From 03ae1f238e2296f5e68a7a479fa837a8ca2e6c91 Mon Sep 17 00:00:00 2001
From: Alexander Nachtmann <anfh22@outlook.com>
Date: Tue, 13 Oct 2026 07:03:40 +0200
Subject: [PATCH] Release 3.0.0: explicit thresholds, complete CRAP scoring,
 deterministic file identity

Three gate contracts change: check, test, the Fallout target and the badge action have no
default threshold; the CRAP gate needs every method scored; a report with several source
roots no longer triggers a disk probe, and unresolved files make every gate NODATA until
--probe-sources or --source-root resolves them. --exclude-test-code joins
--exclude-generated, and an active exclusion is listed on stderr or in JSON.

Seven counting fixes: ParseAsync finishes method-only classes; CRAP rows stay per file and
per overload; condition identity no longer depends on XML packaging; contradictory branch
data warns instead of inflating rates; an empty class summary decides the file; and
./src/C.cs and src/C.cs are one file.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .github/actions/badge/action.yml              |  14 +-
 .github/actions/badge/badge.sh                |   5 +-
 .github/tests/consumer_coverage.py            |   8 +-
 .github/tests/readme_badge_coverage.py        |   7 +-
 .github/workflows/nuget-publish.yml           |   5 +
 CHANGELOG.md                                  |  57 ++
 Directory.Build.props                         |  12 +-
 README.md                                     |  57 +-
 build/Build.cs                                |   7 +-
 docs/releases/3.0.0.md                        |  93 ++++
 src/DotCov.Fallout/CoverageParameters.cs      |  68 ++-
 src/DotCov.Fallout/ICoverageReport.cs         |  59 ++-
 src/DotCov.Fallout/README.md                  |  18 +-
 src/DotCov.Tool/DotCovCli.Test.cs             |  12 +-
 src/DotCov.Tool/DotCovCli.cs                  | 296 +++++++----
 src/DotCov.Tool/README.md                     |  32 +-
 src/DotCov/CoberturaParser.Methods.cs         |  38 +-
 src/DotCov/CoberturaParser.cs                 | 488 +++++++++++++-----
 src/DotCov/CoverageReport.cs                  | 165 ++++--
 src/DotCov/CrapAnalysis.cs                    | 165 +++---
 src/DotCov/FileIdentity.cs                    | 134 +++++
 src/DotCov/Formatters/CrapFormatter.cs        |   2 +
 src/DotCov/Formatters/JsonFormatter.cs        |  21 +
 src/DotCov/MethodCoverageReport.cs            |  38 +-
 src/DotCov/MethodIdentity.cs                  | 142 +++--
 src/DotCov/PathIdentity.cs                    |  49 +-
 src/DotCov/README.md                          |  26 +-
 tests/AGENTS.md                               |   2 +-
 tests/DotCov.Tests/BadgeActionTests.cs        |  22 +-
 tests/DotCov.Tests/CliBadgeTests.cs           |   4 +-
 tests/DotCov.Tests/CliCrapTests.cs            |  41 ++
 tests/DotCov.Tests/CliTestCommandTests.cs     |  18 +-
 tests/DotCov.Tests/CliTests.cs                |   6 +-
 tests/DotCov.Tests/CliUsageProcessTests.cs    |   6 +-
 .../DotCov.Tests/CoberturaParserAsyncTests.cs |  27 +
 tests/DotCov.Tests/CorePathIdentityTests.cs   |  18 +
 tests/DotCov.Tests/CoverageParametersTests.cs |  76 ++-
 tests/DotCov.Tests/CoverageReportEdgeTests.cs |  10 +-
 tests/DotCov.Tests/CrapAnalysisEdgeTests.cs   |  20 +-
 tests/DotCov.Tests/CrapAnalysisTests.cs       |  28 +-
 tests/DotCov.Tests/CrapFoldingTests.cs        | 193 +++++++
 tests/DotCov.Tests/DotCovCliEdgeTests.cs      |   9 +-
 .../DotCovCliTestCommandEdgeTests.cs          |   2 +-
 tests/DotCov.Tests/ExcludeTestCodeTests.cs    | 239 +++++++++
 tests/DotCov.Tests/FalloutBuildTests.cs       | 138 ++++-
 tests/DotCov.Tests/FileIdentityCliTests.cs    | 190 +++++++
 tests/DotCov.Tests/FileIdentityTests.cs       | 308 +++++++++++
 .../Infrastructure/DotcovProcess.cs           |  40 ++
 .../DotCov.Tests/Infrastructure/FakeDotnet.cs |  43 ++
 .../DotCov.Tests/MethodCoverageParseTests.cs  |   3 +-
 tests/DotCov.Tests/ParserIntegrityTests.cs    | 349 +++++++++++++
 tests/DotCov.Tests/ParserSourceTests.cs       |  17 +-
 tests/DotCov.Tests/RepositoryBuildTests.cs    |  18 +-
 tests/DotCov.Tests/ThresholdContractTests.cs  | 151 ++++++
 54 files changed, 3448 insertions(+), 548 deletions(-)
 create mode 100644 docs/releases/3.0.0.md
 create mode 100644 src/DotCov/FileIdentity.cs
 create mode 100644 tests/DotCov.Tests/CrapFoldingTests.cs
 create mode 100644 tests/DotCov.Tests/ExcludeTestCodeTests.cs
 create mode 100644 tests/DotCov.Tests/FileIdentityCliTests.cs
 create mode 100644 tests/DotCov.Tests/FileIdentityTests.cs
 create mode 100644 tests/DotCov.Tests/Infrastructure/DotcovProcess.cs
 create mode 100644 tests/DotCov.Tests/Infrastructure/FakeDotnet.cs
 create mode 100644 tests/DotCov.Tests/ParserIntegrityTests.cs
 create mode 100644 tests/DotCov.Tests/ThresholdContractTests.cs

diff --git a/.github/actions/badge/action.yml b/.github/actions/badge/action.yml
index 6df2d8f..c6a6552 100644
--- a/.github/actions/badge/action.yml
+++ b/.github/actions/badge/action.yml
@@ -21,11 +21,15 @@ inputs:
     description: Report file name to scan a directory for ('filename' or '**/filename'). Empty uses dotcov's default.
     default: ''
   min-line:
-    description: Minimum line coverage percentage.
-    default: '80'
+    description: >-
+      Minimum line coverage percentage, 0 to 100. There is no default threshold: set min-line,
+      min-branch, or both; a dimension left empty is not checked.
+    default: ''
   min-branch:
-    description: Minimum branch coverage percentage; above 0 the badge shows the branch rate too.
-    default: '0'
+    description: >-
+      Minimum branch coverage percentage, 0 to 100; above 0 the badge shows the branch rate too.
+      Set min-line, min-branch, or both.
+    default: ''
   args:
     description: Further `dotcov check` arguments, split on whitespace, e.g. `--exclude-generated`.
     default: ''
@@ -42,7 +46,7 @@ inputs:
     default: 'true'
   version:
     description: dotcov.tool version to install.
-    default: '2.0.0'
+    default: '3.0.0'
   command:
     description: >-
       Command that runs dotcov instead of installing it, split on whitespace, e.g.
diff --git a/.github/actions/badge/badge.sh b/.github/actions/badge/badge.sh
index b5c8cbe..335f28a 100755
--- a/.github/actions/badge/badge.sh
+++ b/.github/actions/badge/badge.sh
@@ -40,7 +40,10 @@ else
     dotcov=("$tools/dotcov")
   fi
 
-  args=(check "$DOTCOV_REPORTS" --min-line "$DOTCOV_MIN_LINE" --min-branch "$DOTCOV_MIN_BRANCH" --badge-dir "$badge_dir")
+  # Only the thresholds that were set: dotcov has no default, and rejects a gate without one.
+  args=(check "$DOTCOV_REPORTS" --badge-dir "$badge_dir")
+  if [ -n "$DOTCOV_MIN_LINE" ]; then args+=(--min-line "$DOTCOV_MIN_LINE"); fi
+  if [ -n "$DOTCOV_MIN_BRANCH" ]; then args+=(--min-branch "$DOTCOV_MIN_BRANCH"); fi
   if [ -n "$DOTCOV_PATTERN" ]; then args+=(--pattern "$DOTCOV_PATTERN"); fi
   if [ -n "${DOTCOV_ARGS//[[:space:]]/}" ]; then
     read -ra extra <<<"$DOTCOV_ARGS"
diff --git a/.github/tests/consumer_coverage.py b/.github/tests/consumer_coverage.py
index a453d62..6d865f3 100644
--- a/.github/tests/consumer_coverage.py
+++ b/.github/tests/consumer_coverage.py
@@ -76,8 +76,10 @@ def measure(args):
         files = {file_key(path, root): counts(value["summary"], args.language)
                  for path, value in native["files"].items()}
 
+    # --probe-sources: the job reads the report where the sources are checked out, so each
+    # relative filename resolves against the root that holds it (dotcov's default is lexical).
     dotcov = ["dotnet", tool]
-    actual = json.loads(run([*dotcov, "report", report, "--format", "json"]))
+    actual = json.loads(run([*dotcov, "report", report, "--format", "json", "--probe-sources"]))
     (output / "dotcov.json").write_text(json.dumps(actual, indent=2), encoding="utf-8")
     summary = actual["summary"]
     observed = tuple(summary[key] for key in ("coveredLines", "totalLines", "coveredBranches", "totalBranches"))
@@ -89,7 +91,7 @@ def measure(args):
     }
     assert actual_files == files, f"Per-file mismatch: native {files}; DotCov {actual_files}"
     # ItsDangerous's upstream reporting config also names tests as a source root. Every
-    # measured file exists under exactly one root, so DotCov attributes it without the
+    # measured file exists under exactly one root, so the disk probe attributes it without the
     # multi-root warning; the per-file comparison above proves that attribution.
     warnings = [warning["kind"] for warning in actual.get("warnings", [])]
     assert warnings == [], warnings
@@ -98,7 +100,7 @@ def measure(args):
     assert 0.9 <= line_hit / line_total < 1
     assert 0.9 <= branch_hit / branch_total < 1
     for name, line, branch, code in [("pass", 90, 90, 0), ("line-fail", 100, 90, 1), ("branch-fail", 90, 100, 1)]:
-        text = run([*dotcov, "check", report, "--min-line", line, "--min-branch", branch,
+        text = run([*dotcov, "check", report, "--min-line", line, "--min-branch", branch, "--probe-sources",
                     "--badge-dir", output / f"cli-{name}"], expected=code)
         assert ("PASS:" if code == 0 else "FAIL:") in text
     expected = {"counts": total, "files": len(files), "language": args.language}
diff --git a/.github/tests/readme_badge_coverage.py b/.github/tests/readme_badge_coverage.py
index 301456e..e731131 100644
--- a/.github/tests/readme_badge_coverage.py
+++ b/.github/tests/readme_badge_coverage.py
@@ -132,7 +132,8 @@ def measure(args):
         assert len(historical) == 14, "Missing upstream per-file evidence"
         assert files == historical, f"Fresh coverage differs from the published Python 3.12 run: {files}"
 
-    actual = json.loads(run(["dotnet", tool, "report", report, "--format", "json"]))
+    # --probe-sources: the report is read beside the checked-out sources (dotcov's default is lexical).
+    actual = json.loads(run(["dotnet", tool, "report", report, "--format", "json", "--probe-sources"]))
     (output / "dotcov.json").write_text(json.dumps(actual, indent=2), encoding="utf-8")
     actual_files = {file_key(file["path"], root): tuple(file[key] for key in
                     ("linesHit", "linesTotal", "branchesHit", "branchesTotal")) for file in actual["files"]}
@@ -164,13 +165,13 @@ def measure(args):
                                           ("line-fail", 100, minimum_branch, 1),
                                           ("branch-fail", minimum_line, 100, 1)]:
             text = run(["dotnet", tool, "check", report, "--min-line", line, "--min-branch", branch,
-                        "--badge-dir", output / f"cli-{phase}"], expected=code)
+                        "--probe-sources", "--badge-dir", output / f"cli-{phase}"], expected=code)
             assert ("PASS:" if code == 0 else "FAIL:") in text
         badge_details = {"badgeMessages": messages}
     else:
         assert Decimal(str(summary["lineRate"])) == percent
         text = run(["dotnet", tool, "check", report, "--min-line", percent,
-                    "--min-branch", 100 if total[3] else 0, "--badge-dir", output / "cli-badge"])
+                    "--min-branch", 100 if total[3] else 0, "--probe-sources", "--badge-dir", output / "cli-badge"])
         assert "PASS:" in text
         badge_details = {"badgeMessages": {"pass": f"{percent:.1f}%"}}
     expected = {"target": args.target, "commit": config["commit"],
diff --git a/.github/workflows/nuget-publish.yml b/.github/workflows/nuget-publish.yml
index 485182d..d6fd8d1 100644
--- a/.github/workflows/nuget-publish.yml
+++ b/.github/workflows/nuget-publish.yml
@@ -256,6 +256,7 @@ jobs:
           min-line: '90'
           min-branch: '90'
           command: dotnet src/DotCov.Tool/bin/Release/net10.0/DotCov.Tool.dll
+          args: --probe-sources
       - name: Publish a red badge when the real branch rate fails
         id: fail
         continue-on-error: true
@@ -265,6 +266,7 @@ jobs:
           min-line: '90'
           min-branch: '100'
           command: dotnet src/DotCov.Tool/bin/Release/net10.0/DotCov.Tool.dll
+          args: --probe-sources
       - name: Verify badge values, action outputs and published files
         env:
           PASS_CODE: ${{ steps.pass.outputs.exit-code }}
@@ -383,6 +385,7 @@ jobs:
           min-line: ${{ matrix.min-line }}
           min-branch: ${{ matrix.min-branch }}
           command: dotnet src/DotCov.Tool/bin/Release/net10.0/DotCov.Tool.dll
+          args: --probe-sources
       - name: Compare the action badge with the published upstream percentage
         env:
           BADGE_CODE: ${{ steps.badge.outputs.exit-code }}
@@ -398,6 +401,7 @@ jobs:
           min-line: '100'
           min-branch: ${{ matrix.min-branch }}
           command: dotnet src/DotCov.Tool/bin/Release/net10.0/DotCov.Tool.dll
+          args: --probe-sources
       - name: Require the line gate failure and exact published badge
         if: matrix.target == 'peek-readable'
         env:
@@ -415,6 +419,7 @@ jobs:
           min-line: ${{ matrix.min-line }}
           min-branch: '100'
           command: dotnet src/DotCov.Tool/bin/Release/net10.0/DotCov.Tool.dll
+          args: --probe-sources
       - name: Require the branch gate failure and exact published badge
         if: matrix.target == 'peek-readable'
         env:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9883666..ae3f59d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -782,3 +782,60 @@ Verified:
   `DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=1`.
 - `dotcov report TestResults --pattern "**/dotcov.coverage.cobertura.*.xml" --format json` on the
   coverlet.MTP output: 27 files, line 99.08%, branch 94.41% → badge `99.1%` brightgreen.
+
+## Task 20 — 2026-10-13 — 3.0.0: explicit thresholds, complete CRAP scoring, deterministic file identity
+
+Three gate contracts change and seven counting bugs are fixed, so every number a gate decides
+on may move. Release notes: `docs/releases/3.0.0.md`.
+
+Changed (contracts):
+- Thresholds are explicit. The `"80"` defaults are gone from `check`, `test`
+  (`TryGetThresholds`), the Fallout component (`CoverageParameters.DefaultMinLine`/
+  `DefaultMinBranch` removed; `ICoverageReport.MinLine`/`MinBranch` are `string?`) and the badge
+  action (`min-line`/`min-branch` default empty; `badge.sh` passes only what was set). Neither
+  threshold → usage error before any report is read or `dotnet test` starts (Fallout: build
+  error naming both parameters); one → the other is disabled; both 0 → `Disabled`; outside
+  0–100, NaN or infinity → exit 2. `report --threshold` and the repo wrapper's badge threshold
+  parse follow the same range; `--max-crap` keeps its own grammar (infinity disables).
+- `CrapReport.Evaluate` needs complete scoring: any `Unscored` method → `NoData` naming the
+  count and `--metrics`; zero scored stays `NoData`; otherwise `Fail` above the limit, `Pass`.
+- File identity is lexical by default (`FileIdentity.Lexical`): several roots and a relative
+  filename → first-root key, one `FileIdentityAmbiguous` warning per file naming the candidate
+  roots, `AmbiguousFiles` on `CoverageReport`/`MethodCoverageReport`/`CrapReport`, and `NoData`
+  from `CoverageReport.Evaluate` and `CrapReport.Evaluate`. 2.0's disk probe is opt-in
+  (`FileIdentity.ProbeSources`, `--probe-sources`, `--coverage-probe-sources-param`); an
+  explicit root (`FileIdentity.FromSourceRoot`, `--source-root`, `--coverage-source-root`) must
+  be declared, else `UndeclaredSourceRootException` → exit 2. The mode is a parser parameter
+  (`IdentityScope` per call), never process state; `ReportResolver` resolves report files only
+  and needs no mode.
+- `--exclude-test-code` (`report`, `check`, `crap`, `snapshot`, `test`) and
+  `ExcludeTestCodeParam` select `ExclusionRules.TestCode` through `ExclusionRules.Excluded`;
+  `--keep` exempts from either exclusion. `CoverageReport.Exclude` and the new
+  `MethodCoverageReport.Exclude` (replacing `CrapAnalysis.ExcludeFiles`) record a
+  `FileExclusion`; stderr lists rules and files for table/md output, JSON carries `excluded`
+  and `exclusionRules`, the Fallout target logs them.
+
+Fixed (numbers):
+- `ParseAsync` finishes method-only classes through the same `ClassContext.Complete` as the
+  sync walk (A1).
+- CRAP rows key by file (A2) and synthesized material by its origin's method ordinal (A3,
+  `SyntheticOrigin`); a folded group attaches only to the one same-named method of its file and
+  type, and a method's own state machine never joins an entry with lines.
+- Condition sets that differ between class blocks of one document poison the line like a merge
+  does (A4); per-`<line>` detail must reproduce its own covered count, and `branch="true"`
+  without `condition-coverage` or an unparseable condition warns (A5). Detail that is not 2-way
+  shaped (switch tables, grcov's per-outcome counts) is left out silently, as before.
+- An empty class-level `<lines>` element still decides the file's lines (A6).
+- `PathIdentity.RemoveDotSegments` normalizes `./`, `/./` and `/.` in file names and roots alike;
+  `..` is kept (A7).
+
+Also: `dotcov --version` prints three components (`3.0.0`); `RejectUnusedArguments` split into
+`UnknownOption`/`RejectInvalidValues` so the repo's own CRAP gate stays at or below 30; CI's
+consumer and README-badge jobs pass `--probe-sources` (itsdangerous declares two roots);
+`tests/AGENTS.md` names TUnit 1.74.
+
+Verified:
+- `fallout Coverage`: 100% lines and branches; full suite green. Each A-fix's regression test
+  fails on `5a50ddf` and passes here; each policy has a contract test per command through the
+  CLI entry point and through the Fallout target (`FalloutBuildTests`, `RepositoryBuildTests`);
+  `dotcov test` contracts run against a stand-in dotnet (`FakeDotnet`).
diff --git a/Directory.Build.props b/Directory.Build.props
index 600aa1a..1d5b625 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -12,7 +12,7 @@
 
   <!-- Versioning: CI passes -p:Version=x.y.z -->
   <PropertyGroup>
-    <VersionPrefix Condition="'$(VersionPrefix)' == ''">2.0.0</VersionPrefix>
+    <VersionPrefix Condition="'$(VersionPrefix)' == ''">3.0.0</VersionPrefix>
     <VersionSuffix Condition="'$(VersionSuffix)' == ''">local</VersionSuffix>
     <Version Condition="'$(VersionSuffix)' != ''">$(VersionPrefix)-$(VersionSuffix)</Version>
     <Version Condition="'$(VersionSuffix)' == ''">$(VersionPrefix)</Version>
@@ -26,6 +26,16 @@
     <PackageProjectUrl>$(RepositoryUrl)</PackageProjectUrl>
     <!-- Common core; each packable project appends its own specifics via $(PackageTags). -->
     <PackageTags>coverage;cobertura;code-coverage;testing</PackageTags>
+    <!-- The release's contract changes first, then the fixes with the direction each number moves;
+         docs/releases/$(VersionPrefix).md holds the full notes. -->
+    <PackageReleaseNotes>
+DotCov 3.0.0 changes three gate contracts; every number a gate decides on may move.
+1. Thresholds are explicit: check, test, the Fallout target and the badge action have no default --min-line 80. Pass --min-line, --min-branch, or both (0 to 100); without either the command exits 2 before reading a report.
+2. The CRAP gate needs every method scored: one unscored method makes it NODATA (exit 3). Emitters without a usable complexity attribute need --metrics.
+3. File identity is deterministic: several source roots no longer trigger a disk probe; unresolved files make check, crap and test NODATA until --probe-sources or --source-root.
+Fixes: contradictory condition detail and empty class summaries no longer inflate branch and line rates; condition identity no longer depends on XML packaging; CRAP rows stay per file and per overload, raising diluted scores; ./src/C.cs and src/C.cs count once; ParseAsync finishes method-only classes.
+New: --exclude-test-code. Full notes: https://github.com/ANcpLua/dotcov/blob/main/docs/releases/$(VersionPrefix).md
+    </PackageReleaseNotes>
   </PropertyGroup>
 
   <!-- Package README: without PackageReadmeFile nuget.org renders only <Description> and shows a
diff --git a/README.md b/README.md
index 77c40d6..5249c0b 100644
--- a/README.md
+++ b/README.md
@@ -5,13 +5,23 @@
 Turn Cobertura XML into a build decision — a table, a markdown block, a JSON payload, and an
 exit code your CI can act on. Local by default; uploads are opt-in.
 
-## Migrating from 1.x
+## Migrating to 3.0
 
-Version 2.0 counts some reports differently. Line totals of istanbul reports (Jest, Vitest) drop
-to the tool's own, and coverage.py reports with several `source` roots resolve each file against
-its own root. Commands, flags and exit codes are unchanged. Check thresholds and badges set on
-1.x numbers; the [2.0 release notes](docs/releases/2.0.0.md) have the details. Coming from 0.x,
-read the [1.0 migration notes](docs/releases/1.0.0.md) first.
+Version 3.0 changes three gate contracts, so every number a gate decides on may move:
+
+- **Thresholds are explicit.** `check`, `test`, the Fallout target and the badge action no longer
+  assume `--min-line 80`. Pass `--min-line`, `--min-branch`, or both (0 to 100); without either,
+  the command stops with exit `2` before it reads a report or runs a test.
+- **CRAP needs complete scoring.** One method `crap` cannot score makes the gate `NODATA` (exit
+  `3`) instead of passing it over. Emitters without a usable `complexity` attribute (gcovr
+  placeholders, ReportGenerator merges, some converters) now need `--metrics` to pass at all.
+- **File identity is deterministic.** A report with several `<source>` roots no longer makes
+  DotCov look at the disk. Its relative files stay unresolved, and `check`, `crap` and `test`
+  return `NODATA` until you pass `--probe-sources` (2.0's disk probe) or `--source-root`.
+
+Seven parser and CRAP fixes also move numbers; the [3.0 release notes](docs/releases/3.0.0.md)
+list each one and its direction. Coming from 1.x, read the [2.0 notes](docs/releases/2.0.0.md)
+too; from 0.x, start with the [1.0 migration notes](docs/releases/1.0.0.md).
 
 ## Getting started
 
@@ -60,8 +70,11 @@ dotcov check coverage.xml --min-line 90 --min-branch 90
 Pass the XML file directly to the badge action's `reports` input. This also avoids directory
 search defaults: `coverage.xml` does not match `**/*cobertura*.xml`.
 DotCov checks line and branch percentages separately; coverage.py's displayed total combines them.
-With several coverage.py `source` roots, each file name is relative to the root that contains it.
-DotCov uses the root under which the file exists, so run it where the sources are checked out.
+With several coverage.py `source` roots, each file name is relative to the root that contains it,
+and the report does not say which. DotCov does not guess: it keys such a file under the first
+root, warns, and its gates answer `NODATA`. Where the sources are checked out, add
+`--probe-sources` to resolve each file against the root that holds it on disk; anywhere else,
+`--source-root <root>` names the root.
 
 CI runs the full suites of two pinned upstream projects on Linux, Windows, and macOS:
 
@@ -119,8 +132,8 @@ Package READMEs cover CLI flags, library APIs, and Fallout parameters.
 | Command | Effect |
 |---|---|
 | `dotcov report <path>` | Parse and render as `table`, `json`, or `md`; `--threshold N` highlights files below N% |
-| `dotcov check <path>` | CI gate on `--min-line` (default `80`) and `--min-branch` (default `0`); `--badge-dir <dir>` writes the verdict as a [badge](#badge) |
-| `dotcov crap <path>` | Per-method risk gate, `comp² · (1 − cov)³ + comp`, worst first; `--max-crap` (default `30`), `--top N`, `--metrics <file>` |
+| `dotcov check <path>` | CI gate on `--min-line`, `--min-branch`, or both, 0 to 100, with no default; a dimension left out is not checked. `--badge-dir <dir>` writes the verdict as a [badge](#badge) |
+| `dotcov crap <path>` | Per-method risk gate, `comp² · (1 − cov)³ + comp`, worst first; `--max-crap` (default `30`), `--top N`, `--metrics <file>`. Every method must be scored |
 | `dotcov diff <before> <after>` | Per-file deltas plus lines that flipped in files the change never touched |
 | `dotcov snapshot <path>` | Versioned JSON with `--commit`, `--branch`, `--project`, and a SHA-256 of the reports it read |
 | `dotcov test [<project>]` | Runs `dotnet test` with Microsoft Code Coverage into a fresh `TestResults/<run>`, then reports and gates it like `check`, `--badge-dir` included; arguments after `--` go to `dotnet test` |
@@ -131,12 +144,23 @@ endpoint you control, and `dotcov --help` prints the full flag reference with ex
 the command does not use, a misspelled flag, `--name=value`, or a second path is an error, never
 a silently applied default.
 
+`--exclude-generated` drops generated code, build output, migrations, `GlobalUsings.cs` and
+`Program.cs`; `--exclude-test-code` drops test projects and fixtures (`*.Tests/`,
+`TestSupport/`, `TestFixtures/`); `--keep <substrings>` exempts paths from either. Test code is
+included unless you exclude it. An active exclusion is never silent: stderr lists its rules and
+every excluded file, and JSON output carries them as `excluded` and `exclusionRules`.
+
+`--probe-sources` and `--source-root <root>` decide which `<source>` root a relative file name
+belongs to when a report declares several (see [TypeScript and Python](#typescript-and-python)).
+Probing reads the disk of the machine running DotCov, so its answer depends on where it runs.
+
 Run `dotcov version` or `dotcov --version` to print the version.
 
 ## Outcomes
 
 Since 1.7, usage errors exit `2` (formerly `5`); execution errors remain `5`.
-Omitting a path exits `2`; supplying a nonexistent path exits `5`. Update script branches.
+Omitting a path exits `2`; supplying a nonexistent path exits `5`. Since 3.0, omitting both
+thresholds of `check` or `test` exits `2` as well. Update script branches.
 
 `report`, `diff`, and `snapshot` return `0` when rendering and any requested upload succeed,
 including when the input contains no coverage data. That is command success, not a coverage
@@ -146,10 +170,10 @@ pass. `check`, `crap`, and `test` return `0` only for a measured pass. Outcomes:
 |---|---|---|
 | `PASS:` | Thresholds met | 0 |
 | `FAIL:` | Below a threshold | 1 |
-| `NODATA:` | The gate lacks the data needed to evaluate | 3 |
+| `NODATA:` | The gate lacks the data needed to evaluate: nothing measured, a requested dimension missing, an unscored CRAP method, or a file whose `<source>` root is unresolved | 3 |
 | `DISABLED:` | Both `check` thresholds are `0`, or `crap --max-crap` is infinite | 4 |
 | `error:` | Unreadable/nonexistent path, parse/size-cap error, upload or badge write failure, failed test run | 5 |
-| `error:` or unknown command | Usage: unknown command/flag, invalid value, missing/extra argument | 2 |
+| `error:` or unknown command | Usage: unknown command/flag, invalid value (a threshold outside 0 to 100 included), missing/extra argument, no threshold for `check` or `test`, a `--source-root` no report declares | 2 |
 
 Use `check` when CI must require measured coverage. Branch on the exit code. See the [CLI exit-code contract](src/DotCov.Tool/README.md#exit-codes)
 for details. Percentages are invariant-formatted, so CI logs read `62.0%` on every
@@ -178,7 +202,7 @@ permissions:
 
 steps:
   # … checkout, setup-dotnet, and a test run writing Cobertura to TestResults/
-  - uses: ANcpLua/dotcov/.github/actions/badge@v2.0.0
+  - uses: ANcpLua/dotcov/.github/actions/badge@v3.0.0
     with:
       reports: TestResults
       min-line: 80
@@ -196,7 +220,8 @@ Then show it in your README:
 To render it through shields.io instead, use
 `https://img.shields.io/endpoint?url=<raw url of coverage-badge.json>`.
 
-The step commits only when the badge's contents change, then fails unless the gate passed.
+`min-line` and `min-branch` have no default: set one or both, as for `check`. The step commits
+only when the badge's contents change, then fails unless the gate passed.
 `fail-on-gate: false` keeps `FAIL`, `NODATA` and `DISABLED` green; an error such as an unreadable
 report still fails. The other inputs are `pattern`, `args` (further `dotcov check` flags, such as
 `--exclude-generated`), `branch`, `version` (the `DotCov.Tool` version to install), and `command`
@@ -224,5 +249,5 @@ fallout Coverage                            # tests plus the coverage gate
 ## Feedback
 
 [Issues](https://github.com/ANcpLua/dotcov/issues) ·
-[Release notes](docs/releases/2.0.0.md) ·
+[Release notes](docs/releases/3.0.0.md) ·
 [MIT](LICENSE)
diff --git a/build/Build.cs b/build/Build.cs
index 05a9134..842e7ff 100644
--- a/build/Build.cs
+++ b/build/Build.cs
@@ -170,11 +170,12 @@ private void WriteBadge(GateResult gate)
         File.WriteAllText(Path.Combine(directory, BadgeFormatter.JsonFileName), BadgeFormatter.ShieldsJson(gate));
     }
 
-    // The thresholds the badge's title names; check validates them on every other path.
+    // The thresholds the badge's title names, under check's grammar; check validates them on
+    // every other path.
     private static double Percent(string value, string flag) =>
-        double.TryParse(value, NumberStyles.Float, CultureInfo.InvariantCulture, out var percent)
+        double.TryParse(value, NumberStyles.Float, CultureInfo.InvariantCulture, out var percent) && percent is >= 0 and <= 100
             ? percent
-            : throw new ArgumentException($"Invalid --{flag} value: '{value}' (expected a number).");
+            : throw new ArgumentException($"Invalid --{flag} value: '{value}' (expected a number from 0 to 100).");
 
     private static async Task RunDotCov(string[] args, TextWriter? output = null, string? failure = null)
     {
diff --git a/docs/releases/3.0.0.md b/docs/releases/3.0.0.md
new file mode 100644
index 0000000..85e36cb
--- /dev/null
+++ b/docs/releases/3.0.0.md
@@ -0,0 +1,93 @@
+# DotCov 3.0.0
+
+Three gate contracts change: thresholds are explicit, the CRAP gate needs every method scored,
+and file identity no longer depends on the machine reading the report. Seven fixes change what
+DotCov counts. Every number a gate decides on may move, so re-check thresholds and badges set on
+2.x numbers.
+
+## What changes in your gates
+
+- **Thresholds are explicit.** `check`, `test`, the Fallout `ReportCoverage` target and the badge
+  action no longer assume `--min-line 80`. Pass `--min-line`, `--min-branch`, or both. Without
+  either, `check` and `test` exit `2` before they read a report or start `dotnet test`, the
+  Fallout target fails naming `Coverage MinLine` and `Coverage MinBranch`, and the badge action
+  fails with dotcov's exit `2`. One threshold checks its dimension and leaves the other
+  unchecked; both at `0` is `DISABLED` (exit `4`). A threshold outside 0 to 100, NaN or infinity
+  is a usage error (exit `2`), and `report --threshold` follows the same range.
+- **The CRAP gate needs complete scoring.** One method `crap` cannot score — no usable
+  complexity, or no lines — makes the verdict `NODATA` (exit `3`); 2.x listed it and passed the
+  rest. The reason names the count and the `--metrics` remedy, and the unscored and
+  unmatched-metrics lists still print in every format. Emitters without a usable `complexity`
+  attribute (gcovr placeholders, ReportGenerator merges, some converters) now need `--metrics` to
+  pass at all.
+- **File identity is deterministic.** A report with several `<source>` roots no longer makes
+  DotCov look at the disk. A relative file name keeps a key under the first root, gets a
+  `FileIdentityAmbiguous` warning naming its candidate roots, and `check`, `crap`, `test` and the
+  Fallout target answer `NODATA` (exit `3`): "N files have ambiguous identity across M source
+  roots; re-run with --probe-sources on the machine that holds the sources or supply
+  --source-root". `report` prints as usual with the warning. `--probe-sources` restores 2.0's
+  disk probe, whose answer depends on the machine running it; `--source-root <root>` names a
+  declared root, and a root no report declares exits `2`. The Fallout target has the same modes
+  as `--coverage-probe-sources-param` and `--coverage-source-root`.
+
+## What changes in your numbers
+
+- **Contradictory condition detail no longer lifts a line (lower branch rates).** A Coverlet
+  `<condition>` set that claims more covered outcomes than its own line's `condition-coverage`
+  — detail at 100% on a `(0/2)` line — used to raise the line to `(2/2)`. Such detail is now
+  dropped with a `MalformedConditionCoverage` warning, and the line keeps its own aggregate. A
+  `branch="true"` line without `condition-coverage`, and a condition that cannot be parsed, warn
+  too instead of passing silently.
+- **An empty class summary decides the file (lower line rates).** `<lines/>` and
+  `<lines></lines>` now count as the class's own statement that it has no lines, as a non-empty
+  summary always did: istanbul's method declaration lines no longer stand in. A file with only
+  that empty summary reads `NODATA` instead of `100%`.
+- **Condition identity does not depend on packaging (lower branch rates).** Two `<class>`
+  blocks of one document that report the same line with different condition numbers now fall
+  back to the line aggregate with a `ConditionIdentityMismatch` warning — exactly what merging
+  the same blocks as two documents did. 2.x unioned them into a total no emitter reported.
+- **CRAP rows stay per file (higher CRAP scores).** The same type and method in two files (two
+  assemblies' `Ns.T.M(Int32)`) were one row averaging both. They are two rows now, and the
+  uncovered one keeps its own score.
+- **Overloads keep their own async and lambda bodies (higher CRAP scores).** All state machines
+  and lambdas of a method name shared one row, so `M(int)` and `M(string)` averaged their lines.
+  Synthesized code now groups by its origin's method ordinal (`<M>d__0` vs `<M>d__1`) and joins
+  a named method only when that origin is proven; a method's own async body never joins a
+  synchronous overload.
+- **`./src/C.cs` and `src/C.cs` are one file (no double counting).** Redundant `.` segments are
+  removed from file names and roots alike; `..` is kept and the disk is never read. Totals drop
+  where one file was counted under two spellings.
+- **The async parser finishes every class (higher line totals on `ParseAsync`).** A class whose
+  lines sit only under `<methods>` contributed nothing to `CoberturaParser.ParseAsync`; it now
+  gives the same report as `Parse`.
+
+## New
+
+`--exclude-test-code` on `report`, `check`, `crap`, `snapshot` and `test` (and
+`--coverage-exclude-test-code-param` on the Fallout target) drops test projects and fixtures
+(`*.Tests/`, `TestSupport/`, `TestFixtures/`) through the same predicate as
+`--exclude-generated`; `--keep` exempts paths from either. Test code still counts unless you
+exclude it. An active exclusion is never silent: stderr lists its rules and every excluded file
+for table and markdown output, and JSON carries `excluded` and `exclusionRules`.
+
+## Library API
+
+`CoberturaParser.Parse`, `ParseAsync` and `ParseMethods` take a `FileIdentity`
+(`Lexical`, `ProbeSources`, `FromSourceRoot(root)`); in `ParseAsync` it precedes the
+cancellation token. Reports carry `AmbiguousFiles` and `Exclusion` (`FileExclusion`).
+`MethodCoverageReport.Exclude` replaces `CrapAnalysis.ExcludeFiles`, and
+`CrapAnalysis.Analyze(MethodCoverageReport)` carries both onto the `CrapReport`. An undeclared
+explicit root throws `UndeclaredSourceRootException`. `ICoverageReport.MinLine` and `MinBranch`
+are `string?` without a default.
+
+## Upgrade
+
+```bash
+dotnet tool update -g DotCov.Tool --version 3.0.0
+```
+
+Add a threshold wherever a gate relied on the default 80. Update the badge action to
+`ANcpLua/dotcov/.github/actions/badge@v3.0.0` and set `min-line`, `min-branch`, or both. Where
+a coverage.py report declares several `source` roots, add `--probe-sources` on the machine that
+holds the sources, or `--source-root`. Update the `DotCov` and `DotCov.Fallout` package
+references to `3.0.0`.
diff --git a/src/DotCov.Fallout/CoverageParameters.cs b/src/DotCov.Fallout/CoverageParameters.cs
index a87dd1b..5d6270b 100644
--- a/src/DotCov.Fallout/CoverageParameters.cs
+++ b/src/DotCov.Fallout/CoverageParameters.cs
@@ -6,44 +6,66 @@ internal enum CoverageFormat { Table, Json, Markdown }
 
 /// <summary>
 /// The validated form of <see cref="ICoverageReport"/>'s parameters. Every value is parsed
-/// exactly once, at the build boundary, with the same grammar the CLI uses: invariant
-/// numbers, digits-only character cap, strict <c>true</c>/<c>false</c>, the <c>md</c> alias,
-/// and the <see cref="ReportPattern"/> shapes. Anything else fails naming the parameter.
+/// exactly once, at the build boundary, with the same grammar the CLI uses: percentages from 0
+/// to 100 with no default threshold, digits-only character cap, strict <c>true</c>/<c>false</c>,
+/// the <c>md</c> alias, the <see cref="ReportPattern"/> shapes, and one file-identity mode.
+/// Anything else fails naming the parameter.
 /// </summary>
 internal sealed record CoverageParameters(
     double MinLine,
     double MinBranch,
     CoverageFormat Format,
     bool ExcludeGenerated,
+    bool ExcludeTestCode,
     ReportPattern Pattern,
-    long MaxChars)
+    long MaxChars,
+    FileIdentity Identity)
 {
-    public const string DefaultMinLine = "80";
-    public const string DefaultMinBranch = "0";
     public const string DefaultFormat = "table";
     public const string DefaultExcludeGenerated = "false";
+    public const string DefaultExcludeTestCode = "false";
     public const string DefaultPattern = ReportPattern.DefaultText;
     public const string DefaultMaxChars = "50000000";
     public const string DefaultBadgeDirectory = "";
+    public const string DefaultProbeSources = "false";
 
     public static CoverageParameters Parse(
-        string minLine, string minBranch, string format, string excludeGenerated, string pattern, string maxChars) =>
-        new(
-            ParseThreshold(minLine, "Coverage MinLine"),
-            ParseThreshold(minBranch, "Coverage MinBranch"),
+        string? minLine, string? minBranch, string format, string excludeGenerated, string excludeTestCode,
+        string pattern, string maxChars, string probeSources, string? sourceRoot)
+    {
+        // No default threshold: a gate nobody set a threshold for would pass on a number nobody chose.
+        if (minLine is null && minBranch is null)
+            throw new ArgumentException(
+                "Missing Coverage MinLine and Coverage MinBranch: the coverage gate has no default threshold. " +
+                "Set --coverage-min-line, --coverage-min-branch, or both (0 to 100; 0 disables a dimension).");
+
+        return new CoverageParameters(
+            minLine is null ? 0 : ParseThreshold(minLine, "Coverage MinLine"),
+            minBranch is null ? 0 : ParseThreshold(minBranch, "Coverage MinBranch"),
             ParseFormat(format, "Coverage Format"),
             ParseFlag(excludeGenerated, "Coverage ExcludeGeneratedParam"),
+            ParseFlag(excludeTestCode, "Coverage ExcludeTestCodeParam"),
             ParsePattern(pattern, "Coverage Pattern"),
-            ParseMaxChars(maxChars, "Coverage MaxCharsParam"));
+            ParseMaxChars(maxChars, "Coverage MaxCharsParam"),
+            ParseIdentity(ParseFlag(probeSources, "Coverage ProbeSourcesParam"), sourceRoot));
+    }
+
+    /// <summary>The exclusion patterns the two flags select; empty when neither is set.</summary>
+    public IReadOnlyList<string> ExclusionPatterns =>
+    [
+        .. ExcludeGenerated ? ExclusionRules.WellKnown : [],
+        .. ExcludeTestCode ? ExclusionRules.TestCode : [],
+    ];
 
     /// <summary>
-    /// Culture-invariant number; a comma decimal separator is garbage, not 80.5. NaN is rejected
-    /// as the CLI rejects it: every comparison against NaN is false, so it gates nothing.
+    /// A finite, culture-invariant number from 0 to 100; a comma decimal separator is garbage,
+    /// not 80.5. NaN is rejected as the CLI rejects it: every comparison against NaN is false,
+    /// so it gates nothing; above 100 nothing could pass, and below 0 nothing could fail.
     /// </summary>
     public static double ParseThreshold(string value, string parameterName) =>
-        double.TryParse(value, NumberStyles.Float, CultureInfo.InvariantCulture, out var parsed) && !double.IsNaN(parsed)
+        double.TryParse(value, NumberStyles.Float, CultureInfo.InvariantCulture, out var parsed) && parsed is >= 0 and <= 100
             ? parsed
-            : throw new ArgumentException($"Invalid {parameterName}: '{value}' (expected a number).");
+            : throw new ArgumentException($"Invalid {parameterName}: '{value}' (expected a number from 0 to 100).");
 
     /// <summary>Digits only: a sign or separator is invalid, so negatives never reach the XML reader. 0 = no cap.</summary>
     public static long ParseMaxChars(string value, string parameterName) =>
@@ -74,4 +96,20 @@ public static ReportPattern ParsePattern(string value, string parameterName) =>
             ? parsed
             : throw new ArgumentException(
                 $"Invalid {parameterName}: '{value}' (only 'filename' and '**/filename' are supported).");
+
+    /// <summary>
+    /// The CLI's three file-identity modes: lexical by default, disk probing with
+    /// ProbeSourcesParam, one declared root with SourceRoot. An empty SourceRoot is unset, like
+    /// an empty BadgeDirectory; setting both is a contradiction, not a precedence rule.
+    /// </summary>
+    public static FileIdentity ParseIdentity(bool probeSources, string? sourceRoot)
+    {
+        if (string.IsNullOrWhiteSpace(sourceRoot))
+            return probeSources ? FileIdentity.ProbeSources : FileIdentity.Lexical;
+
+        return probeSources
+            ? throw new ArgumentException(
+                "Coverage ProbeSourcesParam and Coverage SourceRoot are alternatives: set one of them.")
+            : FileIdentity.FromSourceRoot(sourceRoot);
+    }
 }
diff --git a/src/DotCov.Fallout/ICoverageReport.cs b/src/DotCov.Fallout/ICoverageReport.cs
index 17784ae..a9ac607 100644
--- a/src/DotCov.Fallout/ICoverageReport.cs
+++ b/src/DotCov.Fallout/ICoverageReport.cs
@@ -14,18 +14,19 @@ namespace DotCov.Fallout;
 ///   fallout ReportCoverage --coverage-min-line 80
 ///
 /// <see cref="ReportCoverage"/> attaches itself to <see cref="ICompile"/> when the build
-/// implements it and runs on its own otherwise. The gate policy is fail-closed: only
-/// <see cref="GateOutcome.Pass"/> succeeds; a failed, unmeasurable, or disabled gate fails
-/// the target with a distinct message.
+/// implements it and runs on its own otherwise. There is no default threshold: MinLine,
+/// MinBranch, or both must be set, or the target fails before reading a report. The gate
+/// policy is fail-closed: only <see cref="GateOutcome.Pass"/> succeeds; a failed, unmeasurable,
+/// or disabled gate fails the target with a distinct message.
 /// </summary>
 [ParameterPrefix("Coverage")]
 public interface ICoverageReport : IFalloutBuild
 {
-    [Parameter("Minimum line coverage percentage")]
-    string MinLine => TryGetValue(() => MinLine) ?? CoverageParameters.DefaultMinLine;
+    [Parameter("Minimum line coverage percentage, 0 to 100; set MinLine, MinBranch, or both")]
+    string? MinLine => TryGetValue(() => MinLine);
 
-    [Parameter("Minimum branch coverage percentage")]
-    string MinBranch => TryGetValue(() => MinBranch) ?? CoverageParameters.DefaultMinBranch;
+    [Parameter("Minimum branch coverage percentage, 0 to 100; set MinLine, MinBranch, or both")]
+    string? MinBranch => TryGetValue(() => MinBranch);
 
     [Parameter("Output format: table, json, markdown (md)")]
     string Format => TryGetValue(() => Format) ?? CoverageParameters.DefaultFormat;
@@ -33,6 +34,15 @@ public interface ICoverageReport : IFalloutBuild
     [Parameter("Exclude generated files, migrations, GlobalUsings.cs, Program.cs (true/false)")]
     string ExcludeGeneratedParam => TryGetValue(() => ExcludeGeneratedParam) ?? CoverageParameters.DefaultExcludeGenerated;
 
+    [Parameter("Exclude test projects and fixtures: *.Tests/, TestSupport/, TestFixtures/ (true/false)")]
+    string ExcludeTestCodeParam => TryGetValue(() => ExcludeTestCodeParam) ?? CoverageParameters.DefaultExcludeTestCode;
+
+    [Parameter("Resolve a relative filename under several <source> roots against the root that holds it on this machine's disk (true/false)")]
+    string ProbeSourcesParam => TryGetValue(() => ProbeSourcesParam) ?? CoverageParameters.DefaultProbeSources;
+
+    [Parameter("Resolve a relative filename under several <source> roots against this declared root")]
+    string? SourceRoot => TryGetValue(() => SourceRoot);
+
     [Parameter("Report file name pattern: 'filename' or '**/filename' (gcovr and coverage.py emit coverage.xml)")]
     string Pattern => TryGetValue(() => Pattern) ?? CoverageParameters.DefaultPattern;
 
@@ -50,7 +60,8 @@ public interface ICoverageReport : IFalloutBuild
         .Executes(() =>
         {
             var parameters = CoverageParameters.Parse(
-                MinLine, MinBranch, Format, ExcludeGeneratedParam, Pattern, MaxCharsParam);
+                MinLine, MinBranch, Format, ExcludeGeneratedParam, ExcludeTestCodeParam, Pattern, MaxCharsParam,
+                ProbeSourcesParam, SourceRoot);
 
             var searchDirectory = CoverageSearchDirectory.ToString();
             Assert.True(Directory.Exists(searchDirectory),
@@ -66,14 +77,18 @@ public interface ICoverageReport : IFalloutBuild
                 Log.Information("Merging {Count} coverage reports: {Reports}",
                     inputs.Count, inputs.Select(static input => input.SourceName));
 
-            var report = ParseReports(inputs, parameters.MaxChars);
-            if (parameters.ExcludeGenerated)
-                report = report.Exclude(ExclusionRules.WellKnown);
+            var report = ParseReports(inputs, parameters.MaxChars, parameters.Identity)
+                .Exclude(parameters.ExclusionPatterns);
 
             foreach (var warning in report.Warnings)
                 Log.Warning("Coverage warning ({Kind}) {File}:{Line}: {Detail}",
                     warning.Kind, warning.File, warning.Line, warning.Detail);
 
+            // A number computed without some files says which, like the CLI's stderr listing.
+            if (report.Exclusion.IsActive)
+                Log.Information("Excluded {Count} files by {Rules}: {Files}",
+                    report.Exclusion.ExcludedFiles.Count, report.Exclusion.Patterns, report.Exclusion.ExcludedFiles);
+
             var gate = report.Evaluate(parameters.MinLine, parameters.MinBranch);
 
             // Rendered at most once: the markdown serves both the terminal (when selected)
@@ -121,24 +136,32 @@ public interface ICoverageReport : IFalloutBuild
             }
         });
 
-    /// <summary>Parse at the target boundary: a malformed report fails the target naming the file and XML coordinates.</summary>
-    private static CoverageReport ParseReports(IReadOnlyList<ReportInput> inputs, long maxChars)
+    /// <summary>
+    /// Parse at the target boundary: a malformed report fails the target naming the file and XML
+    /// coordinates, and a SourceRoot no report declares fails naming the parameter.
+    /// </summary>
+    private static CoverageReport ParseReports(IReadOnlyList<ReportInput> inputs, long maxChars, FileIdentity identity)
     {
         CoverageReport? report = null;
-        ReportParseException? failure = null;
+        Exception? failure = null;
+        string? message = null;
         try
         {
-            report = CoberturaParser.Parse(inputs, maxChars);
+            report = CoberturaParser.Parse(inputs, maxChars, identity);
         }
         catch (ReportParseException ex)
         {
-            failure = ex;
+            (failure, message) = (ex, $"Could not parse coverage report {ex.SourceName} (line {ex.LineNumber}, position {ex.LinePosition}): {ex.Message}");
+        }
+        catch (UndeclaredSourceRootException ex)
+        {
+            (failure, message) = (ex, $"Invalid Coverage SourceRoot: {ex.Message}");
         }
 
-        // Failed outside the catch block, so no statement has to follow Assert.Fail, which
+        // Failed outside the catch blocks, so no statement has to follow Assert.Fail, which
         // throws: only a successful parse reaches the return.
         if (failure is not null)
-            Assert.Fail($"Could not parse coverage report {failure.SourceName} (line {failure.LineNumber}, position {failure.LinePosition}): {failure.Message}", failure);
+            Assert.Fail(message!, failure);
 
         return report!;
     }
diff --git a/src/DotCov.Fallout/README.md b/src/DotCov.Fallout/README.md
index 166ac66..625e3ad 100644
--- a/src/DotCov.Fallout/README.md
+++ b/src/DotCov.Fallout/README.md
@@ -34,7 +34,9 @@ class Build : FalloutBuild, ICoverageReport { }
 fallout ReportCoverage --coverage-min-line 80 --coverage-exclude-generated-param true
 ```
 
-That is the whole setup. `ReportCoverage` searches `RootDirectory / "TestResults"` for
+That is the whole setup. There is no default threshold: set `--coverage-min-line`,
+`--coverage-min-branch`, or both, or the target fails naming them before it reads a report.
+`ReportCoverage` searches `RootDirectory / "TestResults"` for
 `**/*cobertura*.xml` (including timestamped MTP reports and hidden directories), merges everything it finds, renders
 the chosen format, appends a markdown block to `$GITHUB_STEP_SUMMARY` when that variable is
 set, and fails the build when line or branch coverage is below threshold.
@@ -46,10 +48,13 @@ build without requiring you to implement `ICompile`.
 
 | Parameter | Default | Effect |
 |---|---|---|
-| `--coverage-min-line` | `80` | Minimum line coverage percentage (invariant number) |
-| `--coverage-min-branch` | `0` | Minimum branch coverage percentage |
+| `--coverage-min-line` | none | Minimum line coverage percentage, 0 to 100 (invariant number); set it, `--coverage-min-branch`, or both |
+| `--coverage-min-branch` | none | Minimum branch coverage percentage, 0 to 100; a dimension left unset is not checked |
 | `--coverage-format` | `table` | `table`, `json`, `markdown`, or `md` |
 | `--coverage-exclude-generated-param` | `false` | `true`/`false`: apply `ExclusionRules.WellKnown` before gating |
+| `--coverage-exclude-test-code-param` | `false` | `true`/`false`: apply `ExclusionRules.TestCode` before gating; the excluded files are logged |
+| `--coverage-probe-sources-param` | `false` | `true`/`false`: resolve a relative file name under several `<source>` roots against the root that holds it on this machine's disk |
+| `--coverage-source-root` | empty (off) | Resolve such file names against this declared root instead |
 | `--coverage-pattern` | `**/*cobertura*.xml` | `filename` (top level) or `**/filename` (recursive) |
 | `--coverage-max-chars-param` | `50000000` | Per-file XML character cap; `0` disables it |
 | `--coverage-badge-directory` | empty (off) | Write `coverage-badge.svg` and `coverage-badge.json` here, relative to the root, for every outcome |
@@ -64,14 +69,17 @@ somewhere other than `RootDirectory / "TestResults"`.
 |---|---|
 | Search directory missing | Target fails: `Coverage search directory '…' does not exist` |
 | Directory exists, no matching report | Target fails: `No files matching '…' found in …` |
+| No threshold set, or one outside 0 to 100 | Target fails before reading a report, naming `Coverage MinLine`/`Coverage MinBranch` |
 | Reports parsed, but nothing measured | Target fails: `Coverage could not be measured: NODATA: …` |
+| Several `<source>` roots, file identity unresolved | Target fails: `Coverage could not be measured: NODATA: … ambiguous identity …` |
+| `--coverage-source-root` not declared by any report | Target fails: `Invalid Coverage SourceRoot: …` |
 | Coverage below a threshold | Target fails: `Coverage below threshold: FAIL: …` |
 | Every threshold is `0` | Target fails: `Coverage gate is disabled …` |
 | Thresholds met | Target succeeds; the verdict is logged |
 | Thresholds met, badge directory unwritable | Target fails: `Coverage gate passed, but its badge could not be written: …` |
 
-Parser warnings (malformed hit counts, ambiguous source roots, …) are logged one per line
-and never change the verdict. The badge is written before a failing verdict fails the target, so
+Parser warnings (malformed hit counts, contradictory branch data, ambiguous source roots, …) are
+logged one per line. Only an unresolved file identity changes the verdict, to `NODATA`. The badge is written before a failing verdict fails the target, so
 a drop turns it red; its colour is the outcome, and its message the line rate, plus the branch
 rate when a branch minimum is set. A non-passing gate keeps its own failure message when the badge
 cannot be written. To publish it to a branch, pass the directory to the
diff --git a/src/DotCov.Tool/DotCovCli.Test.cs b/src/DotCov.Tool/DotCovCli.Test.cs
index b7d2324..848332c 100644
--- a/src/DotCov.Tool/DotCovCli.Test.cs
+++ b/src/DotCov.Tool/DotCovCli.Test.cs
@@ -19,13 +19,9 @@ public static partial class DotCovCli
     static async Task<int> Test(
         Dictionary<string, string> opts, string[] forwarded, TextWriter stdout, TextWriter stderr, bool color)
     {
-        // Flag values are checked before anything runs: a typo must not cost a test run.
-        if (!TryParsePercent("min-line", opts.GetValueOrDefault("min-line", "80"), stderr, out var minLine))
-            return UsageExitCode;
-
-        if (!TryParsePercent("min-branch", opts.GetValueOrDefault("min-branch", "0"), stderr, out var minBranch))
-            return UsageExitCode;
-
+        // Flag values are checked before anything runs: a typo, or a missing threshold, must not
+        // cost a test run.
+        if (!TryGetThresholds("test", opts, stderr, out var minLine, out var minBranch)) return UsageExitCode;
         if (!TryGetBadgeDir(opts, stderr)) return UsageExitCode;
 
         // A fresh directory per run, so the gate reads this run's reports and nothing an earlier
@@ -39,7 +35,7 @@ static async Task<int> Test(
         if (exitCode is not 0)
             throw new CliError($"dotnet test exited with code {exitCode}; coverage was not evaluated.");
 
-        var (merged, inputs) = ParseInput(results, ReportPattern.Default, DefaultMaxChars);
+        var (merged, inputs) = ParseInput(results, ReportPattern.Default, DefaultMaxChars, Identity(opts));
         var report = ApplyExclusions(merged, opts);
         // The table is rendered from the same evaluation as the verdict, so a failing dimension's
         // TOTAL floors like the verdict does: 19999/20000 against --min-line 100 reads 99.9%
diff --git a/src/DotCov.Tool/DotCovCli.cs b/src/DotCov.Tool/DotCovCli.cs
index 6865039..195cd76 100644
--- a/src/DotCov.Tool/DotCovCli.cs
+++ b/src/DotCov.Tool/DotCovCli.cs
@@ -55,12 +55,14 @@ public static async Task<int> RunAsync(string[] args, TextWriter stdout, TextWri
             // Expected failure modes — missing/unreadable paths, malformed metrics XML — get a
             // one-line actionable message, never a stack trace.
             await stderr.WriteLineAsync($"error: {ex.Message}");
-            return ex is UsageError ? UsageExitCode : ErrorExitCode;
+            // A --source-root no report declares is a request that cannot be honored, not a
+            // report that could not be read.
+            return ex is UsageError or UndeclaredSourceRootException ? UsageExitCode : ErrorExitCode;
         }
     }
 
     static bool IsExpectedFailure(Exception ex) =>
-        ex is UsageError or CliError or XmlException or IOException or UnauthorizedAccessException;
+        ex is UsageError or CliError or UndeclaredSourceRootException or XmlException or IOException or UnauthorizedAccessException;
 
     // Not async: each arm hands back its command's Task, so a synchronous command's exception
     // still surfaces inside RunAsync's try, and the switch stays one branch per command.
@@ -90,7 +92,7 @@ static async Task<int> Report(Dictionary<string, string> opts, TextWriter stdout
     {
         if (!opts.TryGetValue("file", out var path))
         {
-            await stderr.WriteLineAsync("error: missing path. Usage: dotcov report <path> [--format table|json|md] [--threshold N] [--exclude-generated]");
+            await stderr.WriteLineAsync("error: missing path. Usage: dotcov report <path> [--format table|json|md] [--threshold N] [--exclude-generated] [--exclude-test-code]");
             return UsageExitCode;
         }
 
@@ -105,7 +107,7 @@ static async Task<int> Report(Dictionary<string, string> opts, TextWriter stdout
 
         if (!TryGetParseOptions(opts, stderr, out var pattern, out var maxChars)) return UsageExitCode;
 
-        var (merged, inputs) = ParseInput(path, pattern, maxChars);
+        var (merged, inputs) = ParseInput(path, pattern, maxChars, Identity(opts));
         var report = ApplyExclusions(merged, opts);
 
         var output = format switch
@@ -124,7 +126,9 @@ static async Task<int> Report(Dictionary<string, string> opts, TextWriter stdout
             WriteGitHubSummary(MarkdownFormatter.Format(report, threshold), stderr);
 
         // The table shows only a warning count; markdown and JSON already list each warning.
-        WriteDiagnostics(path, inputs, format is "table" ? report.Warnings : [], stderr);
+        // JSON carries the exclusion itself; the other formats name it on stderr.
+        WriteDiagnostics(path, inputs, format is "table" ? report.Warnings : [],
+            format is "json" ? FileExclusion.None : report.Exclusion, stderr);
         return exitCode;
     }
 
@@ -132,20 +136,15 @@ static async Task<int> Check(Dictionary<string, string> opts, TextWriter stdout,
     {
         if (!opts.TryGetValue("file", out var path))
         {
-            await stderr.WriteLineAsync("error: missing path. Usage: dotcov check <path> --min-line N [--min-branch N] [--exclude-generated]");
+            await stderr.WriteLineAsync("error: missing path. Usage: dotcov check <path> [--min-line N] [--min-branch N] (at least one) [--exclude-generated] [--exclude-test-code]");
             return UsageExitCode;
         }
 
-        if (!TryParsePercent("min-line", opts.GetValueOrDefault("min-line", "80"), stderr, out var minLine))
-            return UsageExitCode;
-
-        if (!TryParsePercent("min-branch", opts.GetValueOrDefault("min-branch", "0"), stderr, out var minBranch))
-            return UsageExitCode;
-
+        if (!TryGetThresholds("check", opts, stderr, out var minLine, out var minBranch)) return UsageExitCode;
         if (!TryGetParseOptions(opts, stderr, out var pattern, out var maxChars)) return UsageExitCode;
         if (!TryGetBadgeDir(opts, stderr)) return UsageExitCode;
 
-        var (merged, inputs) = ParseInput(path, pattern, maxChars);
+        var (merged, inputs) = ParseInput(path, pattern, maxChars, Identity(opts));
         var report = ApplyExclusions(merged, opts);
         return await Gate(report, report.Evaluate(minLine, minBranch), path, inputs, opts, stdout, stderr);
     }
@@ -178,7 +177,7 @@ void WriteSummary()
             var badgeWritten = WriteBadge(opts, gate, stderr);
             var exitCode = await MaybeUpload(opts, () => JsonFormatter.Format(report), stderr);
             WriteSummary();
-            WriteDiagnostics(path, inputs, report.Warnings, stderr);
+            WriteDiagnostics(path, inputs, report.Warnings, report.Exclusion, stderr);
             return badgeWritten ? exitCode : ErrorExitCode;
         }
 
@@ -197,7 +196,7 @@ void WriteSummary()
         }
 
         WriteSummary();
-        WriteDiagnostics(path, inputs, report.Warnings, stderr);
+        WriteDiagnostics(path, inputs, report.Warnings, report.Exclusion, stderr);
 
         // Failing runs write their badge and upload too — red runs are the ones a badge and a
         // coverage dashboard most need to show. The non-passing gate's exit code wins regardless
@@ -229,17 +228,17 @@ static int Crap(Dictionary<string, string> opts, TextWriter stdout, TextWriter s
         // Default 30 — the original CRAP threshold (crap4j). A fully covered method scores its
         // own complexity, so a lower default fails well-tested code on complexity alone;
         // --max-crap 6 opts into that stricter gate.
-        if (!TryParsePercent("max-crap", opts.GetValueOrDefault("max-crap", "30"), stderr, out var maxCrap))
+        if (!TryParseNumber("max-crap", opts.GetValueOrDefault("max-crap", "30"), stderr, out var maxCrap))
             return UsageExitCode;
 
         if (!TryGetTop(opts, stderr, out var top)) return UsageExitCode;
         if (!TryGetParseOptions(opts, stderr, out var pattern, out var maxChars)) return UsageExitCode;
 
         var inputs = ResolveInputs(path, pattern);
-        var parsed = CoberturaParser.ParseMethods(inputs, maxChars);
-        var methods = ApplyMethodExclusions(parsed.Methods, opts);
-        var report = CrapAnalysis.Analyze(methods, LoadMetrics(opts, maxChars));
+        var parsed = CoberturaParser.ParseMethods(inputs, maxChars, Identity(opts));
+        var report = CrapAnalysis.Analyze(ApplyExclusions(parsed, opts), LoadMetrics(opts, maxChars));
         var gate = report.Evaluate(maxCrap);
+        var exclusion = format is "json" ? FileExclusion.None : report.Exclusion;
 
         stdout.Write(RenderCrap(format, report, gate, top, color));
 
@@ -258,14 +257,14 @@ void WriteSummary()
             if (format is not "json")
                 stdout.WriteLine(gate.ToString());
             WriteSummary();
-            WriteDiagnostics(path, inputs, parsed.Warnings, stderr);
+            WriteDiagnostics(path, inputs, parsed.Warnings, exclusion, stderr);
             return 0;
         }
 
         // Use the same distinct non-passing outcomes as check and test.
         stderr.WriteLine(gate.ToString());
         WriteSummary();
-        WriteDiagnostics(path, inputs, parsed.Warnings, stderr);
+        WriteDiagnostics(path, inputs, parsed.Warnings, exclusion, stderr);
         return NonPassingGateExitCode(gate.Outcome);
     }
 
@@ -316,8 +315,9 @@ static int Diff(Dictionary<string, string> opts, TextWriter stdout, TextWriter s
 
         if (!TryGetParseOptions(opts, stderr, out var pattern, out var maxChars)) return UsageExitCode;
 
-        var (beforeReport, beforeInputs) = ParseInput(before, pattern, maxChars);
-        var (afterReport, afterInputs) = ParseInput(after, pattern, maxChars);
+        var identity = Identity(opts);
+        var (beforeReport, beforeInputs) = ParseInput(before, pattern, maxChars, identity);
+        var (afterReport, afterInputs) = ParseInput(after, pattern, maxChars, identity);
         var result = CoverageDiff.Compare(beforeReport, afterReport);
 
         stdout.Write(format switch
@@ -327,8 +327,8 @@ static int Diff(Dictionary<string, string> opts, TextWriter stdout, TextWriter s
             _ => TableFormatter.FormatDiff(result, color)
         });
 
-        WriteDiagnostics(before, beforeInputs, beforeReport.Warnings, stderr);
-        WriteDiagnostics(after, afterInputs, afterReport.Warnings, stderr);
+        WriteDiagnostics(before, beforeInputs, beforeReport.Warnings, FileExclusion.None, stderr);
+        WriteDiagnostics(after, afterInputs, afterReport.Warnings, FileExclusion.None, stderr);
         return 0;
     }
 
@@ -342,7 +342,7 @@ static async Task<int> Snapshot(Dictionary<string, string> opts, TextWriter stdo
 
         if (!TryGetParseOptions(opts, stderr, out var pattern, out var maxChars)) return UsageExitCode;
 
-        var (merged, inputs) = ParseInput(path, pattern, maxChars);
+        var (merged, inputs) = ParseInput(path, pattern, maxChars, Identity(opts));
         var report = ApplyExclusions(merged, opts);
         var fileHash = HashInputs(inputs);
 
@@ -376,9 +376,10 @@ static async Task<int> Snapshot(Dictionary<string, string> opts, TextWriter stdo
         return exitCode;
     }
 
+    // The package version's three components: the assembly version's fourth is always 0.
     static int Version(TextWriter stdout)
     {
-        stdout.WriteLine($"dotcov {typeof(CoberturaParser).Assembly.GetName().Version}");
+        stdout.WriteLine($"dotcov {typeof(CoberturaParser).Assembly.GetName().Version!.ToString(3)}");
         return 0;
     }
 
@@ -396,26 +397,39 @@ static int Help(TextWriter stdout)
 
             Commands:
               report   <path> [--format table|json|md] [--threshold N]    Parse and display coverage
-              check    <path> --min-line N [--min-branch N]               CI gate (exit 1 if below)
+              check    <path> --min-line N and/or --min-branch N          CI gate (exit 1 if below)
               crap     <path> [--metrics <file>] [--max-crap N] [--top N] CRAP gate: comp^2*(1-cov)^3+comp
                        [--format table|json|md]                           per method (exit 1 if any method
                                                                           is strictly above --max-crap;
-                                                                          at-threshold passes; default 30)
+                                                                          at-threshold passes; default 30;
+                                                                          every method must be scored)
               diff     <before> <after> [--format table|json|md]          Compare two reports
               snapshot <path> [--commit SHA] [--branch B] [--project P]   Create pipeline-ready JSON
                                                                           (identity defaults to 'unknown')
-              test     [<project>] [--min-line N] [--min-branch N]        Run dotnet test with coverage into
+              test     [<project>] --min-line N and/or --min-branch N     Run dotnet test with coverage into
                        [-- <dotnet test arguments>]                       a fresh TestResults/<run>, then
                                                                           report and gate it like check
               version, --version                                          Show version
 
+            Thresholds (check, test) are percentages from 0 to 100, and there is no default: pass
+            --min-line, --min-branch, or both. A dimension left out is not checked; 0 disables one.
+            Without either, check and test exit 2 before reading a report or running a test.
+
             Shared flags (a flag the command does not use is an error, never ignored):
               --exclude-generated       Skip generated files, migrations, GlobalUsings.cs, Program.cs
                                         (report, check, crap, snapshot, test)
-              --keep <substrings>       Exempt comma-separated paths from --exclude-generated by
+              --exclude-test-code       Skip test projects and fixtures: *.Tests/, TestSupport/,
+                                        TestFixtures/ (report, check, crap, snapshot, test)
+              --keep <substrings>       Exempt comma-separated paths from both exclusions by
                                         case-insensitive substring match, not globs; requires
-                                        --exclude-generated (e.g. --keep Program.cs to measure a
-                                        CLI tool's entry point)
+                                        --exclude-generated or --exclude-test-code (e.g. --keep
+                                        Program.cs to measure a CLI tool's entry point)
+              --probe-sources           Resolve a relative filename under several <source> roots
+                                        against the root that holds it on this machine's disk;
+                                        the result depends on where dotcov runs
+              --source-root <path>      Resolve those filenames against this declared root instead
+                                        (--probe-sources and --source-root: every command that
+                                        reads a report)
               --pattern <glob>          Report filename to scan directories for: 'filename'
                                         (top level only) or '**/filename' (recursive)
                                         (default {{ReportPattern.DefaultText}})
@@ -430,6 +444,15 @@ Shared flags (a flag the command does not use is an error, never ignored):
             Every match is merged; when there is more than one, stderr lists them after the result.
             Give each test run a fresh results directory so an earlier run's report is not merged.
 
+            With an exclusion active, stderr lists its rules and every excluded file once; JSON
+            output (report --format json, crap --format json, snapshot) carries them as "excluded"
+            and "exclusionRules" instead.
+
+            A report that declares several <source> roots does not say which root a relative
+            filename belongs to. By default dotcov never guesses from the disk: the file is keyed
+            under the first root with a warning, report prints as usual, and check, crap, and test
+            exit 3 (NODATA) until --probe-sources or --source-root resolves it.
+
             test passes the coverage options of the runner dotnet test uses in this directory
             (DOTNET_TEST_RUNNER, else global.json test.runner, else VSTest). MTP test projects need
             Microsoft.Testing.Extensions.CodeCoverage; VSTest projects get the Code Coverage collector
@@ -439,25 +462,29 @@ without evaluating coverage.
             Exit codes:
               0  success; check, crap, and test require a measured pass
               1  FAIL: below a threshold
-              2  usage error: unknown command/flag, invalid value, missing/extra argument
-              3  NODATA: missing measurements
+              2  usage error: unknown command/flag, invalid value, missing/extra argument, no
+                 threshold (check, test), a --source-root no report declares
+              3  NODATA: missing measurements, an unscored CRAP method, an ambiguous file identity
               4  DISABLED: no active threshold
               5  error: supplied path unavailable, parse/IO/size-cap error, upload or badge write failure,
                  failed test run
             A non-passing gate keeps its exit code even if an upload or badge write also fails.
 
-            crap needs cyclomatic complexity per method: coverlet embeds it in the coverage XML
+            crap needs cyclomatic complexity for every method: coverlet embeds it in the coverage XML
             (used automatically); for other emitters pass --metrics <file> produced by
-            `dotnet msbuild /t:Metrics` (Microsoft.CodeAnalysis.Metrics package).
+            `dotnet msbuild /t:Metrics` (Microsoft.CodeAnalysis.Metrics package). A method without
+            it is listed as unscored, and the gate exits 3 rather than vouch for code it did not score.
 
             Examples:
               dotcov report TestResults/
               dotcov report coverage.cobertura.xml --format json --exclude-generated > coverage.json
               dotcov check TestResults/ --min-line 80 --exclude-generated --github-summary
               dotcov check TestResults/ --min-line 90 --min-branch 80 --badge-dir badge
+              dotcov check TestResults/ --min-branch 75 --exclude-test-code
               dotcov crap TestResults/ --max-crap 6 --github-summary
               dotcov crap coverage.cobertura.xml --metrics MyApp.Metrics.xml --top 10
               dotcov report gcovr-output/ --pattern "**/coverage.xml"   # non-Coverlet report names
+              dotcov check coverage.xml --min-line 85 --source-root src   # several <source> roots
               dotcov report TestResults/ --exclude-generated --keep Program.cs   # measure host bootstrap
               dotcov snapshot TestResults/ --commit abc123 --branch main --project MyApp --upload https://qyl/api/v1/coverage
               dotcov diff before.cobertura.xml after.cobertura.xml --format md
@@ -495,12 +522,23 @@ static IReadOnlyList<ReportInput> ResolveInputs(string path, ReportPattern patte
     }
 
     /// <summary>Parse and merge what <paramref name="path"/> resolves to; the inputs come back so they can be named.</summary>
-    static (CoverageReport Report, IReadOnlyList<ReportInput> Inputs) ParseInput(string path, ReportPattern pattern, long maxChars)
+    static (CoverageReport Report, IReadOnlyList<ReportInput> Inputs) ParseInput(
+        string path, ReportPattern pattern, long maxChars, FileIdentity identity)
     {
         var inputs = ResolveInputs(path, pattern);
-        return (CoberturaParser.Parse(inputs, maxChars), inputs);
+        return (CoberturaParser.Parse(inputs, maxChars, identity), inputs);
     }
 
+    /// <summary>
+    /// --probe-sources / --source-root: how relative filenames resolve under several declared
+    /// roots. Lexical by default, so the same report gives the same keys on every machine.
+    /// The two flags were checked for conflict and emptiness before anything was read.
+    /// </summary>
+    static FileIdentity Identity(Dictionary<string, string> opts) =>
+        opts.TryGetValue("source-root", out var root) ? FileIdentity.FromSourceRoot(root)
+        : opts.ContainsKey("probe-sources") ? FileIdentity.ProbeSources
+        : FileIdentity.Lexical;
+
     /// <summary>
     /// Every report a path resolved to, when there was more than one. All matches are merged, so
     /// a report an earlier run left in the same directory silently lifts the result; naming them
@@ -515,14 +553,32 @@ static void WriteInputs(string path, IReadOnlyList<ReportInput> inputs, TextWrit
             stderr.WriteLine($"  {input.SourceName}");
     }
 
-    /// <summary>A gate's diagnostics, after its verdict: every warning, then the merged reports.</summary>
+    /// <summary>A gate's diagnostics, after its verdict: every warning, the exclusion, then the merged reports.</summary>
     static void WriteDiagnostics(
-        string path, IReadOnlyList<ReportInput> inputs, IReadOnlyList<CoverageWarning> warnings, TextWriter stderr)
+        string path, IReadOnlyList<ReportInput> inputs, IReadOnlyList<CoverageWarning> warnings,
+        FileExclusion exclusion, TextWriter stderr)
     {
         WriteWarnings(warnings, stderr);
+        WriteExclusion(exclusion, stderr);
         WriteInputs(path, inputs, stderr);
     }
 
+    /// <summary>
+    /// An active exclusion, named once: its rules, the --keep exemptions, and every file it
+    /// removed — a number computed without them must say so.
+    /// </summary>
+    static void WriteExclusion(FileExclusion exclusion, TextWriter stderr)
+    {
+        if (!exclusion.IsActive) return;
+
+        stderr.WriteLine($"exclusion rules: {string.Join(", ", exclusion.Patterns)}");
+        if (exclusion.Keep.Count > 0)
+            stderr.WriteLine($"kept by --keep: {string.Join(", ", exclusion.Keep)}");
+        stderr.WriteLine(FormattableString.Invariant($"excluded {exclusion.ExcludedFiles.Count} files:"));
+        foreach (var file in exclusion.ExcludedFiles)
+            stderr.WriteLine($"  {file}");
+    }
+
     /// <summary>
     /// SHA-256 over the resolved reports in resolution order: for a single file exactly
     /// <see cref="FileHasher.ComputeHash"/>, for a directory the set that was merged. Null when
@@ -545,18 +601,9 @@ static void WriteDiagnostics(
         return Convert.ToHexStringLower(sha256.GetHashAndReset());
     }
 
-    /// <summary>Method-level twin of <see cref="ApplyExclusions"/> — same flags, same rule set.</summary>
-    static IReadOnlyList<MethodCoverage> ApplyMethodExclusions(
-        IReadOnlyList<MethodCoverage> methods, Dictionary<string, string> opts)
-    {
-        if (!opts.ContainsKey("exclude-generated")) return methods;
-
-        var keep = opts.TryGetValue("keep", out var raw)
-            ? raw.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)
-            : [];
-
-        return CrapAnalysis.ExcludeFiles(methods, ExclusionRules.WellKnown, keep);
-    }
+    /// <summary>Method-level twin of <see cref="ApplyExclusions(CoverageReport, Dictionary{string, string})"/> — same flags, same rule set.</summary>
+    static MethodCoverageReport ApplyExclusions(MethodCoverageReport report, Dictionary<string, string> opts) =>
+        report.Exclude(ExclusionPatterns(opts), KeepPatterns(opts));
 
     /// <summary>Resolve --pattern / --max-chars for the commands that parse coverage input.</summary>
     static bool TryGetParseOptions(
@@ -627,9 +674,41 @@ static bool TryGetFormat(Dictionary<string, string> opts, TextWriter stderr, out
         return false;
     }
 
-    // NaN is rejected alongside unparseable input: every comparison against NaN is false, so a
-    // NaN threshold renders as "NaN%" while gating nothing.
+    /// <summary>
+    /// --min-line / --min-branch for check and test. There is no default: a gate nobody set
+    /// a threshold for would pass on a number nobody chose. One flag checks its dimension and
+    /// disables the other; both at 0 is the DISABLED gate.
+    /// </summary>
+    static bool TryGetThresholds(
+        string command, Dictionary<string, string> opts, TextWriter stderr, out double minLine, out double minBranch)
+    {
+        minLine = minBranch = 0;
+        var hasLine = opts.TryGetValue("min-line", out var line);
+        var hasBranch = opts.TryGetValue("min-branch", out var branch);
+        if (!hasLine && !hasBranch)
+        {
+            stderr.WriteLine($"error: missing threshold: '{command}' needs --min-line N, --min-branch N, or both (0 to 100; 0 disables a dimension).");
+            return false;
+        }
+
+        return (!hasLine || TryParsePercent("min-line", line!, stderr, out minLine)) &&
+               (!hasBranch || TryParsePercent("min-branch", branch!, stderr, out minBranch));
+    }
+
+    // A percentage is a finite number from 0 to 100. NaN is rejected alongside unparseable
+    // input: every comparison against NaN is false, so a NaN threshold renders as "NaN%" while
+    // gating nothing; 150 or infinity could never pass, and a negative value never fails.
     static bool TryParsePercent(string flag, string raw, TextWriter stderr, out double value)
+    {
+        if (double.TryParse(raw, NumberStyles.Float, CultureInfo.InvariantCulture, out value) && value is >= 0 and <= 100)
+            return true;
+
+        stderr.WriteLine($"error: Invalid --{flag} value: '{raw}' (expected a number from 0 to 100).");
+        return false;
+    }
+
+    // Any number but NaN: an infinite --max-crap is the documented way to disable the CRAP gate.
+    static bool TryParseNumber(string flag, string raw, TextWriter stderr, out double value)
     {
         if (double.TryParse(raw, NumberStyles.Float, CultureInfo.InvariantCulture, out value) && !double.IsNaN(value))
             return true;
@@ -638,17 +717,23 @@ static bool TryParsePercent(string flag, string raw, TextWriter stderr, out doub
         return false;
     }
 
-    static CoverageReport ApplyExclusions(CoverageReport report, Dictionary<string, string> opts)
+    static CoverageReport ApplyExclusions(CoverageReport report, Dictionary<string, string> opts) =>
+        report.Exclude(ExclusionPatterns(opts), KeepPatterns(opts));
+
+    /// <summary>The rule sets the exclusion flags select; empty when neither is set, which excludes nothing.</summary>
+    static List<string> ExclusionPatterns(Dictionary<string, string> opts)
     {
-        if (!opts.ContainsKey("exclude-generated")) return report;
+        List<string> patterns = [];
+        if (opts.ContainsKey("exclude-generated")) patterns.AddRange(ExclusionRules.WellKnown);
+        if (opts.ContainsKey("exclude-test-code")) patterns.AddRange(ExclusionRules.TestCode);
+        return patterns;
+    }
 
-        var keep = opts.TryGetValue("keep", out var raw)
+    static string[] KeepPatterns(Dictionary<string, string> opts) =>
+        opts.TryGetValue("keep", out var raw)
             ? raw.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)
             : [];
 
-        return report.Exclude(ExclusionRules.WellKnown, keep);
-    }
-
     // Display flooring for a rate in a FAILING dimension, one decimal: 79.96% renders 79.9%,
     // never a rounded-up 80.0% that reads as equal to the minimum it missed. GateResult owns
     // this policy (its ToString and the markdown gate overload apply the same floor through
@@ -719,15 +804,21 @@ static async Task<int> MaybeUpload(Dictionary<string, string> opts, Func<string>
     {
         ["help"] = [],
         ["version"] = [],
-        ["report"] = Accept("file", "format", "threshold", "exclude-generated", "keep", "pattern", "max-chars", "github-summary", "upload"),
-        ["check"] = Accept("file", "min-line", "min-branch", "exclude-generated", "keep", "pattern", "max-chars", "github-summary", "upload", "badge-dir"),
-        ["crap"] = Accept("file", "format", "max-crap", "top", "metrics", "exclude-generated", "keep", "pattern", "max-chars", "github-summary"),
-        ["diff"] = Accept("before", "after", "format", "pattern", "max-chars"),
-        ["snapshot"] = Accept("file", "commit", "branch", "project", "exclude-generated", "keep", "pattern", "max-chars", "upload"),
-        ["test"] = Accept("file", "min-line", "min-branch", "exclude-generated", "keep", "github-summary", "badge-dir"),
+        ["report"] = Accept("file", "format", "threshold", Exclusion, Identities, "pattern", "max-chars", "github-summary", "upload"),
+        ["check"] = Accept("file", "min-line", "min-branch", Exclusion, Identities, "pattern", "max-chars", "github-summary", "upload", "badge-dir"),
+        ["crap"] = Accept("file", "format", "max-crap", "top", "metrics", Exclusion, Identities, "pattern", "max-chars", "github-summary"),
+        ["diff"] = Accept("before", "after", "format", Identities, "pattern", "max-chars"),
+        ["snapshot"] = Accept("file", "commit", "branch", "project", Exclusion, Identities, "pattern", "max-chars", "upload"),
+        ["test"] = Accept("file", "min-line", "min-branch", Exclusion, Identities, "github-summary", "badge-dir"),
     };
 
-    static HashSet<string> Accept(params string[] names) => new(names, StringComparer.OrdinalIgnoreCase);
+    // Option groups several commands share: the exclusion flags and the file-identity flags.
+    const string Exclusion = "exclude-generated exclude-test-code keep";
+    const string Identities = "probe-sources source-root";
+
+    static HashSet<string> Accept(params string[] names) =>
+        new(names.SelectMany(static n => n.Split(' ')), StringComparer.OrdinalIgnoreCase);
+
 
     /// <summary>Fail before any report is read or test is run when an argument would otherwise be ignored.</summary>
     static void RejectUnusedArguments(
@@ -740,50 +831,63 @@ static void RejectUnusedArguments(
 
         foreach (var (key, value) in options)
         {
-            if (accepted.Contains(key))
-            {
-                if (value.Length is 0 && (IsPathSlot(command, key) || key.Equals("metrics", StringComparison.OrdinalIgnoreCase)))
-                    throw new UsageError("missing path: the path argument is empty.");
-                continue;
-            }
-
-            // Parse files every path beyond the ones a command takes as "arg<N>".
-            if (key.StartsWith("arg", StringComparison.Ordinal) &&
-                int.TryParse(key.AsSpan(3), NumberStyles.None, CultureInfo.InvariantCulture, out _))
-                throw new UsageError(command is "test"
-                    ? $"Unexpected argument '{value}' for 'test'. Pass dotnet test arguments after '--'."
-                    : $"Unexpected argument '{value}' for '{command}'. To merge several reports, pass their directory.");
-
-            var equalsSign = key.IndexOf('=');
-            throw new UsageError(equalsSign > 0
-                // A valueless flag written with a value: the space-separated form would fail
-                // again, its value becoming a stray positional argument.
-                ? ValuelessFlags.Contains(key[..equalsSign])
-                    ? $"Unknown option '--{key}' for '{command}'. '--{key[..equalsSign]}' takes no value."
-                    : $"Unknown option '--{key}' for '{command}'. Write '--{key[..equalsSign]} {key[(equalsSign + 1)..]}'."
-                : command is "test"
-                    ? $"Unknown option '--{key}' for 'test'. Pass dotnet test arguments after '--'."
-                    : $"Unknown option '--{key}' for '{command}'.");
+            if (!accepted.Contains(key)) throw UnknownOption(command, key, value);
+            if (value.Length is 0 && (IsPathSlot(command, key) || key.Equals("metrics", StringComparison.OrdinalIgnoreCase)))
+                throw new UsageError("missing path: the path argument is empty.");
         }
 
         // What the dictionary cannot show: a flag that got no value, or one spelled like a path.
         if (malformed.Count > 0)
             throw new UsageError(malformed[0]);
 
+        RejectInvalidValues(options);
+    }
+
+    /// <summary>The error for an option the command does not take, worded for what it most likely is.</summary>
+    static UsageError UnknownOption(string command, string key, string value)
+    {
+        // Parse files every path beyond the ones a command takes as "arg<N>".
+        if (key.StartsWith("arg", StringComparison.Ordinal) &&
+            int.TryParse(key.AsSpan(3), NumberStyles.None, CultureInfo.InvariantCulture, out _))
+            return new UsageError(command is "test"
+                ? $"Unexpected argument '{value}' for 'test'. Pass dotnet test arguments after '--'."
+                : $"Unexpected argument '{value}' for '{command}'. To merge several reports, pass their directory.");
+
+        var equalsSign = key.IndexOf('=');
+        return new UsageError(equalsSign > 0
+            // A valueless flag written with a value: the space-separated form would fail
+            // again, its value becoming a stray positional argument.
+            ? ValuelessFlags.Contains(key[..equalsSign])
+                ? $"Unknown option '--{key}' for '{command}'. '--{key[..equalsSign]}' takes no value."
+                : $"Unknown option '--{key}' for '{command}'. Write '--{key[..equalsSign]} {key[(equalsSign + 1)..]}'."
+            : command is "test"
+                ? $"Unknown option '--{key}' for 'test'. Pass dotnet test arguments after '--'."
+                : $"Unknown option '--{key}' for '{command}'.");
+    }
+
+    /// <summary>Accepted options whose value, or whose combination with another, cannot be honored.</summary>
+    static void RejectInvalidValues(Dictionary<string, string> options)
+    {
         if (options.TryGetValue("upload", out var url) &&
             (!Uri.TryCreate(url, UriKind.Absolute, out var uri) || uri.Scheme is not ("http" or "https")))
             throw new UsageError($"Invalid --upload value: '{url}' (expected an absolute http(s) URL).");
 
-        // --keep only exempts files from --exclude-generated; on its own it would change nothing.
-        if (options.ContainsKey("keep") && !options.ContainsKey("exclude-generated"))
-            throw new UsageError("--keep only applies together with --exclude-generated.");
+        // --keep only exempts files from an exclusion; on its own it would change nothing.
+        if (options.ContainsKey("keep") && !options.ContainsKey("exclude-generated") && !options.ContainsKey("exclude-test-code"))
+            throw new UsageError("--keep only applies together with --exclude-generated or --exclude-test-code.");
+
+        if (options.ContainsKey("probe-sources") && options.ContainsKey("source-root"))
+            throw new UsageError("--probe-sources and --source-root are alternatives: pass one of them.");
+
+        if (options.TryGetValue("source-root", out var root) && string.IsNullOrWhiteSpace(root))
+            throw new UsageError($"Invalid --source-root value: '{root}' (expected a declared <source> root).");
     }
 
     // Flags that never take a value. Recorded as "true" the moment the token is seen, so a
     // following non-dash token stays positional: `report --exclude-generated cov.xml` must not
     // swallow the path as the flag's value. Comparer matches the parsed dictionary's.
     static readonly HashSet<string> ValuelessFlags =
-        new(StringComparer.OrdinalIgnoreCase) { "exclude-generated", "github-summary" };
+        new(StringComparer.OrdinalIgnoreCase) { "exclude-generated", "exclude-test-code", "probe-sources", "github-summary" };
 
     /// <summary>
     /// Maps argv to the command and its options, plus an error for each flag the dictionary
diff --git a/src/DotCov.Tool/README.md b/src/DotCov.Tool/README.md
index 9ada42a..ab0fd2a 100644
--- a/src/DotCov.Tool/README.md
+++ b/src/DotCov.Tool/README.md
@@ -37,6 +37,10 @@ dotcov snapshot TestResults/ --commit SHA --branch main --project MyApp
 dotcov test     tests/MyApp.Tests --min-line 80 -- -c Release    # dotnet test, then report and gate
 ```
 
+`check` and `test` have no default threshold: pass `--min-line`, `--min-branch`, or both, each a
+percentage from 0 to 100. A dimension left out is not checked; without either flag the command
+exits `2` before it reads a report or runs a test.
+
 `--github-summary` writes the markdown table to `$GITHUB_STEP_SUMMARY` on pass **and** fail, so a
 green build still shows its number. `--badge-dir <dir>` on `check` and `test` writes the verdict as
 `coverage-badge.svg` and `coverage-badge.json`, coloured by the outcome; the
@@ -62,7 +66,8 @@ starts with the verdict. A failed test run exits `5` with `error:` and no covera
 
 Since 1.7, usage errors exit `2` instead of `5`; update scripts accordingly. A missing
 path argument exits `2`; a supplied nonexistent path exits `5`. Invalid upload URLs
-are usage errors; HTTP/connection failures remain execution errors.
+are usage errors; HTTP/connection failures remain execution errors. Since 3.0, `check` and `test`
+without a threshold exit `2`, and so does a `--source-root` no report declares.
 
 `check`, `crap`, and `test` return `0` only for a measured pass:
 
@@ -70,10 +75,10 @@ are usage errors; HTTP/connection failures remain execution errors.
 |---|---|---|
 | `PASS:` | met the threshold | 0 |
 | `FAIL:` | below the threshold | 1 |
-| `NODATA:` | the gate lacks the data needed to evaluate | 3 |
+| `NODATA:` | the gate lacks the data needed to evaluate: nothing measured, a requested dimension missing, an unscored CRAP method, or a file whose `<source>` root is unresolved | 3 |
 | `DISABLED:` | both `check` thresholds are 0, or `crap --max-crap` is infinite, so the gate cannot fail | 4 |
 | `error:` | unreadable/nonexistent path, parse/size-cap error, upload or badge write failure, failed test run | 5 |
-| `error:` or unknown command | usage: unknown command/flag, invalid value, missing/extra argument | 2 |
+| `error:` or unknown command | usage: unknown command/flag, invalid value (a threshold outside 0 to 100 included), missing/extra argument, no threshold for `check` or `test`, a `--source-root` no report declares | 2 |
 
 `report`, `diff`, and `snapshot` return `0` when rendering and any requested upload succeed.
 A passing gate whose badge cannot be written returns `5`; a non-passing gate keeps its code if an
@@ -113,12 +118,21 @@ from coverlet's per-method attribute automatically; for emitters that write none
 `--metrics` from `dotnet msbuild /t:Metrics`
 ([Microsoft.CodeAnalysis.Metrics](https://www.nuget.org/packages/Microsoft.CodeAnalysis.Metrics)).
 
+The gate needs every method scored. A method without complexity, or without lines, is listed as
+unscored in every format, and one such method makes the verdict `NODATA` (exit `3`): it may be
+the method above the limit. Emitters without a usable `complexity` attribute (gcovr
+placeholders, ReportGenerator merges, some converters) therefore need `--metrics` to pass at all.
+
 ## Flags
 
 | Flag | Effect |
 |---|---|
+| `--min-line <n>`, `--min-branch <n>` | `check`, `test`: thresholds from 0 to 100, no default; set one or both |
 | `--exclude-generated` | Skip `.g.cs`, `.designer.cs`, `/obj/`, `/bin/`, `/Migrations/`, `GlobalUsings.cs`, `Program.cs` |
-| `--keep <subs>` | Comma-separated substrings exempt from `--exclude-generated`; requires it |
+| `--exclude-test-code` | Skip test projects and fixtures: `*.Tests/`, `TestSupport/`, `TestFixtures/`. Test code counts unless you set it |
+| `--keep <subs>` | Comma-separated substrings exempt from both exclusions; requires one of them |
+| `--probe-sources` | Several `<source>` roots: resolve each relative file name against the root that holds it on this machine's disk |
+| `--source-root <root>` | Several `<source>` roots: resolve relative file names against this declared root |
 | `--pattern <glob>` | Filename to scan for. Default `**/*cobertura*.xml`, including timestamped MTP reports |
 | `--max-chars <n>` | Per-file XML character cap. Default `50000000`; `0` = uncapped |
 | `--format` | `table`, `json`, `md` |
@@ -128,6 +142,16 @@ from coverlet's per-method attribute automatically; for emitters that write none
 
 Commands reject unused flags, `--name=value`, and extra paths; see `dotcov --help`.
 
+An active exclusion is named once: stderr lists its rules and every excluded file for table and
+markdown output, and JSON output (`report --format json`, `crap --format json`, `snapshot`)
+carries `excluded` and `exclusionRules` instead.
+
+A report with several `<source>` roots does not say which root a relative file name belongs to.
+By default DotCov never reads the disk to guess: the file is keyed under the first root with a
+`FileIdentityAmbiguous` warning, `report` prints as usual, and `check`, `crap` and `test` exit
+`3`. `--probe-sources` restores 2.0's disk probe — its answer depends on the machine running it,
+so run it where the sources are checked out — and `--source-root` names the root anywhere.
+
 `dotcov version` and `dotcov --version` print the version. Percentages use `62.0%` on every host.
 
 ## Also in this family
diff --git a/src/DotCov/CoberturaParser.Methods.cs b/src/DotCov/CoberturaParser.Methods.cs
index 75de99c..d484b7d 100644
--- a/src/DotCov/CoberturaParser.Methods.cs
+++ b/src/DotCov/CoberturaParser.Methods.cs
@@ -14,13 +14,16 @@ public static partial class CoberturaParser
     /// method name, signature) — including compiler-synthesized classes (state machines,
     /// lambda display classes); interpretation belongs to <see cref="CrapAnalysis"/>. Reports
     /// without <c>&lt;methods&gt;</c> detail (the original Cobertura summary shape, MTP's
-    /// emitter) produce an empty method list, never a throw.
+    /// emitter) produce an empty method list, never a throw. File keys follow
+    /// <paramref name="identity"/> exactly as <see cref="Parse(Stream, long, FileIdentity)"/> does.
     /// </summary>
-    public static MethodCoverageReport ParseMethods(Stream stream, long maxChars = DefaultMaxChars)
+    public static MethodCoverageReport ParseMethods(Stream stream, long maxChars = DefaultMaxChars, FileIdentity? identity = null)
     {
-        using var reader = CreateReader(stream, maxChars, async: false);
+        var scope = new IdentityScope(identity);
         var methods = new MethodCollector();
-        CollectMethods(reader, methods);
+        using (var reader = CreateReader(stream, maxChars, async: false))
+            CollectMethods(reader, methods, scope, sourceName: null);
+        scope.RequireDeclaredRoot();
         return methods.Materialize();
     }
 
@@ -28,20 +31,22 @@ public static MethodCoverageReport ParseMethods(Stream stream, long maxChars = D
     /// Parse one input; the stream is opened and disposed here. Malformed XML surfaces as
     /// <see cref="ReportParseException"/> naming the input.
     /// </summary>
-    public static MethodCoverageReport ParseMethods(ReportInput input, long maxChars = DefaultMaxChars)
+    public static MethodCoverageReport ParseMethods(ReportInput input, long maxChars = DefaultMaxChars, FileIdentity? identity = null)
     {
         ArgumentNullException.ThrowIfNull(input);
-        return ParseMethods([input], maxChars);
+        return ParseMethods([input], maxChars, identity);
     }
 
     /// <summary>
     /// Parse every input into one method set. The same method entry across inputs merges per
-    /// line with <c>Math.Max</c>, mirroring the file-level union-with-max semantics; warnings
-    /// and source roots of every document are carried into the result.
+    /// line with <c>Math.Max</c>, mirroring the file-level union-with-max semantics; warnings,
+    /// source roots and unresolved file identities of every document are carried into the result.
     /// </summary>
-    public static MethodCoverageReport ParseMethods(IEnumerable<ReportInput> inputs, long maxChars = DefaultMaxChars)
+    public static MethodCoverageReport ParseMethods(
+        IEnumerable<ReportInput> inputs, long maxChars = DefaultMaxChars, FileIdentity? identity = null)
     {
         ArgumentNullException.ThrowIfNull(inputs);
+        var scope = new IdentityScope(identity);
         var methods = new MethodCollector();
         foreach (var input in inputs)
         {
@@ -50,7 +55,7 @@ public static MethodCoverageReport ParseMethods(IEnumerable<ReportInput> inputs,
             try
             {
                 using var reader = CreateReader(stream, maxChars, async: false);
-                CollectMethods(reader, methods);
+                CollectMethods(reader, methods, scope, input.SourceName);
             }
             catch (XmlException ex)
             {
@@ -58,15 +63,17 @@ public static MethodCoverageReport ParseMethods(IEnumerable<ReportInput> inputs,
             }
         }
 
+        scope.RequireDeclaredRoot();
         return methods.Materialize();
     }
 
     /// <summary>Walk one document into <paramref name="methods"/>; roots are per document, warnings accumulate.</summary>
-    private static void CollectMethods(XmlReader reader, MethodCollector methods)
+    private static void CollectMethods(XmlReader reader, MethodCollector methods, IdentityScope scope, string? sourceName)
     {
-        var document = new DocumentContext();
+        var document = new DocumentContext(scope, sourceName);
         while (reader.Read())
             Visit(reader, document, files: null, methods);
+        document.Finish();
         methods.Complete(document);
     }
 
@@ -83,6 +90,7 @@ private sealed class MethodCollector
         private readonly List<Entry> _order = [];
         private readonly List<CoverageWarning> _warnings = [];
         private readonly List<string> _sourceRoots = [];
+        private readonly List<AmbiguousFile> _ambiguous = [];
 
         public Entry For(MethodKey key, int? complexity)
         {
@@ -100,6 +108,7 @@ public Entry For(MethodKey key, int? complexity)
         public void Complete(DocumentContext document)
         {
             _warnings.AddRange(document.Warnings);
+            _ambiguous.AddRange(document.AmbiguousFiles);
             if (document.SourceRoots is [""]) return;
             foreach (var root in document.SourceRoots)
                 if (!_sourceRoots.Any(r => string.Equals(PathIdentity.NormalizeRoot(r), PathIdentity.NormalizeRoot(root), StringComparison.Ordinal)))
@@ -111,7 +120,10 @@ public MethodCoverageReport Materialize()
             var result = new List<MethodCoverage>(_order.Count);
             foreach (var entry in _order)
                 result.Add(entry.Materialize());
-            return new MethodCoverageReport(result, _warnings, _sourceRoots);
+            return new MethodCoverageReport(result, _warnings, _sourceRoots)
+            {
+                AmbiguousFiles = AmbiguousFile.Union(_ambiguous)
+            };
         }
 
         public sealed class Entry(MethodKey key)
diff --git a/src/DotCov/CoberturaParser.cs b/src/DotCov/CoberturaParser.cs
index 9c4f59a..e78de13 100644
--- a/src/DotCov/CoberturaParser.cs
+++ b/src/DotCov/CoberturaParser.cs
@@ -2,6 +2,7 @@
 using System.Numerics;
 using System.Text.RegularExpressions;
 using System.Xml;
+using static System.FormattableString;
 
 namespace DotCov;
 
@@ -13,9 +14,9 @@ namespace DotCov;
 /// <para>
 /// Both aggregations share one traversal and one set of decoding rules (file-name identity,
 /// line numbers, hit counts); they differ only in what they collect. The file aggregation
-/// (<see cref="Parse(Stream, long)"/>) folds every <c>&lt;line&gt;</c> of a source file into
+/// (<see cref="Parse(Stream, long, FileIdentity)"/>) folds every <c>&lt;line&gt;</c> of a source file into
 /// one per-file line set — including the class-level summary lines. The method aggregation
-/// (<see cref="ParseMethods(Stream, long)"/>) keeps every <c>&lt;method&gt;</c> distinct and
+/// (<see cref="ParseMethods(Stream, long, FileIdentity)"/>) keeps every <c>&lt;method&gt;</c> distinct and
 /// ignores the class-level summary.
 /// </para>
 /// </summary>
@@ -23,25 +24,28 @@ public static partial class CoberturaParser
 {
     private const long DefaultMaxChars = 50_000_000;
 
-    public static CoverageReport Parse(Stream stream, long maxChars = DefaultMaxChars)
+    /// <summary>
+    /// Parse one document the caller owns (the stream is not disposed). <paramref name="identity"/>
+    /// decides how relative filenames resolve under several declared roots; null is
+    /// <see cref="FileIdentity.Lexical"/>.
+    /// </summary>
+    public static CoverageReport Parse(Stream stream, long maxChars = DefaultMaxChars, FileIdentity? identity = null)
     {
-        using var reader = CreateReader(stream, maxChars, async: false);
-        var document = new DocumentContext();
-        var files = new FileCollector();
-
-        while (reader.Read())
-            Visit(reader, document, files, methods: null);
-
-        return files.Materialize(document);
+        var scope = new IdentityScope(identity);
+        var report = ParseDocument(stream, maxChars, scope, sourceName: null);
+        scope.RequireDeclaredRoot();
+        return report;
     }
 
+    /// <inheritdoc cref="Parse(Stream, long, FileIdentity)"/>
     public static async Task<CoverageReport> ParseAsync(
-        Stream stream, long maxChars = DefaultMaxChars, CancellationToken ct = default)
+        Stream stream, long maxChars = DefaultMaxChars, FileIdentity? identity = null, CancellationToken ct = default)
     {
         ct.ThrowIfCancellationRequested();
+        var scope = new IdentityScope(identity);
         using var reader = CreateReader(stream, maxChars, async: true);
-        var document = new DocumentContext();
-        var files = new FileCollector();
+        var document = new DocumentContext(scope, sourceName: null);
+        var files = new FileCollector(document);
 
         while (await reader.ReadAsync())
         {
@@ -50,7 +54,9 @@ public static async Task<CoverageReport> ParseAsync(
         }
 
         ct.ThrowIfCancellationRequested();
-        return files.Materialize(document);
+        document.Finish();
+        scope.RequireDeclaredRoot();
+        return files.Materialize();
     }
 
     /// <summary>
@@ -58,37 +64,61 @@ public static async Task<CoverageReport> ParseAsync(
     /// disposed here, whatever happens. Malformed XML surfaces as
     /// <see cref="ReportParseException"/> naming the input.
     /// </summary>
-    public static CoverageReport Parse(ReportInput input, long maxChars = DefaultMaxChars)
+    public static CoverageReport Parse(ReportInput input, long maxChars = DefaultMaxChars, FileIdentity? identity = null)
     {
         ArgumentNullException.ThrowIfNull(input);
-        using var stream = input.OpenStream();
-        try
-        {
-            return Parse(stream, maxChars);
-        }
-        catch (XmlException ex)
-        {
-            throw new ReportParseException(input.SourceName, ex);
-        }
+        var scope = new IdentityScope(identity);
+        var report = ParseInput(input, maxChars, scope);
+        scope.RequireDeclaredRoot();
+        return report;
     }
 
     /// <summary>
     /// Parse and merge every input in the given order. An empty input set yields an empty
     /// report; whether that is acceptable is the caller's decision (see <see cref="ReportResolver"/>).
     /// </summary>
-    public static CoverageReport Parse(IEnumerable<ReportInput> inputs, long maxChars = DefaultMaxChars)
+    public static CoverageReport Parse(IEnumerable<ReportInput> inputs, long maxChars = DefaultMaxChars, FileIdentity? identity = null)
     {
         ArgumentNullException.ThrowIfNull(inputs);
+        var scope = new IdentityScope(identity);
         CoverageReport? merged = null;
         foreach (var input in inputs)
         {
-            var report = Parse(input, maxChars);
+            ArgumentNullException.ThrowIfNull(input);
+            var report = ParseInput(input, maxChars, scope);
             merged = merged is null ? report : CoverageReport.Merge(merged, report);
         }
 
+        scope.RequireDeclaredRoot();
         return merged ?? CoverageReport.Empty;
     }
 
+    private static CoverageReport ParseInput(ReportInput input, long maxChars, IdentityScope scope)
+    {
+        using var stream = input.OpenStream();
+        try
+        {
+            return ParseDocument(stream, maxChars, scope, input.SourceName);
+        }
+        catch (XmlException ex)
+        {
+            throw new ReportParseException(input.SourceName, ex);
+        }
+    }
+
+    private static CoverageReport ParseDocument(Stream stream, long maxChars, IdentityScope scope, string? sourceName)
+    {
+        using var reader = CreateReader(stream, maxChars, async: false);
+        var document = new DocumentContext(scope, sourceName);
+        var files = new FileCollector(document);
+
+        while (reader.Read())
+            Visit(reader, document, files, methods: null);
+
+        document.Finish();
+        return files.Materialize();
+    }
+
     // ── XML reader ────────────────────────────────────────────────────────────
 
     /// <summary>The only <see cref="XmlReader.Create(Stream, XmlReaderSettings)"/> call site for Cobertura input.</summary>
@@ -109,12 +139,48 @@ private static XmlReader CreateReader(Stream stream, long maxChars, bool async)
 
     // ── Traversal ─────────────────────────────────────────────────────────────
 
-    /// <summary>Per-document state: the declared source roots and the warnings raised while decoding.</summary>
-    private sealed class DocumentContext
+    /// <summary>
+    /// The file-identity policy of one parse call and what its documents declared. One per
+    /// call, never shared: the explicit-root check spans every document of the call (some
+    /// document must declare the chosen root), so it needs state no single document has.
+    /// </summary>
+    private sealed class IdentityScope(FileIdentity? identity)
+    {
+        private readonly List<string> _declared = [];
+        private bool _anyDocument;
+
+        public FileIdentity Identity { get; } = identity ?? FileIdentity.Lexical;
+
+        public void Record(IReadOnlyList<string> roots)
+        {
+            _anyDocument = true;
+            foreach (var root in roots)
+                if (!_declared.Contains(root)) _declared.Add(root);
+        }
+
+        /// <summary>An explicitly chosen root that no document of the call declares is an invalid request.</summary>
+        public void RequireDeclaredRoot()
+        {
+            if (Identity.SourceRoot is { } root && _anyDocument && !_declared.Contains(root))
+                throw new UndeclaredSourceRootException(root, _declared, sourceName: null);
+        }
+    }
+
+    /// <summary>
+    /// Per-document state: the declared source roots, the warnings raised while decoding, and the
+    /// files whose identity the roots left unresolved.
+    /// </summary>
+    private sealed class DocumentContext(IdentityScope scope, string? sourceName)
     {
         public readonly List<string> SourceRoots = [];
         public readonly List<CoverageWarning> Warnings = [];
+        public readonly List<AmbiguousFile> AmbiguousFiles = [];
         private readonly HashSet<CoverageWarning> _seen = [];
+        private readonly HashSet<string> _ambiguous = new(StringComparer.Ordinal);
+
+        public FileIdentity Identity => scope.Identity;
+
+        public string? SourceName => sourceName;
 
         /// <summary>
         /// Record a warning once per document: coverlet repeats every line under its method and
@@ -124,6 +190,15 @@ public void Warn(CoverageWarning warning)
         {
             if (_seen.Add(warning)) Warnings.Add(warning);
         }
+
+        /// <summary>Record a file keyed under the first of several candidate roots, once per document.</summary>
+        public void MarkAmbiguous(string key)
+        {
+            if (_ambiguous.Add(key)) AmbiguousFiles.Add(new AmbiguousFile(key, SourceRoots.ToArray()));
+        }
+
+        /// <summary>The document is read to its end: its roots count toward the call's explicit-root check.</summary>
+        public void Finish() => scope.Record(SourceRoots);
     }
 
     /// <summary>
@@ -166,16 +241,7 @@ private static async ValueTask VisitAsync(
                 if (root is not null) RecordSource(root, document);
                 break;
             case "class":
-                if (CreateClassContext(reader, document, files, methods: null) is not { } context) return;
-                if (reader.IsEmptyElement) return;
-                var depth = reader.Depth;
-                // Disposing an unfinished subtree reader drains it synchronously, including on cancellation.
-                while (await reader.ReadAsync())
-                {
-                    ct.ThrowIfCancellationRequested();
-                    if (reader.NodeType is XmlNodeType.EndElement && reader.Depth == depth) break;
-                    context.Visit(reader);
-                }
+                await ConsumeClassAsync(reader, document, files, ct);
                 break;
         }
     }
@@ -185,8 +251,8 @@ private static async ValueTask VisitAsync(
     /// sentinel, which <see cref="ResolveFileKey"/> reads as "leave relative filenames
     /// unprefixed". The sentinel is recorded, not discarded: a no-op declared alongside real
     /// roots is a second resolution convention, so it is a candidate root like any other and
-    /// keeps its document-order slot (the FIRST declared root wins when the disk cannot
-    /// decide). Respellings of one root are deduplicated so they cannot fake that multiplicity.
+    /// keeps its document-order slot (the FIRST declared root is the deterministic key).
+    /// Respellings of one root are deduplicated so they cannot fake that multiplicity.
     /// <para>
     /// The root is the element's own character content: every text and CDATA child,
     /// concatenated. A comment or processing instruction splits that text without ending it,
@@ -221,7 +287,8 @@ private static void RecordSource(string value, DocumentContext document)
     /// <c>&lt;methods&gt;&lt;method&gt;</c> reach the method collector (attributed to the enclosing
     /// method) and reach the file collector only when the class has no class-level
     /// <c>&lt;lines&gt;</c>; that summary, when present, alone decides the file's lines.
-    /// <c>ReadSubtree</c> leaves the outer reader on the closing tag when done.
+    /// <c>ReadSubtree</c> leaves the outer reader on the closing tag when done. The async walk
+    /// (<see cref="ConsumeClassAsync"/>) ends in the same <see cref="ClassContext.Complete"/>.
     /// </summary>
     private static void ConsumeClass(XmlReader reader, DocumentContext document, FileCollector? files, MethodCollector? methods)
     {
@@ -235,6 +302,26 @@ private static void ConsumeClass(XmlReader reader, DocumentContext document, Fil
         context.Complete();
     }
 
+    private static async ValueTask ConsumeClassAsync(
+        XmlReader reader, DocumentContext document, FileCollector files, CancellationToken ct)
+    {
+        if (CreateClassContext(reader, document, files, methods: null) is not { } context) return;
+        if (!reader.IsEmptyElement)
+        {
+            var depth = reader.Depth;
+            // Not ReadSubtree: disposing an unfinished subtree reader drains it synchronously,
+            // including on cancellation.
+            while (await reader.ReadAsync())
+            {
+                ct.ThrowIfCancellationRequested();
+                if (reader.NodeType is XmlNodeType.EndElement && reader.Depth == depth) break;
+                context.Visit(reader);
+            }
+        }
+
+        context.Complete();
+    }
+
     private static ClassContext? CreateClassContext(
         XmlReader reader, DocumentContext document, FileCollector? files, MethodCollector? methods) =>
         DecodeFileName(reader, document) is { } file
@@ -247,53 +334,79 @@ private sealed class ClassContext(
         private MethodCollector.Entry? _methodAcc;
         // Method lines wait for the class end: istanbul lists each function's declaration line
         // there, which is not a line of its own line coverage, so a class-level summary wins.
-        private readonly LineAccumulator? _methodLines = fileAcc is null ? null : new LineAccumulator();
+        private readonly LineAccumulator? _methodLines = fileAcc is null ? null : new LineAccumulator(file, document);
         private bool _inMethod;
+        // The class-level <lines> ELEMENT, not a line under it: an empty summary (<lines/>) is
+        // still the class's own statement that it has no lines.
         private bool _hasClassLines;
 
         private LineAccumulator? LineTarget => _inMethod ? _methodLines : fileAcc;
 
-        /// <summary>At the class end, method lines stand in for a class without class-level lines.</summary>
+        /// <summary>
+        /// The one finalisation of a class, shared by the sync and async walks: pending condition
+        /// detail is validated, and method lines stand in for a class without a class-level summary.
+        /// </summary>
         public void Complete()
         {
+            _methodLines?.Flush();
+            fileAcc?.Flush();
             if (!_hasClassLines) fileAcc?.AddFrom(_methodLines!);
         }
 
         public void Visit(XmlReader sub)
         {
-            switch (sub.NodeType, sub.LocalName)
+            if (sub.NodeType is XmlNodeType.EndElement)
             {
-                case (XmlNodeType.Element, "method"):
-                    _methodAcc = methods?.For(
-                        new MethodKey(file, className, sub.GetAttribute("name") ?? "", sub.GetAttribute("signature") ?? ""),
-                        DecodeComplexity(sub.GetAttribute("complexity")));
-                    _inMethod = !sub.IsEmptyElement;
-                    if (sub.IsEmptyElement) _methodAcc = null;
-                    break;
+                if (sub.LocalName is "method") EndMethod();
+                return;
+            }
 
-                case (XmlNodeType.EndElement, "method"):
-                    _methodAcc = null;
-                    _inMethod = false;
-                    break;
+            if (sub.NodeType is not XmlNodeType.Element) return;
 
-                case (XmlNodeType.Element, "line"):
+            switch (sub.LocalName)
+            {
+                case "method":
+                    BeginMethod(sub);
+                    break;
+                case "lines":
                     _hasClassLines |= !_inMethod;
-                    if (!TryDecodeLine(sub, file, document, out var line))
-                    {
-                        // A skipped line takes its nested <condition>s with it; they must not
-                        // attach to the previous branched line.
-                        LineTarget?.SkipLine();
-                        break;
-                    }
-                    LineTarget?.AddLine(sub, line, file, document);
-                    _methodAcc?.AddLine(line);
                     break;
-
-                case (XmlNodeType.Element, "condition"):
+                case "line":
+                    AddLine(sub);
+                    break;
+                case "condition":
                     LineTarget?.AddCondition(sub);
                     break;
             }
         }
+
+        private void BeginMethod(XmlReader sub)
+        {
+            _methodAcc = methods?.For(
+                new MethodKey(file, className, sub.GetAttribute("name") ?? "", sub.GetAttribute("signature") ?? ""),
+                DecodeComplexity(sub.GetAttribute("complexity")));
+            _inMethod = !sub.IsEmptyElement;
+            if (sub.IsEmptyElement) _methodAcc = null;
+        }
+
+        private void EndMethod()
+        {
+            _methodAcc = null;
+            _inMethod = false;
+        }
+
+        private void AddLine(XmlReader sub)
+        {
+            if (!TryDecodeLine(sub, file, document, out var line))
+            {
+                // A skipped line takes its nested <condition>s with it; they must not
+                // attach to the previous branched line.
+                LineTarget?.SkipLine();
+                return;
+            }
+            LineTarget?.AddLine(sub, line);
+            _methodAcc?.AddLine(line);
+        }
     }
 
     // ── Shared decoding ───────────────────────────────────────────────────────
@@ -303,14 +416,15 @@ public void Visit(XmlReader sub)
 
     /// <summary>
     /// The file identity key of a <c>&lt;class filename&gt;</c>: separators normalized to '/'
-    /// (Windows coverlet writes '\'), the document's <c>&lt;source&gt;</c> root applied
-    /// to relative names, and a leading drive letter uppercased. Both aggregations key on this
-    /// string, so method entries join against <see cref="FileCoverage.Path"/> on the same key.
-    /// Returns null for a class without a filename, which carries no attributable data.
+    /// (Windows coverlet writes '\'), redundant <c>.</c> segments removed, the document's
+    /// <c>&lt;source&gt;</c> root applied to relative names, and a leading drive letter
+    /// uppercased. Both aggregations key on this string, so method entries join against
+    /// <see cref="FileCoverage.Path"/> on the same key. Returns null for a class without a
+    /// filename, which carries no attributable data.
     /// </summary>
     private static string? DecodeFileName(XmlReader reader, DocumentContext document) =>
         reader.GetAttribute("filename") is { } filename
-            ? ResolveFileKey(filename.Replace('\\', '/'), document)
+            ? ResolveFileKey(PathIdentity.RemoveDotSegments(filename.Replace('\\', '/')), document)
             : null;
 
     /// <summary>
@@ -368,8 +482,9 @@ private static bool TryDecodeLine(XmlReader reader, string file, DocumentContext
     /// The rooted check is manual (leading '/' or a drive-letter prefix) because
     /// <c>Path.IsPathRooted("C:/x")</c> is false on Linux and reports cross machines. A single
     /// root is applied unconditionally, never only on collision — a conditional prefix would make
-    /// a file's identity unstable across runs. Several roots follow <see cref="ResolveRoot"/>.
-    /// A no-op root (the "" sentinel) resolves as "no prefix".
+    /// a file's identity unstable across runs. Several roots follow the parse's
+    /// <see cref="FileIdentity"/> (<see cref="ResolveRoot"/>). A no-op root (the "" sentinel)
+    /// resolves as "no prefix".
     /// </summary>
     private static string ResolveFileKey(string filename, DocumentContext document)
     {
@@ -377,23 +492,45 @@ private static string ResolveFileKey(string filename, DocumentContext document)
         if (roots.Count > 0 && !IsRooted(filename))
             filename = JoinRoot(roots.Count is 1 ? roots[0] : ResolveRoot(filename, document), filename);
 
-        // Uppercase a leading drive letter so `c:\x\A.cs` and `C:/x/A.cs` — the same file
-        // emitted by different Windows toolchains — produce one Ordinal key. Key normalization,
-        // not a case-insensitive comparer: a Dictionary has a single comparer for every key.
-        if (filename.Length >= 3 && char.IsAsciiLetterLower(filename[0]) && filename[1] == ':' && filename[2] == '/')
-            filename = char.ToUpperInvariant(filename[0]) + filename[1..];
+        return PathIdentity.UppercaseDriveLetter(filename);
+    }
 
-        return filename;
+    /// <summary>
+    /// Pick the root for a relative filename in a document that declares several. Lexical (the
+    /// default) never reads the disk: the first root is the deterministic key, and the file is
+    /// recorded as ambiguous with one warning naming its candidate roots. Probing and an
+    /// explicit root resolve it.
+    /// </summary>
+    private static string ResolveRoot(string filename, DocumentContext document) => document.Identity.Mode switch
+    {
+        FileIdentityMode.ProbeSources => ProbeRoot(filename, document),
+        FileIdentityMode.SourceRoot => DeclaredRoot(document),
+        _ => FirstRootAmbiguous(filename, document)
+    };
+
+    private static string FirstRootAmbiguous(string filename, DocumentContext document)
+    {
+        var roots = document.SourceRoots;
+        var key = PathIdentity.UppercaseDriveLetter(JoinRoot(roots[0], filename));
+        document.MarkAmbiguous(key);
+        document.Warn(new CoverageWarning(
+            CoverageWarningKind.FileIdentityAmbiguous,
+            key,
+            0,
+            $"relative filename '{filename}' could belong to any of {roots.Count} <source> roots " +
+            $"({string.Join(", ", roots.Select(static r => $"'{AmbiguousFile.Display(r)}'"))}) - " +
+            $"keyed under the first, identity unresolved"));
+        return roots[0];
     }
 
     /// <summary>
-    /// Pick the root for a relative filename in a document that declares several. coverage.py
-    /// writes each file relative to the source root that contains it, so the one root under which
-    /// the file exists on disk is the file's own. When it exists under none (a report read away
-    /// from its sources) or under several, the first declared root applies and the document
-    /// carries one report-scoped warning.
+    /// <see cref="FileIdentityMode.ProbeSources"/>: coverage.py writes each file relative to the
+    /// source root that contains it, so the one root under which the file exists on THIS disk is
+    /// taken as the file's own. When it exists under none (a report read away from its sources)
+    /// or under several, the first declared root applies and the document carries one
+    /// report-scoped warning.
     /// </summary>
-    private static string ResolveRoot(string filename, DocumentContext document)
+    private static string ProbeRoot(string filename, DocumentContext document)
     {
         string? match = null;
         foreach (var root in document.SourceRoots)
@@ -419,6 +556,15 @@ private static string FirstRootWithWarning(DocumentContext document)
         return first;
     }
 
+    /// <summary><see cref="FileIdentityMode.SourceRoot"/>: the chosen root, which a document with several roots must declare.</summary>
+    private static string DeclaredRoot(DocumentContext document)
+    {
+        var root = document.Identity.SourceRoot!;
+        return document.SourceRoots.Contains(root)
+            ? root
+            : throw new UndeclaredSourceRootException(root, document.SourceRoots.ToArray(), document.SourceName ?? "the report");
+    }
+
     private static string JoinRoot(string root, string filename) =>
         root.Length is 0 ? filename : root.EndsWith('/') ? root + filename : $"{root}/{filename}";
 
@@ -432,11 +578,12 @@ private static bool IsRooted(string path) =>
     // produces several: the source class itself, each compiler-synthesized state-machine
     // class for async methods, each nested record's Equals/GetHashCode shim, and so on.
     // Within one block, every `<method><lines>` and the class-level summary `<lines>`
-    // repeat the same line numbers with the same or different hit counts. Every per-line
-    // datum — hit counts, branch (Covered, Total) pairs, per-condition outcomes — is
-    // reconciled with Math.Max.
+    // repeat the same line numbers with the same or different hit counts. Hit counts and
+    // branch (Covered, Total) pairs are reconciled with Math.Max; per-condition detail
+    // unions only between equal condition-number sets, exactly as FileCoverage.MergeWith
+    // does across documents.
 
-    private sealed class FileCollector
+    private sealed class FileCollector(DocumentContext document)
     {
         // Ordinal, not OrdinalIgnoreCase: case-differing filenames are genuinely distinct
         // files on the Linux filesystems the format's native emitters run on. Windows
@@ -446,11 +593,11 @@ private sealed class FileCollector
         public LineAccumulator For(string file)
         {
             if (!_files.TryGetValue(file, out var acc))
-                _files[file] = acc = new LineAccumulator();
+                _files[file] = acc = new LineAccumulator(file, document);
             return acc;
         }
 
-        public CoverageReport Materialize(DocumentContext document)
+        public CoverageReport Materialize()
         {
             var result = new List<FileCoverage>(_files.Count);
             foreach (var (filename, acc) in _files)
@@ -464,12 +611,27 @@ public CoverageReport Materialize(DocumentContext document)
                 // keep the sentinel so Merge can tell ('.', '/real') apart from ('/real').
                 SourceRoots = document.SourceRoots.Count is 1 && document.SourceRoots[0].Length is 0
                     ? []
-                    : document.SourceRoots
+                    : document.SourceRoots,
+                AmbiguousFiles = document.AmbiguousFiles
             };
         }
     }
 
-    private sealed class LineAccumulator
+    /// <summary>
+    /// One branched <c>&lt;line&gt;</c> whose <c>&lt;condition&gt;</c> children are being read:
+    /// its own aggregate and the detail seen so far, validated together once the line ends.
+    /// </summary>
+    private sealed class PendingConditions(int line, int covered, int total)
+    {
+        public readonly int Line = line;
+        public readonly int Covered = covered;
+        public readonly int Total = total;
+        public readonly Dictionary<int, int> Conditions = new();
+        /// <summary>A condition whose number or coverage could not be parsed.</summary>
+        public bool Malformed;
+    }
+
+    private sealed class LineAccumulator(string file, DocumentContext document)
     {
         private readonly Dictionary<int, int> _lineHits = new();
 
@@ -479,51 +641,92 @@ private sealed class LineAccumulator
         private readonly Dictionary<int, (int Covered, int Total)> _branchesByLine = new();
 
         // line → (coverlet condition `number` → covered outcomes of that 2-way jump, 0–2).
-        // Keyed per condition so the cross-report merge can union by condition identity.
+        // Keyed per condition so the cross-report merge can union by condition identity. An
+        // EMPTY set is the poison sentinel: the line's blocks disagreed on condition identity.
         private readonly Dictionary<int, Dictionary<int, int>> _conditionsByLine = new();
 
         // Coverlet nests <conditions><condition number= coverage=/></conditions> inside each
         // branched <line>. In document order conditions follow their line, so they are
-        // attributed to the most recent branched line; -1 means "no per-condition detail".
-        private int _conditionLine = -1;
+        // attributed to the most recent branched line; null means "no line to attribute to".
+        private PendingConditions? _pending;
 
         /// <summary>A <c>&lt;line&gt;</c> that could not be decoded: conditions that follow belong to no line.</summary>
-        public void SkipLine() => _conditionLine = -1;
+        public void SkipLine() => Flush();
 
-        public void AddLine(XmlReader reader, LineData line, string file, DocumentContext document)
+        public void AddLine(XmlReader reader, LineData line)
         {
-            _conditionLine = -1;
+            Flush();
             MergeHits(line.Number, line.Hits);
 
             // Emitters disagree on casing: original Cobertura/JaCoCo write `branch="true"`,
             // Coverlet writes `branch="True"`. A literal compare would silently drop Coverlet
             // branches and render branch coverage as a fake 100%.
-            if (!string.Equals(reader.GetAttribute("branch"), "true", StringComparison.OrdinalIgnoreCase) ||
-                reader.GetAttribute("condition-coverage") is not { } cond)
+            if (!string.Equals(reader.GetAttribute("branch"), "true", StringComparison.OrdinalIgnoreCase))
                 return;
 
-            if (TryParseConditionCoverage(cond, out var covered, out var total))
+            if (reader.GetAttribute("condition-coverage") is not { } cond)
             {
-                MergeBranches(line.Number, covered, total);
-                _conditionLine = line.Number;
+                Warn(CoverageWarningKind.MalformedConditionCoverage, line.Number,
+                    "branch=\"true\" without a condition-coverage attribute - no branch counted");
+                return;
             }
-            else
+
+            if (!TryParseConditionCoverage(cond, out var covered, out var total))
             {
-                document.Warn(new CoverageWarning(
-                    CoverageWarningKind.MalformedConditionCoverage,
-                    file,
-                    line.Number,
-                    $"condition-coverage='{cond}' could not be parsed"));
+                Warn(CoverageWarningKind.MalformedConditionCoverage, line.Number,
+                    $"condition-coverage='{cond}' could not be parsed");
+                return;
             }
+
+            MergeBranches(line.Number, covered, total);
+            _pending = new PendingConditions(line.Number, covered, total);
         }
 
         public void AddCondition(XmlReader reader)
         {
-            if (_conditionLine < 0) return;
-            if (!int.TryParse(reader.GetAttribute("number"), NumberStyles.Integer, CultureInfo.InvariantCulture, out var number)) return;
-            if (!TryParseConditionOutcomes(reader.GetAttribute("coverage"), out var covered)) return;
+            if (_pending is not { } pending) return;
+
+            if (int.TryParse(reader.GetAttribute("number"), NumberStyles.Integer, CultureInfo.InvariantCulture, out var number) &&
+                TryParseConditionOutcomes(reader.GetAttribute("coverage"), out var covered))
+                // A number repeated within one line unions like every other per-line datum.
+                pending.Conditions[number] = Math.Max(pending.Conditions.GetValueOrDefault(number), covered);
+            else
+                pending.Malformed = true;
+        }
+
+        /// <summary>
+        /// Validate the pending line's detail against that line's own aggregate, then union it.
+        /// Detail that does not describe 2-outcome jumps (two outcomes per condition do not make
+        /// the line's total: coverlet's switch tables, grcov's one-condition-per-outcome counts)
+        /// never stood for the aggregate and is left out, as it always was. Detail in that shape
+        /// must also reproduce the covered count, or one run would claim more coverage than it
+        /// reports — a condition at 100% would lift a <c>(0/2)</c> line to <c>(2/2)</c>. Such
+        /// detail, and detail that cannot be parsed, is dropped with a warning.
+        /// </summary>
+        public void Flush()
+        {
+            if (_pending is not { } pending) return;
+            _pending = null;
+
+            if (pending.Malformed)
+            {
+                Warn(CoverageWarningKind.MalformedConditionCoverage, pending.Line,
+                    "a <condition> could not be parsed - using the line aggregate");
+                return;
+            }
+
+            if (pending.Conditions.Count is 0 || pending.Conditions.Count * 2 != pending.Total) return;
+
+            var sum = pending.Conditions.Values.Sum();
+            if (sum != pending.Covered)
+            {
+                Warn(CoverageWarningKind.MalformedConditionCoverage, pending.Line,
+                    Invariant($"{pending.Conditions.Count} conditions with {sum} covered outcomes disagree with ") +
+                    Invariant($"condition-coverage ({pending.Covered}/{pending.Total}) - using the line aggregate"));
+                return;
+            }
 
-            MergeCondition(_conditionLine, number, covered);
+            MergeConditionSet(pending.Line, pending.Conditions);
         }
 
         /// <summary>Fold another accumulator's lines, branches and conditions into this one.</summary>
@@ -531,8 +734,7 @@ public void AddFrom(LineAccumulator other)
         {
             foreach (var (line, hits) in other._lineHits) MergeHits(line, hits);
             foreach (var (line, (covered, total)) in other._branchesByLine) MergeBranches(line, covered, total);
-            foreach (var (line, conds) in other._conditionsByLine)
-                foreach (var (number, covered) in conds) MergeCondition(line, number, covered);
+            foreach (var (line, conds) in other._conditionsByLine) MergeConditionSet(line, conds);
         }
 
         private void MergeHits(int line, int hits) =>
@@ -543,24 +745,54 @@ private void MergeBranches(int line, int covered, int total) =>
                 ? (Math.Max(existing.Covered, covered), Math.Max(existing.Total, total))
                 : (covered, total);
 
-        private void MergeCondition(int line, int number, int covered)
+        /// <summary>
+        /// The condition-identity rule of <see cref="FileCoverage.MergeWith"/>, applied between the
+        /// blocks of one document: the same number set unions per number with <c>Math.Max</c>; a
+        /// different set warns once and poisons the line to its raw aggregate, absorbingly.
+        /// </summary>
+        private void MergeConditionSet(int line, Dictionary<int, int> incoming)
         {
-            if (!_conditionsByLine.TryGetValue(line, out var conds))
-                _conditionsByLine[line] = conds = new Dictionary<int, int>();
-            conds[number] = conds.TryGetValue(number, out var existing) ? Math.Max(existing, covered) : covered;
+            if (!_conditionsByLine.TryGetValue(line, out var existing))
+            {
+                _conditionsByLine[line] = new Dictionary<int, int>(incoming);
+                return;
+            }
+
+            // Either side already poisoned (it warned then): absorbing, no second warning.
+            if (existing.Count is 0 || incoming.Count is 0)
+            {
+                existing.Clear();
+                return;
+            }
+
+            if (existing.Count == incoming.Count && incoming.Keys.All(existing.ContainsKey))
+            {
+                foreach (var (number, covered) in incoming)
+                    existing[number] = Math.Max(existing[number], covered);
+                return;
+            }
+
+            Warn(CoverageWarningKind.ConditionIdentityMismatch, line,
+                $"condition numbers [{string.Join(",", existing.Keys.Order())}] vs " +
+                $"[{string.Join(",", incoming.Keys.Order())}] - using the line aggregate");
+            existing.Clear();
         }
 
+        private void Warn(CoverageWarningKind kind, int line, string detail) =>
+            document.Warn(new CoverageWarning(kind, file, line, detail));
+
         public FileCoverage Materialize(string filename)
         {
-            // Keep per-condition detail only where it reconstructs the line aggregate as
-            // 2-outcome jumps (the universal case for &&/||/?:/??/?.). If a switch jump-table
-            // makes it inconsistent, drop to the line aggregate so merge never invents a total
-            // the emitter didn't report — the invariant Merge's per-condition union relies on.
+            // Keep per-condition detail where it reconstructs the line aggregate as 2-outcome
+            // jumps, and keep the poison sentinel. Detail can still fall short of a line whose
+            // larger total came from a block without detail; it then drops to the line
+            // aggregate so merge never invents a total the emitter didn't report — the
+            // invariant Merge's per-condition union relies on.
             var conditionsByLine = new Dictionary<int, IReadOnlyDictionary<int, int>>();
             foreach (var (line, conds) in _conditionsByLine)
                 // Every line in _conditionsByLine has a _branchesByLine entry by construction —
-                // AddCondition only fires after the aggregate is recorded.
-                if (conds.Count * 2 == _branchesByLine[line].Total)
+                // detail is only recorded after the aggregate is.
+                if (conds.Count is 0 || conds.Count * 2 == _branchesByLine[line].Total)
                     conditionsByLine[line] = new Dictionary<int, int>(conds);
 
             return FileCoverage.FromLineData(filename, _lineHits, _branchesByLine, conditionsByLine);
diff --git a/src/DotCov/CoverageReport.cs b/src/DotCov/CoverageReport.cs
index 891fb54..7220969 100644
--- a/src/DotCov/CoverageReport.cs
+++ b/src/DotCov/CoverageReport.cs
@@ -29,22 +29,27 @@ public enum CoverageWarningKind
     BranchTotalMismatch,
 
     /// <summary>
-    /// A Cobertura <c>&lt;line&gt;</c> carried <c>branch="true"</c> but its
-    /// <c>condition-coverage</c> attribute didn't match the <c>(covered/total)</c>
-    /// shape, the numbers overflowed <see cref="int"/>, or it claimed more covered outcomes
-    /// than its total (e.g. <c>150% (3/2)</c>). The parser drops the branch
-    /// entry; this warning makes the omission observable so emitter regressions
-    /// (e.g. malformed Coverlet output) don't silently zero out branch coverage.
+    /// A Cobertura <c>&lt;line&gt;</c> carried invalid branch data. Either its branch
+    /// aggregate is unusable — <c>branch="true"</c> without a <c>condition-coverage</c>
+    /// attribute, a value that doesn't match the <c>(covered/total)</c> shape, numbers that
+    /// overflow <see cref="int"/>, or more covered outcomes than its total (e.g.
+    /// <c>150% (3/2)</c>) — and the parser counts no branch for the line; or its
+    /// <c>&lt;condition&gt;</c> detail is unparseable or disagrees with that line's own
+    /// aggregate, and the parser drops the detail and keeps the aggregate. Either way this
+    /// warning makes the omission observable, so emitter regressions can neither silently zero
+    /// out branch coverage nor inflate it.
     /// </summary>
     MalformedConditionCoverage,
 
     /// <summary>
-    /// Two reports both carried per-condition detail for the same source line but with
-    /// different condition <c>number</c> sets. Coverlet's condition numbers are IL branch
-    /// offsets — stable only for the identical assembly build — so unioning across
-    /// mismatched sets would invent branch totals neither emitter reported.
-    /// <see cref="FileCoverage.MergeWith"/> falls back to the line-level <c>Math.Max</c>
-    /// union for that line and records the downgrade here.
+    /// Per-condition detail for the same source line arrived with different condition
+    /// <c>number</c> sets — from two reports, or from two <c>&lt;class&gt;</c> blocks of one
+    /// document. Coverlet's condition numbers are IL branch offsets, stable only within one
+    /// IL method of one build, so unioning mismatched sets would invent branch totals no
+    /// emitter reported. The parser and <see cref="FileCoverage.MergeWith"/> apply the same
+    /// rule: the line falls back to its raw line-level aggregate, and the downgrade is
+    /// recorded here once per line and document or merge — so the same measurements give the
+    /// same numbers however the XML packages them.
     /// </summary>
     ConditionIdentityMismatch,
 
@@ -58,10 +63,14 @@ public enum CoverageWarningKind
     MalformedHits,
 
     /// <summary>
-    /// File identity could not be established unambiguously. Emitted in two situations:
-    /// (1) a report declared multiple <c>&lt;source&gt;</c> roots — relative filenames are
-    /// resolved against the first, deterministically, because the analyzing machine cannot
-    /// probe the disk the report came from; (2) <see cref="CoverageReport.Merge"/> combined
+    /// File identity could not be established unambiguously. Emitted in three situations:
+    /// (1) under <see cref="FileIdentityMode.Lexical"/>, a relative filename in a report that
+    /// declares several <c>&lt;source&gt;</c> roots — one warning per file, naming the
+    /// candidate roots; the file is keyed under the first and listed in
+    /// <see cref="CoverageReport.AmbiguousFiles"/>, which turns every gate into NoData;
+    /// (2) under <see cref="FileIdentityMode.ProbeSources"/>, a relative filename that exists
+    /// under no declared root or under several on the reading machine — one warning per
+    /// document, and the first root applies; (3) <see cref="CoverageReport.Merge"/> combined
     /// reports whose source roots differ and found files unique to each side that share the
     /// same file name — the same source file uploaded under two path conventions (e.g.
     /// Coverlet default vs <c>DeterministicSourcePaths</c>) looks exactly like this, and if
@@ -198,7 +207,19 @@ public readonly record struct FileCoverage(
     /// order reports are folded in. A poisoned line contributes only its raw line-level
     /// aggregate. Detail present on only one side is carried forward unchanged so a later
     /// merge can still union it; the line aggregate never regresses below what the
-    /// line-level union observed.
+    /// line-level union observed. The parser applies the same rule to the
+    /// <c>&lt;class&gt;</c> blocks of one document, so one document with two blocks and two
+    /// merged documents give the same numbers and the same warnings.
+    /// </para>
+    /// <para>
+    /// Two different checks guard the derived aggregate. Within one document, a
+    /// <c>&lt;line&gt;</c>'s 2-way detail must reproduce that line's own
+    /// <c>condition-coverage</c> exactly: its covered outcomes must sum to the line's covered
+    /// count. Detail that disagrees is dropped with a
+    /// <see cref="CoverageWarningKind.MalformedConditionCoverage"/> warning, because one run
+    /// cannot have covered more than it reports. Across reports the derived aggregate MAY
+    /// exceed either side's: two runs that exercised different conditions of the same line
+    /// legitimately raise each other, which is the point of the per-condition union.
     /// </para>
     /// </summary>
     public IReadOnlyDictionary<int, IReadOnlyDictionary<int, int>> ConditionsByLine
@@ -488,8 +509,8 @@ private Dictionary<int, IReadOnlyDictionary<int, int>> MergeConditions(FileCover
 
     /// <summary>
     /// The condition-identity poison sentinel: an empty condition set. Safe to overload as a
-    /// sentinel because neither the parser's Materialize nor AddCondition ever produces an
-    /// empty <see cref="ConditionsByLine"/> entry — only a mismatch downgrade does.
+    /// sentinel because real detail always holds at least one condition — only a mismatch
+    /// downgrade, here or in the parser's per-document union, produces an empty entry.
     /// </summary>
     private static readonly IReadOnlyDictionary<int, int> PoisonedConditions =
         ReadOnlyDictionary<int, int>.Empty;
@@ -606,6 +627,21 @@ public sealed class CoverageReport
     /// </summary>
     public IReadOnlyList<string> SourceRoots { get; init; } = [];
 
+    /// <summary>
+    /// Files whose identity the parse could not resolve (<see cref="FileIdentityMode.Lexical"/>
+    /// with several declared roots): each is present in <see cref="Files"/> under its
+    /// deterministic first-root key, but nothing proves that root is its own. While any remain,
+    /// <see cref="Evaluate"/> answers <see cref="GateOutcome.NoData"/>. <see cref="Exclude(IEnumerable{string}, IEnumerable{string})"/>
+    /// drops the excluded ones; <see cref="Merge"/> unions both sides.
+    /// </summary>
+    public IReadOnlyList<AmbiguousFile> AmbiguousFiles { get; init; } = [];
+
+    /// <summary>
+    /// The exclusions applied to this report and the files they removed;
+    /// <see cref="FileExclusion.None"/> until <see cref="Exclude(IEnumerable{string}, IEnumerable{string})"/> runs.
+    /// </summary>
+    public FileExclusion Exclusion { get; init; } = FileExclusion.None;
+
     public int TotalLines => Files.Sum(static f => f.LinesTotal);
     public int TotalLinesHit => Files.Sum(static f => f.LinesHit);
     public int TotalBranches => Files.Sum(static f => f.BranchesTotal);
@@ -648,7 +684,9 @@ public IEnumerable<FileCoverage> BelowPercent(double linePercent) =>
     /// <summary>
     /// Decide whether this report clears the given thresholds. Returns the full verdict rather
     /// than a bool so callers can tell a real failure from an unanswerable question from a gate
-    /// that was never armed — three outcomes a bool collapses into "false".
+    /// that was never armed — three outcomes a bool collapses into "false". A report with
+    /// <see cref="AmbiguousFiles"/> is <see cref="GateOutcome.NoData"/>: its numbers may count a
+    /// file under a root that is not its own.
     /// </summary>
     public GateResult Evaluate(double minLinePercent, double minBranchPercent = 0)
     {
@@ -660,6 +698,10 @@ public GateResult Evaluate(double minLinePercent, double minBranchPercent = 0)
             return new GateResult(GateOutcome.NoData, null, null, minLinePercent, minBranchPercent,
                 "report carries no line data - nothing was measured");
 
+        if (AmbiguousFiles.Count > 0)
+            return new GateResult(GateOutcome.NoData, LineRate, BranchRate, minLinePercent, minBranchPercent,
+                AmbiguousFile.GateReason(AmbiguousFiles));
+
         if (minBranchPercent > 0 && !HasBranchData)
             return new GateResult(GateOutcome.NoData, LineRate, null, minLinePercent, minBranchPercent,
                 FormattableString.Invariant($"branch threshold of {minBranchPercent}% requested but the report carries no branch data"));
@@ -710,12 +752,15 @@ public CoverageReport Exclude(IEnumerable<string> patterns, IEnumerable<string>
         if (rules.Count is 0) return this;
 
         var keepRules = keep.ToList();
+        var (kept, excluded) = ExclusionRules.Partition(Files, static f => f.Path, rules, keepRules);
 
-        var filtered = Files
-            .Where(f => !ExclusionRules.Excluded(f.Path, rules, keepRules))
-            .ToList();
-
-        return new CoverageReport(filtered) { Warnings = Warnings, SourceRoots = SourceRoots };
+        return new CoverageReport(kept)
+        {
+            Warnings = Warnings,
+            SourceRoots = SourceRoots,
+            AmbiguousFiles = ExclusionRules.Remaining(AmbiguousFiles, excluded),
+            Exclusion = Exclusion.Then(rules, keepRules, excluded)
+        };
     }
 
     public static CoverageReport Merge(CoverageReport a, CoverageReport b)
@@ -753,7 +798,9 @@ public static CoverageReport Merge(CoverageReport a, CoverageReport b)
             // sequences, so a raw union of c:\repo and C:/repo/ would keep two entries and
             // permanently re-flag every later merge as ambiguous.
             SourceRoots = a.SourceRoots.Concat(b.SourceRoots)
-                .DistinctBy(PathIdentity.NormalizeRoot, StringComparer.Ordinal).ToList()
+                .DistinctBy(PathIdentity.NormalizeRoot, StringComparer.Ordinal).ToList(),
+            AmbiguousFiles = AmbiguousFile.Union(a.AmbiguousFiles.Concat(b.AmbiguousFiles)),
+            Exclusion = a.Exclusion.Union(b.Exclusion)
         };
     }
 
@@ -851,10 +898,11 @@ public static class ExclusionRules
 
     /// <summary>
     /// The one exclusion predicate, shared by <see cref="CoverageReport.Exclude(IEnumerable{string}, IEnumerable{string})"/>
-    /// and <see cref="CrapAnalysis.ExcludeFiles"/> so a path can never be excluded by one
-    /// command and kept by another. Case-insensitive substring match against the path with a
-    /// virtual leading <c>/</c> (so leading-separator rules anchor at top level); a keep match
-    /// always wins.
+    /// and <see cref="MethodCoverageReport.Exclude"/> so a path can never be excluded by one
+    /// command and kept by another, whichever rule set (<see cref="WellKnown"/>,
+    /// <see cref="TestCode"/>, or both) selected it. Case-insensitive substring match against
+    /// the path with a virtual leading <c>/</c> (so leading-separator rules anchor at top
+    /// level); a keep match always wins.
     /// </summary>
     internal static bool Excluded(string path, List<string> rules, List<string> keepRules)
     {
@@ -862,4 +910,61 @@ internal static bool Excluded(string path, List<string> rules, List<string> keep
         return !keepRules.Any(k => probe.Contains(k, StringComparison.OrdinalIgnoreCase)) &&
                rules.Any(p => probe.Contains(p, StringComparison.OrdinalIgnoreCase));
     }
+
+    /// <summary>
+    /// Split <paramref name="items"/> by <see cref="Excluded"/> on their file path: the kept items
+    /// in order, and the distinct excluded paths in first-seen order.
+    /// </summary>
+    internal static (List<T> Kept, List<string> Excluded) Partition<T>(
+        IEnumerable<T> items, Func<T, string> path, List<string> rules, List<string> keepRules)
+    {
+        var kept = new List<T>();
+        var excluded = new List<string>();
+        var seen = new HashSet<string>(StringComparer.Ordinal);
+        foreach (var item in items)
+        {
+            var file = path(item);
+            if (!Excluded(file, rules, keepRules)) kept.Add(item);
+            else if (seen.Add(file)) excluded.Add(file);
+        }
+        return (kept, excluded);
+    }
+
+    /// <summary>The ambiguous files an exclusion left in the report.</summary>
+    internal static List<AmbiguousFile> Remaining(IReadOnlyList<AmbiguousFile> ambiguous, List<string> excluded)
+    {
+        var removed = new HashSet<string>(excluded, StringComparer.Ordinal);
+        return ambiguous.Where(a => !removed.Contains(a.Path)).ToList();
+    }
+}
+
+/// <summary>
+/// What an exclusion did: the patterns applied, the <c>--keep</c> exemptions, and the files
+/// removed. Carried on the report it produced, so every rendering — terminal, step summary,
+/// JSON, upload — can say what was left out instead of presenting a smaller number as the
+/// whole.
+/// </summary>
+/// <param name="Patterns">Exclusion patterns, distinct, in first-applied order.</param>
+/// <param name="Keep">Keep exemptions, distinct, in first-applied order.</param>
+/// <param name="ExcludedFiles">Paths removed, distinct, in first-seen order.</param>
+public sealed record FileExclusion(
+    IReadOnlyList<string> Patterns,
+    IReadOnlyList<string> Keep,
+    IReadOnlyList<string> ExcludedFiles)
+{
+    /// <summary>No exclusion applied.</summary>
+    public static FileExclusion None { get; } = new([], [], []);
+
+    /// <summary>True once any exclusion pattern was applied, even one that removed nothing.</summary>
+    public bool IsActive => Patterns.Count > 0;
+
+    /// <summary>This exclusion followed by another.</summary>
+    internal FileExclusion Then(List<string> patterns, List<string> keep, List<string> excluded) =>
+        Union(new FileExclusion(patterns, keep, excluded));
+
+    /// <summary>Both exclusions at once: every list unioned, Ordinal, first-seen order kept.</summary>
+    internal FileExclusion Union(FileExclusion other) => new(
+        Patterns.Concat(other.Patterns).Distinct(StringComparer.Ordinal).ToArray(),
+        Keep.Concat(other.Keep).Distinct(StringComparer.Ordinal).ToArray(),
+        ExcludedFiles.Concat(other.ExcludedFiles).Distinct(StringComparer.Ordinal).ToArray());
 }
diff --git a/src/DotCov/CrapAnalysis.cs b/src/DotCov/CrapAnalysis.cs
index 0dbe25a..76e163e 100644
--- a/src/DotCov/CrapAnalysis.cs
+++ b/src/DotCov/CrapAnalysis.cs
@@ -91,6 +91,16 @@ internal CrapReport(
         UnmatchedMetricsMembers = unmatchedMetricsMembers;
     }
 
+    /// <summary>
+    /// Files whose identity the parse could not resolve, carried from the
+    /// <see cref="MethodCoverageReport"/> this report was analyzed from. While any remain,
+    /// <see cref="Evaluate"/> answers <see cref="GateOutcome.NoData"/>.
+    /// </summary>
+    public IReadOnlyList<AmbiguousFile> AmbiguousFiles { get; internal init; } = [];
+
+    /// <summary>The exclusions applied to the analyzed methods and the files they removed.</summary>
+    public FileExclusion Exclusion { get; internal init; } = FileExclusion.None;
+
     /// <summary>Scored methods in document order; formatters apply worst-first ordering.</summary>
     public IReadOnlyList<CrapMethod> Methods { get; }
 
@@ -105,31 +115,37 @@ internal CrapReport(
     public IReadOnlyList<string> UnmatchedMetricsMembers { get; }
 
     /// <summary>
-    /// Decide whether every scored method is at or below <paramref name="maxCrap"/>. A method
-    /// exactly AT the threshold passes — the gate fires only strictly above, mirroring
-    /// <c>check</c>'s at-threshold-passes semantics (see <see cref="CrapAnalysis.Exceeds"/>).
-    /// Zero scored methods is <see cref="GateOutcome.NoData"/>, never a pass: a gate that
-    /// cannot see cannot vouch for anything.
+    /// Decide whether every method is at or below <paramref name="maxCrap"/>. A method exactly AT
+    /// the threshold passes — the gate fires only strictly above, mirroring <c>check</c>'s
+    /// at-threshold-passes semantics (see <see cref="CrapAnalysis.Exceeds"/>). The verdict needs
+    /// COMPLETE scoring: a single <see cref="Unscored"/> method makes it
+    /// <see cref="GateOutcome.NoData"/>, because the method the gate cannot score may be the
+    /// one above the limit; zero scored methods is NoData too, and so is a report with
+    /// <see cref="AmbiguousFiles"/>. A gate that cannot see everything cannot vouch for anything.
     /// </summary>
     public CrapGateResult Evaluate(double maxCrap)
     {
+        double? worst = Methods.Count is 0 ? null : Methods.Max(static m => m.Score);
+        var above = Methods.Count(m => CrapAnalysis.Exceeds(m.Score, maxCrap));
+
         // Nothing can exceed an infinite threshold, so the gate cannot fail — reported as
         // Disabled, like check's 0/0, never as a pass.
         if (double.IsPositiveInfinity(maxCrap))
-            return new CrapGateResult(GateOutcome.Disabled, maxCrap, Methods.Count, 0,
-                Methods.Count is 0 ? null : Methods.Max(static m => m.Score),
+            return new CrapGateResult(GateOutcome.Disabled, maxCrap, Methods.Count, 0, worst,
                 "no finite threshold - this gate cannot fail");
 
-        if (Methods.Count is 0)
-        {
-            var reason = Unscored.Count > 0
-                ? Invariant($"{Unscored.Count} methods have coverage but no usable complexity - supply --metrics <file> (dotnet msbuild /t:Metrics)")
-                : "report carries no method-level data - nothing was measured per method";
-            return new CrapGateResult(GateOutcome.NoData, maxCrap, 0, 0, null, reason);
-        }
+        if (AmbiguousFiles.Count > 0)
+            return new CrapGateResult(GateOutcome.NoData, maxCrap, Methods.Count, above, worst,
+                AmbiguousFile.GateReason(AmbiguousFiles));
 
-        var worst = Methods.Max(static m => m.Score);
-        var above = Methods.Count(m => CrapAnalysis.Exceeds(m.Score, maxCrap));
+        if (Unscored.Count > 0)
+            return new CrapGateResult(GateOutcome.NoData, maxCrap, Methods.Count, above, worst,
+                Invariant($"{Unscored.Count} of {Methods.Count + Unscored.Count} methods could not be scored - ") +
+                "supply --metrics <file> (dotnet msbuild /t:Metrics); a verdict needs every method scored");
+
+        if (Methods.Count is 0)
+            return new CrapGateResult(GateOutcome.NoData, maxCrap, 0, 0, null,
+                "report carries no method-level data - nothing was measured per method");
 
         return above is 0
             ? new CrapGateResult(GateOutcome.Pass, maxCrap, Methods.Count, 0, worst,
@@ -176,13 +192,29 @@ internal static bool Exceeds(double score, double maxCrap) =>
     internal static double DisplayScore(double score, double maxCrap) =>
         Exceeds(score, maxCrap) ? Math.Ceiling(score * 10 - GateResult.RateEpsilon) / 10 : score;
 
+    /// <summary>
+    /// Score every method of a parsed report: <see cref="Analyze(IReadOnlyList{MethodCoverage}, IReadOnlyList{CodeMetricsMember})"/>
+    /// over its methods, with the report's unresolved file identities and exclusions carried
+    /// onto the result, where <see cref="CrapReport.Evaluate"/> and the formatters read them.
+    /// </summary>
+    public static CrapReport Analyze(MethodCoverageReport report, IReadOnlyList<CodeMetricsMember>? metricsMembers = null)
+    {
+        ArgumentNullException.ThrowIfNull(report);
+        var analysis = Analyze(report.Methods, metricsMembers);
+        return new CrapReport(analysis.Methods, analysis.Unscored, analysis.UnmatchedMetricsMembers)
+        {
+            AmbiguousFiles = report.AmbiguousFiles,
+            Exclusion = report.Exclusion
+        };
+    }
+
     /// <summary>
     /// Score every method: fold compiler-synthesized methods into their source-method identity,
     /// resolve complexity (coverage-embedded first, metrics file second), and compute CRAP.
     /// Methods that cannot be scored and metrics members that match nothing are returned on the
     /// report's honesty channels — listed, never silently dropped.
     /// </summary>
-    /// <param name="methods">Raw per-method coverage from <see cref="CoberturaParser.ParseMethods"/>.</param>
+    /// <param name="methods">Raw per-method coverage from <see cref="CoberturaParser.ParseMethods(Stream, long, FileIdentity)"/>.</param>
     /// <param name="metricsMembers">
     /// Optional complexity table from <see cref="CodeMetricsReader"/>. Used only for methods the
     /// coverage report carries no usable complexity for — the embedded value wins because it
@@ -203,17 +235,20 @@ public static CrapReport Analyze(
     }
 
     /// <summary>
-    /// Step 1: fold raw coverage entries into logical source methods. Direct entries key by the
-    /// raw IL SIGNATURE, not arity: same-arity overloads (<c>Frob(Int32)</c> vs
-    /// <c>Frob(String)</c>) are distinct source methods, and collapsing them would dilute an
-    /// uncovered overload's CRAP with a covered sibling's lines. Folded entries (state machines,
-    /// lambdas) lost their origin's signature, so all synthetic material for one origin name
-    /// shares a single folded group. Types key by their arity-preserving identity for the same
-    /// reason: <c>Result</c> and <c>Result`1</c> display alike but are different types.
+    /// Step 1: fold raw coverage entries into logical source methods, per FILE: the same type
+    /// and method name in two files — two assemblies' <c>Ns.T.M(Int32)</c>, or two parts of a
+    /// partial class — are two rows, never one averaged row. Direct entries key by the raw IL
+    /// SIGNATURE, not arity: same-arity overloads (<c>Frob(Int32)</c> vs <c>Frob(String)</c>)
+    /// are distinct source methods, and collapsing them would dilute an uncovered overload's
+    /// CRAP with a covered sibling's lines. Folded entries (state machines, lambdas) lost their
+    /// origin's signature, so they key by the origin's method ordinal instead: everything
+    /// synthesized for one source method is one group, and the groups of two overloads stay
+    /// apart. Types key by their arity-preserving identity for the same reason: <c>Result</c>
+    /// and <c>Result`1</c> display alike but are different types.
     /// </summary>
     private static List<LogicalMethod> FoldRawEntries(IReadOnlyList<MethodCoverage> methods)
     {
-        var byKey = new Dictionary<string, LogicalMethod>(StringComparer.Ordinal);
+        var byKey = new Dictionary<(MethodName Name, string Discriminator), LogicalMethod>();
         var order = new List<LogicalMethod>();
 
         foreach (var mc in methods)
@@ -222,18 +257,16 @@ private static List<LogicalMethod> FoldRawEntries(IReadOnlyList<MethodCoverage>
             // non-MoveNext surface of iterators) has no source-method identity to fold into —
             // and no lines a source method is missing.
             if (!MethodIdentity.TryNormalize(mc.ClassName, mc.MethodName,
-                    out var typeKey, out var typeIdentity, out var methodKey, out var folded))
+                    out var typeKey, out var typeIdentity, out var methodKey, out var origin))
                 continue;
 
-            int? arity = folded ? null : MethodIdentity.SignatureArity(mc.Signature);
-
-            var key = folded
-                ? Invariant($"{typeIdentity}|{methodKey}|<folded>")
-                : Invariant($"{typeIdentity}|{methodKey}|{mc.Signature}");
+            var name = new MethodName(mc.File, typeIdentity, methodKey);
+            var key = (name, origin is { } o ? $"<folded:{o.Ordinal}>" : mc.Signature);
 
             if (!byKey.TryGetValue(key, out var logical))
             {
-                logical = new LogicalMethod(typeKey, typeIdentity, methodKey, arity, folded, mc.File);
+                int? arity = origin is null ? MethodIdentity.SignatureArity(mc.Signature) : null;
+                logical = new LogicalMethod(name, typeKey, arity, origin);
                 byKey[key] = logical;
                 order.Add(logical);
             }
@@ -248,32 +281,28 @@ private static List<LogicalMethod> FoldRawEntries(IReadOnlyList<MethodCoverage>
     /// <summary>
     /// Step 2: fold synthetic groups into their origin method. A lambda's lines belong inside
     /// its origin method's body: merging them makes cov(m) span the same code Roslyn's
-    /// complexity counts. Only an UNAMBIGUOUS origin (exactly one same-named overload) absorbs;
-    /// otherwise — including same-arity overload sets, which step 1 keeps distinct — the folded
-    /// group stands as its own row rather than guessing.
+    /// complexity counts. A group attaches only when its origin is established — exactly one
+    /// same-named method in the same file and type, and exactly one synthetic origin of that
+    /// name — and never on name alone: a method's own async/iterator body
+    /// (<see cref="SyntheticOrigin.OwnBody"/>) does not attach to an entry that has lines of its
+    /// own, because that entry is a different, synchronous overload. Everything else stands as
+    /// its own scored row rather than guessing.
     /// </summary>
     private static void FoldSyntheticGroups(List<LogicalMethod> order)
     {
-        var byName = new Dictionary<string, List<LogicalMethod>>(StringComparer.Ordinal);
-        foreach (var logical in order)
-        {
-            if (logical.Folded) continue;
-            var nameKey = $"{logical.TypeIdentity}|{logical.MethodKey}";
-            if (!byName.TryGetValue(nameKey, out var list)) byName[nameKey] = list = [];
-            list.Add(logical);
-        }
+        var direct = order.Where(static l => !l.Folded).ToLookup(static l => l.Name);
 
-        foreach (var logical in order)
+        foreach (var synthetic in order.Where(static l => l.Folded).GroupBy(static l => l.Name))
         {
-            if (!logical.Folded) continue;
-            if (!byName.TryGetValue($"{logical.TypeIdentity}|{logical.MethodKey}", out var candidates) ||
-                candidates.Count != 1)
-                continue;
+            var candidates = direct[synthetic.Key].ToList();
+            if (candidates.Count != 1 || synthetic.Count() != 1) continue;
+
+            var (origin, group) = (candidates[0], synthetic.First());
+            if (group.Origin!.Value.OwnBody && origin.Lines.Count > 0) continue;
 
-            var origin = candidates[0];
-            origin.MergeLines(logical.Lines);
-            origin.MergeEmbeddedComplexity(logical.EmbeddedComplexity);
-            logical.FoldedAway = true;
+            origin.MergeLines(group.Lines);
+            origin.MergeEmbeddedComplexity(group.EmbeddedComplexity);
+            group.FoldedAway = true;
         }
     }
 
@@ -290,7 +319,7 @@ private static (List<CrapMethod> Scored, List<CrapUnscoredMethod> Unscored) Scor
         foreach (var logical in order)
         {
             if (logical.FoldedAway) continue;
-            var display = $"{logical.TypeKey}.{logical.MethodKey}";
+            var display = $"{logical.TypeKey}.{logical.Name.Method}";
 
             if (logical.Lines.Count is 0)
             {
@@ -332,30 +361,18 @@ private static List<string> CollectUnmatched(IReadOnlyList<CodeMetricsMember>? m
         return unmatched;
     }
 
-    /// <summary>
-    /// Filter methods by file path, with exactly the substring-match semantics of
-    /// <see cref="CoverageReport.Exclude(IEnumerable{string}, IEnumerable{string})"/> — the two
-    /// share <see cref="ExclusionRules.Excluded"/>, so <c>--exclude-generated</c> means the same
-    /// thing to <c>crap</c> as it does to <c>report</c> and <c>check</c>.
-    /// </summary>
-    public static IReadOnlyList<MethodCoverage> ExcludeFiles(
-        IReadOnlyList<MethodCoverage> methods, IEnumerable<string> patterns, IEnumerable<string> keep)
-    {
-        var rules = patterns.ToList();
-        if (rules.Count is 0) return methods;
-        var keepRules = keep.ToList();
-
-        return methods.Where(m => !ExclusionRules.Excluded(m.File, rules, keepRules)).ToList();
-    }
+    /// <summary>A logical method's name: file identity key, arity-preserving type identity, method name.</summary>
+    private readonly record struct MethodName(string File, string TypeIdentity, string Method);
 
-    private sealed class LogicalMethod(string typeKey, string typeIdentity, string methodKey, int? arity, bool folded, string file)
+    private sealed class LogicalMethod(MethodName name, string typeKey, int? arity, SyntheticOrigin? origin)
     {
+        public readonly MethodName Name = name;
         public readonly string TypeKey = typeKey;
-        public readonly string TypeIdentity = typeIdentity;
-        public readonly string MethodKey = methodKey;
         public readonly int? Arity = arity;
-        public readonly bool Folded = folded;
-        public readonly string File = file;
+        /// <summary>Set for compiler-synthesized material; null for a method the source names directly.</summary>
+        public readonly SyntheticOrigin? Origin = origin;
+        public bool Folded => Origin is not null;
+        public string File => Name.File;
         public readonly Dictionary<int, int> Lines = new();
         public int? EmbeddedComplexity;
         public bool FoldedAway;
@@ -459,7 +476,7 @@ private static (int? Complexity, CrapComplexitySource Source) ResolveComplexity(
     {
         if (members is null) return null;
 
-        var key = $"{logical.TypeKey}|{MethodIdentity.MetricsMemberName(logical.MethodKey)}";
+        var key = $"{logical.TypeKey}|{MethodIdentity.MetricsMemberName(logical.Name.Method)}";
         if (metricsIndex.TryGetValue(key, out var candidates))
         {
             // Overload disambiguation by arity when both sides know it. When arity is unknown
diff --git a/src/DotCov/FileIdentity.cs b/src/DotCov/FileIdentity.cs
new file mode 100644
index 0000000..2a34da8
--- /dev/null
+++ b/src/DotCov/FileIdentity.cs
@@ -0,0 +1,134 @@
+using static System.FormattableString;
+
+namespace DotCov;
+
+/// <summary>How a relative class filename resolves in a document that declares several <c>&lt;source&gt;</c> roots.</summary>
+public enum FileIdentityMode
+{
+    /// <summary>
+    /// Lexical only, the default: the same XML yields the same keys and warnings on every
+    /// machine. A relative filename under several roots keeps a deterministic key (the first
+    /// root) but its identity is unresolved: the report lists it in
+    /// <see cref="CoverageReport.AmbiguousFiles"/>, and every gate answers
+    /// <see cref="GateOutcome.NoData"/> until a mode below resolves it.
+    /// </summary>
+    Lexical,
+
+    /// <summary>
+    /// Resolve against the root under which the file exists on the READING machine's disk. A
+    /// unique hit wins; none or several fall back to the first root with one document-level
+    /// <see cref="CoverageWarningKind.FileIdentityAmbiguous"/> warning. The result depends on
+    /// where the report is read, so run it where the sources are checked out.
+    /// </summary>
+    ProbeSources,
+
+    /// <summary>
+    /// Resolve against one root chosen explicitly (<see cref="FileIdentity.SourceRoot"/>). Every
+    /// document that declares several roots must declare it, and at least one document must;
+    /// otherwise parsing throws <see cref="UndeclaredSourceRootException"/>.
+    /// </summary>
+    SourceRoot,
+}
+
+/// <summary>
+/// The file-identity policy of one parse, passed to every <see cref="CoberturaParser"/> entry
+/// point; null there means <see cref="Lexical"/>. A value, never process-global state, so two
+/// parses with different policies cannot affect each other. Single-root and root-less documents
+/// and absolute filenames resolve the same way under every mode.
+/// </summary>
+public sealed class FileIdentity
+{
+    private FileIdentity(FileIdentityMode mode, string? sourceRoot)
+    {
+        Mode = mode;
+        SourceRoot = sourceRoot;
+    }
+
+    /// <summary>The deterministic default; see <see cref="FileIdentityMode.Lexical"/>.</summary>
+    public static FileIdentity Lexical { get; } = new(FileIdentityMode.Lexical, null);
+
+    /// <summary>Opt-in disk probing; see <see cref="FileIdentityMode.ProbeSources"/>.</summary>
+    public static FileIdentity ProbeSources { get; } = new(FileIdentityMode.ProbeSources, null);
+
+    /// <summary>
+    /// Resolve relative filenames against <paramref name="root"/>, compared with the declared
+    /// roots after the same normalization (<c>c:\repo\</c> matches <c>C:/repo</c>; <c>.</c> names
+    /// the no-op root).
+    /// </summary>
+    public static FileIdentity FromSourceRoot(string root)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(root);
+        return new FileIdentity(FileIdentityMode.SourceRoot, PathIdentity.NormalizeRoot(root));
+    }
+
+    public FileIdentityMode Mode { get; }
+
+    /// <summary>The normalized chosen root for <see cref="FileIdentityMode.SourceRoot"/>; null otherwise.</summary>
+    public string? SourceRoot { get; }
+}
+
+/// <summary>
+/// A file whose relative filename matched several declared roots under
+/// <see cref="FileIdentityMode.Lexical"/>: it is keyed under the first, but nothing proves that
+/// root is its own.
+/// </summary>
+/// <param name="Path">The deterministic key the file was recorded under (<see cref="FileCoverage.Path"/>).</param>
+/// <param name="CandidateRoots">Every normalized root the filename could belong to, in document order.</param>
+public readonly record struct AmbiguousFile(string Path, IReadOnlyList<string> CandidateRoots)
+{
+    /// <summary>
+    /// The NoData reason every gate gives while files stay ambiguous: <c>check</c>, <c>test</c>,
+    /// <c>crap</c> and the Fallout target say the same thing.
+    /// </summary>
+    internal static string GateReason(IReadOnlyList<AmbiguousFile> files)
+    {
+        var roots = files.SelectMany(static f => f.CandidateRoots).Distinct(StringComparer.Ordinal).Count();
+        return Invariant($"{files.Count} {(files.Count is 1 ? "file has" : "files have")} ambiguous identity across {roots} source roots; ") +
+               "re-run with --probe-sources on the machine that holds the sources or supply --source-root";
+    }
+
+    /// <summary>One entry per path, candidate roots unioned in first-seen order: the merge rule for every report type.</summary>
+    internal static List<AmbiguousFile> Union(IEnumerable<AmbiguousFile> files) =>
+        files.GroupBy(static f => f.Path, StringComparer.Ordinal)
+            .Select(static g => new AmbiguousFile(g.Key,
+                g.SelectMany(static f => f.CandidateRoots).Distinct(StringComparer.Ordinal).ToArray()))
+            .ToList();
+
+    /// <summary>A root as diagnostics print it: the no-op sentinel <c>""</c> reads as <c>.</c>.</summary>
+    internal static string Display(string root) => root.Length is 0 ? "." : root;
+}
+
+/// <summary>
+/// <see cref="FileIdentity.FromSourceRoot"/> named a root a report does not declare: a document
+/// with several roots lacks it, or no document declares it at all. An invalid request rather
+/// than an unreadable report, so the CLI exits with its usage code.
+/// </summary>
+public sealed class UndeclaredSourceRootException : Exception
+{
+    public UndeclaredSourceRootException(string sourceRoot, IReadOnlyList<string> declaredRoots, string? sourceName)
+        : base(BuildMessage(sourceRoot, declaredRoots, sourceName))
+    {
+        SourceRoot = sourceRoot;
+        DeclaredRoots = declaredRoots;
+        SourceName = sourceName;
+    }
+
+    /// <summary>The normalized root that was asked for.</summary>
+    public string SourceRoot { get; }
+
+    /// <summary>The normalized roots that were declared: by <see cref="SourceName"/>, or by every report read.</summary>
+    public IReadOnlyList<string> DeclaredRoots { get; }
+
+    /// <summary>The report that lacks the root; null when no report of the parse declares it.</summary>
+    public string? SourceName { get; }
+
+    private static string BuildMessage(string sourceRoot, IReadOnlyList<string> declaredRoots, string? sourceName)
+    {
+        var declared = declaredRoots.Count is 0
+            ? "none"
+            : string.Join(", ", declaredRoots.Select(static r => $"'{AmbiguousFile.Display(r)}'"));
+        return sourceName is null
+            ? $"source root '{AmbiguousFile.Display(sourceRoot)}' is not declared by any report (declared: {declared})."
+            : $"source root '{AmbiguousFile.Display(sourceRoot)}' is not declared by {sourceName} (declared: {declared}).";
+    }
+}
diff --git a/src/DotCov/Formatters/CrapFormatter.cs b/src/DotCov/Formatters/CrapFormatter.cs
index 76604e6..a7cf972 100644
--- a/src/DotCov/Formatters/CrapFormatter.cs
+++ b/src/DotCov/Formatters/CrapFormatter.cs
@@ -193,6 +193,8 @@ public static string FormatJson(CrapReport report, CrapGateResult gate, int? top
                 writer.WriteEndArray();
             }
 
+            JsonFormatter.WriteExclusion(writer, report.Exclusion);
+
             writer.WriteEndObject();
         }
 
diff --git a/src/DotCov/Formatters/JsonFormatter.cs b/src/DotCov/Formatters/JsonFormatter.cs
index 281625a..8c08821 100644
--- a/src/DotCov/Formatters/JsonFormatter.cs
+++ b/src/DotCov/Formatters/JsonFormatter.cs
@@ -34,6 +34,7 @@ public static string Format(CoverageReport report) => Write(writer =>
         writer.WriteEndArray();
 
         WriteWarnings(writer, report);
+        WriteExclusion(writer, report.Exclusion);
 
         writer.WriteEndObject();
     });
@@ -91,6 +92,7 @@ public static string FormatSnapshot(CoverageSnapshot snapshot) => Write(writer =
         // Warnings travel with the snapshot: remote sinks are exactly the consumers the
         // anomaly channel exists for, and "absent key == clean" holds here as well.
         WriteWarnings(writer, snapshot.Report);
+        WriteExclusion(writer, snapshot.Report.Exclusion);
 
         writer.WriteEndObject();
     });
@@ -129,6 +131,25 @@ private static void WriteWarnings(Utf8JsonWriter writer, CoverageReport report)
         writer.WriteEndArray();
     }
 
+    /// <summary>
+    /// What an active exclusion left out: <c>excluded</c> (the removed paths) and
+    /// <c>exclusionRules</c> (the patterns applied). Both keys are absent when no exclusion was
+    /// applied and present — <c>excluded</c> possibly empty — whenever one was, so a consumer can
+    /// tell "nothing excluded" from "nothing matched".
+    /// </summary>
+    internal static void WriteExclusion(Utf8JsonWriter writer, FileExclusion exclusion)
+    {
+        if (!exclusion.IsActive) return;
+
+        writer.WriteStartArray("excluded");
+        foreach (var path in exclusion.ExcludedFiles) writer.WriteStringValue(path);
+        writer.WriteEndArray();
+
+        writer.WriteStartArray("exclusionRules");
+        foreach (var pattern in exclusion.Patterns) writer.WriteStringValue(pattern);
+        writer.WriteEndArray();
+    }
+
     private static void WriteFile(Utf8JsonWriter writer, FileCoverage f)
     {
         writer.WriteStartObject();
diff --git a/src/DotCov/MethodCoverageReport.cs b/src/DotCov/MethodCoverageReport.cs
index 619af75..bfede36 100644
--- a/src/DotCov/MethodCoverageReport.cs
+++ b/src/DotCov/MethodCoverageReport.cs
@@ -1,9 +1,9 @@
 namespace DotCov;
 
 /// <summary>
-/// Result of <see cref="CoberturaParser.ParseMethods(Stream, long)"/> and friends: the raw
-/// per-method entries plus the diagnostics and source roots observed while reading them, so
-/// nothing the parser noticed is lost on the method-level path.
+/// Result of <see cref="CoberturaParser.ParseMethods(Stream, long, FileIdentity)"/> and friends:
+/// the raw per-method entries plus the diagnostics and source roots observed while reading them,
+/// so nothing the parser noticed is lost on the method-level path.
 /// </summary>
 public sealed class MethodCoverageReport
 {
@@ -30,4 +30,36 @@ public MethodCoverageReport(
     /// identity — the same rule <see cref="CoverageReport.SourceRoots"/> follows.
     /// </summary>
     public IReadOnlyList<string> SourceRoots { get; }
+
+    /// <summary>
+    /// Files whose identity the parse could not resolve — the method-level twin of
+    /// <see cref="CoverageReport.AmbiguousFiles"/>. A <see cref="CrapReport"/> analyzed from
+    /// this report answers <see cref="GateOutcome.NoData"/> while any remain.
+    /// </summary>
+    public IReadOnlyList<AmbiguousFile> AmbiguousFiles { get; init; } = [];
+
+    /// <summary>The exclusions applied to this report and the files they removed.</summary>
+    public FileExclusion Exclusion { get; init; } = FileExclusion.None;
+
+    /// <summary>
+    /// Remove every method whose file matches <paramref name="patterns"/>, unless it matches
+    /// <paramref name="keep"/> — exactly the substring-match semantics of
+    /// <see cref="CoverageReport.Exclude(IEnumerable{string}, IEnumerable{string})"/>; the two
+    /// share one predicate, so <c>--exclude-generated</c> and <c>--exclude-test-code</c> mean
+    /// the same thing to <c>crap</c> as they do to <c>report</c> and <c>check</c>.
+    /// </summary>
+    public MethodCoverageReport Exclude(IEnumerable<string> patterns, IEnumerable<string> keep)
+    {
+        var rules = patterns.ToList();
+        if (rules.Count is 0) return this;
+
+        var keepRules = keep.ToList();
+        var (kept, excluded) = ExclusionRules.Partition(Methods, static m => m.File, rules, keepRules);
+
+        return new MethodCoverageReport(kept, Warnings, SourceRoots)
+        {
+            AmbiguousFiles = ExclusionRules.Remaining(AmbiguousFiles, excluded),
+            Exclusion = Exclusion.Then(rules, keepRules, excluded)
+        };
+    }
 }
diff --git a/src/DotCov/MethodIdentity.cs b/src/DotCov/MethodIdentity.cs
index ddb93c9..93e949e 100644
--- a/src/DotCov/MethodIdentity.cs
+++ b/src/DotCov/MethodIdentity.cs
@@ -22,6 +22,10 @@ namespace DotCov;
 /// bracket parse here matches the OUTER close bracket and re-normalizes the inner name.
 /// Folded methods lose their arity (a state machine's <c>MoveNext()</c> says nothing about the
 /// origin's parameter list), which the matcher records as "unknown" rather than inventing one.
+/// What they keep is the origin's METHOD ORDINAL — Roslyn numbers every source method of a type
+/// and stamps that number into everything it synthesizes for it (<c>&lt;M&gt;d__3</c>,
+/// <c>&lt;M&gt;b__3_0</c>, <c>&lt;M&gt;g__Local|3_0</c>, <c>&lt;&gt;c__DisplayClass3_0</c>), so two
+/// overloads' synthetic material never shares an origin (<see cref="SyntheticOrigin"/>).
 /// </para>
 /// </summary>
 internal static class MethodIdentity
@@ -44,45 +48,45 @@ internal static class MethodIdentity
     /// </param>
     internal static bool TryNormalize(
         string className, string methodName,
-        out string typeKey, out string typeIdentity, out string methodKey, out bool folded)
+        out string typeKey, out string typeIdentity, out string methodKey, out SyntheticOrigin? origin)
     {
         typeKey = "";
         typeIdentity = "";
         methodKey = "";
-        folded = false;
+        origin = null;
 
-        var (typeSegments, stateMachineOrigin, inSyntheticContainer) = ScanClassChain(className);
+        var chain = ScanClassChain(className);
 
-        if (typeSegments.Count is 0) return false;
-        typeIdentity = string.Join(".", typeSegments);
-        typeKey = string.Join(".", typeSegments.Select(StripGenericArity));
+        if (chain.TypeSegments.Count is 0) return false;
+        typeIdentity = string.Join(".", chain.TypeSegments);
+        typeKey = string.Join(".", chain.TypeSegments.Select(StripGenericArity));
 
-        if (stateMachineOrigin is not null)
+        if (chain.StateMachine is { } machine)
         {
             // Only MoveNext carries the method body; .ctor/SetStateMachine/Dispose/Reset/
             // get_Current are machinery.
             if (methodName is not "MoveNext") return false;
-            methodKey = stateMachineOrigin;
-            folded = true;
+            methodKey = machine.Name;
+            origin = new SyntheticOrigin(machine.Ordinal ?? chain.ContainerOrdinal ?? "", machine.OwnBody);
             return true;
         }
 
-        if (inSyntheticContainer)
+        if (chain.InSyntheticContainer)
         {
             // Only mangled members (<M>b__…, <M>g__…) name an origin; a display class's own
             // .ctor or cached-delegate field accessors do not.
-            if (!TryMangledOrigin(methodName, out var origin)) return false;
-            methodKey = origin;
-            folded = true;
+            if (!TryMangledOrigin(methodName, out var name, out var ordinal)) return false;
+            methodKey = name;
+            origin = new SyntheticOrigin(ordinal ?? chain.ContainerOrdinal ?? "", OwnBody: false);
             return true;
         }
 
         // On the source type itself: this-capturing lambdas (<M>b__…) and local functions
         // (<M>g__Name|…) are emitted directly on the type with mangled names.
-        if (TryMangledOrigin(methodName, out var mangledOrigin))
+        if (TryMangledOrigin(methodName, out var mangled, out var mangledOrdinal))
         {
-            methodKey = mangledOrigin;
-            folded = true;
+            methodKey = mangled;
+            origin = new SyntheticOrigin(mangledOrdinal ?? "", OwnBody: false);
             return true;
         }
 
@@ -90,6 +94,17 @@ internal static bool TryNormalize(
         return true;
     }
 
+    /// <summary>
+    /// The nested-class chain of an IL class name: its real type segments (generic arity kept),
+    /// the state machine that terminates it, if any, whether a synthetic container was crossed,
+    /// and the method ordinal that container carries.
+    /// </summary>
+    private readonly record struct ClassChain(
+        List<string> TypeSegments,
+        (string Name, string? Ordinal, bool OwnBody)? StateMachine,
+        bool InSyntheticContainer,
+        string? ContainerOrdinal);
+
     /// <summary>
     /// Walk the nested-class chain of an IL class name, collecting real type segments
     /// (generic arity kept) until a state-machine segment terminates the chain — anything
@@ -100,20 +115,23 @@ internal static bool TryNormalize(
     /// terminal: an async lambda's state machine nests INSIDE its display class
     /// (<c>Type/&lt;&gt;c/&lt;&lt;M&gt;b__0_0&gt;d</c>), so deeper segments must still be scanned.
     /// </summary>
-    private static (List<string> TypeSegments, string? StateMachineOrigin, bool InSyntheticContainer)
-        ScanClassChain(string className)
+    private static ClassChain ScanClassChain(string className)
     {
         var typeSegments = new List<string>();
         var inSyntheticContainer = false;
+        string? containerOrdinal = null;
 
         foreach (var segment in className.Split('/'))
         {
-            if (TryStateMachineOrigin(segment, out var origin))
-                return (typeSegments, origin, inSyntheticContainer);
+            if (TryStateMachineOrigin(segment, out var name, out var ordinal, out var ownBody))
+                return new ClassChain(typeSegments, (name, ordinal, ownBody), inSyntheticContainer, containerOrdinal);
 
             if (segment.StartsWith("<>", StringComparison.Ordinal))
             {
                 inSyntheticContainer = true;
+                // <>c__DisplayClass3_0: the closure of method #3.
+                if (segment.StartsWith(DisplayClassPrefix, StringComparison.Ordinal))
+                    containerOrdinal = MethodOrdinal(segment.AsSpan(DisplayClassPrefix.Length));
                 continue;
             }
 
@@ -123,9 +141,11 @@ private static (List<string> TypeSegments, string? StateMachineOrigin, bool InSy
             typeSegments.Add(segment);
         }
 
-        return (typeSegments, null, inSyntheticContainer);
+        return new ClassChain(typeSegments, null, inSyntheticContainer, containerOrdinal);
     }
 
+    private const string DisplayClassPrefix = "<>c__DisplayClass";
+
     /// <summary>
     /// The member name a Roslyn metrics display carries for a normalized method key.
     /// MinimallyQualifiedFormat drops an explicit implementation's interface (IL
@@ -155,50 +175,87 @@ internal static string MetricsMemberName(string methodKey)
     }
 
     /// <summary>
-    /// State-machine class segment → origin method name. Shapes: <c>&lt;M&gt;d__3</c>
-    /// (async/iterator method), <c>&lt;&lt;M&gt;b__0_0&gt;d</c> (async lambda — bare <c>d</c>,
-    /// no counter), <c>&lt;&lt;M&gt;g__Local|0_0&gt;d</c> (async/iterator local function),
+    /// State-machine class segment → origin method name and ordinal. Shapes: <c>&lt;M&gt;d__3</c>
+    /// (async/iterator method, ordinal 3 — the method's OWN body), <c>&lt;&lt;M&gt;b__0_0&gt;d</c>
+    /// (async lambda — bare <c>d</c>, no counter; ordinal from the lambda name),
+    /// <c>&lt;&lt;M&gt;g__Local|0_0&gt;d</c> (async/iterator local function),
     /// <c>&lt;&lt;Main&gt;$&gt;d__0</c> (top-level statements).
     /// </summary>
-    private static bool TryStateMachineOrigin(string segment, out string origin)
+    private static bool TryStateMachineOrigin(string segment, out string name, out string? ordinal, out bool ownBody)
     {
-        origin = "";
+        name = "";
+        ordinal = null;
+        ownBody = false;
         if (segment.Length < 4 || segment[0] is not '<') return false;
         var close = MatchingClose(segment);
         if (close <= 1) return false;                              // "<>…" has no origin name
         var rest = segment.AsSpan(close + 1);
         if (!rest.SequenceEqual("d") && !rest.StartsWith("d__", StringComparison.Ordinal)) return false;
+
+        var inner = segment[1..close];
+        // A plain inner name is the method itself, so the state machine IS that method's body;
+        // a mangled one (a lambda, a local function, <Main>$) is machinery inside it.
+        ownBody = !TryMangledOrigin(inner, out var innerName, out var innerOrdinal);
         // A type name spells the origin's dots as '-' (`<<-ctor>b__0_0>d`,
         // `<System-Collections-IEnumerable-GetEnumerator>d__3`); '-' is no identifier character.
-        origin = NormalizeOrigin(segment[1..close]).Replace('-', '.');
+        name = (ownBody ? inner : innerName).Replace('-', '.');
+        ordinal = innerOrdinal ?? (rest.Length > 3 ? LeadingDigits(rest[3..]) : null);
         return true;
     }
 
     /// <summary>
     /// <c>&lt;M&gt;b__0_1</c> (lambda) / <c>&lt;M&gt;g__Name|0_0</c> (local function) /
-    /// <c>&lt;Main&gt;$</c> (top-level statements) → origin <c>M</c> / <c>Main</c>.
+    /// <c>&lt;Main&gt;$</c> (top-level statements) → origin <c>M</c> / <c>Main</c>, with the
+    /// origin's method ordinal when the name carries one (<c>b__N_K</c>, <c>g__Name|N_K</c>; a
+    /// display-class lambda's <c>b__K</c> numbers the lambda, not the method).
     /// </summary>
-    private static bool TryMangledOrigin(string methodName, out string origin)
+    private static bool TryMangledOrigin(string methodName, out string origin, out string? ordinal)
     {
         origin = "";
+        ordinal = null;
         if (methodName.Length < 4 || methodName[0] is not '<') return false;
         var close = MatchingClose(methodName);
         if (close <= 1) return false;
         var rest = methodName.AsSpan(close + 1);
-        if (!rest.StartsWith("b__", StringComparison.Ordinal) &&
-            !rest.StartsWith("g__", StringComparison.Ordinal) &&
-            !rest.SequenceEqual("$")) return false;
-        origin = NormalizeOrigin(methodName[1..close]);
+        if (rest.StartsWith("b__", StringComparison.Ordinal))
+            ordinal = MethodOrdinal(rest[3..]);
+        else if (rest.StartsWith("g__", StringComparison.Ordinal))
+            ordinal = MethodOrdinal(rest[(rest.IndexOf('|') + 1)..]);
+        else if (!rest.SequenceEqual("$"))
+            return false;
+
+        // A bracketed origin may itself be mangled (<RunAsync>b__0_0 inside an async-lambda
+        // state machine, <Main>$ inside a top-level-statements local function): re-normalize
+        // until a plain source name remains, keeping the first ordinal found.
+        var inner = methodName[1..close];
+        if (TryMangledOrigin(inner, out var innerOrigin, out var innerOrdinal))
+        {
+            origin = innerOrigin;
+            ordinal ??= innerOrdinal;
+        }
+        else
+        {
+            origin = inner;
+        }
         return true;
     }
 
     /// <summary>
-    /// A bracketed origin may itself be mangled (<c>&lt;RunAsync&gt;b__0_0</c> inside an
-    /// async-lambda state machine, <c>&lt;Main&gt;$</c> inside a top-level-statements local
-    /// function): re-normalize until a plain source name remains.
+    /// The method ordinal at the start of an <c>N_K</c> suffix (<c>0_1</c> → <c>0</c>); null for
+    /// any other shape, including a bare lambda counter.
     /// </summary>
-    private static string NormalizeOrigin(string origin) =>
-        TryMangledOrigin(origin, out var inner) ? inner : origin;
+    private static string? MethodOrdinal(ReadOnlySpan<char> suffix) =>
+        LeadingDigits(suffix) is { } digits && suffix.Length > digits.Length && suffix[digits.Length] is '_'
+            ? digits
+            : null;
+
+    /// <summary>The leading ASCII digits of <paramref name="text"/>; null when it starts with none.</summary>
+    private static string? LeadingDigits(ReadOnlySpan<char> text)
+    {
+        var length = 0;
+        while (length < text.Length && char.IsAsciiDigit(text[length])) length++;
+        return length is 0 ? null : text[..length].ToString();
+    }
 
     /// <summary>
     /// Index of the <c>&gt;</c> matching the leading <c>&lt;</c>, depth-tracked because Roslyn
@@ -222,3 +279,12 @@ private static string StripGenericArity(string segment)
         return tick < 0 ? segment : segment[..tick];
     }
 }
+
+/// <summary>
+/// Where a folded (compiler-synthesized) method came from. <see cref="Ordinal"/> is the origin's
+/// method ordinal ("" when the names carry none), so the synthetic material of
+/// <c>M(int)</c> and <c>M(string)</c> stays apart; <see cref="OwnBody"/> marks an async/iterator
+/// state machine that IS its origin's body — such a method's own (kickoff) entry carries no
+/// lines, so a same-named entry WITH lines is a different overload.
+/// </summary>
+internal readonly record struct SyntheticOrigin(string Ordinal, bool OwnBody);
diff --git a/src/DotCov/PathIdentity.cs b/src/DotCov/PathIdentity.cs
index 78c0860..5e64641 100644
--- a/src/DotCov/PathIdentity.cs
+++ b/src/DotCov/PathIdentity.cs
@@ -14,28 +14,55 @@ internal static class PathIdentity
 
     /// <summary>
     /// Canonical form of a declared <c>&lt;source&gt;</c> root: trimmed, separators flipped
-    /// to <c>/</c>, a leading <c>./</c> stripped, the no-op spellings (<c>.</c>, <c>./</c>,
-    /// empty) collapsed to <c>""</c> (the no-op sentinel), a lowercase drive letter
-    /// uppercased (the same rule the parser applies to file KEYS, so root identity and key
-    /// identity agree), and trailing <c>/</c> trimmed — but never below one character, so
-    /// Coverlet's bare <c>&lt;source&gt;/&lt;/source&gt;</c> root survives intact and the
-    /// documented <c>/</c>-vs-<c>/_/</c> cross-convention detection keeps its operands.
+    /// to <c>/</c>, redundant <c>.</c> segments removed by <see cref="RemoveDotSegments"/>
+    /// (the rule file keys follow too), the no-op spellings (<c>.</c>, <c>./</c>, empty)
+    /// collapsed to <c>""</c> (the no-op sentinel), a lowercase drive letter uppercased (the
+    /// same rule the parser applies to file KEYS, so root identity and key identity agree),
+    /// and trailing <c>/</c> trimmed — but never below one character, so Coverlet's bare
+    /// <c>&lt;source&gt;/&lt;/source&gt;</c> root survives intact and the documented
+    /// <c>/</c>-vs-<c>/_/</c> cross-convention detection keeps its operands.
     /// Applied at parse time in <c>ConsumeSource</c> AND at comparison time in
     /// <see cref="RootsDiffer"/>, so hand-built reports whose roots were never
     /// parser-normalized still compare by identity rather than spelling.
     /// </summary>
     internal static string NormalizeRoot(string root)
     {
-        root = root.Trim().Replace('\\', '/');
-        if (root.StartsWith("./", StringComparison.Ordinal)) root = root[2..];
-        if (root is ".") return "";
-        if (root.Length >= 3 && char.IsAsciiLetterLower(root[0]) && root[1] == ':' && root[2] == '/')
-            root = char.ToUpperInvariant(root[0]) + root[1..];
+        root = UppercaseDriveLetter(RemoveDotSegments(root.Trim().Replace('\\', '/')));
         while (root.Length > 1 && root.EndsWith('/'))
             root = root[..^1];
         return root;
     }
 
+    /// <summary>
+    /// Drop every redundant <c>.</c> segment of a <c>/</c>-separated path — a leading
+    /// <c>./</c>, an inner <c>/./</c>, a trailing <c>/.</c> — so <c>./src/C.cs</c>,
+    /// <c>src/./C.cs</c> and <c>src/C.cs</c> name one file. Lexical only: <c>..</c> is kept
+    /// (resolving it needs the file system's view of links) and the disk is never read. A
+    /// path of only dot segments (<c>.</c>, <c>./</c>) becomes <c>""</c>, the no-op root.
+    /// </summary>
+    internal static string RemoveDotSegments(string path)
+    {
+        // A separator doubled after a leading "./" (".//src") is part of that no-op prefix; left
+        // in place it would turn the relative name into an absolute one.
+        while (path.StartsWith("./", StringComparison.Ordinal))
+            path = path[2..].TrimStart('/');
+        while (path.Contains("/./", StringComparison.Ordinal))
+            path = path.Replace("/./", "/", StringComparison.Ordinal);
+        if (path.EndsWith("/.", StringComparison.Ordinal))
+            path = path[..^1];
+        return path is "." ? "" : path;
+    }
+
+    /// <summary>
+    /// Uppercase a leading drive letter, so <c>c:/x/A.cs</c> and <c>C:/x/A.cs</c> — the same
+    /// file emitted by different Windows toolchains — are one Ordinal key. Key normalization,
+    /// not a case-insensitive comparer: a Dictionary has a single comparer for every key.
+    /// </summary>
+    internal static string UppercaseDriveLetter(string path) =>
+        path.Length >= 3 && char.IsAsciiLetterLower(path[0]) && path[1] == ':' && path[2] == '/'
+            ? char.ToUpperInvariant(path[0]) + path[1..]
+            : path;
+
     /// <summary>
     /// Whether two reports' declared roots genuinely differ — the single predicate behind
     /// both the merge's ambiguity scan and the diff's unconditional name-pairing arm, so
diff --git a/src/DotCov/README.md b/src/DotCov/README.md
index 8d9f403..0d359b5 100644
--- a/src/DotCov/README.md
+++ b/src/DotCov/README.md
@@ -44,6 +44,21 @@ no rate, and treating that as 0% would fail a build that simply measured nothing
 structured flags (`LineBelowThreshold`, `BranchBelowThreshold`, `IsInconclusive`) rather than
 parsing `Reason`.
 
+## File identity
+
+A report that declares several `<source>` roots names its files relative to one of them without
+saying which. Every `CoberturaParser` entry point takes a `FileIdentity`; the default,
+`FileIdentity.Lexical`, never reads the disk, so the same XML gives the same keys on every
+machine. Such a file is keyed under the first root, listed in `report.AmbiguousFiles` with its
+candidate roots, and warned about, and `Evaluate` answers `NoData` while any remain.
+`FileIdentity.ProbeSources` resolves against the root that holds the file on the reading
+machine's disk; `FileIdentity.FromSourceRoot(root)` names the root, and a root no report declares
+throws `UndeclaredSourceRootException`.
+
+```csharp
+var report = CoberturaParser.Parse(inputs, identity: FileIdentity.FromSourceRoot("src"));
+```
+
 ## What else is in the box
 
 ```csharp
@@ -60,10 +75,17 @@ await using var stream = File.OpenRead("coverage.cobertura.xml");
 var report = await CoberturaParser.ParseAsync(stream, ct: cancellationToken);
 
 // Per-method detail — complexity and line hits, the input behind the CRAP gate
-var methods = CoberturaParser.ParseMethods(ReportResolver.Resolve("TestResults/"));
-// methods.Methods, methods.Warnings, methods.SourceRoots
+var methods = CoberturaParser.ParseMethods(ReportResolver.Resolve("TestResults/"))
+                             .Exclude(ExclusionRules.TestCode, keep: []);
+var crap = CrapAnalysis.Analyze(methods);
+var verdict = crap.Evaluate(maxCrap: 30);   // NoData while any method is unscored
 ```
 
+`Exclude` records what it removed: `report.Exclusion` holds the patterns, the keep exemptions and
+the excluded paths, and `JsonFormatter` writes them as `excluded` and `exclusionRules`.
+`ExclusionRules.WellKnown` covers generated code and build output, `ExclusionRules.TestCode` test
+projects and fixtures.
+
 `TableFormatter`, `MarkdownFormatter`, and `JsonFormatter` render a report for a terminal, a PR
 comment, or a pipeline. `BadgeFormatter.Svg(gate)` and `BadgeFormatter.ShieldsJson(gate)` draw an
 evaluated `GateResult` as a coverage badge, coloured by its outcome. Every numeric rendering is
diff --git a/tests/AGENTS.md b/tests/AGENTS.md
index 69abae1..b2a1e0e 100644
--- a/tests/AGENTS.md
+++ b/tests/AGENTS.md
@@ -1,6 +1,6 @@
 # Tests, Coverage und Fallout in diesem Repo
 
-Runner ist **Microsoft.Testing.Platform** (`global.json` → `"test.runner"`), Framework TUnit 1.67.
+Runner ist **Microsoft.Testing.Platform** (`global.json` → `"test.runner"`), Framework TUnit 1.74.
 SDK 10: MTP-Optionen gehen direkt an `dotnet test`; ein zusätzlicher `--`-Trenner ist
 hier nicht erforderlich. Die ältere VSTest-Integration hat andere Aufrufregeln.
 
diff --git a/tests/DotCov.Tests/BadgeActionTests.cs b/tests/DotCov.Tests/BadgeActionTests.cs
index 16ebd25..379a115 100644
--- a/tests/DotCov.Tests/BadgeActionTests.cs
+++ b/tests/DotCov.Tests/BadgeActionTests.cs
@@ -68,6 +68,22 @@ await Assert.That(await Git(cancellationToken, _origin, "ls-tree", "--name-only"
         await Assert.That(await Git(cancellationToken, _clone, "config", "--local", "--list")).DoesNotContain("user.");
     }
 
+    [Test]
+    public async Task NoThreshold_FailsWithDotcovsUsageError_AndPublishesNothing(CancellationToken cancellationToken)
+    {
+        // The action has no default threshold either: an implicit 80 would gate on a number
+        // nobody chose.
+        await Init(cancellationToken);
+
+        var run = await RunAction(cancellationToken);
+
+        await Assert.That(run.ExitCode).IsEqualTo(2).Because(run.Output);
+        await Assert.That(run.Outputs["exit-code"]).IsEqualTo("2");
+        await Assert.That(run.Output).Contains("error: missing threshold: 'check' needs --min-line N, --min-branch N, or both");
+        await Assert.That(run.Output).Contains("dotcov check exited 2 without writing a badge; nothing was published.");
+        await Assert.That(await Git(cancellationToken, _origin, "branch", "--list")).IsEmpty();
+    }
+
     [Test]
     public async Task FailOnGateFalse_KeepsGateOutcomesGreen(CancellationToken cancellationToken)
     {
@@ -85,7 +101,7 @@ public async Task Error_FailsEvenWithFailOnGateFalse_AndPublishesNothing(Cancell
     {
         await Init(cancellationToken);
 
-        var run = await RunAction(cancellationToken, ("reports", _ws.PathOf("missing")), ("fail-on-gate", "false"));
+        var run = await RunAction(cancellationToken, ("reports", _ws.PathOf("missing")), ("min-line", "80"), ("fail-on-gate", "false"));
 
         await Assert.That(run.ExitCode).IsEqualTo(5).Because(run.Output);
         await Assert.That(run.Output).Contains("::error::dotcov check exited 5 without writing a badge; nothing was published.");
@@ -98,7 +114,7 @@ public async Task PublishFalse_RendersWithoutPushing(CancellationToken cancellat
     {
         await Init(cancellationToken);
 
-        var run = await RunAction(cancellationToken, ("publish", "false"));
+        var run = await RunAction(cancellationToken, ("min-line", "80"), ("publish", "false"));
 
         await Assert.That(run.ExitCode).IsEqualTo(0).Because(run.Output);
         await Assert.That(File.Exists(Path.Combine(run.Outputs["directory"], "coverage-badge.svg"))).IsTrue();
@@ -187,7 +203,7 @@ private async Task<ActionRun> RunAction(CancellationToken cancellationToken, par
     {
         var values = new Dictionary<string, string>
         {
-            ["reports"] = _report, ["badge-directory"] = "", ["pattern"] = "", ["min-line"] = "80", ["min-branch"] = "0", ["args"] = "",
+            ["reports"] = _report, ["badge-directory"] = "", ["pattern"] = "", ["min-line"] = "", ["min-branch"] = "", ["args"] = "",
             ["branch"] = "badges", ["publish"] = "true", ["fail-on-gate"] = "true", ["version"] = "unused",
             ["command"] = DotcovCommand(),
         };
diff --git a/tests/DotCov.Tests/CliBadgeTests.cs b/tests/DotCov.Tests/CliBadgeTests.cs
index c954572..884f2fb 100644
--- a/tests/DotCov.Tests/CliBadgeTests.cs
+++ b/tests/DotCov.Tests/CliBadgeTests.cs
@@ -111,7 +111,7 @@ public async Task Check_EmptyBadgeDir_FailsBeforeReadingTheReport()
     {
         var missing = _ws.PathOf("missing.xml");
 
-        var (code, stdout, stderr) = await Run("check", missing, "--badge-dir", "");
+        var (code, stdout, stderr) = await Run("check", missing, "--min-line", "80", "--badge-dir", "");
 
         await Assert.That(code).IsEqualTo(2);
         await Assert.That(stdout).IsEmpty();
@@ -121,7 +121,7 @@ public async Task Check_EmptyBadgeDir_FailsBeforeReadingTheReport()
     [Test]
     public async Task Test_EmptyBadgeDir_FailsBeforeAnyTestRuns()
     {
-        var (code, stdout, stderr) = await Run("test", "--badge-dir", "");
+        var (code, stdout, stderr) = await Run("test", "--min-line", "80", "--badge-dir", "");
 
         await Assert.That(code).IsEqualTo(2);
         // No echoed "> dotnet test" line: nothing was started.
diff --git a/tests/DotCov.Tests/CliCrapTests.cs b/tests/DotCov.Tests/CliCrapTests.cs
index 1a5de9a..9ba0dce 100644
--- a/tests/DotCov.Tests/CliCrapTests.cs
+++ b/tests/DotCov.Tests/CliCrapTests.cs
@@ -315,4 +315,45 @@ public async Task Crap_ExcludeGenerated_DropsExcludedFilesFromGate()
         await Assert.That(withFlag).IsEqualTo(0);
         await Assert.That(stdout).DoesNotContain("Program");
     }
+
+    // ── Complete scoring: one unscored method withholds the verdict ──
+
+    /// <summary>A scored method well below the gate beside one the report gives no complexity for.</summary>
+    private string PartlyScored() =>
+        _ws.Write("partly.cobertura.xml", Cobertura.NewDoc()
+            .AddClass("src/A.cs", "MyApp.A", c => c
+                .Method("Scored", "()", "1", m => m.Line(1, hits: 1))
+                .Method("Unscored", "()", null, m => m.Line(5, hits: 0)))
+            .ToBytes());
+
+    [Test]
+    [Arguments("table")]
+    [Arguments("md")]
+    [Arguments("json")]
+    public async Task Crap_OneUnscoredMethod_IsNoData_Exits3_AndStillListsIt(string format)
+    {
+        // 2.x passed this report: the only scored method sits far below 30, and the method it could
+        // not score was listed and ignored. That method may be the one above the limit.
+        var (code, stdout, stderr) = await Run("crap", PartlyScored(), "--format", format);
+
+        await Assert.That(code).IsEqualTo(DotCovCli.NoDataExitCode);
+        await Assert.That(stderr).StartsWith("NODATA: worst CRAP 1.0 (max 30) - 1 of 2 methods could not be scored - supply --metrics <file>");
+        await Assert.That(stdout).DoesNotContain("PASS:");
+        await Assert.That(stdout).Contains("MyApp.A.Unscored");
+        await Assert.That(stdout).Contains(format is "json" ? "\"outcome\": \"nodata\"" : "no complexity in the coverage report");
+    }
+
+    [Test]
+    public async Task Crap_MetricsFileScoringTheRest_TurnsTheSameReportIntoAMeasuredPass()
+    {
+        // The remedy the reason names: --metrics supplies the missing complexity.
+        var metrics = _ws.Write("A.Metrics.xml", CodeMetricsReportBuilder.Create()
+            .Namespace("MyApp", t => t.Type("A", m => m.Method("void A.Unscored()", 1)))
+            .ToBytes());
+
+        var (code, stdout, _) = await Run("crap", PartlyScored(), "--metrics", metrics);
+
+        await Assert.That(code).IsEqualTo(0).Because(stdout);
+        await Assert.That(stdout).Contains("PASS: worst CRAP 2.0 (max 30) - all 2 methods at or below threshold");
+    }
 }
diff --git a/tests/DotCov.Tests/CliTestCommandTests.cs b/tests/DotCov.Tests/CliTestCommandTests.cs
index 00ddc46..9417f1e 100644
--- a/tests/DotCov.Tests/CliTestCommandTests.cs
+++ b/tests/DotCov.Tests/CliTestCommandTests.cs
@@ -30,7 +30,7 @@ public sealed class CliTestCommandTests : IDisposable
     public async Task WithoutGlobalJson_CollectsWithTheVSTestCollector_IntoAFreshResultsDirectory(
         CancellationToken cancellationToken)
     {
-        var run = await Dotcov(cancellationToken, "test", "missing.csproj");
+        var run = await Dotcov(cancellationToken, "test", "missing.csproj", "--min-line", "80");
 
         await Assert.That(run.StdOut).Contains("test missing.csproj --results-directory \"");
         await Assert.That(run.StdOut).Contains($"{Created("TestResults")}\" {VSTestCoverage}");
@@ -53,7 +53,7 @@ public async Task GlobalJsonTestingPlatform_UsesTheCoverageExtension(
             }
             """);
 
-        var run = await Dotcov(cancellationToken, "test", target);
+        var run = await Dotcov(cancellationToken, "test", target, "--min-line", "80");
 
         await Assert.That(run.StdOut).Contains($"test {option} {target} --results-directory ");
         await Assert.That(run.StdOut).Contains(TestingPlatformCoverage);
@@ -65,7 +65,7 @@ public async Task GlobalJsonInAParentDirectory_SelectsTheRunner_WithoutATarget(C
     {
         _ws.Write("global.json", TestingPlatformGlobalJson);
 
-        var run = await Dotcov(cancellationToken, _ws.CreateDirectory("src/App.Tests"), new Dictionary<string, string?>(), "test");
+        var run = await Dotcov(cancellationToken, _ws.CreateDirectory("src/App.Tests"), new Dictionary<string, string?>(), "test", "--min-line", "80");
 
         await Assert.That(run.StdOut).Contains("test --results-directory \"");
         await Assert.That(run.StdOut).Contains($"{Created("src/App.Tests/TestResults")}\" {TestingPlatformCoverage}");
@@ -80,7 +80,7 @@ public async Task GlobalJsonWithoutAStringRunner_FallsBackToVSTest(string global
     {
         _ws.Write("global.json", globalJson);
 
-        var run = await Dotcov(cancellationToken, "test", "missing.csproj");
+        var run = await Dotcov(cancellationToken, "test", "missing.csproj", "--min-line", "80");
 
         await Assert.That(run.StdOut).Contains(VSTestCoverage);
         await AssertNotEvaluated(run);
@@ -96,7 +96,7 @@ public async Task DotnetTestRunnerVariable_WinsOverGlobalJson_WhenRecognized(
         _ws.Write("global.json", globalJson);
 
         var run = await Dotcov(cancellationToken, _ws.Root,
-            new Dictionary<string, string?> { ["DOTNET_TEST_RUNNER"] = runner }, "test", "missing.csproj");
+            new Dictionary<string, string?> { ["DOTNET_TEST_RUNNER"] = runner }, "test", "missing.csproj", "--min-line", "80");
 
         await Assert.That(run.StdOut).Contains(coverage);
         await AssertNotEvaluated(run);
@@ -121,7 +121,7 @@ public async Task DotnetThatCannotStart_IsAnError(CancellationToken cancellation
         var dotnet = _ws.PathOf("no-sdk/dotnet");
 
         var run = await Dotcov(cancellationToken, _ws.Root,
-            new Dictionary<string, string?> { ["DOTNET_HOST_PATH"] = dotnet }, "test");
+            new Dictionary<string, string?> { ["DOTNET_HOST_PATH"] = dotnet }, "test", "--min-line", "80");
 
         await Assert.That(run.ExitCode).IsEqualTo(5);
         await Assert.That(run.StdOut).StartsWith($"> \"{dotnet}\" test --results-directory ");
@@ -157,10 +157,12 @@ public async Task TestingPlatformProject_IsTestedReportedAndGated(
         await Assert.That(run.StdOut).Contains($"test --project {project} --results-directory ");
         await Assert.That(run.StdOut).Contains("Sign.cs");
         await Assert.That(expectedCode == 0 ? run.StdOut : run.StdErr).Contains(verdict);
+        // A pass leaves stderr to the diagnostics: here the exclusion --exclude-generated applied.
         if (expectedCode == 0)
-            await Assert.That(run.StdErr).IsEmpty();
+            await Assert.That(run.StdErr).StartsWith("exclusion rules: .g.cs, .designer.cs, /obj/");
         else
             await Assert.That(run.StdErr).StartsWith(verdict);
+        await Assert.That(run.StdErr).Contains("excluded ");
         await Assert.That(await File.ReadAllTextAsync(summary, cancellationToken)).Contains($"`{verdict}");
         // --badge-dir is relative to the working directory, and the badge carries the same verdict.
         await Assert.That(await File.ReadAllTextAsync(_ws.PathOf("badge/coverage-badge.json"), cancellationToken))
@@ -179,7 +181,7 @@ public async Task SuccessfulRunWithoutCoverage_ExitsNoData(CancellationToken can
               <PropertyGroup><TargetFramework>net{Environment.Version.Major}.0</TargetFramework></PropertyGroup>
             </Project>
             """);
-        var run = await Dotcov(cancellationToken, "test", "Library.csproj");
+        var run = await Dotcov(cancellationToken, "test", "Library.csproj", "--min-line", "80");
 
         await Assert.That(run.ExitCode).IsEqualTo(3).Because(run.Output);
         await Assert.That(run.StdErr).StartsWith("NODATA:");
diff --git a/tests/DotCov.Tests/CliTests.cs b/tests/DotCov.Tests/CliTests.cs
index ce0d560..962753b 100644
--- a/tests/DotCov.Tests/CliTests.cs
+++ b/tests/DotCov.Tests/CliTests.cs
@@ -199,13 +199,13 @@ public async Task Check_SecondPath_IsAnError_NotSilentlyDropped()
     }
 
     [Test]
-    public async Task Keep_WithoutExcludeGenerated_IsAnError()
+    public async Task Keep_WithoutAnExclusion_IsAnError()
     {
-        // --keep only exempts files from --exclude-generated, so alone it would change nothing.
+        // --keep only exempts files from an exclusion, so alone it would change nothing.
         var (code, _, stderr) = await Run("report", HalfCovered(), "--keep", "Program.cs");
 
         await Assert.That(code).IsEqualTo(2);
-        await Assert.That(stderr).StartsWith("error: --keep only applies together with --exclude-generated.");
+        await Assert.That(stderr).StartsWith("error: --keep only applies together with --exclude-generated or --exclude-test-code.");
     }
 
     [Test]
diff --git a/tests/DotCov.Tests/CliUsageProcessTests.cs b/tests/DotCov.Tests/CliUsageProcessTests.cs
index 706c6d0..4e41a98 100644
--- a/tests/DotCov.Tests/CliUsageProcessTests.cs
+++ b/tests/DotCov.Tests/CliUsageProcessTests.cs
@@ -22,7 +22,7 @@ public async Task BothVersionForms_PrintTheSameVersion(CancellationToken cancell
         await Assert.That(command.ExitCode).IsEqualTo(0);
         await Assert.That(alias.ExitCode).IsEqualTo(0);
         await Assert.That(alias.StdOut).IsEqualTo(command.StdOut);
-        await Assert.That(alias.StdOut).IsEqualTo($"dotcov {typeof(CoberturaParser).Assembly.GetName().Version}{Environment.NewLine}");
+        await Assert.That(alias.StdOut).IsEqualTo($"dotcov {typeof(CoberturaParser).Assembly.GetName().Version!.ToString(3)}{Environment.NewLine}");
         await Assert.That(alias.StdErr).IsEmpty();
         await Assert.That(command.StdErr).IsEmpty();
     }
@@ -35,8 +35,10 @@ public async Task BothVersionForms_PrintTheSameVersion(CancellationToken cancell
     public async Task MissingArgument_AndSuppliedNonexistentPath_HaveDistinctExitCodes(
         string command, CancellationToken cancellationToken)
     {
+        // check has no default threshold: the nonexistent path must be the only thing wrong.
+        string[] threshold = command is "check" ? ["--min-line", "80"] : [];
         var missing = await Run(cancellationToken, command);
-        var nonexistent = await Run(cancellationToken, command, _ws.PathOf("absent.xml"));
+        var nonexistent = await Run(cancellationToken, [command, _ws.PathOf("absent.xml"), .. threshold]);
 
         await Assert.That(missing.ExitCode).IsEqualTo(DotCovCli.UsageExitCode);
         await Assert.That(nonexistent.ExitCode).IsEqualTo(DotCovCli.ErrorExitCode);
diff --git a/tests/DotCov.Tests/CoberturaParserAsyncTests.cs b/tests/DotCov.Tests/CoberturaParserAsyncTests.cs
index 0f094f2..4fe2ee4 100644
--- a/tests/DotCov.Tests/CoberturaParserAsyncTests.cs
+++ b/tests/DotCov.Tests/CoberturaParserAsyncTests.cs
@@ -21,6 +21,33 @@ public async Task ParseAsync_SmallDocument_ReturnsEquivalentReportToSync()
         await Assert.That(async.Files.Count).IsEqualTo(sync.Files.Count);
     }
 
+    [Test]
+    public async Task ParseAsync_MethodOnlyClass_YieldsTheSameReportAsSync()
+    {
+        // A class whose only lines sit under <methods> (no class-level <lines>): the sync walk
+        // let the method lines stand in for the file at the class end; the async walk never
+        // finished the class and reported the file with no lines at all.
+        var doc = Cobertura.NewDoc()
+            .AddClass("src/A.cs", "Ns.A", c => c
+                .Method("M", "()", "2", m => m.Line(3, hits: 1).Line(4, hits: 0))
+                .Method("N", "()", "1", m => m.Line(8, hits: 2)))
+            .AddClass("src/B.cs", c => c.Line(1, hits: 1));
+
+        var sync = doc.Parse();
+        using var stream = doc.ToStream();
+        var async = await CoberturaParser.ParseAsync(stream);
+
+        await Assert.That(async.Files.Select(Shape)).IsEquivalentTo(sync.Files.Select(Shape));
+        await Assert.That(async.Warnings).IsEquivalentTo(sync.Warnings);
+        var a = async.Files.Single(f => f.Path == "src/A.cs");
+        await Assert.That((a.LinesHit, a.LinesTotal)).IsEqualTo((2, 3));
+        await Assert.That(a.LineHits.Keys).IsEquivalentTo([3, 4, 8]);
+    }
+
+    private static (string Path, int LinesHit, int LinesTotal, int BranchesHit, int BranchesTotal, string Lines) Shape(FileCoverage f) =>
+        (f.Path, f.LinesHit, f.LinesTotal, f.BranchesHit, f.BranchesTotal,
+            string.Join(",", f.LineHits.OrderBy(static kv => kv.Key).Select(static kv => $"{kv.Key}:{kv.Value}")));
+
     [Test]
     public async Task ParseAsync_RespectsCancellation()
     {
diff --git a/tests/DotCov.Tests/CorePathIdentityTests.cs b/tests/DotCov.Tests/CorePathIdentityTests.cs
index 43f995a..2bfaf51 100644
--- a/tests/DotCov.Tests/CorePathIdentityTests.cs
+++ b/tests/DotCov.Tests/CorePathIdentityTests.cs
@@ -115,6 +115,24 @@ public async Task Parse_NoOpRootAlongsideRealRoot_FirstDeclaredStillWins_AndWarn
         await Assert.That(report.SourceRoots).IsEquivalentTo(["", "/usr/lib/python3/dist-packages"], CollectionOrdering.Matching);
         var w = await Assert.That(report.Warnings).HasSingleItem();
         await Assert.That(w.Kind).IsEqualTo(CoverageWarningKind.FileIdentityAmbiguous);
+        await Assert.That(w.File).IsEqualTo("app/main.py");
+        await Assert.That(w.Detail).Contains("('.', '/usr/lib/python3/dist-packages')");
+        var ambiguous = await Assert.That(report.AmbiguousFiles).HasSingleItem();
+        await Assert.That(ambiguous.CandidateRoots).IsEquivalentTo(["", "/usr/lib/python3/dist-packages"], CollectionOrdering.Matching);
+    }
+
+    [Test]
+    public async Task Parse_Probe_NoOpRootFirst_FileOnNoDisk_StaysUnprefixed_AndWarnsForTheDocument()
+    {
+        // The 2.0.0 behaviour, now opt-in: probing finds the file under neither root, so the
+        // first root applies — a no-op, so no prefix — with one document-level warning.
+        using var stream = new MemoryStream(Encoding.UTF8.GetBytes(Doc([".", "/usr/lib/python3/dist-packages"], "app/main.py")));
+        var report = CoberturaParser.Parse(stream, identity: FileIdentity.ProbeSources);
+
+        await Assert.That(report.Files.Single().Path).IsEqualTo("app/main.py");
+        await Assert.That(report.AmbiguousFiles).IsEmpty();
+        var w = await Assert.That(report.Warnings).HasSingleItem();
+        await Assert.That(w.File).IsEqualTo("");
         await Assert.That(w.Detail).Contains("unprefixed");
     }
 
diff --git a/tests/DotCov.Tests/CoverageParametersTests.cs b/tests/DotCov.Tests/CoverageParametersTests.cs
index 048bcb2..5894e37 100644
--- a/tests/DotCov.Tests/CoverageParametersTests.cs
+++ b/tests/DotCov.Tests/CoverageParametersTests.cs
@@ -5,21 +5,71 @@ namespace DotCov.Tests;
 
 /// <summary>
 /// The parameter grammar of <see cref="ICoverageReport"/>, validated once at the build
-/// boundary by <see cref="CoverageParameters"/>: invariant numbers, digits-only cap, strict
-/// booleans, case-sensitive formats with the <c>md</c> alias, and the pattern shapes. The
-/// consuming-build tests in <see cref="FalloutBuildTests"/> prove the same grammar through a
-/// real Fallout process.
+/// boundary by <see cref="CoverageParameters"/>: no default threshold, percentages from 0 to
+/// 100, digits-only cap, strict booleans, case-sensitive formats with the <c>md</c> alias, the
+/// pattern shapes, and one file-identity mode. The consuming-build tests in
+/// <see cref="FalloutBuildTests"/> prove the same grammar through a real Fallout process.
 /// </summary>
 public sealed class CoverageParametersTests
 {
+    private static CoverageParameters ParseWithDefaults(
+        string? minLine, string? minBranch, string probeSources = CoverageParameters.DefaultProbeSources, string? sourceRoot = null) =>
+        CoverageParameters.Parse(
+            minLine, minBranch, CoverageParameters.DefaultFormat, CoverageParameters.DefaultExcludeGenerated,
+            CoverageParameters.DefaultExcludeTestCode, CoverageParameters.DefaultPattern, CoverageParameters.DefaultMaxChars,
+            probeSources, sourceRoot);
+
+    [Test]
+    public async Task Parse_OneThreshold_ChecksItAndDisablesTheOther_WithTheDocumentedDefaults()
+    {
+        var p = ParseWithDefaults("80", minBranch: null);
+
+        await Assert.That(p).IsEqualTo(new CoverageParameters(
+            80, 0, CoverageFormat.Table, false, false, ReportPattern.Default, 50_000_000, FileIdentity.Lexical));
+        await Assert.That(ParseWithDefaults(minLine: null, "70").MinBranch).IsEqualTo(70);
+        await Assert.That(ParseWithDefaults(minLine: null, "70").MinLine).IsEqualTo(0);
+    }
+
+    [Test]
+    public async Task Parse_NoThreshold_FailsNamingBothParameters()
+    {
+        var ex = Assert.ThrowsExactly<ArgumentException>(() => ParseWithDefaults(minLine: null, minBranch: null));
+
+        await Assert.That(ex.Message).Contains("Missing Coverage MinLine and Coverage MinBranch");
+        await Assert.That(ex.Message).Contains("--coverage-min-line");
+    }
+
+    [Test]
+    public async Task ExclusionPatterns_SelectEachRuleSetByItsFlag()
+    {
+        static IReadOnlyList<string> Patterns(string generated, string testCode) => CoverageParameters.Parse(
+            "80", null, "table", generated, testCode, CoverageParameters.DefaultPattern, CoverageParameters.DefaultMaxChars,
+            "false", null).ExclusionPatterns;
+
+        await Assert.That(Patterns("false", "false")).IsEmpty();
+        await Assert.That(Patterns("true", "false")).IsEquivalentTo(ExclusionRules.WellKnown);
+        await Assert.That(Patterns("false", "true")).IsEquivalentTo(ExclusionRules.TestCode);
+        await Assert.That(Patterns("true", "true")).IsEquivalentTo([.. ExclusionRules.WellKnown, .. ExclusionRules.TestCode]);
+    }
+
+    [Test]
+    public async Task ParseIdentity_SelectsOneOfTheThreeModes()
+    {
+        await Assert.That(CoverageParameters.ParseIdentity(false, null)).IsSameReferenceAs(FileIdentity.Lexical);
+        await Assert.That(CoverageParameters.ParseIdentity(false, "  ")).IsSameReferenceAs(FileIdentity.Lexical);
+        await Assert.That(CoverageParameters.ParseIdentity(true, null)).IsSameReferenceAs(FileIdentity.ProbeSources);
+
+        var explicitRoot = CoverageParameters.ParseIdentity(false, @"c:\repo\src\");
+        await Assert.That(explicitRoot.Mode).IsEqualTo(FileIdentityMode.SourceRoot);
+        await Assert.That(explicitRoot.SourceRoot).IsEqualTo("C:/repo/src");
+    }
+
     [Test]
-    public async Task Parse_Defaults_MatchTheDocumentedTable()
+    public async Task ParseIdentity_ProbeAndRootTogether_FailsNamingBothParameters()
     {
-        var p = CoverageParameters.Parse(
-            CoverageParameters.DefaultMinLine, CoverageParameters.DefaultMinBranch, CoverageParameters.DefaultFormat,
-            CoverageParameters.DefaultExcludeGenerated, CoverageParameters.DefaultPattern, CoverageParameters.DefaultMaxChars);
+        var ex = Assert.ThrowsExactly<ArgumentException>(() => ParseWithDefaults("80", null, "true", "/repo"));
 
-        await Assert.That(p).IsEqualTo(new CoverageParameters(80, 0, CoverageFormat.Table, false, ReportPattern.Default, 50_000_000));
+        await Assert.That(ex.Message).Contains("Coverage ProbeSourcesParam and Coverage SourceRoot");
     }
 
     [Test]
@@ -48,6 +98,7 @@ public async Task ParseMaxChars_Garbage_ThrowsNamingTheParameter(string value)
     [Arguments("80", 80.0)]
     [Arguments("0", 0.0)]
     [Arguments("72.5", 72.5)]
+    [Arguments("100", 100.0)]
     public async Task ParseThreshold_ValidNumber_Parses(string value, double expected) =>
         await Assert.That(CoverageParameters.ParseThreshold(value, "Coverage MinLine")).IsEqualTo(expected);
 
@@ -55,6 +106,10 @@ public async Task ParseThreshold_ValidNumber_Parses(string value, double expecte
     [Arguments("eighty")]
     [Arguments("80,5")] // invariant culture: comma is not a decimal separator
     [Arguments("")]
+    [Arguments("NaN")]
+    [Arguments("Infinity")]
+    [Arguments("-1")]
+    [Arguments("100.5")]
     public async Task ParseThreshold_Garbage_ThrowsNamingTheParameter(string value)
     {
         var ex = Assert.ThrowsExactly<ArgumentException>(
@@ -134,7 +189,8 @@ public async Task ParsePattern_UnsupportedShape_ThrowsNamingTheParameter(string
     [Test]
     public async Task Parse_NegativeMaxChars_IsBlamedOnMaxChars_NotThePattern()
     {
-        var ex = Assert.ThrowsExactly<ArgumentException>(() => CoverageParameters.Parse("80", "0", "table", "false", "coverage.cobertura.xml", "-1"));
+        var ex = Assert.ThrowsExactly<ArgumentException>(() => CoverageParameters.Parse(
+            "80", "0", "table", "false", "false", "coverage.cobertura.xml", "-1", "false", null));
 
         await Assert.That(ex.Message).Contains("Coverage MaxCharsParam");
         await Assert.That(ex.Message).DoesNotContain("Coverage Pattern");
diff --git a/tests/DotCov.Tests/CoverageReportEdgeTests.cs b/tests/DotCov.Tests/CoverageReportEdgeTests.cs
index 5dcd202..388a61a 100644
--- a/tests/DotCov.Tests/CoverageReportEdgeTests.cs
+++ b/tests/DotCov.Tests/CoverageReportEdgeTests.cs
@@ -207,11 +207,15 @@ public async Task Merge_ParserBuiltReports_AreUnchangedByTheCountFallback()
     {
         // Per-line data on both sides never takes the count fallback: union of lines,
         // per-condition union, and a poisoned line keeps only its raw aggregate, even though
-        // one side's own count (2 covered, from its condition overlay) is higher.
-        var a = Cobertura.NewDoc().AddClass("src/W.cs", c => c
+        // one side's own count (2 covered, from the condition union of its two class blocks)
+        // is higher.
+        var a = Cobertura.NewDoc()
+            .AddClass("src/W.cs", c => c
                 .Line(1, 3).Line(2, 0)
-                .BranchWithConditions(5, "25% (1/4)", (1, "100%"), (2, "0%"))
+                .BranchWithConditions(5, "25% (1/4)", (1, "50%"), (2, "0%"))
                 .Branch(9, "50% (1/2)"))
+            .AddClass("src/W.cs", "W/<Run>d__0", c => c
+                .BranchWithConditions(5, "25% (1/4)", (1, "0%"), (2, "50%")))
             .Parse();
         var b = Cobertura.NewDoc().AddClass("src/W.cs", c => c
                 .Line(2, 1).Line(3, 0)
diff --git a/tests/DotCov.Tests/CrapAnalysisEdgeTests.cs b/tests/DotCov.Tests/CrapAnalysisEdgeTests.cs
index 587dfd9..e5324cd 100644
--- a/tests/DotCov.Tests/CrapAnalysisEdgeTests.cs
+++ b/tests/DotCov.Tests/CrapAnalysisEdgeTests.cs
@@ -72,11 +72,12 @@ public async Task ExplicitInterfaceIterator_StateMachineFoldsIntoTheImplementati
     {
         // `IEnumerator IEnumerable.GetEnumerator() { yield ... }`: the method is
         // System.Collections.IEnumerable.GetEnumerator, its state machine
-        // <System-Collections-IEnumerable-GetEnumerator>d__3.
+        // <System-Collections-IEnumerable-GetEnumerator>d__3. The kickoff stub holds no lines
+        // of its own: the whole body is the state machine's.
         var stub = Method("MyApp.Bag", "System.Collections.IEnumerable.GetEnumerator", "()", complexity: 1,
-            lines: [(12, 1)]);
+            lines: []);
         var sm = Method("MyApp.Bag/<System-Collections-IEnumerable-GetEnumerator>d__3", "MoveNext", "()",
-            complexity: 3, lines: [(13, 0)]);
+            complexity: 3, lines: [(12, 1), (13, 0)]);
 
         var report = CrapAnalysis.Analyze([stub, sm]);
 
@@ -415,16 +416,15 @@ public async Task Evaluate_InfiniteThreshold_WithMethods_ReportsWorstScoreButIsD
     }
 
     [Test]
-    public async Task ExcludeFiles_NoPatterns_ReturnsTheInputUnchanged()
+    public async Task Exclude_NoPatterns_ReturnsTheReportUnchanged()
     {
-        IReadOnlyList<MethodCoverage> methods =
-        [
-            Method("MyApp.Migrations.X", "Up", "()", complexity: 1, lines: [(1, 1)], file: "src/Migrations/X.cs"),
-        ];
+        var report = new MethodCoverageReport(
+            [Method("MyApp.Migrations.X", "Up", "()", complexity: 1, lines: [(1, 1)], file: "src/Migrations/X.cs")], [], []);
 
-        var filtered = CrapAnalysis.ExcludeFiles(methods, [], keep: ["src/Migrations/X.cs"]);
+        var filtered = report.Exclude([], keep: ["src/Migrations/X.cs"]);
 
-        await Assert.That(filtered).IsSameReferenceAs(methods);
+        await Assert.That(filtered).IsSameReferenceAs(report);
+        await Assert.That(filtered.Exclusion.IsActive).IsFalse();
     }
 
     // ── Helpers ───────────────────────────────────────────────────────────────
diff --git a/tests/DotCov.Tests/CrapAnalysisTests.cs b/tests/DotCov.Tests/CrapAnalysisTests.cs
index cdee646..3f36375 100644
--- a/tests/DotCov.Tests/CrapAnalysisTests.cs
+++ b/tests/DotCov.Tests/CrapAnalysisTests.cs
@@ -431,8 +431,11 @@ public async Task MissingMetricsFile_MethodWithoutComplexity_ListedAsUnscored()
         var u = await Assert.That(report.Unscored).HasSingleItem();
         await Assert.That(u.Method).IsEqualTo("MyApp.A.NoComp");
         await Assert.That(u.Reason).Contains("--metrics");
-        // The unscored method never fails the gate — but is never silently dropped either.
-        await Assert.That(report.Evaluate(6).Outcome).IsEqualTo(GateOutcome.Pass);
+        // Never silently dropped, and never passed over: the verdict needs complete scoring.
+        var gate = report.Evaluate(6);
+        await Assert.That(gate.Outcome).IsEqualTo(GateOutcome.NoData);
+        await Assert.That(gate.Reason).StartsWith("1 of 2 methods could not be scored");
+        await Assert.That(gate.Reason).Contains("--metrics");
     }
 
     [Test]
@@ -464,20 +467,25 @@ public async Task MethodWithNoLines_ListedAsUnscored()
     // ── Exclusions ────────────────────────────────────────────────────────────
 
     [Test]
-    public async Task ExcludeFiles_SameSemanticsAsReportExclude()
+    public async Task Exclude_SameSemanticsAsReportExclude_AndCarriedOntoTheCrapReport()
     {
-        var methods = new[]
-        {
+        var methods = new MethodCoverageReport(
+        [
             Method("MyApp.A", "M", "()", complexity: 1, lines: [(1, 1)], file: "src/A.cs"),
             Method("MyApp.Migrations.X", "Up", "()", complexity: 1, lines: [(1, 1)], file: "src/Migrations/X.cs"),
+            Method("MyApp.Migrations.X", "Down", "()", complexity: 1, lines: [(2, 1)], file: "src/Migrations/X.cs"),
             Method("MyApp.Program", "Main", "()", complexity: 1, lines: [(1, 1)], file: "Program.cs"),
-        };
+        ], [], []);
 
-        var filtered = CrapAnalysis.ExcludeFiles(methods, ExclusionRules.WellKnown, keep: ["Program.cs"]);
+        var filtered = methods.Exclude(ExclusionRules.WellKnown, keep: ["Program.cs"]);
+        var report = CrapAnalysis.Analyze(filtered);
 
-        await Assert.That(filtered.Count).IsEqualTo(2);
-        await Assert.That(filtered).DoesNotContain(m => m.File.Contains("Migrations"));
-        await Assert.That(filtered).Contains(m => m.File == "Program.cs");   // keep wins, incl. the virtual-root anchor
+        await Assert.That(filtered.Methods.Count).IsEqualTo(2);
+        await Assert.That(filtered.Methods).DoesNotContain(m => m.File.Contains("Migrations"));
+        await Assert.That(filtered.Methods).Contains(m => m.File == "Program.cs");   // keep wins, incl. the virtual-root anchor
+        await Assert.That(report.Exclusion.ExcludedFiles).IsEquivalentTo(["src/Migrations/X.cs"]);   // once per file
+        await Assert.That(report.Exclusion.Patterns).IsEquivalentTo(ExclusionRules.WellKnown);
+        await Assert.That(report.Exclusion.Keep).IsEquivalentTo(["Program.cs"]);
     }
 
     // ── Helpers ───────────────────────────────────────────────────────────────
diff --git a/tests/DotCov.Tests/CrapFoldingTests.cs b/tests/DotCov.Tests/CrapFoldingTests.cs
new file mode 100644
index 0000000..7ad47c3
--- /dev/null
+++ b/tests/DotCov.Tests/CrapFoldingTests.cs
@@ -0,0 +1,193 @@
+using System.Collections.ObjectModel;
+using DotCov.Tests.Infrastructure;
+
+namespace DotCov.Tests;
+
+/// <summary>
+/// Which coverage entries become one CRAP row. A row averages the lines it folds, so folding two
+/// methods that are not one dilutes the riskier one's score: entries fold only within one file,
+/// overloads keep their own rows, and compiler-synthesized material attaches to its origin only
+/// when the origin is proven.
+/// </summary>
+public sealed class CrapFoldingTests
+{
+    // ── A2: one row per file ──────────────────────────────────────────────────
+
+    [Test]
+    public async Task SameMethodInTwoFiles_IsTwoRows_NotOneAveragedRow()
+    {
+        // Two assemblies each define Ns.T.M(Int32): one never runs, the other always does.
+        var methods = Cobertura.NewDoc()
+            .AddClass("svc-a/T.cs", "Ns.T", c => c.Method("M", "(System.Int32)", "3", m => m.Line(1, 0).Line(2, 0)))
+            .AddClass("svc-b/T.cs", "Ns.T", c => c.Method("M", "(System.Int32)", "3", m => m.Line(1, 1).Line(2, 1)))
+            .ParseMethods();
+
+        var report = CrapAnalysis.Analyze(methods);
+
+        await Assert.That(report.Methods.Select(static m => (m.Method, m.File, m.Coverage, m.Score))).IsEquivalentTo(
+        [
+            ("Ns.T.M", "svc-a/T.cs", 0.0, 12.0),   // 3²·1³ + 3
+            ("Ns.T.M", "svc-b/T.cs", 1.0, 3.0),
+        ]);
+        await Assert.That(report.Evaluate(6).Outcome).IsEqualTo(GateOutcome.Fail);
+    }
+
+    [Test]
+    public async Task SyntheticMaterial_NeverAttachesToASameNamedMethodInAnotherFile()
+    {
+        // A partial class is one type, but a lambda's body lives in the file of its origin: a
+        // same-named method in another file is not proven to be that origin.
+        var report = CrapAnalysis.Analyze(
+        [
+            Method("Ns.T", "M", "()", 1, [(10, 1)], file: "src/T.Part1.cs"),
+            Method("Ns.T/<>c", "<M>b__0_0", "()", 4, [(30, 0)], file: "src/T.Part2.cs"),
+        ]);
+
+        await Assert.That(report.Methods.Select(static m => (m.File, m.Complexity))).IsEquivalentTo(
+            [("src/T.Part1.cs", 1), ("src/T.Part2.cs", 4)]);
+    }
+
+    // ── A3: overloads keep their own synthetic material ───────────────────────
+
+    [Test]
+    public async Task AsyncOverloads_KeepTheirOwnRowsAndScores()
+    {
+        // M(int) and M(string), both async: coverlet writes only their state machines. The
+        // ordinals (d__0, d__1) keep them apart instead of averaging their lines into one row.
+        var methods = Cobertura.NewDoc()
+            .AddClass("src/T.cs", "Ns.T/<M>d__0", c => c.Method("MoveNext", "()", "2", m => m.Line(5, 1).Line(6, 1)))
+            .AddClass("src/T.cs", "Ns.T/<M>d__1", c => c.Method("MoveNext", "()", "4", m => m.Line(12, 0).Line(13, 0)))
+            .ParseMethods();
+
+        var report = CrapAnalysis.Analyze(methods);
+
+        await Assert.That(report.Methods.Select(static m => (m.Method, m.StartLine, m.Coverage, m.Score))).IsEquivalentTo(
+        [
+            ("Ns.T.M", 5, 1.0, 2.0),
+            ("Ns.T.M", 12, 0.0, 20.0),   // 4²·1³ + 4: not diluted to a passing average
+        ]);
+        await Assert.That(report.Unscored).IsEmpty();
+        await Assert.That(report.Evaluate(6).Outcome).IsEqualTo(GateOutcome.Fail);
+    }
+
+    [Test]
+    public async Task AsyncOverloads_WithBothKickoffEntries_StayApart()
+    {
+        // The shape the folded key used to average: two named overloads AND both state
+        // machines. No name proves which machine belongs to which overload, so nothing attaches.
+        var report = CrapAnalysis.Analyze(
+        [
+            Method("Ns.T", "M", "(System.Int32)", 1, [(4, 1)]),
+            Method("Ns.T", "M", "(System.String)", 1, [(10, 1)]),
+            Method("Ns.T/<M>d__0", "MoveNext", "()", 2, [(5, 1)]),
+            Method("Ns.T/<M>d__1", "MoveNext", "()", 4, [(11, 0)]),
+        ]);
+
+        await Assert.That(report.Methods.Count).IsEqualTo(4);
+        await Assert.That(report.Methods).Contains(static m => m is { StartLine: 11, Score: 20.0 });
+    }
+
+    [Test]
+    public async Task SyncOverloadAndAsyncOverload_TheStateMachineDoesNotJoinTheSyncBody()
+    {
+        // M(int) is synchronous and has lines of its own; <M>d__1 is the whole body of the async
+        // M(string), whose kickoff coverlet never writes. A method's own state machine never
+        // joins an entry with lines: that entry is a different overload.
+        var report = CrapAnalysis.Analyze(
+        [
+            Method("Ns.T", "M", "(System.Int32)", 1, [(4, 1)]),
+            Method("Ns.T/<M>d__1", "MoveNext", "()", 5, [(11, 0), (12, 0)]),
+        ]);
+
+        await Assert.That(report.Methods.Select(static m => (m.StartLine, m.Complexity, m.Score)))
+            .IsEquivalentTo([(4, 1, 1.0), (11, 5, 30.0)]);
+    }
+
+    [Test]
+    public async Task LambdasOfTwoOverloads_StayTwoGroups()
+    {
+        // <M>b__0_0 belongs to method #0, <M>b__1_0 to method #1: two origins. With two overloads
+        // named M there is no telling which is #0, so both lambdas stand as their own rows —
+        // never one row averaging both.
+        var report = CrapAnalysis.Analyze(
+        [
+            Method("Ns.T", "M", "(System.Int32)", 1, [(4, 1)]),
+            Method("Ns.T", "M", "(System.String)", 1, [(10, 1)]),
+            Method("Ns.T/<>c", "<M>b__0_0", "(System.Int32)", 3, [(5, 1)]),
+            Method("Ns.T/<>c", "<M>b__1_0", "(System.Int32)", 3, [(11, 0)]),
+        ]);
+
+        await Assert.That(report.Methods.Count).IsEqualTo(4);
+        await Assert.That(report.Methods).Contains(static m => m is { StartLine: 5, Coverage: 1.0 });
+        await Assert.That(report.Methods).Contains(static m => m is { StartLine: 11, Coverage: 0.0 });
+    }
+
+    [Test]
+    public async Task LambdasOfOneMethod_FoldIntoItsOnlyOverload()
+    {
+        // Everything synthesized for method #2 — two lambdas, a closure, a local function and
+        // its state machine — is one origin, and one named M can only be that origin.
+        var report = CrapAnalysis.Analyze(
+        [
+            Method("Ns.T", "M", "()", 1, [(4, 1)]),
+            Method("Ns.T/<>c", "<M>b__2_0", "(System.Int32)", 2, [(5, 1)]),
+            Method("Ns.T/<>c", "<M>b__2_1", "(System.Int32)", 2, [(6, 0)]),
+            Method("Ns.T/<>c__DisplayClass2_0", "<M>b__0", "()", 3, [(7, 1)]),
+            Method("Ns.T", "<M>g__Local|2_0", "()", 1, [(8, 1)]),
+            Method("Ns.T/<<M>g__Run|2_1>d", "MoveNext", "()", 4, [(9, 1)]),
+        ]);
+
+        var m = await Assert.That(report.Methods).HasSingleItem();
+        await Assert.That((m.Method, m.Complexity, m.Coverage)).IsEqualTo(("Ns.T.M", 4, 5.0 / 6));
+    }
+
+    /// <summary>
+    /// Two synthetic entries for an origin named M and no named M: whether their names carry the
+    /// same method ordinal decides one row or two. A bare lambda counter (<c>b__12</c>), a
+    /// malformed suffix, or a missing ordinal is no ordinal at all, so such entries share one
+    /// "unknown origin" row.
+    /// </summary>
+    [Test]
+    [Arguments("Ns.T/<>c", "<M>b__0_1", "Ns.T/<>c", "<M>b__0_2", 1)]
+    [Arguments("Ns.T/<>c", "<M>b__0_1", "Ns.T/<>c", "<M>b__1_0", 2)]
+    [Arguments("Ns.T/<>c", "<M>b__12", "Ns.T/<>c", "<M>b__13", 1)]
+    [Arguments("Ns.T/<>c", "<M>b__1x", "Ns.T/<>c", "<M>b__x_2", 1)]
+    [Arguments("Ns.T", "<M>g__Local|2_0", "Ns.T", "<M>g__Other|3_0", 2)]
+    [Arguments("Ns.T", "<M>g__Local", "Ns.T", "<M>g__Other|", 1)]
+    [Arguments("Ns.T/<>c__DisplayClass3_0", "<M>b__0", "Ns.T/<>c__DisplayClass4_0", "<M>b__0", 2)]
+    [Arguments("Ns.T/<>c__DisplayClass3_0", "<M>b__0", "Ns.T/<>c__DisplayClass3_1", "<M>b__1", 1)]
+    [Arguments("Ns.T/<M>d__0", "MoveNext", "Ns.T/<M>d__1", "MoveNext", 2)]
+    [Arguments("Ns.T/<M>d__", "MoveNext", "Ns.T/<M>d", "MoveNext", 1)]
+    [Arguments("Ns.T/<>c/<<M>b__0_0>d", "MoveNext", "Ns.T/<>c/<<M>b__0_1>d", "MoveNext", 1)]
+    [Arguments("Ns.T/<>c__DisplayClass3_0/<<M>b__0>d", "MoveNext", "Ns.T/<>c__DisplayClass4_0/<<M>b__0>d", "MoveNext", 2)]
+    [Arguments("Ns.T/<<M>b__0_0>d__5", "MoveNext", "Ns.T/<<M>b__1_0>d__5", "MoveNext", 2)]
+    [Arguments("Ns.T", "<<M>$>g__Local|4_0", "Ns.T/<>c", "<M>b__4_1", 1)]
+    [Arguments("Ns.T/<>c__DisplayClass9_0", "<<M>g__Local|2_0>b__0", "Ns.T/<>c", "<M>b__2_5", 1)]
+    public async Task SyntheticEntries_GroupByTheirOriginsMethodOrdinal(
+        string classA, string methodA, string classB, string methodB, int rows)
+    {
+        var report = CrapAnalysis.Analyze(
+        [
+            Method(classA, methodA, "()", 1, [(5, 1)]),
+            Method(classB, methodB, "()", 1, [(9, 0)]),
+        ]);
+
+        await Assert.That(report.Methods.Count).IsEqualTo(rows);
+        await Assert.That(report.Methods).All(static m => m.Method == "Ns.T.M");
+    }
+
+    private static MethodCoverage Method(
+        string className, string methodName, string signature, int complexity,
+        (int Line, int Hits)[] lines, string file = "src/T.cs")
+    {
+        var hits = lines.ToDictionary(static l => l.Line, static l => l.Hits);
+        return new MethodCoverage(
+            className, methodName, signature, file,
+            lines.Length is 0 ? 0 : lines.Min(static l => l.Line),
+            lines.Length is 0 ? 0 : lines.Max(static l => l.Line),
+            lines.Count(static l => l.Hits > 0), lines.Length, complexity)
+        {
+            LineHits = new ReadOnlyDictionary<int, int>(hits)
+        };
+    }
+}
diff --git a/tests/DotCov.Tests/DotCovCliEdgeTests.cs b/tests/DotCov.Tests/DotCovCliEdgeTests.cs
index b513ca3..6ffb050 100644
--- a/tests/DotCov.Tests/DotCovCliEdgeTests.cs
+++ b/tests/DotCov.Tests/DotCovCliEdgeTests.cs
@@ -311,7 +311,9 @@ public async Task Check_BranchNoData_PrintsNoLineOffenderList()
     [Arguments("snapshot")]
     public async Task InvalidMaxChars_IsRejectedBeforeAnyReportIsRead(string command)
     {
-        var (code, stdout, stderr) = await Run(command, HalfCovered(), "--max-chars", "-1");
+        string[] threshold = command is "check" ? ["--min-line", "80"] : [];
+
+        var (code, stdout, stderr) = await Run([command, HalfCovered(), .. threshold, "--max-chars", "-1"]);
 
         await AssertOneLineError(code, stdout, stderr, "error: Invalid --max-chars value: '-1'");
     }
@@ -443,12 +445,13 @@ public async Task Crap_KeepExemptsAMethodFileFromExcludeGenerated()
     [Test]
     public async Task Report_DocumentScopedWarning_IsWrittenWithoutALocation()
     {
-        // Two <source> roots: the warning belongs to the document, not to a file or line.
+        // Two <source> roots probed on a disk that holds neither file: the warning belongs to the
+        // document, not to a file or line.
         var path = _ws.Write("roots.cobertura.xml", Cobertura.NewDoc()
             .WithSource("/a").WithSource("/b")
             .AddClass("x/Foo.cs", c => c.Line(1, hits: 1)));
 
-        var (code, _, stderr) = await Run("report", path);
+        var (code, _, stderr) = await Run("report", path, "--probe-sources");
 
         await Assert.That(code).IsEqualTo(0);
         await Assert.That(stderr).StartsWith("warning: multiple <source> roots - resolving relative filenames against the first ('/a')");
diff --git a/tests/DotCov.Tests/DotCovCliTestCommandEdgeTests.cs b/tests/DotCov.Tests/DotCovCliTestCommandEdgeTests.cs
index 455f255..4ecfff6 100644
--- a/tests/DotCov.Tests/DotCovCliTestCommandEdgeTests.cs
+++ b/tests/DotCov.Tests/DotCovCliTestCommandEdgeTests.cs
@@ -24,7 +24,7 @@ public async Task ResultsDirectoryThatCannotBeCreated_IsAnError_BeforeDotnetTest
         // IOException: a file named TestResults occupies the place of the run directory.
         _ws.Write("TestResults", "not a directory");
 
-        var run = await Dotcov(cancellationToken, "test", "missing.csproj");
+        var run = await Dotcov(cancellationToken, "test", "missing.csproj", "--min-line", "80");
 
         await Assert.That(run.ExitCode).IsEqualTo(5);
         // No echoed "> dotnet test" line: nothing was started.
diff --git a/tests/DotCov.Tests/ExcludeTestCodeTests.cs b/tests/DotCov.Tests/ExcludeTestCodeTests.cs
new file mode 100644
index 0000000..5f932cb
--- /dev/null
+++ b/tests/DotCov.Tests/ExcludeTestCodeTests.cs
@@ -0,0 +1,239 @@
+using System.Text.Json;
+using DotCov.Tests.Infrastructure;
+using DotCov.Tool;
+
+namespace DotCov.Tests;
+
+/// <summary>
+/// <c>--exclude-test-code</c> on every command that takes an exclusion, through the one
+/// predicate <c>--exclude-generated</c> uses, and the rule that an active exclusion is never
+/// silent: stderr names its rules and files for table and markdown output, JSON carries
+/// <c>excluded</c> and <c>exclusionRules</c>. The Fallout parameter is pinned in
+/// <see cref="FalloutBuildTests"/>.
+/// </summary>
+public sealed class ExcludeTestCodeTests : IDisposable
+{
+    private const string TestFile = "tests/App.Tests/WidgetTests.cs";
+    private const string TestCodeRules = "exclusion rules: .Tests/, .Tests\\, TestSupport/, TestSupport\\, /TestFixtures/, \\TestFixtures\\";
+
+    private readonly TempWorkspace _ws = TempWorkspace.Create("dotcov-exclude-tests-");
+
+    public void Dispose() => _ws.Dispose();
+
+    private static async Task<(int Code, string StdOut, string StdErr)> Run(params string[] args)
+    {
+        var stdout = new StringWriter();
+        var stderr = new StringWriter();
+        var code = await DotCovCli.RunAsync(args, stdout, stderr);
+        return (code, stdout.ToString(), stderr.ToString());
+    }
+
+    /// <summary>Product code at 50%, test code fully covered by construction — it lifts the total to 75%.</summary>
+    private string Mixed() => _ws.Write("mixed.cobertura.xml", Cobertura.NewDoc()
+        .AddClass("src/App/Widget.cs", "App.Widget", c => c
+            .Method("Draw", "()", "4", m => m.Line(1, 1).Line(2, 0))
+            .Line(1, 1).Line(2, 0))
+        .AddClass(TestFile, "App.Tests.WidgetTests", c => c
+            .Method("Draws", "()", "1", m => m.Line(1, 1).Line(2, 1))
+            .Line(1, 1).Line(2, 1)));
+
+    [Test]
+    public async Task Report_Table_DropsTestCode_AndNamesTheExclusionOnStderr()
+    {
+        var (code, stdout, stderr) = await Run("report", Mixed(), "--exclude-test-code");
+
+        await Assert.That(code).IsEqualTo(0);
+        await Assert.That(stdout).DoesNotContain("WidgetTests");
+        await Assert.That(stdout).Contains("50.0%");
+        await Assert.That(stderr).IsEqualTo(string.Join(Environment.NewLine,
+            TestCodeRules, "excluded 1 files:", $"  {TestFile}", ""));
+    }
+
+    [Test]
+    public async Task Report_Markdown_NamesTheExclusionOnStderr()
+    {
+        var (code, stdout, stderr) = await Run("report", Mixed(), "--exclude-test-code", "--format", "md");
+
+        await Assert.That(code).IsEqualTo(0);
+        await Assert.That(stdout).DoesNotContain("WidgetTests");
+        await Assert.That(stderr).StartsWith(TestCodeRules);
+        await Assert.That(stderr).Contains($"  {TestFile}");
+    }
+
+    [Test]
+    public async Task Report_Json_CarriesExcludedAndExclusionRules_AndStderrStaysQuiet()
+    {
+        var (code, stdout, stderr) = await Run("report", Mixed(), "--exclude-test-code", "--format", "json");
+
+        await Assert.That(code).IsEqualTo(0);
+        await Assert.That(stderr).IsEmpty();
+        using var json = JsonDocument.Parse(stdout);
+        await Assert.That(json.RootElement.GetProperty("excluded").EnumerateArray().Select(static e => e.GetString()!))
+            .IsEquivalentTo([TestFile]);
+        await Assert.That(json.RootElement.GetProperty("exclusionRules").EnumerateArray().Select(static e => e.GetString()!))
+            .IsEquivalentTo(ExclusionRules.TestCode);
+    }
+
+    [Test]
+    public async Task Report_WithoutAnExclusion_JsonHasNeitherKey()
+    {
+        var (_, stdout, _) = await Run("report", Mixed(), "--format", "json");
+
+        using var json = JsonDocument.Parse(stdout);
+        await Assert.That(json.RootElement.TryGetProperty("excluded", out _)).IsFalse();
+        await Assert.That(json.RootElement.TryGetProperty("exclusionRules", out _)).IsFalse();
+    }
+
+    [Test]
+    public async Task Check_GatesWithoutTestCode_AndNamesTheExclusionAfterTheVerdict()
+    {
+        var (without, _, _) = await Run("check", Mixed(), "--min-line", "70");
+        var (code, stdout, stderr) = await Run("check", Mixed(), "--min-line", "70", "--exclude-test-code");
+
+        await Assert.That(without).IsEqualTo(0);   // 75%: the tests' own lines carried it
+        await Assert.That(code).IsEqualTo(1);
+        await Assert.That(stdout).IsEmpty();
+        await Assert.That(stderr).StartsWith("FAIL: line 50.0% (min 70%)");
+        await Assert.That(stderr).Contains(TestCodeRules);
+        await Assert.That(stderr).Contains($"  {TestFile}");
+    }
+
+    [Test]
+    public async Task Check_Pass_NamesTheExclusionOnStderr()
+    {
+        var (code, stdout, stderr) = await Run("check", Mixed(), "--min-line", "50", "--exclude-test-code");
+
+        await Assert.That(code).IsEqualTo(0);
+        await Assert.That(stdout).StartsWith("PASS: line 50.0%");
+        await Assert.That(stderr).StartsWith(TestCodeRules);
+    }
+
+    [Test]
+    [Arguments("table")]
+    [Arguments("md")]
+    public async Task Crap_DropsTestCodeMethods_AndNamesTheExclusionOnStderr(string format)
+    {
+        var (code, stdout, stderr) = await Run("crap", Mixed(), "--exclude-test-code", "--format", format);
+
+        await Assert.That(code).IsEqualTo(0);
+        await Assert.That(stdout).DoesNotContain("WidgetTests");
+        await Assert.That(stdout).Contains("App.Widget.Draw");
+        await Assert.That(stderr).Contains(TestCodeRules);
+        await Assert.That(stderr).Contains($"  {TestFile}");
+    }
+
+    [Test]
+    public async Task Crap_Json_CarriesExcludedAndExclusionRules()
+    {
+        var (code, stdout, stderr) = await Run("crap", Mixed(), "--exclude-test-code", "--format", "json");
+
+        await Assert.That(code).IsEqualTo(0);
+        await Assert.That(stderr).IsEmpty();
+        using var json = JsonDocument.Parse(stdout);
+        await Assert.That(json.RootElement.GetProperty("excluded").EnumerateArray().Select(static e => e.GetString()!))
+            .IsEquivalentTo([TestFile]);
+        await Assert.That(json.RootElement.GetProperty("exclusionRules").GetArrayLength()).IsEqualTo(ExclusionRules.TestCode.Count);
+    }
+
+    [Test]
+    public async Task Snapshot_CarriesExcludedAndExclusionRules()
+    {
+        var (code, stdout, stderr) = await Run(
+            "snapshot", Mixed(), "--exclude-test-code", "--commit", "abc", "--branch", "main", "--project", "App");
+
+        await Assert.That(code).IsEqualTo(0);
+        await Assert.That(stderr).IsEmpty();
+        using var json = JsonDocument.Parse(stdout);
+        await Assert.That(json.RootElement.GetProperty("excluded")[0].GetString()).IsEqualTo(TestFile);
+        await Assert.That(json.RootElement.GetProperty("files").GetArrayLength()).IsEqualTo(1);
+    }
+
+    [Test]
+    public async Task Keep_OverridesTestCodeExclusion_LikeItOverridesGenerated()
+    {
+        // --keep needs no --exclude-generated beside --exclude-test-code.
+        var (code, stdout, stderr) = await Run("report", Mixed(), "--exclude-test-code", "--keep", "WidgetTests.cs");
+
+        await Assert.That(code).IsEqualTo(0);
+        await Assert.That(stdout).Contains("WidgetTests");
+        await Assert.That(stderr).IsEqualTo(string.Join(Environment.NewLine,
+            TestCodeRules, "kept by --keep: WidgetTests.cs", "excluded 0 files:", ""));
+    }
+
+    [Test]
+    public async Task BothExclusions_ApplyBothRuleSets_ThroughOnePredicate()
+    {
+        var path = _ws.Write("both.cobertura.xml", Cobertura.NewDoc()
+            .AddClass("src/App/Widget.cs", c => c.Line(1, 1))
+            .AddClass("src/App/obj/Gen.g.cs", c => c.Line(1, 0))
+            .AddClass("TestSupport/Fixture.cs", c => c.Line(1, 0)));
+
+        var (code, stdout, stderr) = await Run("report", path, "--exclude-generated", "--exclude-test-code", "--format", "json");
+
+        await Assert.That(code).IsEqualTo(0).Because(stderr);
+        using var json = JsonDocument.Parse(stdout);
+        await Assert.That(json.RootElement.GetProperty("excluded").EnumerateArray().Select(static e => e.GetString()!))
+            .IsEquivalentTo(["src/App/obj/Gen.g.cs", "TestSupport/Fixture.cs"]);
+        await Assert.That(json.RootElement.GetProperty("exclusionRules").EnumerateArray().Select(static e => e.GetString()!))
+            .IsEquivalentTo([.. ExclusionRules.WellKnown, .. ExclusionRules.TestCode]);
+    }
+
+    [Test]
+    public async Task ExclusionFlag_OnACommandThatTakesNone_IsAUsageError()
+    {
+        var path = Mixed();
+
+        var (code, _, stderr) = await Run("diff", path, path, "--exclude-test-code");
+
+        await Assert.That(code).IsEqualTo(DotCovCli.UsageExitCode);
+        await Assert.That(stderr).StartsWith("error: Unknown option '--exclude-test-code' for 'diff'.");
+    }
+
+    [Test]
+    public async Task ExclusionFlag_TakesNoValue_SoAFollowingPathStaysPositional()
+    {
+        var (code, stdout, _) = await Run("report", "--exclude-test-code", Mixed());
+
+        await Assert.That(code).IsEqualTo(0);
+        await Assert.That(stdout).DoesNotContain("WidgetTests");
+    }
+
+    [Test]
+    public async Task Test_GatesWithoutTestCode_AfterASuccessfulRun(CancellationToken cancellationToken)
+    {
+        var dotnet = FakeDotnet.Write(_ws, Mixed());
+
+        var run = await DotcovProcess.RunAsync(cancellationToken, _ws.Root,
+            new Dictionary<string, string?> { ["DOTNET_HOST_PATH"] = dotnet },
+            "test", "--min-line", "70", "--exclude-test-code");
+
+        await Assert.That(run.ExitCode).IsEqualTo(1).Because(run.Output);
+        await Assert.That(run.StdOut).DoesNotContain("WidgetTests");
+        await Assert.That(run.StdErr).StartsWith("FAIL: line 50.0% (min 70%)");
+        await Assert.That(run.StdErr).Contains(TestCodeRules);
+    }
+
+    // ── The library side: what an exclusion records ──
+
+    [Test]
+    public async Task Exclude_Twice_AccumulatesRulesAndFiles_AndMergeUnionsThem()
+    {
+        var report = Cobertura.NewDoc()
+            .AddClass("src/A.cs", c => c.Line(1, 1))
+            .AddClass("src/obj/B.g.cs", c => c.Line(1, 1))
+            .AddClass("tests/A.Tests/ATests.cs", c => c.Line(1, 1))
+            .Parse();
+
+        var once = report.Exclude(ExclusionRules.WellKnown, ["Program.cs"]);
+        var twice = once.Exclude(ExclusionRules.TestCode, []);
+        var merged = CoverageReport.Merge(twice, report.Exclude(ExclusionRules.WellKnown));
+
+        await Assert.That(report.Exclusion).IsSameReferenceAs(FileExclusion.None);
+        await Assert.That(report.Exclusion.IsActive).IsFalse();
+        await Assert.That(twice.Files.Select(static f => f.Path)).IsEquivalentTo(["src/A.cs"]);
+        await Assert.That(twice.Exclusion.ExcludedFiles).IsEquivalentTo(["src/obj/B.g.cs", "tests/A.Tests/ATests.cs"]);
+        await Assert.That(twice.Exclusion.Patterns).IsEquivalentTo([.. ExclusionRules.WellKnown, .. ExclusionRules.TestCode]);
+        await Assert.That(twice.Exclusion.Keep).IsEquivalentTo(["Program.cs"]);
+        await Assert.That(merged.Exclusion.ExcludedFiles).IsEquivalentTo(["src/obj/B.g.cs", "tests/A.Tests/ATests.cs"]);
+    }
+}
diff --git a/tests/DotCov.Tests/FalloutBuildTests.cs b/tests/DotCov.Tests/FalloutBuildTests.cs
index 1de74e7..1f43b24 100644
--- a/tests/DotCov.Tests/FalloutBuildTests.cs
+++ b/tests/DotCov.Tests/FalloutBuildTests.cs
@@ -113,7 +113,7 @@ public async Task Disabled_EveryThresholdZero_ExitsNonZero_Distinctly(Cancellati
     [Test]
     public async Task MissingSearchDirectory_FailsNamingTheDirectory(CancellationToken cancellationToken)
     {
-        var run = await RunBuild(cancellationToken);
+        var run = await RunBuild(cancellationToken, null, "--coverage-min-line", "40");
 
         await Assert.That(run.ExitCode).IsNotEqualTo(0);
         await Assert.That(run.Output).Contains($"Coverage search directory '{_ws.PathOf("TestResults")}' does not exist");
@@ -124,7 +124,7 @@ public async Task DirectoryWithoutMatches_FailsNamingThePattern(CancellationToke
     {
         _ws.Write("TestResults/notes.txt", "nothing here");
 
-        var run = await RunBuild(cancellationToken, null, "--coverage-pattern", "**/coverage.xml");
+        var run = await RunBuild(cancellationToken, null, "--coverage-pattern", "**/coverage.xml", "--coverage-min-line", "40");
 
         await Assert.That(run.ExitCode).IsNotEqualTo(0);
         await Assert.That(run.Output).Contains($"No files matching '**/coverage.xml' found in {_ws.PathOf("TestResults")}");
@@ -146,7 +146,7 @@ public async Task MalformedReport_FailsNamingTheFile(CancellationToken cancellat
     {
         var bad = _ws.Write("TestResults/coverage.cobertura.xml", "<coverage><packa");
 
-        var run = await RunBuild(cancellationToken);
+        var run = await RunBuild(cancellationToken, null, "--coverage-min-line", "40");
 
         await Assert.That(run.ExitCode).IsNotEqualTo(0);
         await Assert.That(run.Output).Contains($"Could not parse coverage report {bad} (line 1, position ");
@@ -167,7 +167,8 @@ public async Task InvalidParameter_FailsBeforeReadingAnyReport(string flag, stri
     {
         WriteHalfCovered();
 
-        var run = await RunBuild(cancellationToken, null, flag, value);
+        // A threshold in the dimension the case does not test: the named parameter is the only error.
+        var run = await RunBuild(cancellationToken, null, flag, value, "--coverage-min-branch", "0");
 
         await Assert.That(run.ExitCode).IsNotEqualTo(0);
         await Assert.That(run.Output).Contains(expected);
@@ -179,7 +180,7 @@ public async Task MaxChars_BelowDocumentSize_FailsNamingTheFile(CancellationToke
     {
         var path = WriteHalfCovered();
 
-        var run = await RunBuild(cancellationToken, null, "--coverage-max-chars-param", "50");
+        var run = await RunBuild(cancellationToken, null, "--coverage-max-chars-param", "50", "--coverage-min-line", "40");
 
         await Assert.That(run.ExitCode).IsNotEqualTo(0);
         await Assert.That(run.Output).Contains($"Could not parse coverage report {path}");
@@ -208,10 +209,135 @@ public async Task ExcludeGenerated_TrueDropsGeneratedFiles_FalseKeepsThem(Cancel
 
         await Assert.That(kept.ExitCode).IsEqualTo(0).Because(kept.Output);
         await Assert.That(kept.Output).Contains("Migrations/M1.cs");
-        await Assert.That(excluded.Output).DoesNotContain("Migrations/M1.cs");
+        await Assert.That(kept.Output).DoesNotContain("Excluded ");
+        // Gone from the table; named once, in the exclusion line.
+        await Assert.That(excluded.Output).Contains("Excluded 1 files by");
+        await Assert.That(excluded.Output.Split("Migrations/M1.cs").Length - 1).IsEqualTo(1).Because(excluded.Output);
         await Assert.That(excluded.Output).Contains("PASS: line 100.0%");
     }
 
+    [Test]
+    public async Task ExcludeTestCode_TrueDropsTestCode_AndLogsWhatItExcluded(CancellationToken cancellationToken)
+    {
+        _ws.Write("TestResults/coverage.cobertura.xml", Cobertura.NewDoc()
+            .AddClass("src/A.cs", c => c.Line(1, hits: 1).Line(2, hits: 0))
+            .AddClass("tests/A.Tests/ATests.cs", c => c.Line(1, hits: 1).Line(2, hits: 1)));
+
+        var kept = await RunBuild(cancellationToken, null, "--coverage-min-line", "70");
+        var excluded = await RunBuild(cancellationToken, null, "--coverage-min-line", "70", "--coverage-exclude-test-code-param", "true");
+
+        await Assert.That(kept.ExitCode).IsEqualTo(0).Because(kept.Output);
+        await Assert.That(excluded.ExitCode).IsNotEqualTo(0);
+        await Assert.That(excluded.Output).Contains("Coverage below threshold: FAIL: line 50.0% (min 70%)");
+        await Assert.That(excluded.Output).Contains("Excluded 1 files by");
+        await Assert.That(excluded.Output).Contains("tests/A.Tests/ATests.cs");
+    }
+
+    // ── Thresholds: explicit, 0 to 100, one disables the other ────────────────
+
+    [Test]
+    public async Task NoThreshold_FailsNamingTheParameters_BeforeReadingAnyReport(CancellationToken cancellationToken)
+    {
+        // A malformed report would fail the parse; the missing threshold fails first.
+        _ws.Write("TestResults/coverage.cobertura.xml", "<coverage><packa");
+
+        var run = await RunBuild(cancellationToken);
+
+        await Assert.That(run.ExitCode).IsNotEqualTo(0);
+        await Assert.That(run.Output).Contains("Missing Coverage MinLine and Coverage MinBranch: the coverage gate has no default threshold.");
+        await Assert.That(run.Output).DoesNotContain("Could not parse");
+    }
+
+    [Test]
+    [Arguments("--coverage-min-line", "150", "Invalid Coverage MinLine: '150' (expected a number from 0 to 100).")]
+    [Arguments("--coverage-min-branch", "Infinity", "Invalid Coverage MinBranch: 'Infinity' (expected a number from 0 to 100).")]
+    [Arguments("--coverage-min-line", "NaN", "Invalid Coverage MinLine: 'NaN' (expected a number from 0 to 100).")]
+    public async Task ThresholdOutsideZeroToHundred_FailsNamingTheParameter(
+        string flag, string value, string expected, CancellationToken cancellationToken)
+    {
+        WriteHalfCovered();
+
+        var run = await RunBuild(cancellationToken, null, flag, value);
+
+        await Assert.That(run.ExitCode).IsNotEqualTo(0);
+        await Assert.That(run.Output).Contains(expected);
+        await Assert.That(run.Output).DoesNotContain("src/A.cs");
+    }
+
+    [Test]
+    public async Task BranchThresholdAlone_LeavesTheLineDimensionUnchecked(CancellationToken cancellationToken)
+    {
+        _ws.Write("TestResults/coverage.cobertura.xml", Cobertura.NewDoc()
+            .AddClass("src/M.cs", c => c.Line(1, hits: 0).Branch(2, "100% (2/2)")));
+
+        var run = await RunBuild(cancellationToken, null, "--coverage-min-branch", "90");
+
+        await Assert.That(run.ExitCode).IsEqualTo(0).Because(run.Output);
+        await Assert.That(run.Output).Contains("Coverage gate passed: PASS: line 50.0% (min 0%), branch 100.0% (min 90%)");
+    }
+
+    // ── File identity: lexical by default, probing and an explicit root opt in ──
+
+    private void WriteTwoRootReport() =>
+        _ws.Write("TestResults/coverage.cobertura.xml", Cobertura.NewDoc()
+            .WithSource("src").WithSource("tests")
+            .AddClass("test_app.py", c => c.Line(1, hits: 1).Line(2, hits: 0)));
+
+    [Test]
+    public async Task AmbiguousIdentity_IsNoData_ByDefault(CancellationToken cancellationToken)
+    {
+        WriteTwoRootReport();
+        _ws.Write("tests/test_app.py", "");   // on disk, but the default never looks
+
+        var run = await RunBuild(cancellationToken, null, "--coverage-min-line", "40");
+
+        await Assert.That(run.ExitCode).IsNotEqualTo(0);
+        await Assert.That(run.Output).Contains(
+            "Coverage could not be measured: NODATA: line 50.0% (min 40%), branch n/a (min 0%) - 1 file has ambiguous identity across 2 source roots");
+        await Assert.That(run.Output).Contains("relative filename 'test_app.py' could belong to any of 2 <source> roots");
+    }
+
+    [Test]
+    [Arguments("--coverage-probe-sources-param", "true")]
+    [Arguments("--coverage-source-root", "tests")]
+    public async Task AmbiguousIdentity_ResolvedByEitherParameter_IsAMeasuredPass(
+        string flag, string value, CancellationToken cancellationToken)
+    {
+        WriteTwoRootReport();
+        _ws.Write("tests/test_app.py", "");
+
+        var run = await RunBuild(cancellationToken, null, "--coverage-min-line", "40", flag, value);
+
+        await Assert.That(run.ExitCode).IsEqualTo(0).Because(run.Output);
+        await Assert.That(run.Output).Contains("Coverage gate passed: PASS: line 50.0% (min 40%)");
+        await Assert.That(run.Output).Contains("tests/test_app.py");
+    }
+
+    [Test]
+    public async Task SourceRoot_NotDeclared_FailsNamingTheParameter(CancellationToken cancellationToken)
+    {
+        WriteTwoRootReport();
+
+        var run = await RunBuild(cancellationToken, null, "--coverage-min-line", "40", "--coverage-source-root", "lib");
+
+        await Assert.That(run.ExitCode).IsNotEqualTo(0);
+        await Assert.That(run.Output).Contains("Invalid Coverage SourceRoot: source root 'lib' is not declared by ");
+        await Assert.That(run.Output).DoesNotContain("PASS:");
+    }
+
+    [Test]
+    public async Task ProbeSourcesAndSourceRoot_Together_FailBeforeReadingAnyReport(CancellationToken cancellationToken)
+    {
+        WriteTwoRootReport();
+
+        var run = await RunBuild(cancellationToken, null, "--coverage-min-line", "40",
+            "--coverage-probe-sources-param", "true", "--coverage-source-root", "tests");
+
+        await Assert.That(run.ExitCode).IsNotEqualTo(0);
+        await Assert.That(run.Output).Contains("Coverage ProbeSourcesParam and Coverage SourceRoot are alternatives");
+        await Assert.That(run.Output).DoesNotContain("test_app.py");
+    }
+
     // ── Diagnostics and summary ───────────────────────────────────────────────
 
     [Test]
diff --git a/tests/DotCov.Tests/FileIdentityCliTests.cs b/tests/DotCov.Tests/FileIdentityCliTests.cs
new file mode 100644
index 0000000..2bcad34
--- /dev/null
+++ b/tests/DotCov.Tests/FileIdentityCliTests.cs
@@ -0,0 +1,190 @@
+using DotCov.Tests.Infrastructure;
+using DotCov.Tool;
+
+namespace DotCov.Tests;
+
+/// <summary>
+/// File identity through the real dotcov process. The report declares two RELATIVE roots,
+/// <c>src</c> and <c>tests</c>, so resolution against the disk would depend on the working
+/// directory: by default it never does, and check, crap and test refuse a verdict until
+/// <c>--probe-sources</c> or <c>--source-root</c> resolves the files. The Fallout parameters
+/// are pinned in <see cref="FalloutBuildTests"/>.
+/// </summary>
+[Category("Integration")]
+[Timeout(60_000)]
+public sealed class FileIdentityCliTests : IDisposable
+{
+    private const string Ambiguous =
+        "NODATA: line 50.0% (min 40%), branch n/a (min 0%) - 1 file has ambiguous identity across 2 source roots; " +
+        "re-run with --probe-sources on the machine that holds the sources or supply --source-root";
+
+    private readonly TempWorkspace _ws = TempWorkspace.Create("dotcov identity-");
+    private readonly string _report;
+
+    public FileIdentityCliTests() =>
+        _report = _ws.Write("report/coverage.cobertura.xml", Cobertura.NewDoc()
+            .WithSource("src").WithSource("tests")
+            .AddClass("test_app.py", "test_app", c => c
+                .Method("test_it", "()", "2", m => m.Line(1, 1).Line(2, 0))
+                .Line(1, 1).Line(2, 0)));
+
+    public void Dispose() => _ws.Dispose();
+
+    private Task<ChildRun> Dotcov(CancellationToken cancellationToken, string workingDirectory, params string[] args) =>
+        DotcovProcess.RunAsync(cancellationToken, workingDirectory, new Dictionary<string, string?>(), args);
+
+    /// <summary>A machine that holds the sources: test_app.py exists under the SECOND root.</summary>
+    private string SourceCheckout()
+    {
+        _ws.Write("checkout/tests/test_app.py", "");
+        _ws.CreateDirectory("checkout/src");
+        return _ws.PathOf("checkout");
+    }
+
+    [Test]
+    public async Task Report_DefaultMode_GivesTheSameKeysAndWarnings_InEveryWorkingDirectory(CancellationToken cancellationToken)
+    {
+        var withSources = await Dotcov(cancellationToken, SourceCheckout(), "report", _report, "--format", "json");
+        var elsewhere = await Dotcov(cancellationToken, _ws.CreateDirectory("elsewhere"), "report", _report, "--format", "json");
+
+        await Assert.That(withSources.ExitCode).IsEqualTo(0).Because(withSources.Output);
+        await Assert.That(withSources.StdOut).IsEqualTo(elsewhere.StdOut);
+        await Assert.That(withSources.StdErr).IsEqualTo(elsewhere.StdErr);
+        await Assert.That(withSources.StdOut).Contains("\"path\": \"src/test_app.py\"");
+        await Assert.That(withSources.StdOut).Contains("\"kind\": \"FileIdentityAmbiguous\"");
+    }
+
+    [Test]
+    public async Task Report_Table_PrintsNormally_WithTheWarning(CancellationToken cancellationToken)
+    {
+        var run = await Dotcov(cancellationToken, _ws.Root, "report", _report);
+
+        await Assert.That(run.ExitCode).IsEqualTo(0);
+        await Assert.That(run.StdOut).Contains("src/test_app.py");
+        await Assert.That(run.StdErr).StartsWith(
+            "warning: src/test_app.py: relative filename 'test_app.py' could belong to any of 2 <source> roots ('src', 'tests')");
+    }
+
+    [Test]
+    public async Task ProbeSources_ReproducesTwoPointZero_OnTheMachineThatHoldsTheSources(CancellationToken cancellationToken)
+    {
+        var run = await Dotcov(cancellationToken, SourceCheckout(), "report", _report, "--format", "json", "--probe-sources");
+
+        await Assert.That(run.ExitCode).IsEqualTo(0);
+        await Assert.That(run.StdOut).Contains("\"path\": \"tests/test_app.py\"");
+        await Assert.That(run.StdOut).DoesNotContain("FileIdentityAmbiguous");
+    }
+
+    [Test]
+    public async Task Check_DefaultMode_IsNoData_WithTheRemedy(CancellationToken cancellationToken)
+    {
+        var run = await Dotcov(cancellationToken, SourceCheckout(), "check", _report, "--min-line", "40");
+
+        await Assert.That(run.ExitCode).IsEqualTo(DotCovCli.NoDataExitCode);
+        await Assert.That(run.StdOut).IsEmpty();
+        await Assert.That(run.StdErr).StartsWith(Ambiguous);
+    }
+
+    [Test]
+    [Arguments("--probe-sources")]
+    [Arguments("--source-root tests")]
+    [Arguments("--source-root ./tests/")]
+    public async Task Check_ResolvedIdentity_IsAMeasuredVerdict(string flags, CancellationToken cancellationToken)
+    {
+        var identity = flags.Split(' ');
+
+        var run = await Dotcov(cancellationToken, SourceCheckout(), ["check", _report, "--min-line", "40", .. identity]);
+
+        await Assert.That(run.ExitCode).IsEqualTo(0).Because(run.Output);
+        await Assert.That(run.StdOut).StartsWith("PASS: line 50.0% (min 40%)");
+        await Assert.That(run.StdErr).IsEmpty();
+    }
+
+    [Test]
+    public async Task SourceRoot_TheReportDoesNotDeclare_IsAUsageError(CancellationToken cancellationToken)
+    {
+        var run = await Dotcov(cancellationToken, _ws.Root, "check", _report, "--min-line", "40", "--source-root", "lib");
+
+        await Assert.That(run.ExitCode).IsEqualTo(DotCovCli.UsageExitCode);
+        await Assert.That(run.StdOut).IsEmpty();
+        await Assert.That(run.StdErr).IsEqualTo(
+            $"error: source root 'lib' is not declared by {_report} (declared: 'src', 'tests').{Environment.NewLine}");
+    }
+
+    [Test]
+    [Arguments("report")]
+    [Arguments("crap")]
+    [Arguments("snapshot")]
+    [Arguments("diff")]
+    public async Task BothModesAtOnce_OrABlankRoot_IsAUsageError_OnEveryReportReadingCommand(
+        string command, CancellationToken cancellationToken)
+    {
+        string[] paths = command is "diff" ? [_report, _report] : [_report];
+
+        var both = await Dotcov(cancellationToken, _ws.Root, [command, .. paths, "--probe-sources", "--source-root", "src"]);
+        var blank = await Dotcov(cancellationToken, _ws.Root, [command, .. paths, "--source-root", " "]);
+
+        await Assert.That(both.ExitCode).IsEqualTo(DotCovCli.UsageExitCode);
+        await Assert.That(both.StdErr).IsEqualTo(
+            $"error: --probe-sources and --source-root are alternatives: pass one of them.{Environment.NewLine}");
+        await Assert.That(blank.ExitCode).IsEqualTo(DotCovCli.UsageExitCode);
+        await Assert.That(blank.StdErr).StartsWith("error: Invalid --source-root value: ' '");
+    }
+
+    [Test]
+    public async Task Crap_DefaultMode_IsNoData_AndAnExplicitRootMeasuresIt(CancellationToken cancellationToken)
+    {
+        var ambiguous = await Dotcov(cancellationToken, _ws.Root, "crap", _report);
+        var resolved = await Dotcov(cancellationToken, _ws.Root, "crap", _report, "--source-root", "tests");
+
+        await Assert.That(ambiguous.ExitCode).IsEqualTo(DotCovCli.NoDataExitCode);
+        await Assert.That(ambiguous.StdErr).StartsWith(
+            "NODATA: worst CRAP 2.5 (max 30) - 1 file has ambiguous identity across 2 source roots;");
+        await Assert.That(resolved.ExitCode).IsEqualTo(0).Because(resolved.Output);
+        await Assert.That(resolved.StdOut).Contains("PASS: worst CRAP 2.5 (max 30)");
+    }
+
+    [Test]
+    public async Task Test_DefaultMode_IsNoData_AndAnExplicitRootMeasuresIt(CancellationToken cancellationToken)
+    {
+        var dotnet = FakeDotnet.Write(_ws, _report);
+        var environment = new Dictionary<string, string?> { ["DOTNET_HOST_PATH"] = dotnet };
+
+        var ambiguous = await DotcovProcess.RunAsync(cancellationToken, _ws.Root, environment, "test", "--min-line", "40");
+        var resolved = await DotcovProcess.RunAsync(cancellationToken, _ws.Root, environment,
+            "test", "--min-line", "40", "--source-root", "tests");
+
+        await Assert.That(ambiguous.ExitCode).IsEqualTo(DotCovCli.NoDataExitCode).Because(ambiguous.Output);
+        await Assert.That(ambiguous.StdErr).StartsWith(Ambiguous);
+        await Assert.That(resolved.ExitCode).IsEqualTo(0).Because(resolved.Output);
+        await Assert.That(resolved.StdOut).Contains("PASS: line 50.0% (min 40%)");
+    }
+
+    [Test]
+    public async Task Test_BranchThresholdAlone_AfterARun_LeavesLinesUnchecked(CancellationToken cancellationToken)
+    {
+        // The post-run half of the threshold contract, which a real test run would take minutes to show.
+        var report = _ws.Write("branches.cobertura.xml", Cobertura.NewDoc()
+            .AddClass("src/M.cs", c => c.Line(1, hits: 0).Branch(2, "100% (2/2)")));
+
+        var run = await DotcovProcess.RunAsync(cancellationToken, _ws.Root,
+            new Dictionary<string, string?> { ["DOTNET_HOST_PATH"] = FakeDotnet.Write(_ws, report) },
+            "test", "--min-branch", "90");
+
+        await Assert.That(run.ExitCode).IsEqualTo(0).Because(run.Output);
+        await Assert.That(run.StdOut).Contains("PASS: line 50.0% (min 0%), branch 100.0% (min 90%)");
+    }
+
+    [Test]
+    public async Task Diff_AndSnapshot_ResolveWithTheSameFlags(CancellationToken cancellationToken)
+    {
+        var diff = await Dotcov(cancellationToken, _ws.Root, "diff", _report, _report, "--format", "json", "--source-root", "tests");
+        var snapshot = await Dotcov(cancellationToken, _ws.Root,
+            "snapshot", _report, "--commit", "c", "--branch", "b", "--project", "p", "--source-root", "tests");
+
+        await Assert.That(diff.ExitCode).IsEqualTo(0).Because(diff.Output);
+        await Assert.That(diff.StdOut).Contains("\"path\": \"tests/test_app.py\"");
+        await Assert.That(snapshot.ExitCode).IsEqualTo(0).Because(snapshot.Output);
+        await Assert.That(snapshot.StdOut).Contains("\"path\": \"tests/test_app.py\"");
+    }
+}
diff --git a/tests/DotCov.Tests/FileIdentityTests.cs b/tests/DotCov.Tests/FileIdentityTests.cs
new file mode 100644
index 0000000..a8a1cd1
--- /dev/null
+++ b/tests/DotCov.Tests/FileIdentityTests.cs
@@ -0,0 +1,308 @@
+using System.Text;
+using DotCov.Tests.Infrastructure;
+
+namespace DotCov.Tests;
+
+/// <summary>
+/// The three file-identity modes of the library. Lexical, the default, never reads the disk: a
+/// relative filename under several roots keeps a deterministic key, is listed as ambiguous, and
+/// turns every gate into NoData. Probing reproduces 2.0.0 (<see cref="ParserSourceTests"/>), and
+/// an explicit root resolves the ambiguity on any machine.
+/// </summary>
+public sealed class FileIdentityTests : IDisposable
+{
+    private readonly TempWorkspace _ws = TempWorkspace.Create("dotcov-identity-");
+
+    public void Dispose() => _ws.Dispose();
+
+    /// <summary>A workspace directory as a declared root: forward slashes, like the parser's keys.</summary>
+    private string Root(string relative) => _ws.CreateDirectory(relative).Replace('\\', '/');
+
+    private static Cobertura TwoRoots(string first, string second, params string[] files)
+    {
+        var doc = Cobertura.NewDoc().WithSource(first).WithSource(second);
+        foreach (var file in files)
+            doc.AddClass(file, "C", c => c.Line(1, hits: 1).Line(2, hits: 0));
+        return doc;
+    }
+
+    [Test]
+    public async Task Lexical_KeysUnderTheFirstRoot_ListsTheFile_AndNeverReadsTheDisk()
+    {
+        // The file exists only under the SECOND root. Probing would find it; lexical resolution
+        // must not, or the same XML would key differently on another machine.
+        var src = Root("src");
+        var tests = Root("tests");
+        _ws.Write("tests/test_app.py", "");
+
+        var report = TwoRoots(src, tests, "test_app.py").Parse();
+
+        await Assert.That(report.Files.Single().Path).IsEqualTo($"{src}/test_app.py");
+        var ambiguous = await Assert.That(report.AmbiguousFiles).HasSingleItem();
+        await Assert.That(ambiguous.Path).IsEqualTo($"{src}/test_app.py");
+        await Assert.That(ambiguous.CandidateRoots).IsEquivalentTo([src, tests], TUnit.Assertions.Enums.CollectionOrdering.Matching);
+        var warning = await Assert.That(report.Warnings).HasSingleItem();
+        await Assert.That(warning.Kind).IsEqualTo(CoverageWarningKind.FileIdentityAmbiguous);
+        await Assert.That(warning.File).IsEqualTo($"{src}/test_app.py");
+        await Assert.That(warning.Detail).IsEqualTo(
+            $"relative filename 'test_app.py' could belong to any of 2 <source> roots ('{src}', '{tests}') - keyed under the first, identity unresolved");
+
+        var probed = CoberturaParser.Parse(TwoRoots(src, tests, "test_app.py").ToStream(), identity: FileIdentity.ProbeSources);
+        await Assert.That(probed.Files.Single().Path).IsEqualTo($"{tests}/test_app.py");
+        await Assert.That(probed.AmbiguousFiles).IsEmpty();
+    }
+
+    [Test]
+    public async Task Lexical_GateIsNoData_NamingFilesAndRoots_AndHowToResolveThem()
+    {
+        var one = TwoRoots("/a", "/b", "x.cs").Parse();
+        var two = TwoRoots("/a", "/b", "x.cs", "y.cs").Parse();
+
+        var gate = one.Evaluate(10);
+        await Assert.That(gate.Outcome).IsEqualTo(GateOutcome.NoData);
+        await Assert.That(gate.LineRate).IsEqualTo(0.5);   // measured, but not attributable
+        await Assert.That(gate.Reason).IsEqualTo(
+            "1 file has ambiguous identity across 2 source roots; re-run with --probe-sources on the machine that holds the sources or supply --source-root");
+        await Assert.That(two.Evaluate(10).Reason).StartsWith("2 files have ambiguous identity across 2 source roots;");
+        // A disabled gate stays disabled: nothing is asked of the numbers.
+        await Assert.That(one.Evaluate(0).Outcome).IsEqualTo(GateOutcome.Disabled);
+    }
+
+    [Test]
+    public async Task Lexical_OneFileInSeveralClassBlocks_IsListedAndWarnedOnce()
+    {
+        var report = Cobertura.NewDoc().WithSource("/a").WithSource("/b")
+            .AddClass("x.cs", "C", c => c.Line(1, 1))
+            .AddClass("x.cs", "C/<M>d__0", c => c.Line(2, 0))
+            .Parse();
+
+        await Assert.That(report.AmbiguousFiles.Select(static a => a.Path)).IsEquivalentTo(["/a/x.cs"]);
+        await Assert.That(report.Warnings.Count).IsEqualTo(1);
+    }
+
+    [Test]
+    public async Task Lexical_SingleRootAndAbsoluteNames_AreNeverAmbiguous()
+    {
+        var single = Cobertura.NewDoc().WithSource("/a").AddClass("x.cs", c => c.Line(1, 1)).Parse();
+        var absolute = TwoRoots("/a", "/b", "/elsewhere/x.cs").Parse();
+
+        await Assert.That(single.AmbiguousFiles).IsEmpty();
+        await Assert.That(absolute.AmbiguousFiles).IsEmpty();
+        await Assert.That(absolute.Warnings).IsEmpty();
+        await Assert.That(absolute.Evaluate(10).Outcome).IsEqualTo(GateOutcome.Pass);
+    }
+
+    [Test]
+    public async Task SourceRoot_ResolvesAgainstTheChosenRoot_WithoutWarnings()
+    {
+        // Compared after normalization: a Windows spelling of a declared root matches it.
+        var report = CoberturaParser.Parse(TwoRoots("C:/repo/src", "C:/repo/tests", "x.cs").ToStream(),
+            identity: FileIdentity.FromSourceRoot(@"c:\repo\tests\"));
+
+        await Assert.That(report.Files.Single().Path).IsEqualTo("C:/repo/tests/x.cs");
+        await Assert.That(report.Warnings).IsEmpty();
+        await Assert.That(report.AmbiguousFiles).IsEmpty();
+        await Assert.That(report.Evaluate(10).Outcome).IsEqualTo(GateOutcome.Pass);
+    }
+
+    [Test]
+    public async Task SourceRoot_TheNoOpRoot_LeavesRelativeNamesUnprefixed()
+    {
+        var report = CoberturaParser.Parse(TwoRoots(".", "/real", "app/main.py").ToStream(),
+            identity: FileIdentity.FromSourceRoot("."));
+
+        await Assert.That(report.Files.Single().Path).IsEqualTo("app/main.py");
+        await Assert.That(report.AmbiguousFiles).IsEmpty();
+    }
+
+    [Test]
+    public async Task SourceRoot_UndeclaredByAMultiRootReport_Throws_NamingTheReportAndItsRoots()
+    {
+        var input = ReportInput.FromBytes("job-a.xml", TwoRoots("/a", "/b", "x.cs").ToBytes());
+
+        var fromInput = Assert.ThrowsExactly<UndeclaredSourceRootException>(
+            () => CoberturaParser.Parse(input, identity: FileIdentity.FromSourceRoot("/c")));
+        var fromStream = Assert.ThrowsExactly<UndeclaredSourceRootException>(
+            () => CoberturaParser.Parse(TwoRoots(".", "/b", "x.cs").ToStream(), identity: FileIdentity.FromSourceRoot("/c")));
+
+        await Assert.That(fromInput.Message).IsEqualTo("source root '/c' is not declared by job-a.xml (declared: '/a', '/b').");
+        await Assert.That(fromInput.SourceRoot).IsEqualTo("/c");
+        await Assert.That(fromInput.DeclaredRoots).IsEquivalentTo(["/a", "/b"]);
+        await Assert.That(fromInput.SourceName).IsEqualTo("job-a.xml");
+        await Assert.That(fromStream.Message).IsEqualTo("source root '/c' is not declared by the report (declared: '.', '/b').");
+    }
+
+    [Test]
+    public async Task SourceRoot_DeclaredByNoReport_Throws_EvenWhereNothingIsAmbiguous()
+    {
+        // A flag nobody's report can use is a mistake, not a no-op.
+        var a = ReportInput.FromBytes("a.xml", Cobertura.NewDoc().WithSource("/a").AddClass("x.cs", c => c.Line(1, 1)).ToBytes());
+        var plain = ReportInput.FromBytes("plain.xml", Cobertura.NewDoc().AddClass("/abs/y.cs", c => c.Line(1, 1)).ToBytes());
+
+        var ex = Assert.ThrowsExactly<UndeclaredSourceRootException>(
+            () => CoberturaParser.Parse([a, plain], identity: FileIdentity.FromSourceRoot("/b")));
+        var none = Assert.ThrowsExactly<UndeclaredSourceRootException>(
+            () => CoberturaParser.Parse(plain, identity: FileIdentity.FromSourceRoot("/b")));
+
+        await Assert.That(ex.Message).IsEqualTo("source root '/b' is not declared by any report (declared: '/a').");
+        await Assert.That(ex.SourceName).IsNull();
+        await Assert.That(none.Message).IsEqualTo("source root '/b' is not declared by any report (declared: none).");
+    }
+
+    [Test]
+    public async Task SourceRoot_DeclaredByOneOfSeveralReports_ResolvesThatOne_AndLeavesTheOthers()
+    {
+        var single = ReportInput.FromBytes("single.xml",
+            Cobertura.NewDoc().WithSource("/svc-a").AddClass("x.cs", c => c.Line(1, 1)).ToBytes());
+        var multi = ReportInput.FromBytes("multi.xml", TwoRoots("/svc-b/src", "/svc-b/tests", "y.cs").ToBytes());
+
+        var report = CoberturaParser.Parse([single, multi], identity: FileIdentity.FromSourceRoot("/svc-b/tests"));
+
+        await Assert.That(report.Files.Select(static f => f.Path)).IsEquivalentTo(["/svc-a/x.cs", "/svc-b/tests/y.cs"]);
+        await Assert.That(report.AmbiguousFiles).IsEmpty();
+    }
+
+    [Test]
+    public async Task SourceRoot_WithoutAnyReport_IsNotAnError_TheGateSaysNoData()
+    {
+        var report = CoberturaParser.Parse([], identity: FileIdentity.FromSourceRoot("/b"));
+
+        await Assert.That(report.Evaluate(10).Outcome).IsEqualTo(GateOutcome.NoData);
+    }
+
+    [Test]
+    [Arguments("")]
+    [Arguments("   ")]
+    public async Task FromSourceRoot_Blank_Throws(string root)
+    {
+        var ex = Assert.Throws<ArgumentException>(() => FileIdentity.FromSourceRoot(root));
+
+        await Assert.That(ex.ParamName).IsEqualTo("root");
+    }
+
+    [Test]
+    public async Task Modes_AreValues_NotProcessState()
+    {
+        await Assert.That(FileIdentity.Lexical.Mode).IsEqualTo(FileIdentityMode.Lexical);
+        await Assert.That(FileIdentity.Lexical.SourceRoot).IsNull();
+        await Assert.That(FileIdentity.ProbeSources.Mode).IsEqualTo(FileIdentityMode.ProbeSources);
+        await Assert.That(FileIdentity.FromSourceRoot("/x/").SourceRoot).IsEqualTo("/x");
+
+        // Two parses with different modes, interleaved, each get their own resolution.
+        var xml = TwoRoots("/a", "/b", "x.cs");
+        var explicitRoot = CoberturaParser.Parse(xml.ToStream(), identity: FileIdentity.FromSourceRoot("/b"));
+        var lexical = CoberturaParser.Parse(xml.ToStream());
+        await Assert.That(explicitRoot.Files.Single().Path).IsEqualTo("/b/x.cs");
+        await Assert.That(lexical.Files.Single().Path).IsEqualTo("/a/x.cs");
+    }
+
+    [Test]
+    public async Task ParseAsync_FollowsTheSameModes()
+    {
+        var xml = TwoRoots("/a", "/b", "x.cs");
+
+        var lexical = await CoberturaParser.ParseAsync(xml.ToStream());
+        var chosen = await CoberturaParser.ParseAsync(xml.ToStream(), identity: FileIdentity.FromSourceRoot("/b"));
+
+        await Assert.That(lexical.AmbiguousFiles.Single().Path).IsEqualTo("/a/x.cs");
+        await Assert.That(chosen.Files.Single().Path).IsEqualTo("/b/x.cs");
+        await Assert.That(async () => await CoberturaParser.ParseAsync(xml.ToStream(), identity: FileIdentity.FromSourceRoot("/c")))
+            .ThrowsExactly<UndeclaredSourceRootException>();
+        await Assert.That(async () => await CoberturaParser.ParseAsync(
+                Cobertura.NewDoc().WithSource("/a").AddClass("x.cs", c => c.Line(1, 1)).ToStream(),
+                identity: FileIdentity.FromSourceRoot("/c")))
+            .ThrowsExactly<UndeclaredSourceRootException>();
+    }
+
+    [Test]
+    public async Task Merge_UnionsAmbiguousFiles_AndExcludeDropsTheExcludedOnes()
+    {
+        var first = TwoRoots("/a", "/b", "x.cs", "obj/G.g.cs").Parse();
+        var second = TwoRoots("/a", "/c", "x.cs").Parse();
+
+        var merged = CoverageReport.Merge(first, second);
+        var excluded = merged.Exclude(ExclusionRules.WellKnown);
+
+        await Assert.That(merged.AmbiguousFiles.Select(static a => a.Path)).IsEquivalentTo(["/a/x.cs", "/a/obj/G.g.cs"]);
+        await Assert.That(merged.AmbiguousFiles.Single(static a => a.Path == "/a/x.cs").CandidateRoots)
+            .IsEquivalentTo(["/a", "/b", "/c"], TUnit.Assertions.Enums.CollectionOrdering.Matching);
+        await Assert.That(excluded.AmbiguousFiles.Select(static a => a.Path)).IsEquivalentTo(["/a/x.cs"]);
+        await Assert.That(excluded.Evaluate(10).Reason).StartsWith("1 file has ambiguous identity across 3 source roots;");
+    }
+
+    // ── The method-level path and the CRAP gate ──
+
+    private static Cobertura TwoRootsWithMethods(string file) => Cobertura.NewDoc().WithSource("/a").WithSource("/b")
+        .AddClass(file, "Ns.C", c => c.Method("M", "()", "1", m => m.Line(1, 1)));
+
+    [Test]
+    public async Task ParseMethods_Lexical_ListsTheFile_AndTheCrapGateIsNoData()
+    {
+        var methods = CoberturaParser.ParseMethods(TwoRootsWithMethods("x.cs").ToStream());
+
+        await Assert.That(methods.Methods.Single().File).IsEqualTo("/a/x.cs");
+        await Assert.That(methods.AmbiguousFiles.Single().Path).IsEqualTo("/a/x.cs");
+        var gate = CrapAnalysis.Analyze(methods).Evaluate(30);
+        await Assert.That(gate.Outcome).IsEqualTo(GateOutcome.NoData);
+        await Assert.That(gate.Reason).StartsWith("1 file has ambiguous identity across 2 source roots;");
+        // An infinite threshold disables the gate before the identity is asked about.
+        await Assert.That(CrapAnalysis.Analyze(methods).Evaluate(double.PositiveInfinity).Outcome).IsEqualTo(GateOutcome.Disabled);
+    }
+
+    [Test]
+    public async Task ParseMethods_ExplicitRoot_IsAMeasuredCrapPass()
+    {
+        var input = ReportInput.FromBytes("methods.xml", TwoRootsWithMethods("x.cs").ToBytes());
+
+        var methods = CoberturaParser.ParseMethods(input, identity: FileIdentity.FromSourceRoot("/b"));
+
+        await Assert.That(methods.Methods.Single().File).IsEqualTo("/b/x.cs");
+        await Assert.That(CrapAnalysis.Analyze(methods).Evaluate(30).Outcome).IsEqualTo(GateOutcome.Pass);
+        await Assert.That(() => CoberturaParser.ParseMethods(TwoRootsWithMethods("x.cs").ToStream(),
+                identity: FileIdentity.FromSourceRoot("/z")))
+            .ThrowsExactly<UndeclaredSourceRootException>();
+        await Assert.That(() => CoberturaParser.ParseMethods(
+                Cobertura.NewDoc().WithSource("/a").AddClass("x.cs", "C", c => c.Method("M", "()", "1", m => m.Line(1, 1))).ToStream(),
+                identity: FileIdentity.FromSourceRoot("/z")))
+            .ThrowsExactly<UndeclaredSourceRootException>();
+    }
+
+    [Test]
+    public async Task ParseMethods_AmbiguousAcrossInputs_AreUnioned_AndExcludeDropsThem()
+    {
+        var first = ReportInput.FromBytes("1.xml", TwoRootsWithMethods("x.cs").ToBytes());
+        var second = ReportInput.FromBytes("2.xml", Cobertura.NewDoc().WithSource("/a").WithSource("/c")
+            .AddClass("x.cs", "Ns.C", c => c.Method("N", "()", "1", m => m.Line(2, 1))).ToBytes());
+
+        var methods = CoberturaParser.ParseMethods([first, second]);
+        var excluded = methods.Exclude(["x.cs"], []);
+
+        var ambiguous = await Assert.That(methods.AmbiguousFiles).HasSingleItem();
+        await Assert.That(ambiguous.CandidateRoots).IsEquivalentTo(["/a", "/b", "/c"], TUnit.Assertions.Enums.CollectionOrdering.Matching);
+        await Assert.That(excluded.AmbiguousFiles).IsEmpty();
+        await Assert.That(excluded.Methods).IsEmpty();
+        await Assert.That(excluded.Exclusion.ExcludedFiles).IsEquivalentTo(["/a/x.cs"]);
+    }
+
+    [Test]
+    public async Task Probe_StaysTheOptIn_ItsResultDependsOnTheReadingMachine()
+    {
+        // Same XML, two machines: one holds the file under the second root, the other holds
+        // nothing. That difference is exactly why probing is opt-in.
+        var holder = Root("holder/b");
+        _ws.Write("holder/b/x.cs", "");
+        var holderA = holder[..^"/b".Length] + "/a";
+        var xml = Encoding.UTF8.GetBytes($"""
+            <coverage><sources><source>{holderA}</source><source>{holder}</source></sources>
+            <packages><package><classes><class name="C" filename="x.cs"><lines><line number="1" hits="1"/></lines></class>
+            </classes></package></packages></coverage>
+            """);
+
+        var probed = CoberturaParser.Parse(new MemoryStream(xml), identity: FileIdentity.ProbeSources);
+        Directory.Delete(holder, recursive: true);
+        var probedElsewhere = CoberturaParser.Parse(new MemoryStream(xml), identity: FileIdentity.ProbeSources);
+
+        await Assert.That(probed.Files.Single().Path).IsEqualTo($"{holder}/x.cs");
+        await Assert.That(probedElsewhere.Files.Single().Path).IsEqualTo($"{holderA}/x.cs");
+    }
+}
diff --git a/tests/DotCov.Tests/Infrastructure/DotcovProcess.cs b/tests/DotCov.Tests/Infrastructure/DotcovProcess.cs
new file mode 100644
index 0000000..0391b04
--- /dev/null
+++ b/tests/DotCov.Tests/Infrastructure/DotcovProcess.cs
@@ -0,0 +1,40 @@
+using System.Diagnostics;
+
+namespace DotCov.Tests.Infrastructure;
+
+/// <summary>
+/// The dotcov tool as a real child process in a working directory of the test's choosing, with
+/// an explicit environment: for contracts that depend on the working directory or on
+/// <c>DOTNET_HOST_PATH</c>, which an in-process run would have to change for the whole test host.
+/// </summary>
+internal static class DotcovProcess
+{
+    public static Task<ChildRun> RunAsync(
+        CancellationToken cancellationToken, string workingDirectory,
+        IReadOnlyDictionary<string, string?> environment, params string[] args)
+    {
+        var directory = AppContext.BaseDirectory;
+        var start = new ProcessStartInfo("dotnet")
+        {
+            WorkingDirectory = workingDirectory,
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            UseShellExecute = false
+        };
+        foreach (var argument in new[]
+        {
+            "exec", "--depsfile", Path.Combine(directory, "DotCov.Tests.deps.json"),
+            "--runtimeconfig", Path.Combine(directory, "DotCov.Tests.runtimeconfig.json"),
+            Path.Combine(directory, "DotCov.Tool.dll")
+        }.Concat(args))
+            start.ArgumentList.Add(argument);
+
+        start.Environment.Remove("GITHUB_STEP_SUMMARY");
+        start.Environment.Remove("DOTNET_TEST_RUNNER");
+        start.Environment["NO_COLOR"] = "1";
+        foreach (var (name, value) in environment)
+            if (value is null) start.Environment.Remove(name); else start.Environment[name] = value;
+
+        return ChildProcess.RunAsync(start, cancellationToken);
+    }
+}
diff --git a/tests/DotCov.Tests/Infrastructure/FakeDotnet.cs b/tests/DotCov.Tests/Infrastructure/FakeDotnet.cs
new file mode 100644
index 0000000..8b8c2e7
--- /dev/null
+++ b/tests/DotCov.Tests/Infrastructure/FakeDotnet.cs
@@ -0,0 +1,43 @@
+namespace DotCov.Tests.Infrastructure;
+
+/// <summary>
+/// A stand-in for the dotnet that <c>dotcov test</c> starts, named through
+/// <c>DOTNET_HOST_PATH</c> (which the SDK sets for the tools it runs). It copies a prepared
+/// Cobertura report into the <c>--results-directory</c> dotcov passes and exits 0, so the gate
+/// after a successful test run is exercised in milliseconds instead of a real build.
+/// </summary>
+internal static class FakeDotnet
+{
+    public static string Write(TempWorkspace ws, string report)
+    {
+        if (OperatingSystem.IsWindows())
+        {
+            // CRLF: cmd.exe's label search misreads LF-only batch files.
+            return ws.Write("fake-dotnet.cmd", $"""
+                @echo off
+                :next
+                if "%~1"=="" exit /b 1
+                if "%~1"=="--results-directory" (
+                  copy /y "{report}" "%~2\coverage.cobertura.xml" >nul
+                  exit /b 0
+                )
+                shift
+                goto next
+                """.ReplaceLineEndings("\r\n"));
+        }
+
+        var path = ws.Write("fake-dotnet", $"""
+            #!/bin/sh
+            while [ "$#" -gt 0 ]; do
+              if [ "$1" = "--results-directory" ]; then
+                cp "{report}" "$2/coverage.cobertura.xml"
+                exit 0
+              fi
+              shift
+            done
+            exit 1
+            """.ReplaceLineEndings("\n"));
+        File.SetUnixFileMode(path, UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.UserExecute);
+        return path;
+    }
+}
diff --git a/tests/DotCov.Tests/MethodCoverageParseTests.cs b/tests/DotCov.Tests/MethodCoverageParseTests.cs
index b90b4de..c0ec50b 100644
--- a/tests/DotCov.Tests/MethodCoverageParseTests.cs
+++ b/tests/DotCov.Tests/MethodCoverageParseTests.cs
@@ -264,10 +264,11 @@ public async Task ParseMethods_Warnings_AreCompleteAcrossInputs()
 
         await Assert.That(report.Warnings.Select(w => (w.Kind, w.File, w.Line))).IsEquivalentTo(
         [
-            (CoverageWarningKind.FileIdentityAmbiguous, "", 0),
+            (CoverageWarningKind.FileIdentityAmbiguous, "/a/x.cs", 0),
             (CoverageWarningKind.MalformedHits, "/a/x.cs", 3),
             (CoverageWarningKind.MalformedHits, "y.cs", 4),
         ], CollectionOrdering.Matching);
+        await Assert.That(report.AmbiguousFiles.Select(a => a.Path)).IsEquivalentTo(["/a/x.cs"]);
         await Assert.That(report.Methods.Select(m => m.LineHits.Values.Single())).IsEquivalentTo([0, 0], CollectionOrdering.Matching);
     }
 
diff --git a/tests/DotCov.Tests/ParserIntegrityTests.cs b/tests/DotCov.Tests/ParserIntegrityTests.cs
new file mode 100644
index 0000000..da28c2d
--- /dev/null
+++ b/tests/DotCov.Tests/ParserIntegrityTests.cs
@@ -0,0 +1,349 @@
+using System.Text;
+using DotCov.Tests.Infrastructure;
+using DotCov.Tool;
+
+namespace DotCov.Tests;
+
+/// <summary>
+/// Parser rules that keep a number from depending on how the XML is packaged or spelled:
+/// condition identity across the class blocks of one document, branch data that contradicts
+/// itself, an empty class summary, and redundant <c>.</c> segments in file names.
+/// </summary>
+public sealed class ParserIntegrityTests : IDisposable
+{
+    private readonly TempWorkspace _ws = TempWorkspace.Create("dotcov-integrity-");
+
+    public void Dispose() => _ws.Dispose();
+
+    private static async Task<(int Code, string StdOut, string StdErr)> Run(params string[] args)
+    {
+        var stdout = new StringWriter();
+        var stderr = new StringWriter();
+        var code = await DotCovCli.RunAsync(args, stdout, stderr);
+        return (code, stdout.ToString(), stderr.ToString());
+    }
+
+    private static CoverageReport ParseXml(string xml) =>
+        CoberturaParser.Parse(new MemoryStream(Encoding.UTF8.GetBytes(xml)));
+
+    // ── A4: condition identity does not depend on XML packaging ───────────────
+
+    private static void BlockWithCondition5(Cobertura.ClassBuilder c) =>
+        c.Line(9, hits: 1).BranchWithConditions(10, "50% (1/2)", (5, "50%"));
+
+    private static void BlockWithCondition9(Cobertura.ClassBuilder c) =>
+        c.BranchWithConditions(10, "50% (1/2)", (9, "50%"));
+
+    [Test]
+    public async Task ConditionIdentity_OneDocumentWithTwoBlocks_EqualsTwoMergedDocuments()
+    {
+        // The same measurements, packaged once as two <class> blocks of one document and once
+        // as two documents. Different condition numbers on line 10 do not identify the same
+        // branches, so neither packaging may union them into a (2/4) the emitter never reported.
+        var oneDocument = Cobertura.NewDoc()
+            .AddClass("src/X.cs", "Ns.X", BlockWithCondition5)
+            .AddClass("src/X.cs", "Ns.X/<Run>d__0", BlockWithCondition9)
+            .Parse();
+        var twoDocuments = CoverageReport.Merge(
+            Cobertura.NewDoc().AddClass("src/X.cs", "Ns.X", BlockWithCondition5).Parse(),
+            Cobertura.NewDoc().AddClass("src/X.cs", "Ns.X/<Run>d__0", BlockWithCondition9).Parse());
+
+        foreach (var report in new[] { oneDocument, twoDocuments })
+        {
+            var file = report.Files.Single();
+            await Assert.That((file.BranchesHit, file.BranchesTotal)).IsEqualTo((1, 2));
+            await Assert.That((file.LinesHit, file.LinesTotal)).IsEqualTo((2, 2));
+            await Assert.That(file.ConditionsByLine[10]).IsEmpty();   // poisoned: raw aggregate only
+        }
+
+        await Assert.That(oneDocument.BranchRate).IsEqualTo(twoDocuments.BranchRate);
+        await Assert.That(oneDocument.Warnings.Select(static w => (w.Kind, w.File, w.Line)))
+            .IsEquivalentTo(twoDocuments.Warnings.Select(static w => (w.Kind, w.File, w.Line)));
+        var warning = await Assert.That(oneDocument.Warnings).HasSingleItem();
+        await Assert.That(warning.Kind).IsEqualTo(CoverageWarningKind.ConditionIdentityMismatch);
+        await Assert.That(warning.Detail).IsEqualTo("condition numbers [5] vs [9] - using the line aggregate");
+    }
+
+    [Test]
+    public async Task ConditionIdentity_SameSetInTwoBlocks_UnionsPerNumber_LikeAMerge()
+    {
+        // Same condition numbers: two blocks that each exercised a different condition raise
+        // each other, exactly as two merged documents do.
+        static void First(Cobertura.ClassBuilder c) => c.BranchWithConditions(10, "25% (1/4)", (5, "50%"), (7, "0%"));
+        static void Second(Cobertura.ClassBuilder c) => c.BranchWithConditions(10, "25% (1/4)", (5, "0%"), (7, "50%"));
+
+        var oneDocument = Cobertura.NewDoc()
+            .AddClass("src/X.cs", "Ns.X", First).AddClass("src/X.cs", "Ns.X/<>c", Second).Parse();
+        var twoDocuments = CoverageReport.Merge(
+            Cobertura.NewDoc().AddClass("src/X.cs", "Ns.X", First).Parse(),
+            Cobertura.NewDoc().AddClass("src/X.cs", "Ns.X/<>c", Second).Parse());
+
+        await Assert.That(oneDocument.Files.Single().BranchesByLine[10]).IsEqualTo((2, 4));
+        await Assert.That(twoDocuments.Files.Single().BranchesByLine[10]).IsEqualTo((2, 4));
+        await Assert.That(oneDocument.Warnings).IsEmpty();
+    }
+
+    [Test]
+    public async Task ConditionIdentity_PoisonedLine_StaysPoisoned_WarningOnce()
+    {
+        // A third block that agrees with the first cannot resurrect the detail: the poison is
+        // absorbing, so the result does not depend on block order.
+        var report = Cobertura.NewDoc()
+            .AddClass("src/X.cs", "Ns.X", BlockWithCondition5)
+            .AddClass("src/X.cs", "Ns.X/<A>d__0", BlockWithCondition9)
+            .AddClass("src/X.cs", "Ns.X/<B>d__1", c => c.BranchWithConditions(10, "100% (2/2)", (5, "100%")))
+            .Parse();
+
+        var file = report.Files.Single();
+        await Assert.That(file.BranchesByLine[10]).IsEqualTo((2, 2));   // raw Math.Max aggregate
+        await Assert.That(file.ConditionsByLine[10]).IsEmpty();
+        await Assert.That(report.Warnings.Count(static w => w.Kind is CoverageWarningKind.ConditionIdentityMismatch)).IsEqualTo(1);
+    }
+
+    [Test]
+    public async Task ConditionDetail_OnlyFromABlockWithASmallerTotal_FallsBackToTheAggregate()
+    {
+        // Line 10's larger total came from a block without detail; one condition cannot stand for
+        // four outcomes, so the detail is left out — silently, nothing is malformed.
+        var report = Cobertura.NewDoc()
+            .AddClass("src/X.cs", "Ns.X", c => c.BranchWithConditions(10, "50% (1/2)", (5, "50%")))
+            .AddClass("src/X.cs", "Ns.X/<>c", c => c.Branch(10, "50% (2/4)"))
+            .Parse();
+
+        var file = report.Files.Single();
+        await Assert.That(file.BranchesByLine[10]).IsEqualTo((2, 4));
+        await Assert.That(file.ConditionsByLine.ContainsKey(10)).IsFalse();
+        await Assert.That(report.Warnings).IsEmpty();
+    }
+
+    [Test]
+    public async Task ConditionIdentity_MethodLinesAndClassLines_RepeatTheSameDetail_WithoutAWarning()
+    {
+        // Coverlet's own repetition: the same branched line under its <method> and in the class
+        // summary carries the same condition set and unions to itself.
+        const string xml = """
+            <coverage><packages><package><classes>
+              <class name="Ns.X" filename="src/X.cs">
+                <methods><method name="M" signature="()"><lines>
+                  <line number="10" hits="1" branch="True" condition-coverage="50% (1/2)">
+                    <conditions><condition number="5" type="jump" coverage="50%"/></conditions>
+                  </line>
+                </lines></method></methods>
+                <lines>
+                  <line number="10" hits="1" branch="True" condition-coverage="50% (1/2)">
+                    <conditions><condition number="5" type="jump" coverage="50%"/></conditions>
+                  </line>
+                </lines>
+              </class>
+            </classes></package></packages></coverage>
+            """;
+
+        var report = ParseXml(xml);
+
+        await Assert.That(report.Files.Single().ConditionsByLine[10]).IsEquivalentTo(new Dictionary<int, int> { [5] = 1 });
+        await Assert.That(report.Warnings).IsEmpty();
+    }
+
+    [Test]
+    public async Task ConditionIdentity_MethodOnlyClasses_ApplyTheRuleWhenMethodLinesStandIn()
+    {
+        // Without class-level lines, method lines stand in for the file: two method-only blocks
+        // with different condition numbers on one line poison it, like class-level lines do.
+        const string xml = """
+            <coverage><packages><package><classes>
+              <class name="Ns.X" filename="src/X.cs"><methods><method name="M" signature="()"><lines>
+                <line number="10" hits="1" branch="True" condition-coverage="50% (1/2)">
+                  <conditions><condition number="5" type="jump" coverage="50%"/></conditions>
+                </line>
+              </lines></method></methods></class>
+              <class name="Ns.X/&lt;M&gt;d__0" filename="src/X.cs"><methods><method name="MoveNext" signature="()"><lines>
+                <line number="10" hits="1" branch="True" condition-coverage="50% (1/2)">
+                  <conditions><condition number="9" type="jump" coverage="50%"/></conditions>
+                </line>
+              </lines></method></methods></class>
+            </classes></package></packages></coverage>
+            """;
+
+        var report = ParseXml(xml);
+
+        await Assert.That(report.Files.Single().BranchesByLine[10]).IsEqualTo((1, 2));
+        await Assert.That(report.Warnings.Single().Kind).IsEqualTo(CoverageWarningKind.ConditionIdentityMismatch);
+    }
+
+    // ── A5: branch data that contradicts itself warns and never passes ────────
+
+    [Test]
+    public async Task BranchLineWithoutConditionCoverage_WarnsAndCountsNoBranch()
+    {
+        const string xml = """
+            <coverage><packages><package><classes>
+              <class name="X" filename="src/X.cs"><lines>
+                <line number="1" hits="1" branch="false"/>
+                <line number="2" hits="1" branch="true"/>
+              </lines></class>
+            </classes></package></packages></coverage>
+            """;
+
+        var report = ParseXml(xml);
+
+        var warning = await Assert.That(report.Warnings).HasSingleItem();
+        await Assert.That(warning.Kind).IsEqualTo(CoverageWarningKind.MalformedConditionCoverage);
+        await Assert.That((warning.File, warning.Line)).IsEqualTo(("src/X.cs", 2));
+        await Assert.That(warning.Detail).Contains("without a condition-coverage attribute");
+        await Assert.That(report.HasBranchData).IsFalse();
+        await Assert.That(report.Evaluate(0, 100).Outcome).IsEqualTo(GateOutcome.NoData);
+
+        var path = _ws.Write("no-condition-coverage.cobertura.xml", xml);
+        var (code, stdout, stderr) = await Run("check", path, "--min-branch", "100");
+        await Assert.That(code).IsEqualTo(DotCovCli.NoDataExitCode);
+        await Assert.That(stdout).DoesNotContain("PASS");
+        await Assert.That(stderr).Contains("warning: src/X.cs:2: branch=\"true\" without a condition-coverage attribute");
+    }
+
+    [Test]
+    public async Task ConditionDetailClaimingMoreThanItsLine_IsDroppedWithAWarning()
+    {
+        // (0/2) with one condition at 100%: the overlay used to lift the line to (2/2), a fake
+        // 100% branch PASS from a report that says no branch outcome was taken.
+        var doc = Cobertura.NewDoc()
+            .AddClass("src/X.cs", c => c.BranchWithConditions(4, "0% (0/2)", (11, "100%")));
+
+        var report = doc.Parse();
+
+        var file = report.Files.Single();
+        await Assert.That((file.BranchesHit, file.BranchesTotal)).IsEqualTo((0, 2));
+        await Assert.That(file.ConditionsByLine).IsEmpty();
+        var warning = await Assert.That(report.Warnings).HasSingleItem();
+        await Assert.That(warning.Kind).IsEqualTo(CoverageWarningKind.MalformedConditionCoverage);
+        await Assert.That(warning.Detail).IsEqualTo(
+            "1 conditions with 2 covered outcomes disagree with condition-coverage (0/2) - using the line aggregate");
+        await Assert.That(report.Evaluate(0, 100).Outcome).IsEqualTo(GateOutcome.Fail);
+
+        var (code, stdout, _) = await Run("check", _ws.Write("lifted.cobertura.xml", doc), "--min-branch", "100");
+        await Assert.That(code).IsEqualTo(1);
+        await Assert.That(stdout).DoesNotContain("PASS");
+    }
+
+    [Test]
+    [Arguments("lots", "5")]
+    [Arguments("50%", "five")]
+    public async Task UnparseableCondition_IsDroppedWithAWarning(string coverage, string number)
+    {
+        var report = ParseXml($"""
+            <coverage><packages><package><classes>
+              <class name="X" filename="src/X.cs"><lines>
+                <line number="4" hits="1" branch="true" condition-coverage="50% (1/2)">
+                  <conditions><condition number="{number}" type="jump" coverage="{coverage}"/></conditions>
+                </line>
+              </lines></class>
+            </classes></package></packages></coverage>
+            """);
+
+        await Assert.That(report.Files.Single().BranchesByLine[4]).IsEqualTo((1, 2));
+        await Assert.That(report.Files.Single().ConditionsByLine).IsEmpty();
+        var warning = await Assert.That(report.Warnings).HasSingleItem();
+        await Assert.That(warning.Detail).IsEqualTo("a <condition> could not be parsed - using the line aggregate");
+    }
+
+    [Test]
+    public async Task ConditionNumberRepeatedWithinALine_UnionsWithMax()
+    {
+        var report = Cobertura.NewDoc()
+            .AddClass("src/X.cs", c => c.BranchWithConditions(4, "50% (1/2)", (5, "0%"), (5, "50%"), (5, "0%")))
+            .Parse();
+
+        await Assert.That(report.Files.Single().ConditionsByLine[4]).IsEquivalentTo(new Dictionary<int, int> { [5] = 1 });
+        await Assert.That(report.Warnings).IsEmpty();
+    }
+
+    [Test]
+    public async Task SwitchCondition_IsNotTwoWayDetail_AndKeepsTheAggregateSilently()
+    {
+        // Coverlet's switch: one condition for three outcomes. Not malformed, just not 2-way.
+        var report = Cobertura.NewDoc()
+            .AddClass("src/X.cs", c => c.BranchWithConditions(4, "66% (2/3)", (7, "66.67%")))
+            .Parse();
+
+        await Assert.That(report.Files.Single().BranchesByLine[4]).IsEqualTo((2, 3));
+        await Assert.That(report.Files.Single().ConditionsByLine).IsEmpty();
+        await Assert.That(report.Warnings).IsEmpty();
+    }
+
+    // ── A6: an empty class summary still decides the file's lines ─────────────
+
+    [Test]
+    [Arguments("<lines/>")]
+    [Arguments("<lines></lines>")]
+    public async Task EmptyClassSummary_KeepsMethodDeclarationLinesOut_FileIsNoData(string emptyLines)
+    {
+        // istanbul lists each function's declaration line under <methods>; the class's own
+        // <lines> — here empty — says the file has no statements, so nothing was measured.
+        var xml = $"""
+            <coverage><packages><package><classes>
+              <class name="index.js" filename="src/index.js">
+                <methods><method name="(anonymous_0)" signature="()V"><lines>
+                  <line number="1" hits="1"/>
+                </lines></method></methods>
+                {emptyLines}
+              </class>
+            </classes></package></packages></coverage>
+            """;
+
+        var sync = ParseXml(xml);
+        var async = await CoberturaParser.ParseAsync(new MemoryStream(Encoding.UTF8.GetBytes(xml)));
+
+        foreach (var report in new[] { sync, async })
+        {
+            await Assert.That(report.Files.Single().LinesTotal).IsEqualTo(0);
+            await Assert.That(report.Evaluate(80).Outcome).IsEqualTo(GateOutcome.NoData);
+        }
+
+        var (code, stdout, stderr) = await Run("check", _ws.Write("empty-summary.cobertura.xml", xml), "--min-line", "80");
+        await Assert.That(code).IsEqualTo(DotCovCli.NoDataExitCode);
+        await Assert.That(stdout).DoesNotContain("PASS");
+        await Assert.That(stderr).StartsWith("NODATA:");
+    }
+
+    // ── A7: one file, however its relative name is spelled ───────────────────
+
+    [Test]
+    public async Task DotSegments_InFilenames_FoldIntoOneFile()
+    {
+        var report = Cobertura.NewDoc()
+            .AddClass("./src/C.cs", "C", c => c.Line(1, hits: 1))
+            .AddClass("src/C.cs", "C", c => c.Line(2, hits: 0))
+            .AddClass("src/./C.cs", "C", c => c.Line(3, hits: 1))
+            .AddClass(".//src/C.cs", "C", c => c.Line(4, hits: 1))
+            .AddClass(@".\src\.\C.cs", "C", c => c.Line(5, hits: 1))
+            .Parse();
+
+        var file = await Assert.That(report.Files).HasSingleItem();
+        await Assert.That(file.Path).IsEqualTo("src/C.cs");
+        await Assert.That((file.LinesHit, file.LinesTotal)).IsEqualTo((4, 5));
+    }
+
+    [Test]
+    public async Task DotSegments_RootsAndFilenamesFollowOneRule_ParentSegmentsAreKept()
+    {
+        var report = Cobertura.NewDoc()
+            .WithSource("./repo/./src/.")
+            .AddClass("./app/C.cs", "C", c => c.Line(1, hits: 1))
+            .AddClass("app/../app/C.cs", "C", c => c.Line(2, hits: 1))
+            .Parse();
+
+        await Assert.That(report.SourceRoots).IsEquivalentTo(["repo/src"]);
+        // `..` is never resolved: that needs the file system's view of links, and the disk is not read.
+        await Assert.That(report.Files.Select(static f => f.Path))
+            .IsEquivalentTo(["repo/src/app/C.cs", "repo/src/app/../app/C.cs"]);
+    }
+
+    [Test]
+    [Arguments("./.")]
+    [Arguments("/.")]
+    public async Task DotSegments_RootOfOnlyDots_IsTheNoOpOrTheFilesystemRoot(string root)
+    {
+        var report = Cobertura.NewDoc().WithSource(root).AddClass("app/C.cs", "C", c => c.Line(1, hits: 1)).Parse();
+
+        await Assert.That(report.Files.Single().Path).IsEqualTo(root is "/." ? "/app/C.cs" : "app/C.cs");
+    }
+}
diff --git a/tests/DotCov.Tests/ParserSourceTests.cs b/tests/DotCov.Tests/ParserSourceTests.cs
index e496b57..a3a3ae5 100644
--- a/tests/DotCov.Tests/ParserSourceTests.cs
+++ b/tests/DotCov.Tests/ParserSourceTests.cs
@@ -5,10 +5,10 @@ namespace DotCov.Tests;
 
 public sealed class ParserSourceTests
 {
-    private static CoverageReport ParseXml(string xml)
+    private static CoverageReport ParseXml(string xml, FileIdentity? identity = null)
     {
         using var stream = new MemoryStream(Encoding.UTF8.GetBytes(xml));
-        return CoberturaParser.Parse(stream);
+        return CoberturaParser.Parse(stream, identity: identity);
     }
 
     /// <summary>One class per filename, with optional <c>&lt;source&gt;</c> roots (raw, unescaped).</summary>
@@ -45,8 +45,9 @@ public async Task Parse_CommentInsideSource_IsNotARoot()
     [Test]
     public async Task Parse_MultipleRoots_WarningIsReportScopedWithEmptyFile()
     {
-        // Ambiguous roots concern the report, not a particular file or line.
-        var report = ParseXml(Doc("<sources><source>/a</source><source>/b</source></sources>", "x.cs"));
+        // Probing a disk that holds neither candidate: the ambiguity concerns the report, not a
+        // particular file or line.
+        var report = ParseXml(Doc("<sources><source>/a</source><source>/b</source></sources>", "x.cs"), FileIdentity.ProbeSources);
 
         var w = await Assert.That(report.Warnings).HasSingleItem();
         await Assert.That(w.Kind).IsEqualTo(CoverageWarningKind.FileIdentityAmbiguous);
@@ -65,11 +66,13 @@ public async Task Parse_MultipleRoots_EachFileResolvesAgainstTheRootThatHasIt()
         ws.Write("src/pkg/app.py", "");
         ws.Write("tests/test_app.py", "");
 
-        var report = ParseXml(Doc($"<sources><source>{src}</source><source>{tests}</source></sources>", "pkg/app.py", "test_app.py"));
+        var report = ParseXml(Doc($"<sources><source>{src}</source><source>{tests}</source></sources>", "pkg/app.py", "test_app.py"),
+            FileIdentity.ProbeSources);
 
         await Assert.That(report.Files.Select(f => f.Path).Order(StringComparer.Ordinal))
             .IsEquivalentTo(new[] { $"{src}/pkg/app.py", $"{tests}/test_app.py" }.Order(StringComparer.Ordinal));
         await Assert.That(report.Warnings).IsEmpty();
+        await Assert.That(report.AmbiguousFiles).IsEmpty();
     }
 
     [Test]
@@ -81,7 +84,7 @@ public async Task Parse_MultipleRoots_FileUnderEveryRoot_UsesTheFirstAndWarns()
         ws.Write("a/x.py", "");
         ws.Write("b/x.py", "");
 
-        var report = ParseXml(Doc($"<sources><source>{a}</source><source>{b}</source></sources>", "x.py"));
+        var report = ParseXml(Doc($"<sources><source>{a}</source><source>{b}</source></sources>", "x.py"), FileIdentity.ProbeSources);
 
         await Assert.That(report.Files.Single().Path).IsEqualTo($"{a}/x.py");
         var w = await Assert.That(report.Warnings).HasSingleItem();
@@ -96,7 +99,7 @@ public async Task Parse_NoOpRootBesideARealRoot_UsesTheRootThatHasTheFile()
         var src = RootOf(ws, "src");
         ws.Write("src/pkg/app.py", "");
 
-        var report = ParseXml(Doc($"<sources><source>.</source><source>{src}</source></sources>", "pkg/app.py"));
+        var report = ParseXml(Doc($"<sources><source>.</source><source>{src}</source></sources>", "pkg/app.py"), FileIdentity.ProbeSources);
 
         await Assert.That(report.Files.Single().Path).IsEqualTo($"{src}/pkg/app.py");
         await Assert.That(report.Warnings).IsEmpty();
diff --git a/tests/DotCov.Tests/RepositoryBuildTests.cs b/tests/DotCov.Tests/RepositoryBuildTests.cs
index 4ebccd1..928b389 100644
--- a/tests/DotCov.Tests/RepositoryBuildTests.cs
+++ b/tests/DotCov.Tests/RepositoryBuildTests.cs
@@ -105,7 +105,7 @@ public async Task Coverage_SourceProjectMissing_InvalidThreshold_FailsNamingIt(C
             "--badge-directory", "out/badge");
 
         await Assert.That(run.ExitCode).IsNotEqualTo(0);
-        await Assert.That(run.Output).Contains("Invalid --min-line value: 'abc' (expected a number).");
+        await Assert.That(run.Output).Contains("Invalid --min-line value: 'abc' (expected a number from 0 to 100).");
         await Assert.That(Directory.Exists(_workspace.PathOf("out/badge"))).IsFalse();
     }
 
@@ -136,6 +136,22 @@ public async Task Crap_NoScorableMethods_FailsWithNoData(CancellationToken cance
         await Assert.That(run.Output).Contains("NODATA:");
     }
 
+    [Test]
+    public async Task Crap_UnscoredMethod_FailsWithNoData_ThoughEveryScoredMethodPasses(CancellationToken cancellationToken)
+    {
+        // The target's gate needs every method scored: the one without complexity withholds it.
+        var report = _workspace.Write("reports/dotcov.coverage.cobertura.456.xml", Cobertura.NewDoc()
+            .AddClass("src/Example.cs", "Example", c => c
+                .Method("Scored", "()", "1", m => m.Line(1, 1))
+                .Method("Unscored", "()", null, m => m.Line(5, 0))));
+
+        var run = await Run(cancellationToken, "Crap", "--reports", report);
+
+        await Assert.That(run.ExitCode).IsNotEqualTo(0);
+        await Assert.That(run.Output).Contains("NODATA: worst CRAP 1.0 (max 30) - 1 of 2 methods could not be scored");
+        await Assert.That(run.Output).Contains("dotcov crap exited with code 3");
+    }
+
     [Test]
     public async Task Diff_ExplicitBeforeAndAfter_UsesBothInputs(CancellationToken cancellationToken)
     {
diff --git a/tests/DotCov.Tests/ThresholdContractTests.cs b/tests/DotCov.Tests/ThresholdContractTests.cs
new file mode 100644
index 0000000..f242cb4
--- /dev/null
+++ b/tests/DotCov.Tests/ThresholdContractTests.cs
@@ -0,0 +1,151 @@
+using DotCov.Tests.Infrastructure;
+using DotCov.Tool;
+
+namespace DotCov.Tests;
+
+/// <summary>
+/// The threshold contract <c>check</c> and <c>test</c> share (the Fallout target's twin is in
+/// <see cref="FalloutBuildTests"/>): no default threshold, one flag checks its dimension and
+/// disables the other, both at 0 is DISABLED, and only finite percentages from 0 to 100 parse.
+/// </summary>
+public sealed class ThresholdContractTests : IDisposable
+{
+    private readonly TempWorkspace _ws = TempWorkspace.Create("dotcov-thresholds-");
+
+    public void Dispose() => _ws.Dispose();
+
+    private static async Task<(int Code, string StdOut, string StdErr)> Run(params string[] args)
+    {
+        var stdout = new StringWriter();
+        var stderr = new StringWriter();
+        var code = await DotCovCli.RunAsync(args, stdout, stderr);
+        return (code, stdout.ToString(), stderr.ToString());
+    }
+
+    /// <summary>100% of lines, 50% of branches.</summary>
+    private string LinesFullBranchesHalf() =>
+        _ws.Write("half-branches.cobertura.xml", Cobertura.NewDoc()
+            .AddClass("src/B.cs", c => c.Line(1, hits: 1).Branch(2, "50% (1/2)")));
+
+    /// <summary>50% of lines, no branch data.</summary>
+    private string HalfLinesOnly() =>
+        _ws.Write("half-lines.cobertura.xml", Cobertura.NewDoc()
+            .AddClass("src/A.cs", c => c.Line(1, hits: 1).Line(2, hits: 0)));
+
+    [Test]
+    public async Task Check_WithoutAnyThreshold_IsAUsageError_BeforeTheReportIsRead()
+    {
+        // The path does not exist: reading it would be exit 5. The missing threshold wins, and
+        // no implicit 80 decides the gate.
+        var (code, stdout, stderr) = await Run("check", _ws.PathOf("absent.xml"));
+
+        await Assert.That(code).IsEqualTo(DotCovCli.UsageExitCode);
+        await Assert.That(stdout).IsEmpty();
+        await Assert.That(stderr).IsEqualTo(
+            "error: missing threshold: 'check' needs --min-line N, --min-branch N, or both (0 to 100; 0 disables a dimension)." +
+            Environment.NewLine);
+    }
+
+    [Test]
+    public async Task Test_WithoutAnyThreshold_IsAUsageError_BeforeDotnetTestStarts()
+    {
+        var (code, stdout, stderr) = await Run("test", "App.Tests.csproj");
+
+        await Assert.That(code).IsEqualTo(DotCovCli.UsageExitCode);
+        // No echoed "> dotnet test" line: nothing was started.
+        await Assert.That(stdout).IsEmpty();
+        await Assert.That(stderr).StartsWith("error: missing threshold: 'test' needs --min-line N, --min-branch N, or both");
+    }
+
+    [Test]
+    public async Task Check_BranchThresholdAlone_LeavesTheLineDimensionUnchecked()
+    {
+        // 50% of lines would fail any line minimum; the line dimension was not asked about.
+        var path = _ws.Write("mixed.cobertura.xml", Cobertura.NewDoc()
+            .AddClass("src/M.cs", c => c.Line(1, hits: 0).Branch(2, "100% (2/2)")));
+
+        var (code, stdout, _) = await Run("check", path, "--min-branch", "90");
+
+        await Assert.That(code).IsEqualTo(0);
+        await Assert.That(stdout).StartsWith("PASS: line 50.0% (min 0%), branch 100.0% (min 90%)");
+    }
+
+    [Test]
+    public async Task Check_LineThresholdAlone_LeavesTheBranchDimensionUnchecked()
+    {
+        var (code, stdout, _) = await Run("check", LinesFullBranchesHalf(), "--min-line", "100");
+
+        await Assert.That(code).IsEqualTo(0);
+        await Assert.That(stdout).StartsWith("PASS: line 100.0% (min 100%), branch 50.0% (min 0%)");
+    }
+
+    [Test]
+    public async Task Check_BranchThresholdAlone_WithoutBranchData_IsNoData()
+    {
+        var (code, _, stderr) = await Run("check", HalfLinesOnly(), "--min-branch", "50");
+
+        await Assert.That(code).IsEqualTo(DotCovCli.NoDataExitCode);
+        await Assert.That(stderr).StartsWith("NODATA:");
+    }
+
+    [Test]
+    public async Task Check_BothThresholdsZero_IsDisabled()
+    {
+        var (code, _, stderr) = await Run("check", HalfLinesOnly(), "--min-line", "0", "--min-branch", "0");
+
+        await Assert.That(code).IsEqualTo(DotCovCli.DisabledExitCode);
+        await Assert.That(stderr).StartsWith("DISABLED:");
+    }
+
+    [Test]
+    [MatrixDataSource]
+    public async Task OutOfRangeOrNonFinite_IsAUsageError(
+        [Matrix("check", "test")] string command,
+        [Matrix("--min-line", "--min-branch")] string flag,
+        [Matrix("-1", "100.5", "1e3", "Infinity", "-Infinity", "NaN")] string value)
+    {
+        string[] target = command is "check" ? [HalfLinesOnly()] : [];
+
+        var (code, stdout, stderr) = await Run([command, .. target, flag, value]);
+
+        await Assert.That(code).IsEqualTo(DotCovCli.UsageExitCode);
+        await Assert.That(stdout).IsEmpty();
+        await Assert.That(stderr).IsEqualTo($"error: Invalid {flag} value: '{value}' (expected a number from 0 to 100).{Environment.NewLine}");
+    }
+
+    [Test]
+    [Arguments("0")]
+    [Arguments("100")]
+    [Arguments("99.95")]
+    public async Task BoundaryValues_Parse(string value)
+    {
+        var (code, _, stderr) = await Run("check", LinesFullBranchesHalf(), "--min-line", value);
+
+        await Assert.That(code is 0 or DotCovCli.DisabledExitCode).IsTrue().Because(stderr);
+    }
+
+    [Test]
+    [Arguments("150")]
+    [Arguments("-5")]
+    public async Task Report_ThresholdOutsideZeroToHundred_IsAUsageError(string value)
+    {
+        var (code, _, stderr) = await Run("report", HalfLinesOnly(), "--threshold", value);
+
+        await Assert.That(code).IsEqualTo(DotCovCli.UsageExitCode);
+        await Assert.That(stderr).StartsWith($"error: Invalid --threshold value: '{value}' (expected a number from 0 to 100).");
+    }
+
+    [Test]
+    public async Task Help_ShowsThresholdsExplicitly_AndNamesNoDefault()
+    {
+        var (_, stdout, _) = await Run("help");
+
+        await Assert.That(stdout).Contains("check    <path> --min-line N and/or --min-branch N");
+        await Assert.That(stdout).Contains("test     [<project>] --min-line N and/or --min-branch N");
+        await Assert.That(stdout).Contains("there is no default");
+        await Assert.That(stdout).DoesNotContain("default 80");
+        foreach (var example in stdout.Split('\n').Where(static l => l.TrimStart().StartsWith("dotcov check", StringComparison.Ordinal) ||
+                                                                      l.TrimStart().StartsWith("dotcov test", StringComparison.Ordinal)))
+            await Assert.That(example).Contains("--min-");
+    }
+}