pub fn report(root: &Path, run: &StoredRun) -> Result<Value, String>
Cache derived assessments separately from immutable coverage evidence. Every query still verifies current source, map and managed-state identities.