Findings go out through ob_puts, like every other builder's report content, rather than straight to the logger. Three things follow from that, and none of them held before:

• -o finally receives the findings. noir scan . -P -o report.txt wrote the endpoint list to the file and left the secrets on stdout only, so the saved report was missing the part -P was run for.
• The file copy is plain text, and so is a redirected stdout. The is_color this used to be handed came from NoirRunner, which reads the color option with no terminal check because that same flag also colors stderr progress logs; @is_color here is the TTY-aware one, so -P > findings.txt no longer gets ANSI codes.
• A closed downstream pipe (| head) stops the stdout writes but lets the -o file finish, instead of exit(0)-ing mid-report.