSON manifests) may never claim — one shared law.
@@ -16669,8 +16572,7 @@ function isReservedPrefix(ruleId) {
 	const upper = ruleId.toUpperCase();
 	return RESERVED_PREFIXES.some((p) => upper.startsWith(p));
 }
-//#endregion
-//#region src/plugins/load.ts
+// src/plugins/load.ts
 /**
 * Plugin API (Upgrade-Plan-v3 Phase 6, tier-2 item #1).
 *
@@ -16776,8 +16678,7 @@ function loadPlugins(root, gateOpen = false) {
 	}
 	return result;
 }
-//#endregion
-//#region src/plugins/local-rules.ts
+// src/plugins/local-rules.ts
 /**
 * Local plugin/rule contract (Verification Trust Evolution Plan §18 —
 * Local Extensibility).
@@ -17089,8 +16990,7 @@ async function loadModuleRules(path, result) {
 		result.rules.push(rule);
 	}
 }
-//#endregion
-//#region src/plugins/trust-gate.ts
+// src/plugins/trust-gate.ts
 /**
 * Plugin trust gate (audit-remediation-master-plan.md, locked decision C2).
 *
@@ -17126,8 +17026,7 @@ function renderGateNotice(skipped) {
 	lines.push("To run them, re-run with --enable-plugins (or set MJOLNIR_ENABLE_PLUGINS=1).", "Declarative JSON rule manifests (mjolnir-rules/*.json) are unaffected — they execute no code.");
 	return lines.join("\n");
 }
-//#endregion
-//#region src/engine/scan-pipeline.ts
+// src/engine/scan-pipeline.ts
 /**
 * Canonical scan pipeline (M6 — blueprint §9.2).
 *
@@ -17143,8 +17042,10 @@ function renderGateNotice(skipped) {
 * module moved. Re-exports in cli.ts keep the historical import surface.
 */
 var scan_pipeline_exports = /* @__PURE__ */ __exportAll({
+	DEFAULT_MAX_DURATION_MS: () => DEFAULT_MAX_DURATION_MS$1,
 	EVIDENCE_OVERRIDES: () => EVIDENCE_OVERRIDES$1,
 	KNOWN_RULE_IDS: () => KNOWN_RULE_IDS$1,
+	MAX_DURATION_MS: () => MAX_DURATION_MS$1,
 	OVERLAP_META_BY_RULE_ID: () => OVERLAP_META_BY_RULE_ID$1,
 	SUITE_INVALIDATING_RULE_IDS: () => SUITE_INVALIDATING_RULE_IDS$1,
 	applyPostScanProcessing: () => applyPostScanProcessing,
@@ -17161,8 +17062,13 @@ var scan_pipeline_exports = /* @__PURE__ */ __exportAll({
 	summarizeForensicVerdicts: () => summarizeForensicVerdicts
 });
 const UNIVERSAL_RULES = RULES.map(asUniversal);
-const DEFAULT_MAX_DURATION_MS$2 = 6e5;
-const MAX_DURATION_MS$2 = 36e5;
+/**
+* The scan time budget: the default, and the ceiling every surface enforces.
+* Owned here, where the clamp is applied; `cli.ts` and the MCP server import
+* these rather than keeping copies that only agree by coincidence.
+*/
+const DEFAULT_MAX_DURATION_MS$1 = 6e5;
+const MAX_DURATION_MS$1 = 36e5;
 /** Registered rule IDs — used to warn on unknown severityOverrides keys (M4). */
 const KNOWN_RULE_IDS$1 = new Set(RULES.map((r) => r.id));
 /**
@@ -17205,9 +17111,10 @@ async function buildUniversalRules$1(root, strict, opts = {}) {
 	for (const p of plugins) for (const r of p.rules) if (r.tier) tierByRuleId.set(r.id, r.tier);
 	for (const r of local.rules) if (r.tier) tierByRuleId.set(r.id, r.tier);
 	let rules = [...UNIVERSAL_RULES, ...externalRules];
-	const withheldRuleIds = rules.filter((r) => tierByRuleId.get(r.id) === "quarantine").map((r) => r.id).sort();
+	const quarantined = rules.filter((r) => tierByRuleId.get(r.id) === "quarantine").map((r) => r.id).sort();
+	const withheldRuleIds = strict ? [] : quarantined;
 	if (!strict) rules = rules.filter((r) => tierByRuleId.get(r.id) !== "quarantine");
-	const rulesWithheld = strict ? 0 : withheldRuleIds.length;
+	const rulesWithheld = withheldRuleIds.length;
 	const rulesApplied = rules.length;
 	const pluginMeta = [...plugins.map((p) => ({
 		name: p.name,
@@ -17604,12 +17511,28 @@ function applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, dec
 	const runtimeIncomplete = discoveredReport !== void 0 && discoveredReport.report.analysisComplete !== true;
 	let forensicVerdicts;
 	let evidenceRecords = [];
-	if (discoveredReport && discoveredReport.report.analysisComplete === true) try {
-		evidenceRecords = buildEvidenceRecords(discoveredReport.report, discoveredReport.path);
-		stampRuntimeCorroboration(findings, discoveredReport.report, workspace.root);
-		forensicVerdicts = summarizeForensicVerdicts(discoveredReport.report);
-	} catch {
-		evidenceRecords = [];
+	if (discoveredReport && discoveredReport.report.analysisComplete === true) {
+		const before = findings.map((f) => ({
+			runtimeCorroboration: f.runtimeCorroboration,
+			trustLevel: f.trustLevel
+		}));
+		try {
+			const records = buildEvidenceRecords(discoveredReport.report, discoveredReport.path);
+			stampRuntimeCorroboration(findings, discoveredReport.report, workspace.root);
+			forensicVerdicts = summarizeForensicVerdicts(discoveredReport.report);
+			evidenceRecords = records;
+		} catch {
+			findings.forEach((f, i) => {
+				const prev = before[i];
+				if (prev?.runtimeCorroboration === void 0) delete f.runtimeCorroboration;
+				else f.runtimeCorroboration = prev.runtimeCorroboration;
+				if (prev?.trustLevel === void 0) delete f.trustLevel;
+				else f.trustLevel = prev.trustLevel;
+			});
+			forensicVerdicts = void 0;
+			evidenceRecords = [];
+			recordDegradation("runtime-corroboration-failed");
+		}
 	}
 	return {
 		evidenceRecords,
@@ -17900,8 +17823,8 @@ async function runScan$1(args, hooks = {}) {
 async function runScanInProject(args, hooks = {}) {
 	const started = Date.now();
 	const degradationWindow = beginDegradationWindow();
-	const requestedDuration = Number.isFinite(args.maxDurationMs) ? args.maxDurationMs : DEFAULT_MAX_DURATION_MS$2;
-	const deadline = started + Math.min(Math.max(1, requestedDuration), MAX_DURATION_MS$2);
+	const requestedDuration = Number.isFinite(args.maxDurationMs) ? args.maxDurationMs : DEFAULT_MAX_DURATION_MS$1;
+	const deadline = started + Math.min(Math.max(1, requestedDuration), MAX_DURATION_MS$1);
 	const discovered = discoverWorkspace(args.target);
 	const targetAbs = resolve(args.target);
 	const scanRoot = discovered && discovered.root !== targetAbs && targetAbs.startsWith(discovered.root + sep) ? {
@@ -18042,8 +17965,7 @@ async function runScanInProject(args, hooks = {}) {
 	resetTsMorphProject();
 	return result;
 }
-//#endregion
-//#region src/commands/help.ts
+// src/commands/help.ts
 /** Ordered registry — grouped by the same categories the overview uses. */
 const HELP_ENTRIES = [
 	{
@@ -18482,8 +18404,7 @@ function renderRootHelp(schemaVersion = 1, options = {}) {
 	lines.push(`Docs: ${DOCS_URL}   (JSON schemaVersion ${schemaVersion}, additive-only)`);
 	return lines.join("\n");
 }
-//#endregion
-//#region src/integrations/sentry.ts
+// src/integrations/sentry.ts
 /**
 * Sentry crash reporting — opt-in, and inert unless a DSN is configured.
 *
@@ -18609,8 +18530,7 @@ async function flushSentry(timeoutMs = FLUSH_TIMEOUT_MS) {
 		return false;
 	}
 }
-//#endregion
-//#region src/integrations/ci-install.ts
+// src/integrations/ci-install.ts
 /**
 * CI integration (Sprint-Plan W7): generates .github/workflows/mjolnir.yml
 * from internal templates ONLY — no user-input interpolation (R3 supply-chain).
@@ -18697,10 +18617,12 @@ function publishedVersionForInstall(startDir = import.meta.dirname) {
 	return ENGINE_VERSION;
 }
 /**
-* Template v2 (Terminal + CI UX Overhaul plan, M4): the summary step
-* calls `mjolnir --format github-summary mjolnir.json` — annotations +
-* step summary via
-* ONE emitter — instead of the v1 inline SUMMARY_SCRIPT. The gate
+* Template v3: the reporting steps render the saved report with
+* `mjolnir mjolnir.json --format github-summary` (annotations + step summary
+* via ONE emitter) and `--format pr-comment`. Template v2, generated through
+* 6.0.0, called `summary` and `pr-comment --from`, the verbs those formats
+* replaced, so its reporting steps exited 10 and, being `continue-on-error`,
+* did so silently: no annotations and no comment, on every run. The gate
 * script is unchanged (reads `partial`, `findings[].severity`).
 */
 /** Renders findings into `$GITHUB_STEP_SUMMARY`; tolerates a missing scan result.
@@ -18725,12 +18647,52 @@ const SUMMARY_SCRIPT_V1 = [
 	"}",
 	"process.stdout.write(lines.length + \" finding(s)\\n\");"
 ].join("\n");
-/** True when a workflow was generated by any Mjölnir template (v1 or v2).
+/** True when a workflow was generated by any Mjölnir template (v1, v2 or v3).
+*
+* The comparison runs on the canonical form, so a workflow generated by an
+* earlier release still matches. It used to be byte equality with the current
+* template, and the pinned package version alone made every file from the
+* previous release read as hand-customised: an upgrade needed `--force`, the
+* one flag that also overwrites real customisations.
+*
 * The v1 needle is matched in its INDENTED form: the v1 template embedded
 * the script via indentBlock(…, 10) inside the `run: |` scalar, so the
 * raw unindented substring never appears in a real v1 file. */
 function isKnownTemplate(content) {
-	return GATES.some((g) => content === TEMPLATE(g)) || GATES.some((g) => content === ACTION_TEMPLATE(g)) || content.includes(indentBlock(SUMMARY_SCRIPT_V1, 10));
+	const file = canonicalWorkflow(content);
+	return GATES.some((g) => {
+		const npx = canonicalWorkflow(TEMPLATE(g));
+		const action = canonicalWorkflow(ACTION_TEMPLATE(g));
+		return file === npx || file === templateV2(npx) || file === action || file === actionTemplateWithoutVersion(action);
+	}) || file.includes(indentBlock(SUMMARY_SCRIPT_V1, 10));
+}
+/**
+* A generated workflow with the parts that legitimately change between
+* releases blanked: line endings, the pinned package version (in the npx
+* tarball and in the Action's `version:` input) and every pinned action SHA
+* with its version comment. Dependabot moves the `actions/*` pins between
+* releases, so blanking only the Mjölnir Action's SHA made each of those bumps
+* turn every workflow the previous release generated into one that reads as
+* hand-customised.
+*/
+function canonicalWorkflow(text) {
+	return text.replace(/\r\n/g, "\n").replace(/mjolnir-qa-[0-9A-Za-z.+-]+?\.tgz/g, "mjolnir-qa-<version>.tgz").replace(/(\n {10}version: )"[^"\n]*"/g, "$1\"<version>\"").replace(/(uses: [^\s@]+)@[0-9a-f]{40}[^\n]*/g, "$1@<sha>");
+}
+/**
+* The action template through 6.0.0, which passed no `version:` and so ran
+* whatever its pinned Action defaulted to.
+*/
+function actionTemplateWithoutVersion(canonical) {
+	return canonical.replace("\n          version: \"<version>\"", "");
+}
+/**
+* Template v2, the npx template through 6.0.0, rebuilt from v3: the same file
+* with its two reporting steps calling the verbs the formats replaced. A v2
+* workflow is recognised because it is broken, so `ci install` has to be able
+* to replace it without `--force`.
+*/
+function templateV2(v3) {
+	return v3.replace(".tgz mjolnir.json --format github-summary\n", ".tgz summary mjolnir.json\n").replace(".tgz mjolnir.json --format pr-comment > mjolnir-comment.md\n", ".tgz pr-comment --from mjolnir.json > mjolnir-comment.md\n");
 }
 /** Indents an embedded script so it sits inside a YAML `run: |` block scalar. */
 function indentBlock(text, spaces) {
@@ -18773,12 +18735,12 @@ jobs:
       - name: Annotations + Job Summary
         if: always()
         continue-on-error: true
-        run: npx --yes https://registry.npmjs.org/mjolnir-qa/-/mjolnir-qa-${INSTALL_VERSION}.tgz summary mjolnir.json
+        run: npx --yes https://registry.npmjs.org/mjolnir-qa/-/mjolnir-qa-${INSTALL_VERSION}.tgz mjolnir.json --format github-summary
       - name: Render PR comment
         if: always()
         continue-on-error: true
-        run: npx --yes https://registry.npmjs.org/mjolnir-qa/-/mjolnir-qa-${INSTALL_VERSION}.tgz pr-comment --from mjolnir.json > mjolnir-comment.md
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        run: npx --yes https://registry.npmjs.org/mjolnir-qa/-/mjolnir-qa-${INSTALL_VERSION}.tgz mjolnir.json --format pr-comment > mjolnir-comment.md
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: mjolnir-report
@@ -18803,7 +18765,7 @@ ${indentBlock(gateScript(gate), 10)}
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: mjolnir-report
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -18846,12 +18808,22 @@ const GATES = [
 	"warning"
 ];
 /**
-* The action-ref the action-based template pins (P1: distribution).
-* The current `v3` major is maintained on every stable release by the
-* dedicated Action tag workflow. The generated workflow pins an immutable
-* Action SHA, never @latest.
+* The Action the action-based template pins: a commit on `main`, by SHA,
+* because a generated workflow must never resolve a mutable ref.
+*
+* It is the merge commit of #740, the first commit on `main` whose
+* `action.yml` renders the saved report with `--format pr-comment` and
+* `--format github-summary`. The pin it replaced, 4a588bc, was a pull-request
+* branch commit that `main` never contained: its `action.yml` installed
+* `mjolnir-qa@latest` and called the retired `trust-report` verb, and every
+* workflow `ci install` generated ran it. A pin can only name a commit that
+* already exists, so it moves in the change AFTER the Action it points at.
+*
+* The template passes `version:` because the Action's own default is the
+* published stable AT THIS COMMIT, which may be an older CLI than the one that
+* generated the workflow.
 */
-const ACTION_REF = "Sergey-Bar/Mjolnir@4a588bc62d517bc85fc44c0eae64c6587d3bf70b";
+const ACTION_REF = "Sergey-Bar/Mjolnir@6bf46a0e64e2f3ee16266d8456d1b16e5ae16214";
 /**
 * The action-based workflow for one gate level (P1.3): the root
 * action.yml does checkout-independent scanning — setup-node, the scan
@@ -18874,8 +18846,11 @@ const ACTION_REF = "Sergey-Bar/Mjolnir@4a588bc62d517bc85fc44c0eae64c6587d3bf70b"
 *     finish is not a pass — see the exit-code contract in docs/VERSIONING.md.
 *  3. `version:` was pinned to the engine's working version, which while the
 *     candidate is a release candidate is not on npm, so the generated
-*     workflow could not install what it asked for. The input is omitted now
-*     and the Action's own default (the published stable) applies.
+*     workflow could not install what it asked for. It was then omitted,
+*     which handed the choice to the pinned Action's default, the stable that
+*     was published when that commit was made. It now names the published
+*     version the installing package resolves, the same pin the npx template
+*     uses.
 */
 const ACTION_TEMPLATE = (gate) => `name: Mjölnir
 
@@ -18905,13 +18880,14 @@ jobs:
         continue-on-error: true
         uses: ${ACTION_REF}
         with:
+          version: "${INSTALL_VERSION}"
           scope: changed
           format: json
           fail-on: ${gate === "advisory" ? "none" : gate}
           pr-comment: "false"
           trust-artifact: "false"
           annotations: "true"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: mjolnir-report
@@ -18942,7 +18918,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: mjolnir-report
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -19015,8 +18991,7 @@ function ciInstall(root, gate, options = {}) {
 		diffSummary: []
 	};
 }
-//#endregion
-//#region src/cli-io.ts
+// src/cli-io.ts
 const out = (...parts) => console.log(parts.map(String).join(" "));
 const err = (...parts) => console.error(parts.map(String).join(" "));
 function internalErrorMessage(err, emit, debug) {
@@ -19185,8 +19160,7 @@ function buildMachineContract(result) {
 		...result.forensicVerdicts !== void 0 ? { forensicVerdicts: result.forensicVerdicts } : {}
 	};
 }
-//#endregion
-//#region src/commands/fixture-example.ts
+// src/commands/fixture-example.ts
 /**
 * Shared example-fixture selection for `mjolnir explain` (explain.ts)
 * and the generated rule docs (rule-docs.ts) — one chooser so both
@@ -19204,8 +19178,7 @@ function firstFixtureFile(dir) {
 	const entries = readdirSync(dir).filter((f) => !f.startsWith(".")).sort();
 	return entries.length > 0 ? join(dir, entries[0]) : null;
 }
-//#endregion
-//#region src/commands/explain.ts
+// src/commands/explain.ts
 /**
 * `mjolnir explain <RULE-ID>` — implements Plan.md Sprint 1.3
 * (Master-Stabilization-Plan Sprint 5, Task 19).
@@ -19546,8 +19519,7 @@ function renderVerdictExplain(result, width = DEFAULT_EXPLAIN_WIDTH) {
 function pctOf(v) {
 	return `${Math.round(v * 100)}%`;
 }
-//#endregion
-//#region src/engine/resolution.ts
+// src/engine/resolution.ts
 /** Correlation identity (v1-compatible): ruleId\0file\0message. */
 const fingerprint$1 = findingFingerprint;
 /**
@@ -19612,8 +19584,7 @@ function resolve$1(input) {
 		comparedAgainst
 	};
 }
-//#endregion
-//#region src/commands/baseline.ts
+// src/commands/baseline.ts
 /**
 * A shared finding-set READER. Neither verb it used to serve survives the v6 CLI collapse (plan §3): `baseline` and `diff` are both retired, and the capability they shared is now `mjolnir scan --scope changed`.
 * (Master-Stabilization-Plan.md).
@@ -19767,8 +19738,7 @@ function renderBaselineSaved(path, count, replaced) {
 	lines.push(nextStep("mjolnir scan --scope changed", ui$8) + " — see only what's new.");
 	return lines.join("\n");
 }
-//#endregion
-//#region src/commands/verify.ts
+// src/commands/verify.ts
 /**
 * `mjolnir ci verify` — the agent-loop digest (product-gap-remediation
 * master plan P7, plan 1788853205786 — flag agent, decision 6).
@@ -19875,8 +19845,7 @@ function renderVerifyDigest(digest) {
 	}
 	return lines.join("\n").trimEnd();
 }
-//#endregion
-//#region src/forensics/triage.ts
+// src/forensics/triage.ts
 const ui$7 = plainContext();
 const QUARANTINE_MIN_ATTEMPTS = 2;
 /** Deterministic triage table rows, worst first. */
@@ -20023,8 +19992,7 @@ function renderTriageWorkflowJson(report) {
 		rows: workflowRows(report)
 	}, null, 2) + "\n";
 }
-//#endregion
-//#region src/commands/pw-report.ts
+// src/commands/pw-report.ts
 const ui$6 = plainContext();
 function summarizePwRun(report) {
 	const slowest = [...report.verdicts].sort((a, b) => b.totalDurationMs - a.totalDurationMs).slice(0, 5).map((v) => ({
@@ -20058,8 +20026,7 @@ function renderPwRunSummary(s) {
 	}
 	return lines.join("\n");
 }
-//#endregion
-//#region src/mcp/server.ts
+// src/mcp/server.ts
 /**
 * MCP stdio transport (blueprint §21 — Phase 4, PURE TRANSPORT).
 *
@@ -20077,22 +20044,38 @@ function renderPwRunSummary(s) {
 * - parameter size caps; ONE scan in flight (serialized queue) reusing
 *   the pipeline's own budgets; zero network (no fetches anywhere); no
 *   shell execution beyond Mjölnir's own verbs.
-* - filesystem boundary = scan target + `.mjolnir/` (same as CLI).
+* - filesystem boundary: the tools are read-only, and with no further
+*   configuration they accept any path the parent process passes (the
+*   parent is the trust boundary). `MJOLNIR_WORKSPACE_ROOT` confines every
+*   path argument to that directory, symlinks resolved.
 * - the plugin trust gate applies unchanged (--enable-plugins is NOT
 *   exposed over MCP: tools run with the gate CLOSED unless the server
 *   was started with MJOLNIR_ENABLE_PLUGINS=1 in its own environment).
 */
 /** Hard caps (§21 threat model: parameter size + resource bounds). */
 const MAX_PARAM_BYTES = 65536;
-const MAX_DURATION_MS$1 = 36e5;
-const DEFAULT_MAX_DURATION_MS$1 = 6e5;
 const PROTOCOL_VERSION = "2025-06-18";
-const CONFIGURED_ROOT = process.env.MJOLNIR_WORKSPACE_ROOT ? resolve(process.env.MJOLNIR_WORKSPACE_ROOT) : null;
+/** The real path of `p`, or its lexical resolution when it does not exist. */
+function realOrResolved(p) {
+	try {
+		return realpathSync.native(resolve(p));
+	} catch {
+		return resolve(p);
+	}
+}
+/**
+* The optional workspace root. When set, every path argument must resolve
+* INSIDE it after symlinks are followed.
+*
+* Unset is open by design and is documented that way in the header: the MCP
+* tools are read-only and the stdio parent is the trust boundary. Setting
+* `MJOLNIR_WORKSPACE_ROOT` is how a host confines them.
+*/
+const CONFIGURED_ROOT = process.env.MJOLNIR_WORKSPACE_ROOT ? realOrResolved(process.env.MJOLNIR_WORKSPACE_ROOT) : null;
 function isPathAllowed(path) {
 	if (!CONFIGURED_ROOT) return true;
-	const candidate = resolve(path);
-	const rel = relative(CONFIGURED_ROOT, candidate);
-	return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+	const rel = relative(CONFIGURED_ROOT, realOrResolved(path));
+	return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
 }
 /** JSON-RPC error codes (subset used here). */
 const MCP_ERRORS = {
@@ -20134,7 +20117,7 @@ const MCP_TOOLS = [
 				},
 				fixturesRoot: {
 					type: "string",
-					description: "Root directory for fixture lookups (defaults to cwd)."
+					description: "Root directory for fixture lookups (defaults to <cwd>/tests/fixtures, as for `mjolnir explain`)."
 				}
 			},
 			required: ["ruleId"]
@@ -20214,7 +20197,7 @@ function validateParams(name, args) {
 		if (typeof args["path"] !== "string" || args["path"].length === 0) return "scan requires a non-empty string `path`";
 		if (args["maxDurationMs"] !== void 0) {
 			const duration = args["maxDurationMs"];
-			if (typeof duration !== "number" || !Number.isFinite(duration) || duration <= 0 || duration > MAX_DURATION_MS$1) return "`maxDurationMs` must be a finite positive number within the server budget";
+			if (typeof duration !== "number" || !Number.isFinite(duration) || duration <= 0 || duration > 36e5) return "`maxDurationMs` must be a finite positive number within the server budget";
 		}
 	}
 	if (name === "explain") {
@@ -20318,7 +20301,7 @@ async function handleToolCall(call) {
 					message: "fixturesRoot must be a string"
 				}
 			};
-			const explanation = explainRule(ruleId, (typeof rawFixturesRoot === "string" ? rawFixturesRoot : void 0) ?? process.cwd());
+			const explanation = explainRule(ruleId, (typeof rawFixturesRoot === "string" ? rawFixturesRoot : void 0) ?? join(process.cwd(), "tests", "fixtures"));
 			if (!explanation.ok) return {
 				jsonrpc: "2.0",
 				id: call.id,
@@ -20569,8 +20552,7 @@ async function handleMcpMessage(msg) {
 		}
 	};
 }
-//#endregion
-//#region src/mcp/transport.ts
+// src/mcp/transport.ts
 /**
 * MCP stdio transport loop (blueprint §21 — the framing around the
 * pure-transport server).
@@ -20667,8 +20649,7 @@ async function handleStdioLine(line, write) {
 	}
 	write(`${JSON.stringify(response)}\n`);
 }
-//#endregion
-//#region src/scorer/prioritize.ts
+// src/scorer/prioritize.ts
 /**
 * "Fix this first" prioritization (Master-Stabilization-Plan Sprint 5,
 * Task 20).
@@ -20718,8 +20699,7 @@ function prioritize(findings) {
 function topFixes(findings, n = 3) {
 	return prioritize(findings).filter((p) => p.scoreGain > 0).slice(0, n);
 }
-//#endregion
-//#region src/reporter/art.ts
+// src/reporter/art.ts
 /**
 * ASCII art assets for the Mjölnir terminal experience.
 * Minimal Nordic / engineering aesthetic — professional, not fantasy.
@@ -20756,8 +20736,7 @@ const TROPHY = String.raw`
 "─".repeat(58);
 /** Wordmark for the 100-state celebration block. */
 const FORGED_WORDMARK = "⚡ F O R G E D ⚡";
-//#endregion
-//#region src/reporter/tone-blunt.ts
+// src/reporter/tone-blunt.ts
 /**
 * Static blunt messages keyed by rule ID. A simple string lookup
 * (no per-entry closures) so coverage is not artificially fragmented
@@ -20829,8 +20808,7 @@ function bluntMessage(f) {
 	if (msg !== void 0) return msg;
 	return `${f.message} — fix it or suppress it; ignoring it is worse than either.`;
 }
-//#endregion
-//#region src/reporter/terminal.ts
+// src/reporter/terminal.ts
 /** Non-verbose finding cards shown before the overflow line. The
 * JSON/SARIF contract always carries ALL findings — this cap is a
 * terminal display concern only. */
@@ -21312,8 +21290,7 @@ function countBySeverity(result) {
 	}
 	return counts;
 }
-//#endregion
-//#region src/engine/trust-classification.ts
+// src/engine/trust-classification.ts
 /**
 * Completeness, decided once.
 *
@@ -21419,8 +21396,7 @@ function classifyTrust(result, summary) {
 		gaps
 	};
 }
-//#endregion
-//#region src/lib/format.ts
+// src/lib/format.ts
 /**
 * Shared formatting utilities. Single definition site for `pct()` (Task 20)
 * — the two callers (commands/trust-report.ts, reporter/trust-report.ts)
@@ -21429,8 +21405,7 @@ function classifyTrust(result, summary) {
 function pct$1(v) {
 	return `${Math.round(v * 100)}%`;
 }
-//#endregion
-//#region src/reporter/trust-report.ts
+// src/reporter/trust-report.ts
 /** The one label rule, so no renderer grows a second opinion. */
 function gateLabel(f, gate) {
 	return isAtGate(f, gate, isAdvisoryFinding) ? "GATE" : "WARN";
@@ -21571,8 +21546,7 @@ function renderTrustReport(result, opts) {
 	lines.push("");
 	return lines.join("\n");
 }
-//#endregion
-//#region src/reporter/sarif.ts
+// src/reporter/sarif.ts
 /**
 * SARIF fingerprint values must be printable and stable. The engine's identity
 * strings join their parts with NUL (a separator no repository path or message
@@ -21684,6 +21658,10 @@ function renderSarif(result, repoRootUri) {
 			}
 		}))
 	};
+	const srcRoot = (uri) => {
+		const encoded = uri.replaceAll("\\", "/").split("/").map((seg) => seg === "" ? "" : encodeURI(seg).replaceAll("%25", "%").replaceAll("#", "%23").replaceAll("?", "%3F")).join("/");
+		return encoded.endsWith("/") ? encoded : `${encoded}/`;
+	};
 	const sarif = {
 		$schema: "https://json.schemastore.org/sarif-2.1.0.json",
 		version: [
@@ -21693,13 +21671,12 @@ function renderSarif(result, repoRootUri) {
 		].join("."),
 		runs: [repoRootUri ? {
 			...run,
-			originalUriBaseIds: { SRCROOT: { uri: repoRootUri.replaceAll("\\", "/").split("/").map((seg) => seg === "" ? "" : encodeURI(seg).replaceAll("%25", "%").replaceAll("#", "%23").replaceAll("?", "%3F")).join("/") } }
+			originalUriBaseIds: { SRCROOT: { uri: srcRoot(repoRootUri) } }
 		} : run]
 	};
 	return JSON.stringify(sarif, null, 2);
 }
-//#endregion
-//#region src/reporter/codequality.ts
+// src/reporter/codequality.ts
 function codeQualitySeverity(severity) {
 	if (severity === "error") return "major";
 	if (severity === "warning") return "minor";
@@ -21718,8 +21695,7 @@ function renderCodeQuality(result) {
 	}));
 	return JSON.stringify(issues, null, 2) + "\n";
 }
-//#endregion
-//#region src/reporter/mermaid.ts
+// src/reporter/mermaid.ts
 /**
 * `--format mermaid` — test-architecture diagram (Sprint 9 Task 38,
 * Master-Stabilization-Plan.md). Ranked first among the delight
@@ -21818,8 +21794,7 @@ function renderMermaid(result) {
 	for (const { id, cls } of styleAssignments) lines.push(`  class ${id} ${cls};`);
 	return lines.join("\n");
 }
-//#endregion
-//#region src/reporter/progress.ts
+// src/reporter/progress.ts
 /**
 * Live scan progress (Terminal + CI UX Overhaul plan, M3).
 *
@@ -21918,8 +21893,7 @@ var ProgressRenderer = class {
 		this.erase();
 	}
 };
-//#endregion
-//#region src/lib/git-utils.ts
+// src/lib/git-utils.ts
 /**
 * Shared git utilities (Task 18). The `currentCommit` / `targetCommit`
 * pattern was duplicated between cli.ts and commands/trust-report.ts.
@@ -21952,8 +21926,7 @@ function currentCommit(root, opts = {}) {
 		return opts.nullable ? null : "unknown";
 	}
 }
-//#endregion
-//#region src/commands/report-io.ts
+// src/commands/report-io.ts
 /**
 * Shared saved-report loading (agent-handoff plan §9.0).
 *
@@ -22146,8 +22119,7 @@ function loadSavedReport(reportPath) {
 function reportExists(reportPath) {
 	return existsSync(reportPath);
 }
-//#endregion
-//#region src/commands/trust-report.ts
+// src/commands/trust-report.ts
 function buildArtifactIdentity(result, commit) {
 	const revisions = /* @__PURE__ */ new Map();
 	const levels = /* @__PURE__ */ new Map();
@@ -22173,8 +22145,7 @@ function buildArtifactIdentity(result, commit) {
 		}
 	};
 }
-//#endregion
-//#region src/reporter/pr-report-actions.ts
+// src/reporter/pr-report-actions.ts
 /** GitHub-native actions. Social drafts contain only public project information. */
 const PROJECT_URL = "https://github.com/Sergey-Bar/Mjolnir";
 const SHARE_URL = "https://sergey-bar.github.io/Mjolnir/";
@@ -22293,8 +22264,7 @@ const PR_BRAND_CONTRACT = {
 	terminology: "trust-engine",
 	footerFormat: "scanId + generatedBy"
 };
-//#endregion
-//#region src/reporter/pr-report-shared.ts
+// src/reporter/pr-report-shared.ts
 const UNIFIED_MARKER = "<!-- mjolnir-report:v2 -->";
 /**
 * The one place a comment asset URL is written down.
@@ -22321,6 +22291,24 @@ const MAX_FINDINGS_PER_GROUP = 25;
 function escMd(s) {
 	return sanitizeData(s).replace(/([\\`*_{}[\]()#+!|<>])/g, "\\$1");
 }
+/**
+* A Markdown code span for untrusted text.
+*
+* Backslash escapes are literal inside a code span, so `escMd` there rendered
+* `__snapshots__` as `\_\_snapshots\_\_` and `app/(auth)` as `app/\(auth\)`.
+* A span cannot be broken out of with formatting characters, only with a
+* backtick run, so it is fenced with one backtick more than the longest run
+* inside (CommonMark 6.1) and padded where the text would otherwise touch the
+* fence. Kept to one line, because a newline would end the list item.
+*/
+function mdCodeSpan(raw) {
+	const text = sanitizeData(raw).replace(/[\r\n]+/g, " ");
+	if (text.trim() === "") return "` `";
+	const longest = Math.max(0, ...[...text.matchAll(/`+/g)].map((m) => m[0].length));
+	const fence = "`".repeat(longest + 1);
+	const pad = text.startsWith("`") || text.endsWith("`") || text.startsWith(" ") && text.endsWith(" ") ? " " : "";
+	return `${fence}${pad}${text}${pad}${fence}`;
+}
 function looksLikeCode(s) {
 	return /[(;={]|await |expect\(/.test(s);
 }
@@ -22335,10 +22323,8 @@ function evidenceTagLine(f) {
 }
 function findingLineMd(f) {
 	const icon = f.severity === "error" ? "🔴" : f.severity === "warning" ? "🟡" : "🔵";
-	const fix = escMd(f.fix);
-	const fixBody = looksLikeCode(f.fix) ? `\`${fix}\`` : `_${fix}_`;
-	const safePath = escMd(f.file).replace(/[\r\n]+/g, " ");
-	return `${icon} **${escMd(f.ruleId)}** \`${safePath}:${f.line}\` — ${escMd(f.message)} ${escMd(`[${evidenceTagLine(f)}]`)}\n  Fix: ${fixBody}`;
+	const fixBody = looksLikeCode(f.fix) ? mdCodeSpan(f.fix) : `_${escMd(f.fix)}_`;
+	return `${icon} **${escMd(f.ruleId)}** ${mdCodeSpan(`${f.file}:${f.line}`)} — ${escMd(f.message)} ${escMd(`[${evidenceTagLine(f)}]`)}\n  Fix: ${fixBody}`;
 }
 /**
 * Reader-facing sentences for the `analysisStatus.reasons` tokens.
@@ -22369,7 +22355,8 @@ const REASON_PHRASES = [
 	["runtime-incomplete", "the runtime evidence set is incomplete"],
 	["identity-incomplete", "the run could not be bound to the tree it analysed"],
 	["degraded:", "capability was lost to a swallowed error"],
-	["truncated:", "the scan was cut short"]
+	["truncated:", "the scan was cut short"],
+	["coverage:quarantine:", "quarantine-tier rule(s) withheld, as in every default scan (`--include-warn` runs them)"]
 ];
 /**
 * `scope-ignored:1` -> "1 path was ignored by the scope filter".
@@ -22516,7 +22503,9 @@ function renderUnifiedReport(result, options = {}) {
 		provisionalRuleIds: [],
 		ceilingReasons: []
 	};
-	const incomplete = isIncompleteResult(result) || !result.trustSummary || summary.level === "L0" && summary.evidenceCoverage === 0;
+	const analysisIncomplete = isIncompleteResult(result) || !result.trustSummary;
+	const noEvidence = summary.level === "L0" && summary.evidenceCoverage === 0;
+	const incomplete = analysisIncomplete || noEvidence;
 	lines.push(`## <img width="16" height="16" alt="" src="${MARK_URL}"/> Mjölnir Verification Report`);
 	lines.push("");
 	lines.push("> Tests tell you what passed. Mjölnir tells you what you can trust.");
@@ -22527,8 +22516,9 @@ function renderUnifiedReport(result, options = {}) {
 	}
 	if (incomplete) {
 		const reasons = result.analysisStatus?.reasons ?? [];
+		const explained = [...reasons.length > 0 ? [humanizeReasons(reasons)] : [], ...!analysisIncomplete && noEvidence ? ["no runtime evidence corroborates this run, so an empty result is an observation, not a verdict"] : []];
 		lines.push(`> [!WARNING]
-> **Analysis status: INCOMPLETE.** ${reasons.length > 0 ? humanizeReasons(reasons) : "The scan did not complete a trustworthy analysis."}`);
+> **Analysis status: INCOMPLETE.** ${explained.length > 0 ? explained.join("; ") : "The scan did not complete a trustworthy analysis."}`);
 		lines.push("");
 	}
 	const diff = options.diff;
@@ -22698,8 +22688,7 @@ function enforceCommentLimit(lines) {
 	}
 	return render() + notice;
 }
-//#endregion
-//#region src/commands/pr-comment.ts
+// src/commands/pr-comment.ts
 /**
 * Escape markdown-significant characters (markdown spec).
 * Kept exported for downstream consumer compatibility.
@@ -22721,8 +22710,7 @@ function renderPrComment(result, options = {}) {
 		...options.commit !== void 0 ? { commit: options.commit } : {}
 	});
 }
-//#endregion
-//#region src/commands/why.ts
+// src/commands/why.ts
 /**
 * `mjolnir explain <file:line> <file>:<line>` — occurrence-level evidence/explanation
 * query (agent-handoff plan M2).
@@ -22894,8 +22882,7 @@ async function runWhyCommand(argv, io = {
 	}));
 	return filtered.length > 0 ? 0 : 1;
 }
-//#endregion
-//#region src/commands/handover.ts
+// src/commands/handover.ts
 const ui$5 = plainContext();
 const FAKE_GREEN_RULES = /* @__PURE__ */ new Set([
 	"QA-TEST-003",
@@ -22983,8 +22970,7 @@ function renderHandover(map) {
 	lines.push("Generated by mjolnir explain --plan — re-run after big refactors.");
 	return lines.join("\n");
 }
-//#endregion
-//#region src/commands/stats.ts
+// src/commands/stats.ts
 /**
 * `mjolnir stats` — Sprint 6 Task 26 (Master-Stabilization-Plan.md).
 *
@@ -23104,14 +23090,72 @@ function renderStats(stats) {
 	lines.push("different machine — this file is local-only, by design.");
 	return lines.join("\n");
 }
-//#endregion
-//#region src/reporter/github.ts
+// src/reporter/github.ts
+/** Escape a workflow-command PROPERTY value. */
+function escapeAnnotationProperty(value) {
+	return value.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A").replaceAll(":", "%3A").replaceAll(",", "%2C");
+}
+/** Escape a workflow-command MESSAGE. */
+function escapeAnnotationMessage(value) {
+	return value.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
+}
 /** ANSI-injection guard for the summary path (belt + braces). */
 function stripAnsiForSummary(value) {
 	return value.replace(/\x1b\[[0-9;:?]*[ -/]*[@-~]/g, "");
 }
-//#endregion
-//#region src/commands/summary.ts
+const SEVERITY_TO_COMMAND = {
+	error: "error",
+	warning: "warning",
+	info: "notice"
+};
+/** Render ONE workflow-command annotation line (no trailing newline). */
+function renderAnnotation(a) {
+	const props = [`file=${escapeAnnotationProperty(a.file)}`, `line=${Math.max(1, a.line ?? 1)}`];
+	if (a.column !== void 0) props.push(`column=${Math.max(1, a.column)}`);
+	props.push(`title=${escapeAnnotationProperty(a.title)}`);
+	return `::${SEVERITY_TO_COMMAND[a.severity]} ${props.join(",")}::${escapeAnnotationMessage(a.message)}`;
+}
+/** Render annotations for every finding in a report's findings array. */
+function renderAnnotations(findings) {
+	return findings.map((f) => {
+		return renderAnnotation({
+			severity: f.severity === "error" || f.severity === "warning" ? f.severity : "info",
+			file: f.file,
+			line: f.line,
+			column: f.column,
+			title: f.ruleId,
+			message: f.message
+		});
+	});
+}
+/** GitHub caps annotation messages — keep the head, point at the summary. */
+function truncateMessage(message, max = 250) {
+	if (message.length <= max) return message;
+	return `${message.slice(0, max)}… (full text in the step summary)`;
+}
+// src/commands/summary.ts
+/**
+* the `--format github-summary` render — CI annotations + step summary
+* (Terminal + CI UX Overhaul plan, M4).
+*
+* Additive command; default report path `mjolnir.json`. Reads a saved
+* ScanResult JSON (the `--json` scan output) and emits:
+*  1. GitHub annotations to stdout, only when GITHUB_ACTIONS=true —
+*     one per finding, via the single github.ts emitter.
+*  2. A step-summary markdown document to $GITHUB_STEP_SUMMARY when
+*     set (else stdout; --stdout forces stdout): score + band, text
+*     score bar, dimensions table, top deductions, collapsible
+*     per-severity details with fix lines, and an honesty notice for
+*     partial/no-score reports.
+*
+* Exit codes (frozen contract): 0 on success — this command NEVER
+* blocks; the gate step decides. 10 missing file argument. 2
+* unreadable/invalid JSON (a data problem; the message explains).
+*
+* Paths: findings are scan-target-relative. The generated workflow
+* scans the repo root, so the default output is directly usable;
+* `--path-prefix <dir>` re-scopes for subdirectory scans.
+*/
 const DETAILS_PER_SEVERITY_CAP = 25;
 /**
 * The score bar. BW-105: the canonical gauge with the inert palette — the
@@ -23188,7 +23232,7 @@ function renderStepSummary(result, options = {}) {
 		lines.push(`<details${open}>`, `<summary>${icons[sev]} ${list.length} ${sev}${list.length === 1 ? "" : "s"}</summary>`, "");
 		for (const f of list.slice(0, DETAILS_PER_SEVERITY_CAP)) {
 			const path = options.pathPrefix ? `${options.pathPrefix.replace(/\/$/, "")}/${f.file}` : f.file;
-			lines.push(`- **${escapeMarkdown(f.ruleId)}** \`${escapeMarkdown(path)}:${f.line}\` — ${escapeMarkdown(stripAnsiForSummary(f.message))}`);
+			lines.push(`- **${escapeMarkdown(f.ruleId)}** ${mdCodeSpan(`${path}:${f.line}`)} — ${escapeMarkdown(stripAnsiForSummary(f.message))}`);
 			lines.push(`  - Fix: ${escapeMarkdown(stripAnsiForSummary(f.fix))}`);
 		}
 		if (list.length > DETAILS_PER_SEVERITY_CAP) lines.push(`- … and ${list.length - DETAILS_PER_SEVERITY_CAP} more — see the full JSON artifact.`);
@@ -23205,8 +23249,92 @@ function renderStepSummary(result, options = {}) {
 	lines.push("<!-- mjolnir-honesty: scores derive from rules with published evidence levels and measured false-positive rates where available. -->");
 	return lines.join("\n");
 }
-//#endregion
-//#region src/commands/milestone-args.ts
+/** Render one finding as an escaped annotation line. Fields are
+* sanitized with the same sanitizeData layer the terminal uses
+* (github.ts's escapers cover %/CR/LF, not OSC/C0), then %/CR/LF-escaped. */
+function annotationForFinding(f) {
+	return renderAnnotations([{
+		...f,
+		file: sanitizeData(f.file),
+		ruleId: sanitizeData(f.ruleId),
+		message: truncateMessage(stripAnsiForSummary(sanitizeData(f.message)))
+	}])[0];
+}
+const KNOWN_SUMMARY_FLAGS = /* @__PURE__ */ new Set([
+	"--stdout",
+	"--path-prefix",
+	"--help",
+	"-h"
+]);
+/**
+* Testable summary command core. Returns the process exit code.
+* Streams: annotations → stdout (always; GitHub greps them), summary →
+* step-summary file when set unless --stdout. Unknown flags are a
+* usage error (exit 10) — a typo'd --stdout must not silently route
+* the summary to $GITHUB_STEP_SUMMARY.
+*/
+function runSummaryCommand(argv, io = {
+	out: (line) => console.log(line),
+	err: (line) => console.error(line)
+}) {
+	for (let i = 0; i < argv.length; i++) {
+		const a = argv[i] ?? "";
+		if (!a.startsWith("-")) continue;
+		if (a === "--path-prefix") {
+			const val = argv[i + 1];
+			if (val === void 0 || val.startsWith("-")) {
+				io.err(usageErrorMessage({
+					flag: "--path-prefix",
+					token: val
+				}));
+				return 10;
+			}
+			i++;
+			continue;
+		}
+		if (KNOWN_SUMMARY_FLAGS.has(a)) continue;
+		io.err(usageErrorMessage({ token: a }));
+		return 10;
+	}
+	const stdout = argv.includes("--stdout");
+	const prefixIdx = argv.indexOf("--path-prefix");
+	const pathPrefix = prefixIdx !== -1 ? argv[prefixIdx + 1] : void 0;
+	const reportPath = argv.filter((a, i) => a !== void 0 && !a.startsWith("-") && (prefixIdx === -1 || i !== prefixIdx + 1))[0] ?? "mjolnir.json";
+	if (!existsSync(reportPath)) {
+		io.err(`mjolnir: report file not found: ${reportPath}`);
+		io.err("  Run the scan with --json first: mjolnir --json > mjolnir.json");
+		return 10;
+	}
+	let result;
+	try {
+		result = loadSavedReport(reportPath);
+	} catch (err) {
+		io.err(`mjolnir: cannot read ${reportPath}: ${errorMessage(err)}`);
+		return 2;
+	}
+	const env = process.env;
+	if (env["GITHUB_ACTIONS"] === "true") for (const f of result.findings) {
+		const file = pathPrefix ? `${pathPrefix.replace(/\/$/, "")}/${f.file}` : f.file;
+		io.out(annotationForFinding({
+			...f,
+			file
+		}));
+	}
+	const summary = renderStepSummary(result, {
+		stdout,
+		...pathPrefix !== void 0 ? { pathPrefix } : {}
+	});
+	const stepSummaryPath = stdout ? void 0 : env["GITHUB_STEP_SUMMARY"];
+	if (stepSummaryPath) try {
+		appendFileSync(stepSummaryPath, `${summary}\n`);
+	} catch (err) {
+		io.err(`mjolnir: could not write $GITHUB_STEP_SUMMARY (${errorMessage(err)}); printing to stdout instead.`);
+		io.out(summary);
+	}
+	else io.out(summary);
+	return 0;
+}
+// src/commands/milestone-args.ts
 /**
 * The argument layer every milestone command shares.
 *
@@ -23358,8 +23486,7 @@ function isWorkflowFile(path) {
 	const normalized = path.replaceAll("\\", "/");
 	return normalized.startsWith(".github/workflows/") || normalized === ".gitlab-ci.yml" || normalized === ".gitlab-ci.yaml" || basename(normalized) === "Jenkinsfile";
 }
-//#endregion
-//#region src/engine/cross-file.ts
+// src/engine/cross-file.ts
 /**
 * Cross-file analysis (Upgrade-Plan-v3 Phase 6, tier-3 item #2).
 *
@@ -23405,8 +23532,7 @@ function findDuplicateTestNames(files) {
 	});
 	return out.sort((a, b) => compareCodePoints(a.name, b.name));
 }
-//#endregion
-//#region src/engine/cross-file-analysis.ts
+// src/engine/cross-file-analysis.ts
 /**
 * Analyze cross-file signals across the scanned test files.
 * Pure function — same input always produces same output.
@@ -23544,8 +23670,7 @@ function renderCrossFileAnalysis(result) {
 	}
 	return lines.join("\n").trimEnd();
 }
-//#endregion
-//#region src/engine/evidence-graph.ts
+// src/engine/evidence-graph.ts
 /**
 * Build a complete evidence graph from a scan result.
 * Pure function — deterministic output for the same input.
@@ -23691,8 +23816,7 @@ function renderEvidenceGraphResult(result) {
 	lines.push(`  ${result.agenticProfile.note}`);
 	return lines.join("\n").trimEnd();
 }
-//#endregion
-//#region src/frameworks/scorecard.ts
+// src/frameworks/scorecard.ts
 const SCORECARD_DIMENSIONS = [
 	"discovery",
 	"astUsage",
@@ -24802,8 +24926,7 @@ const FRAMEWORK_SCORECARDS = [
 	makeScorecard("jenkins", FRAMEWORK_OVERRIDES["jenkins"]),
 	makeScorecard("gitlab-ci", FRAMEWORK_OVERRIDES["gitlab-ci"])
 ];
-//#endregion
-//#region src/engine/framework-maturity.ts
+// src/engine/framework-maturity.ts
 /**
 * M5 — Framework Maturity Tracking for Playwright.
 *
@@ -24892,8 +25015,7 @@ function renderPlaywrightMaturityReport(report) {
 	}
 	return lines.join("\n").trimEnd();
 }
-//#endregion
-//#region src/engine/suppression-integrity.ts
+// src/engine/suppression-integrity.ts
 /**
 * ENGINE-006 — Suppression Integrity: detect suppression abuse,
 * unknown rules, expired entries, and compute a full integrity report.
@@ -24987,8 +25109,7 @@ function computeSuppressionIntegrity(suppressions, findings, knownRuleIds, now =
 		expiredSuppressions: detectExpiredSuppressions(suppressions, now)
 	};
 }
-//#endregion
-//#region src/engine/suppression-governance.ts
+// src/engine/suppression-governance.ts
 /**
 * M6 — Suppression Policy Governance Gate.
 *
@@ -25051,15 +25172,13 @@ function renderSuppressionGovernanceResult(result) {
 	} else lines.push("All suppression policy checks passed.");
 	return lines.join("\n").trimEnd();
 }
-//#endregion
-//#region src/adapters/gitlab-ci.ts
+// src/adapters/gitlab-ci.ts
 function parseGitLabCi(content) {
 	const parsed = parse(content);
 	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("GitLab CI YAML is not a valid object.");
 	return parsed;
 }
-//#endregion
-//#region src/engine/cli-command-names.ts
+// src/engine/cli-command-names.ts
 const CLI_COMMAND_NAMES = [
 	"scan",
 	"policy",
@@ -25079,8 +25198,7 @@ const CLI_COMMAND_NAMES = [
 	"help"
 ];
 const CLI_NON_SCAN_COMMANDS = new Set(CLI_COMMAND_NAMES.filter((command) => command !== "scan"));
-//#endregion
-//#region src/engine/verification-intelligence.ts
+// src/engine/verification-intelligence.ts
 const CI_WORKFLOW_FILES = [
 	".github/workflows/ci.yml",
 	".github/workflows/test.yml",
@@ -25571,8 +25689,7 @@ function renderCIIntegrityReport(report) {
 	}
 	return lines.join("\n").trimEnd();
 }
-//#endregion
-//#region src/commands/milestone.ts
+// src/commands/milestone.ts
 async function runMilestoneScan(args, io, readSources, strict = false) {
 	const target = resolve(args.target);
 	const valid = validateTarget(target, io);
@@ -25804,8 +25921,7 @@ async function runCIIntegrityCommand(argv, io = {
 		return milestoneError(error, io, argv.includes("--debug"));
 	}
 }
-//#endregion
-//#region src/scorer/scoring-policy.ts
+// src/scorer/scoring-policy.ts
 /**
 * `mjolnir scan --policy` — the scoring policy, as the code states it.
 *
@@ -25867,8 +25983,7 @@ function renderScoringPolicy() {
 	lines.push("Every number above is imported from src/scorer/scorer.ts at run time. A", "policy that cannot be read cannot be checked, and an uncheckable policy", "is the thing this product exists to catch.");
 	return lines.join("\n");
 }
-//#endregion
-//#region src/commands/fix.ts
+// src/commands/fix.ts
 /**
 * `mjolnir fix` — Safe Auto-Fix with Proof (Tier 1 #3).
 *
@@ -26292,8 +26407,7 @@ function renderFixReport(results, dryRun) {
 	lines.push(`${parts.join(" · ")}${dryRun ? " (dry-run)" : ""}. Every applied fix was verified against the rule that flagged it.`);
 	return lines.join("\n");
 }
-//#endregion
-//#region src/commands/rules-catalog.ts
+// src/commands/rules-catalog.ts
 /**
 * `mjolnir explain --list` — machine-readable rule catalog with Trust Metadata.
 *
@@ -26510,8 +26624,7 @@ function countCompleteQuads(ruleIds, root = process.cwd()) {
 		total: ruleIds.length
 	};
 }
-//#endregion
-//#region src/frameworks/provider-capability-contract.ts
+// src/frameworks/provider-capability-contract.ts
 const CI_PROVIDER_CAPABILITY_SCHEMA = "m30.ci-provider-capabilities@1";
 const CI_PROVIDER_IDS = [
 	"github-actions",
@@ -26757,8 +26870,7 @@ const CI_PROVIDER_CAPABILITY_RECORDS = [
 	}
 ];
 new Map(CI_PROVIDER_CAPABILITY_RECORDS.map((record) => [record.provider, record]));
-//#endregion
-//#region src/v6/maturity.ts
+// src/v6/maturity.ts
 /**
 * v6 capability maturity ladder — `M0`–`M5` (ADR 0001).
 *
@@ -26957,8 +27069,7 @@ function nextLevelGapFromEvidence(evidence, owner, revisitTrigger) {
 		question: "How much does it matter? (technical severity stays separate)"
 	}
 ].map((axis) => axis.id);
-//#endregion
-//#region src/v6/ecosystem-census.ts
+// src/v6/ecosystem-census.ts
 /**
 * The leading major of a version or range. `FRAMEWORK_INVENTORY`
 * records *validated versions* (`1.44`, `29`) while a manifest records a
@@ -26971,8 +27082,7 @@ function versionMajor(raw) {
 	if (!match) return null;
 	return (match[0] ?? "").split(".")[0] ?? null;
 }
-//#endregion
-//#region src/v6/ecosystem-probe.ts
+// src/v6/ecosystem-probe.ts
 /**
 * Filesystem-backed census evidence + the discovery probe (ADR 0010).
 *
@@ -27224,8 +27334,7 @@ function corpusReposOf(root) {
 		}
 	});
 }
-//#endregion
-//#region src/v6/capability-registry.ts
+// src/v6/capability-registry.ts
 /**
 
 }
@@ -27708,8 +27817,7 @@ function validateRegistry(registry) {
 	}
 	return diagnostics;
 }
-//#endregion
-//#region src/commands/capability.ts
+// src/commands/capability.ts
 /** Parse the flags. Anything flag-shaped that is not documented is a
 *  usage error rather than a silently ignored argument, because
 *  `capability --promote-m3` must not read as "show me everything". */
@@ -27829,8 +27937,7 @@ function runCapabilityCommand(argv, io = {
 	io.out(json ? capabilityJson(entries, diagnostics) : `${renderCapabilityText(entries, diagnostics)}\n`);
 	return diagnostics.length > 0 ? 1 : 0;
 }
-//#endregion
-//#region src/rules/measurement-status.ts
+// src/rules/measurement-status.ts
 /**
 * Derive the measurement status for a single rule.
 *
@@ -27877,8 +27984,7 @@ function getMeasurementStatus(rules = RULES) {
 		};
 	});
 }
-//#endregion
-//#region src/commands/rule-health.ts
+// src/commands/rule-health.ts
 /**
 * Build the per-rule health table from the shipped registry. Deterministic
 * order: the RULES registry order (stable across runs).
@@ -28009,8 +28115,7 @@ function renderRuleHealth(rows, limit) {
 	return lines.join("\n");
 }
 Object.keys(MEASURED_FP).length;
-//#endregion
-//#region src/playwright/selector-health-types.ts
+// src/playwright/selector-health-types.ts
 /** Risk weights per locator shape (0 = resilient, higher = brittle). */
 const LOCATOR_RISK = {
 	"role-based": 0,
@@ -28019,8 +28124,7 @@ const LOCATOR_RISK = {
 	"css-chain": 60,
 	xpath: 90
 };
-//#endregion
-//#region src/playwright/selector-health.ts
+// src/playwright/selector-health.ts
 /**
 * Selector Health Score engine (Upgrade-Plan-v2 R3, the headline feature).
 *
@@ -28148,8 +28252,7 @@ function computeSelectorHealth(root, ignoreMatcher = DEFAULT_IGNORE_MATCHER) {
 	walk(root);
 	return specs.sort((a, b) => a.score - b.score || compareCodePoints(a.file, b.file));
 }
-//#endregion
-//#region src/cli-handlers.ts
+// src/cli-handlers.ts
 /**
 * Handler functions for every Mjolnir CLI verb.
 *
@@ -28158,6 +28261,35 @@ function computeSelectorHealth(root, ignoreMatcher = DEFAULT_IGNORE_MATCHER) {
 * (Task 6: renderScanOutput helper).
 */
 /**
+* The one catch for a scan-backed verb.
+*
+* An invalid `mjolnir.config.json` is the USER's error and exits 10 (usage),
+* as `scan` always did. `fix`, `ci verify` and `explain --plan` each had
+* their own catch that only knew the internal-error arm, so the same config
+* typo exited 20 and printed "this is a bug in Mjölnir" on three verbs.
+*/
+function verbFailure(error, io, debug) {
+	if (error instanceof ConfigValidationError) {
+		io.err(error.message);
+		return 10;
+	}
+	internalErrorMessage(error, io.err, debug);
+	return 20;
+}
+/**
+* The notices a scan reports about itself, sent to the verb's own stderr.
+*
+* `fix`, `ci verify` and `handover` called `runScan` with no hooks, so a
+* config warning (an unknown key, an expired suppression) never reached the
+* user on those verbs, and the plugin gate notice bypassed `io.err`.
+*/
+function scanNotices(io) {
+	return {
+		onConfigWarning: (message) => io.err(message),
+		onGateNotice: (notice) => io.err(notice)
+	};
+}
+/**
 * The one place a run's gate level is resolved from `--blocking`, then
 * `mjolnir.config.json`, then the shipped default.
 *
@@ -28207,9 +28339,11 @@ function renderScanOutput(result, args, target, io, gate) {
 	else if (args.format === "pr-comment") {
 		const baseline = loadBaseline(join(target, DEFAULT_BASELINE_PATH));
 		const diff = baseline ? diffAgainstBaseline(result, baseline) : void 0;
+		const commit = commitBoundTo(result, target);
 		io.out(renderPrComment(result, {
 			...diff ? { diff } : {},
-			version: ENGINE_VERSION
+			version: ENGINE_VERSION,
+			...commit !== void 0 ? { commit } : {}
 		}));
 	} else if (args.format === "github-summary") io.out(renderStepSummary(result));
 	else if (args.json) io.out(JSON.stringify({
@@ -28298,6 +28432,58 @@ async function runSuppressionGate(args, target, io) {
 	if (args.base !== void 0) argv.push("--base", args.base);
 	return runSuppressionGateCommand(argv, io);
 }
+/**
+* The commit a rendered report may claim, or undefined when it cannot claim one.
+*
+* The scan records the HEAD it analysed (`runIdentity.commit`). A report states
+* that commit only when the repository at `dir` is still at it, so a report
+* rendered from another commit's JSON reads `unknown` instead of borrowing an
+* identity nothing here can confirm. The retired `pr-comment --from` verb took
+* the commit from a `--commit` argument; the formats that replaced it check the
+* checkout instead, which needs no flag and cannot be handed the wrong value.
+*/
+function commitBoundTo(result, dir) {
+	const recorded = result.runIdentity?.commit;
+	if (recorded === void 0) return void 0;
+	return currentCommit(dir, { nullable: true }) === recorded ? recorded : void 0;
+}
+/**
+* `--format github-summary|pr-comment <report.json>`: render a SAVED report.
+*
+* The v6 collapse retired `summary <report>` and `pr-comment --from <report>`
+* onto these two formats and shipped only the half that scans. Every CI
+* consumer renders the `--json` report its scan step already wrote: the
+* Action, both `ci install` templates and this repository's own PR workflow.
+* All of them kept calling the retired verbs, and all of them exited 10. A
+* second scan is not a substitute, because the comment has to describe the
+* result the gate read rather than one that happens to agree with it.
+*
+* Delegation, not reimplementation, which is the rule `--suppression-gate`
+* follows. Each retired verb's command still owns its contract, exit codes
+* included. The render never gates and exits 0. A report that cannot be read
+* exits 2 for the summary and 10 for the comment, as those verbs did.
+*
+* Returns null when the request is a scan: another format, or a target that
+* is not a file.
+*/
+function renderSavedReport(args, target, io) {
+	if (args.format !== "github-summary" && args.format !== "pr-comment") return null;
+	if (!isRegularFile(target)) return null;
+	if (args.format === "github-summary") return runSummaryCommand([target], io);
+	return runPrCommentCommand([
+		"--from",
+		target,
+		"--version",
+		ENGINE_VERSION
+	], io);
+}
+function isRegularFile(path) {
+	try {
+		return statSync(path).isFile();
+	} catch {
+		return false;
+	}
+}
 async function runScanCommand(argv, io = {
 	out,
 	err
@@ -28305,6 +28491,8 @@ async function runScanCommand(argv, io = {
 	const args = parseArgsOrUsage(argv, io);
 	if (!args) return 10;
 	const target = resolve(args.target);
+	const savedRender = renderSavedReport(args, target, io);
+	if (savedRender !== null) return savedRender;
 	const invalid = validateScanTarget(target, io.err);
 	if (invalid !== null) return invalid;
 	if (args.suppressions) return printSuppressionLedger(target, io);
@@ -28325,24 +28513,26 @@ async function runScanCommand(argv, io = {
 			...args,
 			target
 		}, {
-			onConfigWarning: (message) => io.err(message),
+			...scanNotices(io),
 			onProgress: (e) => progress.onEvent(e),
-			onGateNotice: (notice) => io.err(notice),
 			...args.debug ? { onRuleCrash: (ruleId, file, error) => {
 				const detail = error instanceof Error ? [error.message, error.stack].filter((value) => Boolean(value)).join("\n") : String(error);
 				crashLog.push(`${ruleId} crashed on ${file}: ${detail}`);
 			} } : {}
 		});
 		progress.done();
+		let baselineFailed = false;
 		if (args.saveBaseline) {
 			const outPath = join(target, DEFAULT_BASELINE_PATH);
-			try {
+			const notice = args.format === "terminal" ? io.out : io.err;
+			if (result.partial) io.err("baseline NOT saved — this scan is partial, and a truncated before-state would report every finding it missed as RESOLVED. Re-run without the time budget.");
+			else try {
 				const saved = saveBaseline(result, currentCommit(target) ?? "unknown", outPath);
-				io.out(renderBaselineSaved(DEFAULT_BASELINE_PATH, result.findings.length, { ...saved.backupPath !== void 0 ? { backupPath: saved.backupPath } : {} }));
+				notice(renderBaselineSaved(DEFAULT_BASELINE_PATH, result.findings.length, { ...saved.backupPath !== void 0 ? { backupPath: saved.backupPath } : {} }));
 			} catch (saveErr) {
 				io.err(`baseline save FAILED — ${saveErr instanceof Error ? saveErr.message : String(saveErr)}`);
 				io.err("The scan completed; the snapshot was not written. Fix the path permissions and re-run with `--save-baseline`.");
-				return 1;
+				baselineFailed = true;
 			}
 		}
 		if (args.debug && crashLog.length > 0) {
@@ -28350,7 +28540,7 @@ async function runScanCommand(argv, io = {
 			for (const line of crashLog.slice(0, 50)) io.err(`  ${line}`);
 			if (crashLog.length > 50) io.err(`  … and ${crashLog.length - 50} more`);
 		}
-		const { config, warnings } = loadConfig(target, { knownRuleIds: KNOWN_RULE_IDS$1 });
+		const { config } = loadConfig(target, { knownRuleIds: KNOWN_RULE_IDS$1 });
 		for (const d of args.deprecatedFlags ?? []) io.err(`warning: ${d.flag} is deprecated and will be removed in 7.0 — use ${d.replacement}. It still does exactly what it did; nothing about your scan changes this release.`);
 		const gate = resolveGateLevel(args.blocking, config);
 		if (args.scoreOnly) {
@@ -28377,7 +28567,7 @@ async function runScanCommand(argv, io = {
 			}
 		}
 		if (result.partial) return 2;
-		for (const w of warnings) io.err(w);
+		if (baselineFailed) return 2;
 		return scanExitCode({
 			partial: false,
 			findings: result.findings,
@@ -28387,12 +28577,7 @@ async function runScanCommand(argv, io = {
 			...args.requireFullCoverage !== void 0 ? { requireFullCoverage: args.requireFullCoverage } : {}
 		});
 	} catch (err) {
-		if (err instanceof ConfigValidationError) {
-			io.err(err.message);
-			return 10;
-		}
-		internalErrorMessage(err, io.err, args?.debug === true);
-		return 20;
+		return verbFailure(err, io, args?.debug === true);
 	}
 }
 async function runFixCommand(argv, io = {
@@ -28406,16 +28591,17 @@ async function runFixCommand(argv, io = {
 		const target = resolve(args.target);
 		const invalid = validateScanTarget(target, io.err);
 		if (invalid !== null) return invalid;
-		const fixes = planAndApplyFixes(await runScan$1({
+		const result = await runScan$1({
 			...args,
 			target,
 			strict: true
-		}), target, { dryRun });
+		}, scanNotices(io));
+		const fixes = planAndApplyFixes(result, target, { dryRun });
 		io.out(renderFixReport(fixes, dryRun));
+		if (result.partial) return 2;
 		return fixes.some((f) => f.status === "failed") ? 1 : 0;
 	} catch (err) {
-		internalErrorMessage(err, io.err, args?.debug === true);
-		return 20;
+		return verbFailure(err, io, args?.debug === true);
 	}
 }
 async function runVerifyCommand(argv, io = {
@@ -28431,15 +28617,21 @@ async function runVerifyCommand(argv, io = {
 		const result = await runScan$1({
 			...args,
 			target
-		});
-		const digest = buildVerifyDigest(result, loadBaseline(join(target, DEFAULT_BASELINE_PATH), (w) => io.err(w)));
+		}, scanNotices(io));
+		const baseline = loadBaseline(join(target, DEFAULT_BASELINE_PATH), (w) => io.err(w));
+		const digest = buildVerifyDigest(result, baseline);
 		io.out(renderVerifyDigest(digest));
 		if (result.partial) return 2;
 		if (!digest.hasBaseline) return 2;
-		return digest.new.some((f) => f.severity === "error") ? 1 : 0;
+		const { config } = loadConfig(target, { knownRuleIds: KNOWN_RULE_IDS$1 });
+		return scanExitCode({
+			partial: false,
+			findings: diffAgainstBaseline(result, baseline).newFindings,
+			gate: resolveGateLevel(args.blocking, config),
+			isAdvisory: isAdvisoryFinding
+		});
 	} catch (err) {
-		internalErrorMessage(err, io.err, args?.debug === true);
-		return 20;
+		return verbFailure(err, io, args?.debug === true);
 	}
 }
 async function runPrCommentCommand(argv, io = {
@@ -28454,13 +28646,14 @@ async function runPrCommentCommand(argv, io = {
 			return 10;
 		}
 		try {
-			const saved = loadSavedReport(resolve(fromPath));
+			const reportPath = resolve(fromPath);
+			const saved = loadSavedReport(reportPath);
 			const option = (flag) => {
 				const index = argv.indexOf(flag);
 				return index >= 0 ? argv[index + 1] : void 0;
 			};
 			const version = option("--version");
-			const commit = option("--commit");
+			const commit = option("--commit") ?? commitBoundTo(saved, dirname(reportPath));
 			const repoUrl = option("--repo-url");
 			io.out(renderPrComment(saved, {
 				...version ? { version } : {},
@@ -28523,17 +28716,21 @@ async function runHandoverCommand(argv, io = {
 		const result = await runScan$1({
 			...args,
 			target
-		});
+		}, scanNotices(io));
 		let forensics = null;
+		let forensicsFailed = false;
 		const resultsDir = join(target, "test-results");
 		if (existsSync(resultsDir)) try {
 			forensics = runForensics(resultsDir, { writeFlakyMd: false }).report;
-		} catch {}
+		} catch (forensicsErr) {
+			io.err(`warning: test-results/ could not be read (${errorMessage(forensicsErr)}) — the map below is static-only.`);
+			forensicsFailed = true;
+		}
 		io.out(renderHandover(buildHandover(result, forensics)));
+		if (result.partial || forensicsFailed) return 2;
 		return 0;
 	} catch (err) {
-		internalErrorMessage(err, io.err, args?.debug === true);
-		return 20;
+		return verbFailure(err, io, args?.debug === true);
 	}
 }
 function runPwReportCommand(argv, io = {
@@ -28667,7 +28864,7 @@ function runEvidenceArm(argv, io) {
 		const { report } = runForensics(resolve(target), { writeFlakyMd });
 		if (asJson) io.out(JSON.stringify(report, null, 2));
 		else io.out(asMd ? renderTriageMd(report) : renderTriage(report));
-		return report.analysisComplete === false ? 1 : 0;
+		return report.analysisComplete === false ? 2 : 0;
 	} catch (err) {
 		internalErrorMessage(err, io.err, argv.includes("--debug"));
 		return 20;
@@ -28820,8 +29017,7 @@ async function runDoctorPlaywright(argv, io = { out }) {
 		return 20;
 	}
 }
-//#endregion
-//#region src/rules/rule-metadata-schema.ts
+// src/rules/rule-metadata-schema.ts
 const VALID_SEVERITIES = SEVERITY_ORDER$1;
 const VALID_CATEGORIES = RULE_CATEGORIES;
 const VALID_QA_IMPACTS = Object.keys(QA_IMPACT_LABELS);
@@ -28869,8 +29065,7 @@ function validateAllRulesMetadata(rules) {
 	for (const rule of rules) all.push(...validateRuleMetadata(rule));
 	return all;
 }
-//#endregion
-//#region src/engine/detector-hash.ts
+// src/engine/detector-hash.ts
 /**
 * Detector revision integrity engine (certification-audit Phase 3,
 * G4/D8v2/D17).
@@ -29138,8 +29333,7 @@ const RULE_ID_RE = new RegExp(`^QA-(?:${[
 		appliesTo: "test-files"
 	}
 ].map((f) => f.token).join("|")})-\\d{3}$`);
-//#endregion
-//#region src/commands/doctor.ts
+// src/commands/doctor.ts
 /**
 * `mjolnir doctor` — self-audit of Mjolnir's own rule base.
 *
@@ -30086,8 +30280,7 @@ function stripNonDeterministicFields(json, fields = NON_DETERMINISTIC_FIELDS) {
 	for (const field of fields) delete json[field];
 	return json;
 }
-//#endregion
-//#region src/commands/doctor-run.ts
+// src/commands/doctor-run.ts
 /**
 * Doctor CLI entry (certification-audit Phase 5, G6): the command handler
 * lives beside the check implementations instead of in cli.ts — the CLI
@@ -30185,8 +30378,7 @@ function installedPackageRoot() {
 		return process.cwd();
 	}
 }
-//#endregion
-//#region src/commands/handoff.ts
+// src/commands/handoff.ts
 /**
 * `mjolnir handoff [mjolnir.json]` — the deterministic fix-handoff
 * artifact (agent-handoff plan M3).
@@ -30272,7 +30464,7 @@ function verificationBlock(version) {
 /** The per-rule remediation copy block (fenced, self-contained). */
 function ruleCopyBlock(group, version) {
 	const f = group.findings[0];
-	const occurrences = group.findings.slice(0, OCCURRENCE_CAP).map((x) => `- \`${escapeMarkdown(x.file)}:${x.line}\``).join("\n");
+	const occurrences = group.findings.slice(0, OCCURRENCE_CAP).map((x) => `- ${mdCodeSpan(`${x.file}:${x.line}`)}`).join("\n");
 	const overflow = group.findings.length > OCCURRENCE_CAP ? `\n- … and ${group.findings.length - OCCURRENCE_CAP} more — see the JSON report.` : "";
 	return [
 		"```text",
@@ -30398,7 +30590,7 @@ function renderHandoff(result, options = {}, version = ENGINE_VERSION) {
 		lines.push("");
 		lines.push(`**Occurrences (${g.findings.length}):**`);
 		lines.push("");
-		for (const f of g.findings.slice(0, OCCURRENCE_CAP)) lines.push(`- \`${escapeMarkdown(f.file)}:${f.line}\` — ${escapeMarkdown(f.message)}`);
+		for (const f of g.findings.slice(0, OCCURRENCE_CAP)) lines.push(`- ${mdCodeSpan(`${f.file}:${f.line}`)} — ${escapeMarkdown(f.message)}`);
 		if (g.findings.length > OCCURRENCE_CAP) lines.push(`- … and ${g.findings.length - OCCURRENCE_CAP} more — see the JSON report.`);
 		lines.push("");
 		lines.push(ruleCopyBlock(g, version));
@@ -30496,8 +30688,7 @@ function runHandoffCommand(argv, io = {
 	}));
 	return 0;
 }
-//#endregion
-//#region src/commands/install-agents.ts
+// src/commands/install-agents.ts
 /**
 * `mjolnir install` — instruction-surface installer (agent-handoff
 * plan M4).
@@ -30823,8 +31014,7 @@ function executeHookInstall(entry) {
 		default: return false;
 	}
 }
-//#endregion
-//#region src/commands/release-trust.ts
+// src/commands/release-trust.ts
 /**
 * `mjolnir ci release-trust` — the Release Trust Verdict (product-gap
 * master plan §5, plan 1789009691197 R4a).
@@ -31535,8 +31725,7 @@ function runReleaseTrustCommand(argv, io = {
 		return 20;
 	}
 }
-//#endregion
-//#region src/commands/policy.ts
+// src/commands/policy.ts
 /**
 * `mjolnir policy` — Policy-as-Code (TL-2).
 *
@@ -31660,8 +31849,7 @@ async function runPolicyCommand(argv, io) {
 	io.err(`Unknown policy subcommand: ${subcommand}`);
 	return 10;
 }
-//#endregion
-//#region src/commands/analyze.ts
+// src/commands/analyze.ts
 /**
 * `mjolnir analyze --cross-file` — Cross-File Analysis (SDET-7).
 *
@@ -31797,8 +31985,7 @@ function runAnalyzeCommand(argv, io) {
 		return 20;
 	}
 }
-//#endregion
-//#region src/commands/ci-adapter.ts
+// src/commands/ci-adapter.ts
 /**
 * `mjolnir ci adapters` — CI Adapters (SDET-4).
 *
@@ -31919,8 +32106,7 @@ function runCiAdapterCommand(argv, io) {
 	io.out(output);
 	return 0;
 }
-//#endregion
-//#region src/engine/machine-contract-verification.ts
+// src/engine/machine-contract-verification.ts
 /**
 * M11 — Machine Contract Verification.
 *
@@ -32082,8 +32268,7 @@ function renderContractVerification(result) {
 	}
 	return lines.join("\n").trimEnd();
 }
-//#endregion
-//#region src/commands/contract-verify.ts
+// src/commands/contract-verify.ts
 /**
 * `contract-verify` — the machine-contract and exit-code validators, and the
 * command that runs them.
@@ -32240,8 +32425,7 @@ async function runContractVerifyCommand(argv, io = {
 		return milestoneError(error, io, argv.includes("--debug"));
 	}
 }
-//#endregion
-//#region src/commands/share.ts
+// src/commands/share.ts
 /**
 * `mjolnir share` — React Doctor's proof loop, without its server.
 *
@@ -32471,8 +32655,7 @@ async function runShareCommand(argv, io) {
 		return 20;
 	}
 }
-//#endregion
-//#region src/engine/historical-trust.ts
+// src/engine/historical-trust.ts
 /**
 * Compute a trust snapshot from a scan result and run identity.
 * Pure function — deterministic output for the same input.
@@ -32658,8 +32841,7 @@ function renderTrustTrend(trend) {
 	}
 	return lines.join("\n").trimEnd();
 }
-//#endregion
-//#region src/commands/release-trend.ts
+// src/commands/release-trend.ts
 /**
 * `ci release-trend` — how the signed release's trust record has moved across
 * releases.
@@ -32716,8 +32898,7 @@ async function runTrustTrendCommand(argv, io = {
 		return milestoneError(error, io, argv.includes("--debug"));
 	}
 }
-//#endregion
-//#region src/cli.ts
+// src/cli.ts
 /**
 * Mjölnir CLI entry point (W1-02).
 * Exit codes (§24.1, frozen): 0 clean · 1 findings ≥ gate · 2 partial ·
@@ -32730,16 +32911,14 @@ async function runTrustTrendCommand(argv, io = {
 * bundled `dist/cli.mjs`, so resolving package.json at runtime depends on
 * where the file happens to sit after install. This follows the same
 * discipline as SARIF's `driver.version` — kept in sync by
-* `scripts/archive/sync-sarif-version.cjs` (archived; superseded by the release
-* workflow's own version stamping) on release and guarded by
+* `npm run version:surface:sync` (it rewrites every identity surface) on
+* release and guarded by
 * `tests/contract/version-consistency.spec.ts` locally. R4c moved the literal to
 * src/engine/version.ts (a leaf module) so the scan pipeline's run
 * identity can carry it without a cli.ts import cycle; this re-export
 * keeps every existing consumer stable.
 */
-const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isValidFindingRecord, discoverAndParseRuntimeReport, KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID, EVIDENCE_OVERRIDES, SUITE_INVALIDATING_RULE_IDS } = scan_pipeline_exports;
-const DEFAULT_MAX_DURATION_MS = 6e5;
-const MAX_DURATION_MS = 36e5;
+const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isValidFindingRecord, discoverAndParseRuntimeReport, KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID, EVIDENCE_OVERRIDES, SUITE_INVALIDATING_RULE_IDS, DEFAULT_MAX_DURATION_MS, MAX_DURATION_MS } = scan_pipeline_exports;
 function parseArgs(argv, onError) {
 	const args = {
 		target: ".",
@@ -32798,7 +32977,7 @@ function parseArgs(argv, onError) {
 			args.base = ref;
 		} else if (a === "--max-duration") {
 			const v = Number(argv[++i]);
-			if (!Number.isFinite(v) || v <= 0 || v * 1e3 > 36e5) return reject({
+			if (!Number.isFinite(v) || v <= 0 || v * 1e3 > MAX_DURATION_MS) return reject({
 				flag: "--max-duration",
 				token: argv[i]
 			});
@@ -32857,11 +33036,22 @@ function parseArgs(argv, onError) {
 	}
 	return args;
 }
-/** Scan flags that exist — the "did you mean" candidate pool. */
+/**
+* Scan flags that exist — the "did you mean" candidate pool.
+*
+* Every flag `parseArgs` accepts, and nothing it rejects. The pool had
+* drifted both ways: ten accepted flags were missing, and `--dry-run` and
+* `--version` were in it although a scan rejects them, so `mjolnir scan
+* --dry-run` answered `unknown flag "--dry-run"` and then suggested it.
+* tests/cli/help.spec.ts reads `parseArgs` to hold the two lists together.
+*/
 const KNOWN_SCAN_FLAGS = [
 	"--json",
 	"--format",
 	"--verbose",
+	"--suppressions",
+	"--suppression-gate",
+	"--policy",
 	"--scope",
 	"--base",
 	"--max-duration",
@@ -32876,12 +33066,16 @@ const KNOWN_SCAN_FLAGS = [
 	"--record-milestones",
 	"--save-baseline",
 	"--cache",
+	"--no-progress",
+	"--category",
+	"--score",
+	"--require-full-coverage",
+	"--staged",
+	"--blocking",
+	"--enable-plugins",
 	"--monorepo",
 	"--help",
-	"-h",
-	"--version",
-	"-v",
-	"--dry-run"
+	"-h"
 ];
 /** Hand-rolled Levenshtein distance (plan M2: no new dependencies). */
 function levenshtein(a, b) {
@@ -33085,7 +33279,7 @@ function runCiInstall(argv, io = {
 		return 10;
 	}
 	io.out(`${result.existed ? "Updated" : "Created"} ${result.written}`);
-	io.out(noAction ? `Plain-npx template (--no-action). Gate: ${gate}.` : `Action-based template: uses Sergey-Bar/Mjolnir@4a588bc62d517bc85fc44c0eae64c6587d3bf70b0 (immutable pin). Gate: ${gate}.`);
+	io.out(noAction ? `Plain-npx template (--no-action). Gate: ${gate}.` : `Action-based template: uses ${ACTION_REF} (immutable pin). Gate: ${gate}.`);
 	io.out(gate === "advisory" ? "Advisory mode reports findings without blocking. Opt in with --gate error or --gate warning." : `Blocking mode fails on ${gate} findings.`);
 	io.out("Change with: mjolnir ci install --gate error|warning|advisory");
 	if (!noAction) io.out("Prefer the plain-npx workflow? Re-run with --no-action.");
@@ -33138,13 +33332,8 @@ async function main(argv = process$1.argv.slice(2), io = {
 		io.out(renderCiSubcommandHelp());
 		return 10;
 	}
-	if (argv[0] === "ci" && argv[1] === "install") return runCiInstall(argv.slice(2), io);
 	if (argv[0] === "ci") {
 		const sub = argv[1];
-		if (sub === void 0 || sub === "--help" || sub === "-h") {
-			io.out(renderCiSubcommandHelp());
-			return sub === void 0 ? 10 : 0;
-		}
 		const entry = CI_SUBCOMMANDS[sub];
 		if (entry === void 0) {
 			io.err(`mjolnir ci: unknown subcommand "${sub}".`);
@@ -33236,7 +33425,6 @@ if (isEntryPoint()) {
 		await flushSentry();
 	}
 }
-//#endregion
-export { ENGINE_VERSION as CLI_VERSION, DEFAULT_MAX_DURATION_MS, EVIDENCE_OVERRIDES, EXPLAIN_ARMS, KNOWN_RULE_IDS, MAX_DURATION_MS, OVERLAP_META_BY_RULE_ID, SUITE_INVALIDATING_RULE_IDS, buildUniversalRules, discoverAndParseRuntimeReport, err, exitForFindings, fallbackWorkspace, internalErrorMessage, isEntryPoint, isValidFindingRecord, levenshtein, main, nearestFlags, out, parseArgs, parseArgsOrUsage, pathMatchesGlob, printUsage, renderCiSubcommandHelp, renderScanOutput, runAnalyzeCommand, runCIIntegrityCommand, runCiAdapterCommand, runCiInstall, runContractVerifyCommand, runCrossFileCommand, runDoctorCommand, runDoctorPlaywright, runEvidenceArm, runEvidenceGraphCommand, runExplainCommand, runFixCommand, runFrameworkMaturityCommand, runHandoffCommand, runHandoverCommand, runHelpCommand, runInstallCommand, runPolicyCommand, runPrCommentCommand, runPwReportCommand, runReleaseTrustCommand, runRulesCommand, runScan, runScanCommand, runStatsCommand, runSuppressionGateCommand, runSuppressions, runTrustTrendCommand, runVerifyCommand, runWhyCommand, usageErrorMessage, validateScanTarget };
+export { ENGINE_VERSION as CLI_VERSION, DEFAULT_MAX_DURATION_MS, EVIDENCE_OVERRIDES, EXPLAIN_ARMS, KNOWN_RULE_IDS, KNOWN_SCAN_FLAGS, MAX_DURATION_MS, OVERLAP_META_BY_RULE_ID, SUITE_INVALIDATING_RULE_IDS, buildUniversalRules, discoverAndParseRuntimeReport, err, exitForFindings, fallbackWorkspace, internalErrorMessage, isEntryPoint, isValidFindingRecord, levenshtein, main, nearestFlags, out, parseArgs, parseArgsOrUsage, pathMatchesGlob, printUsage, renderCiSubcommandHelp, renderScanOutput, runAnalyzeCommand, runCIIntegrityCommand, runCiAdapterCommand, runCiInstall, runContractVerifyCommand, runCrossFileCommand, runDoctorCommand, runDoctorPlaywright, runEvidenceArm, runEvidenceGraphCommand, runExplainCommand, runFixCommand, runFrameworkMaturityCommand, runHandoffCommand, runHandoverCommand, runHelpCommand, runInstallCommand, runPolicyCommand, runPrCommentCommand, runPwReportCommand, runReleaseTrustCommand, runRulesCommand, runScan, runScanCommand, runStatsCommand, runSuppressionGateCommand, runSuppressions, runTrustTrendCommand, runVerifyCommand, runWhyCommand, usageErrorMessage, validateScanTarget };
 
 //# sourceMappingURL=cli.mjs.map