semi implemented and features implemented save checkpoint

docs/implplan-blocked/audits/csproj-standards/Policy/StellaOps.Policy.Engine/StellaOps.Policy.Engine.md

@@ -0,0 +1,263 @@
+# Audit - StellaOps.Policy.Engine
+
+## Project
+- Path: `src/Policy/StellaOps.Policy.Engine/StellaOps.Policy.Engine.csproj`
+- Module: `Policy`
+- Kind: `WebService`
+- SDK: `Microsoft.NET.Sdk.Web`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 218
+- Service locator usage (BuildServiceProvider/GetService): 3
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Policy/StellaOps.Policy.Engine/Evaluation/PolicyExpressionEvaluator.cs` (1530 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Telemetry/PolicyEngineTelemetry.cs` (1187 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Compilation/PolicyMetadataExtractor.cs` (988 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Evaluation/PolicyEvaluator.cs` (914 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Simulation/RiskSimulationBreakdownService.cs` (897 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Services/PolicyRuntimeEvaluationService.cs` (897 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Gates/PolicyGateEvaluator.cs` (881 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/RiskSimulationEndpoints.cs` (869 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Simulation/SimulationAnalyticsService.cs` (811 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Telemetry/ExplainTraceExport.cs` (701 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/ScoreProvenanceChain.cs` (700 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Services/ExceptionApprovalRulesService.cs` (698 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Vex/VexDecisionSigningService.cs` (695 lines)
+  - `src/Policy/StellaOps.Policy.Engine/ExceptionCache/RedisExceptionEffectiveCache.cs` (679 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Simulation/RiskSimulationService.cs` (652 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/RiskProfileEndpoints.cs` (599 lines)
+  - `src/Policy/StellaOps.Policy.Engine/ExceptionCache/MessagingExceptionEffectiveCache.cs` (585 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Telemetry/RuleHitTraceCollector.cs` (572 lines)
+  - `src/Policy/StellaOps.Policy.Engine/WhatIfSimulation/WhatIfSimulationService.cs` (552 lines)
+  - `src/Policy/StellaOps.Policy.Engine/AirGap/RiskProfileAirGapExport.cs` (549 lines)
+  - `src/Policy/StellaOps.Policy.Engine/IncrementalOrchestrator/IncrementalPolicyOrchestrator.cs` (537 lines)
+  - `src/Policy/StellaOps.Policy.Engine/IncrementalOrchestrator/PolicyChangeEvent.cs` (535 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/VerdictEvidenceWeightedScore.cs` (523 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/VerificationPolicyValidator.cs` (516 lines)
+  - `src/Policy/StellaOps.Policy.Engine/EffectiveDecisionMap/RedisEffectiveDecisionMap.cs` (501 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/ViolationEndpoints.cs` (500 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Services/PolicyExplainerService.cs` (497 lines)
+  - `src/Policy/StellaOps.Policy.Engine/IncrementalOrchestrator/IncrementalOrchestratorBackgroundService.cs` (495 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Gates/VexTrustGate.cs` (489 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Vex/VexDecisionModels.cs` (478 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Scoring/EvidenceWeightedScore/MigrationTelemetryService.cs` (471 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Telemetry/PolicyTimelineEvents.cs` (471 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Console/ConsoleAttestationReportService.cs` (470 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Gates/DriftGateEvaluator.cs` (468 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Notifications/PolicyProfileNotificationService.cs` (467 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Vex/VexDecisionEmitter.cs` (466 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Scoring/Engines/AdvancedScoringEngine.cs` (460 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Events/PolicyEventProcessor.cs` (454 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Scoring/EvidenceWeightedScore/ConfidenceToEwsAdapter.cs` (446 lines)
+  - `src/Policy/StellaOps.Policy.Engine/EffectiveDecisionMap/MessagingEffectiveDecisionMap.cs` (428 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/ConflictEndpoints.cs` (425 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Telemetry/RuleHitTrace.cs` (424 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/PolicyDecisionAttestationService.cs` (424 lines)
+  - `src/Policy/StellaOps.Policy.Engine/ProofOfExposure/PoEPolicyModels.cs` (423 lines)
+  - `src/Policy/StellaOps.Policy.Engine/AirGap/AirGapNotifications.cs` (422 lines)
+  - `src/Policy/StellaOps.Policy.Engine/ProofOfExposure/PoEValidationService.cs` (422 lines)
+  - `src/Policy/StellaOps.Policy.Engine/DependencyInjection/PolicyEngineServiceCollectionExtensions.cs` (422 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/PolicyDecisionPredicate.cs` (421 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/VerificationPolicyEditorEndpoints.cs` (414 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Options/PolicyEngineOptions.cs` (414 lines)
+  - `src/Policy/StellaOps.Policy.Engine/DeterminismGuard/ProhibitedPatternAnalyzer.cs` (412 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Events/ProfileEventPublisher.cs` (412 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Materialization/EffectiveFindingWriter.cs` (412 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Notifications/PolicyProfileNotificationPublisher.cs` (396 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/EffectivePolicyEndpoints.cs` (396 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/AttestationReportService.cs` (394 lines)
+  - `src/Policy/StellaOps.Policy.Engine/SelectionJoin/SelectionJoinService.cs` (390 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Scoring/EvidenceWeightedScore/DualEmitVerdictEnricher.cs` (390 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/VerdictPredicate.cs` (386 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Gates/StabilityDampingGate.cs` (384 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Caching/ProvcachePolicyEvaluationCache.cs` (384 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/PolicyPackEndpoints.cs` (382 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Telemetry/EvidenceBundle.cs` (379 lines)
+  - `src/Policy/StellaOps.Policy.Engine/ReachabilityFacts/SignalsBackedReachabilityFactsStore.cs` (377 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Materialization/EffectiveFindingModels.cs` (376 lines)
+  - `src/Policy/StellaOps.Policy.Engine/DeterminismGuard/GuardedPolicyEvaluator.cs` (375 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Scoring/EvidenceWeightedScore/EwsTelemetryService.cs` (375 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Program.cs` (371 lines)
+  - `src/Policy/StellaOps.Policy.Engine/WhatIfSimulation/WhatIfSimulationModels.cs` (371 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Gates/PolicyGateDecision.cs` (369 lines)
+  - `src/Policy/StellaOps.Policy.Engine/ReachabilityFacts/IReachabilityFactsSignalsClient.cs` (366 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/OverrideEndpoints.cs` (360 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/UnknownsEndpoints.cs` (354 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Evaluation/PolicyEvaluationContext.cs` (353 lines)
+  - `src/Policy/StellaOps.Policy.Engine/DeterminismGuard/DeterminismGuardService.cs` (352 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/RvaVerifier.cs` (350 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Telemetry/PolicyEvaluationAttestation.cs` (347 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Services/RiskProfileConfigurationService.cs` (344 lines)
+  - `src/Policy/StellaOps.Policy.Engine/ReachabilityFacts/ReachabilityFactsOverlayCache.cs` (333 lines)
+  - `src/Policy/StellaOps.Policy.Engine/AirGap/StalenessSignaling.cs` (327 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/CvssReceiptEndpoints.cs` (327 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Scoring/Engines/SimpleScoringEngine.cs` (326 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Scoring/IScoringEngine.cs` (323 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Evaluation/VerdictSummary.cs` (323 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Services/ExceptionAwareEvaluationService.cs` (321 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Crypto/CryptoRiskEvaluator.cs` (319 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Scoring/EvidenceWeightedScore/PolicyEvaluationContextEwsExtensions.cs` (314 lines)
+  - `src/Policy/StellaOps.Policy.Engine/ReachabilityFacts/ReachabilityFactsSignalsClient.cs` (310 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/DeterminizationConfigEndpoints.cs` (310 lines)
+  - `src/Policy/StellaOps.Policy.Engine/SelectionJoin/PurlEquivalence.cs` (309 lines)
+  - `src/Policy/StellaOps.Policy.Engine/ConsoleExport/ConsoleExportJobService.cs` (305 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Scoring/EvidenceWeightedScore/EvidenceWeightedScoreEnricher.cs` (304 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/RiskBudgetEndpoints.cs` (304 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Adapters/ExceptionAdapter.cs` (303 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Vex/VexOverrideSignals.cs` (301 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Notifications/PolicyProfileNotificationModels.cs` (300 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Simulation/RiskSimulationBreakdown.cs` (295 lines)
+  - `src/Policy/StellaOps.Policy.Engine/MergePreview/PolicyMergePreviewService.cs` (294 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/ScopeAttachmentEndpoints.cs` (290 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Workers/PolicyEvaluationWorkerService.cs` (287 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Domain/ExceptionContracts.cs` (287 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Policies/DeterminizationRuleSet.cs` (283 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Compilation/PolicyComplexityAnalyzer.cs` (283 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/RiskProfileAirGapEndpoints.cs` (283 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Signals/Entropy/EntropyPenaltyCalculator.cs` (280 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Subscriptions/SignalUpdateHandler.cs` (272 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Caching/InMemoryPolicyEvaluationCache.cs` (271 lines)
+  - `src/Policy/StellaOps.Policy.Engine/ReachabilityFacts/ReachabilityFactsJoiningService.cs` (270 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Scoring/RiskScoringTriggerService.cs` (268 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Scoring/Engines/ProofAwareScoringEngine.cs` (267 lines)
+  - `src/Policy/StellaOps.Policy.Engine/AirGap/PolicyPackBundleImportService.cs` (266 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/VerdictBudgetCheck.cs` (266 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Domain/ExceptionMapper.cs` (265 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/VerificationPolicyEditorModels.cs` (264 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/VerdictPredicateBuilder.cs` (264 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Tenancy/TenantContextMiddleware.cs` (262 lines)
+  - `src/Policy/StellaOps.Policy.Engine/ReachabilityFacts/ReachabilityFactsModels.cs` (258 lines)
+  - `src/Policy/StellaOps.Policy.Engine/AirGap/SealedModeErrors.cs` (255 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/BudgetEndpoints.cs` (253 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Services/GateBypassAuditor.cs` (253 lines)
+  - `src/Policy/StellaOps.Policy.Engine/BatchEvaluation/BatchEvaluationModels.cs` (247 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Services/PolicyCompilationService.cs` (245 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Gates/DriftGateContext.cs` (244 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/PolicyLintEndpoints.cs` (241 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/ProfileExportEndpoints.cs` (241 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Console/ConsoleSimulationDiffService.cs` (240 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Tenancy/TenantContextModels.cs` (240 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Telemetry/TelemetryExtensions.cs` (239 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/ConsoleExportEndpoints.cs` (238 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/ScoringDeterminismVerifier.cs` (237 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Simulation/SimulationAnalytics.cs` (236 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/RvaService.cs` (235 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/AttestationReportEndpoints.cs` (233 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Scoring/EvidenceWeightedScore/PolicyEvidenceWeightedScoreOptions.cs` (232 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Console/ConsoleAttestationReportModels.cs` (228 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/VerificationPolicyEndpoints.cs` (227 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Adapters/ExceptionEffectRegistry.cs` (226 lines)
+  - `src/Policy/StellaOps.Policy.Engine/ExceptionCache/ExceptionCacheModels.cs` (225 lines)
+  - `src/Policy/StellaOps.Policy.Engine/EffectiveDecisionMap/EffectiveDecisionModels.cs` (221 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Compilation/PolicyCompileMetadata.cs` (220 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Gates/PolicyGateOptions.cs` (218 lines)
+  - `src/Policy/StellaOps.Policy.Engine/AirGap/SealedModeService.cs` (216 lines)
+  - `src/Policy/StellaOps.Policy.Engine/ReachabilityFacts/ReachabilityFactsStore.cs` (213 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Services/PolicyDecisionService.cs` (212 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Telemetry/IncidentMode.cs` (212 lines)
+  - `src/Policy/StellaOps.Policy.Engine/ReachabilityFacts/ReachabilityCoreBridge.cs` (210 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/RvaBuilder.cs` (208 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Vex/VexProofSpineService.cs` (207 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Materialization/PolicyExplainTrace.cs` (206 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Gates/Determinization/DeterminizationGate.cs` (205 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Confidence/VexTrustConfidenceFactorProvider.cs` (204 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Caching/MessagingPolicyEvaluationCache.cs` (202 lines)
+  - `src/Policy/StellaOps.Policy.Engine/ProofOfExposure/PoEPolicyEnricher.cs` (200 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Scoring/EvidenceWeightedScore/IFindingScoreEnricher.cs` (200 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Crypto/CryptoRiskAtoms.cs` (200 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Storage/InMemory/InMemoryExceptionRepository.cs` (198 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/IPolicyDecisionAttestationService.cs` (197 lines)
+  - `src/Policy/StellaOps.Policy.Engine/DeterminismGuard/DeterminismViolation.cs` (197 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/ProfileEventEndpoints.cs` (195 lines)
+  - `src/Policy/StellaOps.Policy.Engine/SelectionJoin/SelectionJoinModels.cs` (192 lines)
+  - `src/Policy/StellaOps.Policy.Engine/ConsoleExport/ConsoleExportModels.cs` (190 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/VerdictReasonCode.cs` (188 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/InMemoryAttestationReportStore.cs` (188 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/RvaPredicate.cs` (187 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/VerdictAttestationService.cs` (186 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Gates/Determinization/SignalSnapshotBuilder.cs` (185 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Services/PathScopeMetrics.cs` (185 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Events/PolicyEffectiveEventModels.cs` (184 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Services/PolicyEvaluationService.PathScope.cs` (182 lines)
+  - `src/Policy/StellaOps.Policy.Engine/ReachabilityFacts/MessagingReachabilityFactsOverlayCache.cs` (180 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Scoring/ScorePolicyService.cs` (179 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/AttestationReportModels.cs` (178 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/RiskVerdictAttestation.cs` (177 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Domain/PolicyPackRecord.cs` (176 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Services/PolicyBundleService.cs` (176 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Services/VerdictLinkService.cs` (172 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Events/ProfileEventModels.cs` (172 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Overlay/PathScopeSimulationBridgeService.cs` (172 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Services/EffectivePolicyAuditor.cs` (169 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Gates/VexTrustGateOptions.cs` (165 lines)
+  - `src/Policy/StellaOps.Policy.Engine/BatchEvaluation/BatchExceptionLoader.cs` (165 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Gates/Determinization/DeterminizationGateMetrics.cs` (163 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Scoring/RiskScoringModels.cs` (162 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/SealedModeEndpoints.cs` (159 lines)
+  - `src/Policy/StellaOps.Policy.Engine/ExceptionCache/IExceptionEffectiveCache.cs` (156 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Scoring/ScoringProfileService.cs` (156 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Scoring/ProfileAwareScoringService.cs` (153 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Gates/DriftGateOptions.cs` (151 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/PolicyCompilationEndpoints.cs` (150 lines)
+  - `src/Policy/StellaOps.Policy.Engine/BuildGate/ExceptionRecheckGate.cs` (150 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/BatchEvaluationEndpoint.cs` (148 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Caching/IPolicyEvaluationCache.cs` (145 lines)
+  - `src/Policy/StellaOps.Policy.Engine/EffectiveDecisionMap/IEffectiveDecisionMap.cs` (144 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Signals/Entropy/EntropyModels.cs` (143 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/VerificationPolicyModels.cs` (143 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Simulation/RiskSimulationModels.cs` (141 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Scoring/EvidenceWeightedScore/EvidenceWeightedScoreServiceCollectionExtensions.cs` (134 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Services/InMemoryPolicyPackRepository.cs` (126 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/ConsoleAttestationReportEndpoints.cs` (125 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Gates/VexTrustGateMetrics.cs` (125 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/RiskProfileSchemaEndpoints.cs` (121 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/StalenessEndpoints.cs` (121 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Streaming/PathScopeSimulationService.cs` (118 lines)
+  - `src/Policy/StellaOps.Policy.Engine/ConsoleExport/InMemoryConsoleExportStores.cs` (118 lines)
+  - `src/Policy/StellaOps.Policy.Engine/AirGap/SealedModeModels.cs` (114 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Orchestration/OrchestratorJobService.cs` (113 lines)
+  - `src/Policy/StellaOps.Policy.Engine/AirGap/PolicyPackBundleModels.cs` (113 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Policies/DeterminizationPolicy.cs` (112 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Workers/PolicyEvaluationWorkerHost.cs` (112 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Tenancy/TenantContextServiceCollectionExtensions.cs` (109 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Attestation/HttpAttestorClient.cs` (107 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Services/LicenseComplianceService.cs` (107 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Orchestration/PolicyWorkerService.cs` (107 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Caching/CacheBypassAccessor.cs` (106 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Scoring/RiskScoringJobStore.cs` (106 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Ledger/LedgerExportService.cs` (104 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Scoring/ScoringEngineFactory.cs` (102 lines)
+  - `src/Policy/StellaOps.Policy.Engine/Endpoints/PolicyPackBundleEndpoints.cs` (102 lines)
+- Service locator matches:
+  - `src/Policy/StellaOps.Policy.Engine/DependencyInjection/PolicyEngineServiceCollectionExtensions.cs`:271 var options = sp.GetService<Microsoft.Extensions.Options.IOptions<ReachabilityFactsSignalsClientOptions>>()?.Value;
+  - `src/Policy/StellaOps.Policy.Engine/Tenancy/TenantContextServiceCollectionExtensions.cs`:93 .GetService<ITenantContextAccessor>();
+  - `src/Policy/StellaOps.Policy.Engine/Program.cs`:163 sp.GetService<StellaOps.Policy.Engine.ExceptionCache.IExceptionEffectiveCache>(),
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/Policy/__Tests/StellaOps.Policy.Engine.Tests/StellaOps.Policy.Engine.Tests.csproj [Unit], src/Policy/__Tests/StellaOps.Policy.Engine.Contract.Tests/StellaOps.Policy.Engine.Contract.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.