@backbencher/brain 0.0.0-stage → 0.1.0

package/dist/real-yaml-analyzer-J6MQG3YX.js

@@ -0,0 +1,3528 @@
+import {
+  ASTEngine
+} from "./chunk-V44PGPA6.js";
+import "./chunk-BQ3OVQ3P.js";
+import "./chunk-SK6YVHFZ.js";
+import "./chunk-2BSKD7O3.js";
+import "./chunk-KAET47ZL.js";
+import "./chunk-KCDECRJY.js";
+import "./chunk-MLKGABMK.js";
+
+// src/ast/real-yaml-analyzer.ts
+import { readFileSync, readdirSync, statSync } from "fs";
+import { join } from "path";
+var stripDotSlash = (s) => s.startsWith("./") ? s.slice(2) : s;
+var stripTrailingSlashes = (s) => {
+  let e = s.length;
+  while (e > 0 && s.charCodeAt(e - 1) === 47) e--;
+  return e === s.length ? s : s.slice(0, e);
+};
+var isYamlSpelling = (s) => {
+  const t = s.toLowerCase();
+  return t.endsWith(".yaml") || t.endsWith(".yml");
+};
+var hasTemplateOrGlobChar = (s) => s.includes("{") || s.includes("}") || s.includes("$") || s.includes("*") || s.includes("?");
+var hasJsWhitespace = (s) => {
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c === 9 || c === 10 || c === 11 || c === 12 || c === 13 || c === 32 || c === 160 || c === 5760 || c >= 8192 && c <= 8202 || c === 8232 || c === 8233 || c === 8239 || c === 8287 || c === 12288 || c === 65279) return true;
+  }
+  return false;
+};
+var hasUriSchemePrefix = (s) => {
+  const isAlpha = (c) => c >= 65 && c <= 90 || c >= 97 && c <= 122;
+  if (s.length === 0 || !isAlpha(s.charCodeAt(0))) return false;
+  for (let i = 1; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c === 58) return true;
+    if (!isAlpha(c) && !(c >= 48 && c <= 57) && c !== 43 && c !== 46 && c !== 45) return false;
+  }
+  return false;
+};
+var hasParamKeyPrefix = (s) => {
+  const isStart = (c) => c >= 65 && c <= 90 || c >= 97 && c <= 122 || c === 95;
+  if (s.length === 0 || !isStart(s.charCodeAt(0))) return false;
+  for (let i = 1; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c === 61) return true;
+    if (!isStart(c) && !(c >= 48 && c <= 57)) return false;
+  }
+  return false;
+};
+var isMatrixPathKey = (s) => s === "matrix" || s.endsWith(".matrix");
+var isCheckoutAction = (s) => s.startsWith("actions/checkout") && (s.length === 16 || s.charCodeAt(16) === 64);
+var parseStepsPath = (s, suffix) => {
+  if (!s.endsWith(suffix)) return null;
+  const body = s.slice(0, s.length - suffix.length);
+  if (!body.endsWith("]")) return null;
+  const open = body.lastIndexOf(".steps[");
+  if (open < 0) return null;
+  const digits = body.slice(open + 7, body.length - 1);
+  if (digits.length === 0) return null;
+  for (let i = 0; i < digits.length; i++) {
+    const c = digits.charCodeAt(i);
+    if (c < 48 || c > 57) return null;
+  }
+  return [body.slice(0, open), Number(digits)];
+};
+var isAnsibleParamName = (s) => {
+  if (s.length === 0) return false;
+  const first = s.charCodeAt(0);
+  if (first < 97 || first > 122) return false;
+  for (let i = 1; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c >= 97 && c <= 122 || c >= 48 && c <= 57 || c === 95) continue;
+    return false;
+  }
+  return true;
+};
+var isBareRefName = (s) => {
+  if (s.length === 0) return false;
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c >= 65 && c <= 90 || c >= 97 && c <= 122 || c >= 48 && c <= 57) continue;
+    if (c === 95 || c === 45 || c === 36) continue;
+    return false;
+  }
+  return true;
+};
+var MAPPING_TYPES = /* @__PURE__ */ new Set(["block_mapping", "flow_mapping"]);
+var MAPPING_PAIR_TYPES = /* @__PURE__ */ new Set(["block_mapping_pair", "flow_pair"]);
+var SEQUENCE_TYPES = /* @__PURE__ */ new Set(["block_sequence", "flow_sequence"]);
+var SEQUENCE_ITEM_TYPES = /* @__PURE__ */ new Set(["block_sequence_item"]);
+var WRAPPER_TYPES = /* @__PURE__ */ new Set(["block_node", "flow_node"]);
+var DIRECTIVE_TYPES = /* @__PURE__ */ new Set(["yaml_directive", "tag_directive", "reserved_directive"]);
+var SCALAR_TYPES = /* @__PURE__ */ new Set([
+  "string_scalar",
+  "plain_scalar",
+  "single_quote_scalar",
+  "double_quote_scalar",
+  "integer_scalar",
+  "float_scalar",
+  "boolean_scalar",
+  "null_scalar",
+  "block_scalar",
+  "timestamp_scalar"
+]);
+var RESOLVED_VALUE_VOCABULARY = /* @__PURE__ */ new Set([
+  "object",
+  "array",
+  "string",
+  "integer",
+  "float",
+  "boolean",
+  "null",
+  "timestamp",
+  "alias",
+  "anchor",
+  "untyped"
+]);
+var SCALAR_SHAPES = /* @__PURE__ */ new Set(["string", "integer", "float", "boolean", "null", "timestamp"]);
+var TAG_TYPE_OVERRIDES = {
+  str: "string",
+  int: "integer",
+  float: "float",
+  bool: "boolean",
+  null: "null",
+  map: "object",
+  seq: "array",
+  omap: "array",
+  pairs: "array",
+  set: "array",
+  binary: "string",
+  merge: "object",
+  timestamp: "timestamp"
+};
+var YAML_CORE_PREFIX = "tag:yaml.org,2002:";
+var INCLUDE_TAGS = /* @__PURE__ */ new Set([
+  "include",
+  "inc",
+  "include_tasks",
+  "include_role",
+  "include_vars",
+  "include_file",
+  "import",
+  "import_tasks",
+  "import_playbook",
+  "import_role",
+  "import_file"
+]);
+function looksLikePath(text, quoted = false) {
+  if (!text || text.trim() !== text) return false;
+  if (!quoted && text.includes(" ")) return false;
+  return text.includes(".") || text.includes("/");
+}
+var QUOTED_SCALAR_TYPES = /* @__PURE__ */ new Set(["single_quote_scalar", "double_quote_scalar"]);
+var SECRET_PAYLOAD_KEYS = /* @__PURE__ */ new Set(["data", "stringData", "binaryData"]);
+var SENSITIVE_KEY_NAMES = /* @__PURE__ */ new Set([
+  "password",
+  "passwd",
+  "pass",
+  "secret",
+  "secrets",
+  "token",
+  "tokens",
+  "apikey",
+  "api_key",
+  "api_secret",
+  "access_key",
+  "accesskey",
+  "secret_key",
+  "secretkey",
+  "private_key",
+  "privatekey",
+  "client_secret",
+  "clientsecret",
+  "credential",
+  "credentials",
+  "auth",
+  "authorization",
+  "session_key",
+  "signing_key",
+  "encryption_key",
+  "connection_string",
+  "dsn",
+  "bearer_token",
+  "refresh_token",
+  "id_rsa"
+]);
+var DEPENDS_ON_KEYS = /* @__PURE__ */ new Set(["depends_on", "dependsOn", "needs", "requires"]);
+var RESOURCE_REF_WRAPPERS = /* @__PURE__ */ new Set(["configMapRef", "secretRef", "configMapKeyRef", "secretKeyRef"]);
+var RESOURCE_REF_SOURCES = /* @__PURE__ */ new Map([
+  ["configMap", "name"],
+  // A SecretVolumeSource names the secret `secretName` (upstream
+  // `SecretVolumeSource.secretName`); `name` is the EnvVarSource spelling, which is
+  // the WRAPPER above and is read there. Probed both: a `volumes[].secret: { name: x }`
+  // payload is not the API's shape and is left unreferenced rather than guessed at.
+  ["secret", "secretName"],
+  ["persistentVolumeClaim", "claimName"]
+]);
+var RESOURCE_REF_SCALARS = /* @__PURE__ */ new Set(["serviceAccountName"]);
+var FILE_IMPORT_KEYS = /* @__PURE__ */ new Set([
+  "include_tasks",
+  "import_tasks",
+  "import_playbook",
+  "import_role",
+  "include_role",
+  "import_values",
+  "import",
+  "include",
+  // `include_vars` — R3 (2026-10-21, the yaml lane's whole-population open sweep).
+  //
+  // THE ASYMMETRY THIS FIXES IS THE EVIDENCE. `INCLUDE_TAGS` (the line above) has carried
+  // `include_vars` since the include family was written, because the TAG spelling `!include_vars`
+  // names a vars file. The KEY spelling `include_vars:` names the SAME file and was not in this
+  // set, so the same Ansible construct was covered in one spelling and missed in the other.
+  //
+  // MEASURED, not assumed. The open sweep (the census's `yaml.include_family_key` tally, taken
+  // over the WHOLE admitted population from the TREE — never from the analyzer's own decisions)
+  // found the include family and its per-spelling counts; the VALUE SHAPES decided which
+  // spellings are file inclusions and which are not:
+  //
+  //   `include_vars: <file>`            a vars FILE            -> an import
+  //   `include_vars: {file: <file>}`    a vars FILE            -> an import (the `file:` key)
+  //   `include_vars: {dir: …, with_first_found: …}`  a DIRECTORY of vars -> not a file
+  //   `include_vars: "{{ lookup(…) }}"`  an expression          -> a name read, not a known file
+  //
+  // The other out-of-set spellings the sweep found are NOT file inclusions, and the sweep is
+  // what says so rather than the absence of a number: `include-hidden-files: true`,
+  // `include_aggregate_mounts: true`, `include_in_metadata: true` and `include_tags: true` are
+  // BOOLEAN FLAGS; `INCLUDE_DIR: ${{ github.workspace }}/…` is an ENVIRONMENT VARIABLE holding a
+  // C++ include path; and Helm's `import-values:` names VALUE PATHS (`child:`/`parent:`) between
+  // charts, not a file at all. So `import-values` stays out of this set, and `include_vars` is
+  // the one spelling the sweep proved is a file inclusion the analyzer did not attempt.
+  //
+  // WHAT THE EXISTING EXTRACTION ALREADY GETS RIGHT, so the fix adds no new machinery: a value
+  // that is a MAPPING without a `file:` key contributes nothing (`fileImportTargets` refuses a
+  // mapping), a SEQUENCE contributes only its scalar items, and a scalar contributes one
+  // candidate. The file CLAIM is still made by `keywordIncludeClaim`, which states a project-file
+  // claim only when the project actually carries the file and falls back to `isExternal`
+  // otherwise — so this fix can only ADD checkable edges, never weaken one.
+  "include_vars"
+]);
+var ROLE_IMPORT_KEYS = /* @__PURE__ */ new Set(["include_role", "import_role"]);
+var INCLUDE_SELECTOR_SEGMENTS = /* @__PURE__ */ new Set([
+  "branches",
+  "paths",
+  "sources",
+  "generate_for",
+  "outputs",
+  "exposure",
+  "objc-interfaces",
+  "objc-protocols",
+  "enums"
+]);
+var ROLE_SUBDIR_NAMES = /* @__PURE__ */ new Set([
+  "tasks",
+  "handlers",
+  "vars",
+  "defaults",
+  "meta",
+  "templates",
+  "files",
+  "library"
+]);
+var OPENAPI_COMPONENT_CONTAINERS = /* @__PURE__ */ new Set([
+  "schemas",
+  "responses",
+  "parameters",
+  "examples",
+  "requestBodies",
+  "headers",
+  "securitySchemes",
+  "links",
+  "callbacks",
+  "pathItems"
+]);
+function schemaPublicationRole(parentPath, document) {
+  const prefix = `${document}.`;
+  if (!parentPath.startsWith(prefix)) return null;
+  const parts = parentPath.slice(prefix.length).split(".");
+  if (parts.length === 1 && (parts[0] === "definitions" || parts[0] === "$defs")) return parts[0];
+  if (parts.length === 2 && parts[0] === "components" && OPENAPI_COMPONENT_CONTAINERS.has(parts[1])) {
+    return `components.${parts[1]}`;
+  }
+  return null;
+}
+function isJobLevelPath(parentPath, document) {
+  const prefix = `${document}.jobs.`;
+  if (!parentPath.startsWith(prefix)) return false;
+  const jobId = parentPath.slice(prefix.length);
+  return jobId.length > 0 && !jobId.includes(".");
+}
+var OPENAPI_METHODS = /* @__PURE__ */ new Set([
+  "get",
+  "put",
+  "post",
+  "delete",
+  "options",
+  "head",
+  "patch",
+  "trace"
+]);
+var FRAMEWORK_SIGNATURES = [
+  {
+    name: "GitHub Actions",
+    maturity: 25,
+    insight: "GitHub Actions CI/CD detected",
+    all: [{ path: "jobs", shape: "object" }],
+    any: [
+      { path: "on", shape: "any", pathHint: ".github/workflows" },
+      { path: "on", shape: "object" },
+      { path: "on", shape: "array" },
+      { path: "on", shape: "string" }
+    ]
+  },
+  {
+    name: "Docker Compose",
+    maturity: 20,
+    insight: "Containerized architecture detected",
+    all: [{ path: "services", shape: "object" }],
+    any: [
+      { path: "version", shape: "any" },
+      { path: "networks", shape: "any" },
+      { path: "volumes", shape: "any" },
+      { path: "configs", shape: "any" }
+    ]
+  },
+  {
+    name: "Kubernetes",
+    maturity: 30,
+    insight: "Kubernetes orchestration detected",
+    all: [
+      { path: "apiVersion", shape: "string" },
+      { path: "kind", shape: "string" }
+    ]
+  },
+  {
+    name: "GitLab CI",
+    maturity: 25,
+    insight: "GitLab CI/CD detected",
+    all: [{ path: "stages", shape: "array" }],
+    any: [
+      { path: "variables", shape: "any" },
+      { path: "default", shape: "any" },
+      { path: "include", shape: "any" }
+    ]
+  },
+  {
+    name: "Ansible",
+    maturity: 20,
+    insight: "Ansible provisioning detected",
+    all: [{ path: "hosts", shape: "any" }],
+    any: [
+      { path: "tasks", shape: "any" },
+      { path: "roles", shape: "any" },
+      { path: "play", shape: "any" }
+    ]
+  },
+  {
+    name: "Spring Boot",
+    maturity: 10,
+    insight: "Spring Boot configuration detected",
+    all: [
+      { path: "spring", shape: "object" },
+      { path: "server", shape: "any" }
+    ]
+  },
+  {
+    name: "CircleCI",
+    maturity: 25,
+    insight: "CircleCI CI/CD detected",
+    all: [
+      { path: "version", shape: "string" },
+      { path: "jobs", shape: "object" }
+    ],
+    any: [{ path: "workflows", shape: "any" }, { path: "executors", shape: "any" }]
+  },
+  {
+    name: "Azure Pipelines",
+    maturity: 25,
+    insight: "Azure Pipelines CI/CD detected",
+    all: [
+      { path: "trigger", shape: "any" },
+      { path: "pool", shape: "any" },
+      { path: "steps", shape: "any" }
+    ]
+  },
+  {
+    name: "Serverless Framework",
+    maturity: 20,
+    insight: "Serverless service definition detected",
+    all: [
+      { path: "service", shape: "string" },
+      { path: "provider", shape: "any" },
+      { path: "functions", shape: "object" }
+    ]
+  },
+  {
+    name: "Prometheus",
+    maturity: 15,
+    insight: "Prometheus scrape configuration detected",
+    all: [{ path: "scrape_configs", shape: "array" }],
+    any: [{ path: "global", shape: "any" }]
+  },
+  {
+    name: "CloudFormation",
+    maturity: 20,
+    insight: "AWS CloudFormation template detected",
+    all: [{ path: "AWSTemplateFormatVersion", shape: "any" }]
+  },
+  {
+    name: "OpenAPI",
+    maturity: 20,
+    insight: "OpenAPI/Swagger interface contract detected",
+    all: [{ path: "paths", shape: "object" }],
+    any: [
+      { path: "openapi", shape: "string" },
+      { path: "swagger", shape: "string" }
+    ]
+  },
+  {
+    name: "Helm chart",
+    maturity: 20,
+    insight: "Helm chart metadata detected",
+    all: [
+      { path: "kind", shape: "string" },
+      { path: "name", shape: "string" },
+      { path: "version", shape: "string" }
+    ],
+    any: [{ path: "apiVersion", shape: "string" }]
+  }
+];
+var RealYamlAnalyzer = class _RealYamlAnalyzer {
+  analyze(rootNode, content, filePath, context) {
+    const ctx = {
+      filePath,
+      projectRoot: typeof context?.projectRoot === "string" ? context.projectRoot : void 0,
+      content,
+      symbols: [],
+      relationships: [],
+      imports: [],
+      exports: [],
+      metadata: {
+        detectedFrameworks: [],
+        frameworkPatterns: [],
+        // Declared here because M60 R8's census reads the metadata INITIALISER, and
+        // the real value is only known after shape detection has run. Before that
+        // point this key genuinely has no value, so `undefined` is the honest
+        // initializer and not a placeholder.
+        framework: void 0,
+        hasFrameworkIntelligence: true,
+        patterns: [],
+        architecturalInsights: [],
+        devOpsMaturity: 0,
+        securityScore: 100,
+        configurationComplexity: 0,
+        yamlVersion: null,
+        tagHandles: [],
+        reservedDirectives: [],
+        sensitiveValueCount: 0
+      },
+      anchors: /* @__PURE__ */ new Map(),
+      aliasRefs: [],
+      relationshipKeys: /* @__PURE__ */ new Set(),
+      symbolIds: /* @__PURE__ */ new Set(),
+      visitedNodes: 0,
+      documentCount: 0,
+      maxDepth: 0,
+      pointerIndex: /* @__PURE__ */ new Map(),
+      shapeIndex: /* @__PURE__ */ new Map(),
+      documentShapes: /* @__PURE__ */ new Map(),
+      serviceIndex: /* @__PURE__ */ new Map(),
+      serviceKeyIndex: /* @__PURE__ */ new Map(),
+      topLevelObjectIndex: /* @__PURE__ */ new Map(),
+      commentIndex: /* @__PURE__ */ new Map(),
+      trailingIndex: /* @__PURE__ */ new Map(),
+      sensitiveDocuments: /* @__PURE__ */ new Set(),
+      declaredNames: /* @__PURE__ */ new Map(),
+      documentKinds: /* @__PURE__ */ new Map(),
+      tagHandles: /* @__PURE__ */ new Map(),
+      duplicateCounters: /* @__PURE__ */ new Map(),
+      pendingActionUses: [],
+      stepWithFacts: /* @__PURE__ */ new Map(),
+      pendingSchemaPublications: [],
+      pendingReferences: [],
+      frameworks: [],
+      frameworkPatterns: []
+    };
+    ctx.parseHadError = rootNode.hasError === true;
+    this.collectComments(rootNode, ctx);
+    this.visit(rootNode, {
+      parent: null,
+      parentPath: "",
+      pointerPath: "",
+      document: this.documentName(filePath, 1, ctx.projectRoot),
+      depth: 0,
+      siblingKeys: /* @__PURE__ */ new Set()
+    }, ctx);
+    this.detectFrameworks(ctx);
+    this.resolveActionUses(ctx);
+    this.resolveSchemaExports(ctx);
+    this.resolveAliases(ctx);
+    this.resolvePointerReferences(ctx);
+    this.emitSchemaComposition(ctx);
+    this.resolveSiblingReferences(ctx);
+    this.attachQualifiedCalls(ctx);
+    this.applySecurityScore(ctx);
+    this.classifyEvidenceTier(ctx);
+    ctx.metadata.configurationComplexity = ctx.visitedNodes;
+    ctx.metadata.maxDepth = ctx.maxDepth;
+    ctx.metadata.documentCount = ctx.documentCount;
+    ctx.metadata.symbolCount = ctx.symbols.length;
+    ctx.metadata.relationshipCount = ctx.relationships.length;
+    ctx.metadata.pointerReferenceCount = ctx.pointerIndex.size;
+    ctx.metadata.framework = ctx.frameworks[0] ?? null;
+    ctx.metadata.detectedFrameworks = ctx.frameworks;
+    ctx.metadata.frameworkPatterns = ctx.frameworkPatterns;
+    const declaredOwn = /* @__PURE__ */ new Set();
+    for (const s of ctx.symbols) {
+      if (typeof s.name === "string" && s.name.length > 0) declaredOwn.add(s.name);
+      const q = typeof s.qualifiedName === "string" ? s.qualifiedName : "";
+      if (q.length > 0) declaredOwn.add(q);
+    }
+    let strippedOwnContradicted = 0;
+    let strippedNoExternalShape = 0;
+    const hasExternalShape = (tgt) => {
+      if (tgt.includes("/") || tgt.includes(":") || tgt.includes("@")) return true;
+      if (tgt.includes(".")) return true;
+      return false;
+    };
+    for (const r of ctx.relationships) {
+      const md = r?.metadata;
+      if (!md || typeof md !== "object" || md.isExternal !== true) continue;
+      const tgt = String(r.target ?? "");
+      if (tgt.length === 0) continue;
+      if (declaredOwn.has(tgt)) {
+        delete md.isExternal;
+        strippedOwnContradicted++;
+        continue;
+      }
+      const tagUri = typeof md.tagUri === "string" ? md.tagUri : "";
+      if (!hasExternalShape(tgt) && tagUri.length === 0) {
+        delete md.isExternal;
+        strippedNoExternalShape++;
+      }
+    }
+    if (strippedOwnContradicted > 0) {
+      ;
+      ctx.metadata.isExternalStrippedOwnFileContradicted = strippedOwnContradicted;
+    }
+    if (strippedNoExternalShape > 0) {
+      ;
+      ctx.metadata.isExternalStrippedNoExternalShape = strippedNoExternalShape;
+    }
+    return {
+      symbols: ctx.symbols,
+      relationships: ctx.relationships,
+      imports: ctx.imports,
+      exports: ctx.exports,
+      metadata: ctx.metadata
+    };
+  }
+  // ---------------------------------------------------------------- comments
+  /**
+   * Pass A. Comments are children of `stream`, siblings of `document`, so the main
+   * walk reaches them BEFORE the key they document and a pending-comment buffer
+   * could never see them. They are therefore indexed by the line they precede, with
+   * their column, and attached during the walk by position. `comment.text` is the
+   * comment's own text; the `#` run is removed by slicing, not by a pattern.
+   */
+  collectComments(rootNode, ctx) {
+    const stack = [rootNode];
+    while (stack.length > 0) {
+      const node = stack.pop();
+      if (node.type === "comment") {
+        const text = this.commentText(node);
+        if (text) {
+          const column = node.startPosition.column + 1;
+          const nextLine = node.endPosition.row + 2;
+          const leading = ctx.commentIndex.get(nextLine);
+          if (leading) leading.push({ text, column });
+          else ctx.commentIndex.set(nextLine, [{ text, column }]);
+          const ownLine = node.startPosition.row + 1;
+          const trailing = ctx.trailingIndex.get(ownLine);
+          if (trailing) trailing.push({ text, column });
+          else ctx.trailingIndex.set(ownLine, [{ text, column }]);
+        }
+        continue;
+      }
+      for (let i = node.childCount - 1; i >= 0; i--) {
+        const child = node.child(i);
+        if (child) stack.push(child);
+      }
+    }
+  }
+  commentText(node) {
+    const raw = node.text;
+    let i = 0;
+    while (i < raw.length && (raw[i] === "#" || raw[i] === " ")) i++;
+    return raw.slice(i).trimEnd();
+  }
+  /**
+   * The docstring a symbol earns: leading comments on the line above at the same or
+   * shallower column, plus a trailing comment on its own row to the right. Purely
+   * positional — no comment text is matched against anything, so a comment can only
+   * ever document a neighbour, never be guessed onto an unrelated key.
+   */
+  docstringFor(line, column, ctx) {
+    const parts = [];
+    const above = ctx.commentIndex.get(line);
+    if (above) {
+      for (const c of above) if (c.column <= column) parts.push(c.text);
+    }
+    const trailing = ctx.trailingIndex.get(line);
+    if (trailing) {
+      for (const c of trailing) if (c.column > column) parts.push(c.text);
+    }
+    return parts.length > 0 ? parts.join("\n") : void 0;
+  }
+  // ------------------------------------------------------------------- walk
+  visit(node, visitContext, ctx) {
+    const stack = [{ node, context: visitContext }];
+    while (stack.length > 0) {
+      const item = stack.pop();
+      const curr = item.node;
+      const current = item.context;
+      if (curr.isMissing) continue;
+      ctx.visitedNodes++;
+      if (current.depth > ctx.maxDepth) ctx.maxDepth = current.depth;
+      if (curr.type === "stream") {
+        this.pushChildren(stack, curr, current);
+        continue;
+      }
+      if (curr.type === "comment") continue;
+      if (curr.type === "document") {
+        this.visitDocument(curr, current, ctx, stack);
+        continue;
+      }
+      if (DIRECTIVE_TYPES.has(curr.type)) {
+        this.visitDirective(curr, ctx);
+        this.pushChildren(stack, curr, current);
+        continue;
+      }
+      if (curr.type === "ERROR" || curr.type === "MISSING") {
+        this.descendThroughDamage(curr, current, ctx, stack);
+        continue;
+      }
+      if (SEQUENCE_ITEM_TYPES.has(curr.type) && !current.sequenceItem) {
+        const child = this.firstNamedChild(curr);
+        if (child) this.visitSequenceItem(child, curr, current, ctx, stack, this.itemIndexAmongSiblings(curr));
+        continue;
+      }
+      if (current.sequenceItem) {
+        this.visitSequenceItem(curr, curr, current, ctx, stack, current.sequenceIndex ?? 0);
+        continue;
+      }
+      if (WRAPPER_TYPES.has(curr.type)) {
+        this.pushChildren(stack, curr, current);
+        continue;
+      }
+      if (MAPPING_TYPES.has(curr.type)) {
+        this.pushMappingChildren(stack, curr, current, ctx);
+        continue;
+      }
+      if (MAPPING_PAIR_TYPES.has(curr.type)) {
+        this.visitMappingPair(curr, current, ctx, stack);
+        continue;
+      }
+      if (SEQUENCE_TYPES.has(curr.type)) {
+        this.visitSequence(curr, current, ctx, stack);
+        continue;
+      }
+      if (curr.type === "anchor") {
+        this.visitAnchor(curr, current, ctx, stack);
+        continue;
+      }
+      if (curr.type === "alias") {
+        this.visitAlias(curr, current, ctx);
+        continue;
+      }
+      this.pushChildren(stack, curr, current);
+    }
+  }
+  visitDocument(node, current, ctx, stack) {
+    const documentName = this.documentName(ctx.filePath, ctx.documentCount + 1, ctx.projectRoot);
+    ctx.documentCount++;
+    if (ctx.documentCount > 1) this.addPattern(ctx, "Multi-document YAML");
+    if (!ctx.anchors.has(documentName)) ctx.anchors.set(documentName, /* @__PURE__ */ new Map());
+    const document = this.createSymbol(
+      documentName,
+      ASTEngine.SymbolKind.Module,
+      node,
+      current.parent,
+      current.parentPath,
+      ctx,
+      { yamlSpecific: true, nodeType: "document", documentIndex: ctx.documentCount, fullPath: documentName },
+      documentName
+    );
+    const kind = this.topLevelScalar(node, "kind");
+    const isSecretDocument = kind === "Secret" || kind === "SealedSecret";
+    if (isSecretDocument) {
+      ctx.sensitiveDocuments.add(documentName);
+      this.addPattern(ctx, "Secret Manifest");
+    }
+    const declaredName = this.topLevelScalar(node, "metadata.name") ?? this.topLevelScalarFromMapping(node, "metadata", "name");
+    if (declaredName) {
+      ctx.declaredNames.set(declaredName, documentName);
+      if (kind) ctx.documentKinds.set(declaredName, kind);
+    }
+    this.pushChildren(stack, node, {
+      parent: document,
+      parentPath: documentName,
+      pointerPath: "",
+      document: documentName,
+      depth: current.depth + 1,
+      siblingKeys: /* @__PURE__ */ new Set(),
+      inSecretDocument: isSecretDocument || current.inSecretDocument
+    });
+    void document;
+  }
+  visitDirective(node, ctx) {
+    if (node.type === "yaml_directive") {
+      const version = this.findNamedChild(node, "yaml_version");
+      ctx.metadata.yamlVersion = version ? this.scalarText(version) : this.scalarText(node);
+      this.addPattern(ctx, "YAML Version Directive");
+      return;
+    }
+    if (node.type === "tag_directive") {
+      const handle = this.findNamedChild(node, "tag_handle");
+      const prefix = this.findNamedChild(node, "tag_prefix");
+      if (handle && prefix) {
+        const h = this.scalarText(handle);
+        const p = this.scalarText(prefix);
+        ctx.tagHandles.set(h, p);
+        const handles = ctx.metadata.tagHandles ?? [];
+        handles.push(`${h} -> ${p}`);
+        ctx.metadata.tagHandles = handles;
+      }
+      this.addPattern(ctx, "YAML Tag Directive");
+      return;
+    }
+    const name = this.findNamedChild(node, "directive_name");
+    const parameter = this.findNamedChild(node, "directive_parameter");
+    const reserved = ctx.metadata.reservedDirectives ?? [];
+    reserved.push(name ? this.scalarText(name) : this.scalarText(node));
+    if (parameter) reserved.push(this.scalarText(parameter));
+    ctx.metadata.reservedDirectives = reserved;
+    this.addPattern(ctx, "Reserved Directive");
+  }
+  /**
+     * Descend through a grammar ERROR while KEEPING the enclosing identity.
+     *
+     * WHY NOT A NEW SCOPE. The first version answered damage with damage: a damaged node
+     * became a synthetic `#damaged@<line>` scope and every symbol beneath it was renamed
+     * under that prefix. It stopped ids colliding — which was the actual defect — but it
+     * renamed the ENTIRE key tree of the file, and the F5 differential then reported
+     * 45,990 "unexplained" disagreements that were this one decision, not a disagreement
+     * between the two parsers. Nothing is lost by keeping identity, so nothing should be
+     * renamed.
+     *
+     * SO: the pairs keep the document's identity, the symbols carry `recovered: true` plus
+     * the line and width of the damage that was passed through, and the file keeps the
+     * pattern. The damage is still declared — on the symbols and in the pattern list —
+     * but it is declared as METADATA rather than baked into every name.
+     *
+     * A root-level ERROR has no `document` node, so the file would otherwise have no
+     * identity at all; that case synthesises the document symbol from the stem, marked
+     * recovered, which is what keeps `v1.27.swagger` instead of `[13].swagger`.
+     *
+     * WHAT THE DAMAGE ACTUALLY IS — corrected 2026-09-28 by script/m60/yaml-bucket-audit.ts,
+     * which overturned the description this comment previously gave. It used to say "a
+     * single 58-byte multi-line double-quoted scalar … at the document root", and the
+     * 58-byte figure is real but it is a DIFFERENT node: in v1.28 it is a nested ERROR at
+     * bytes 79,218-79,276, line 2453, depth 4. The root node ITSELF is the ERROR, and it
+     * is enormous. Measured over `docker/api/docs/v1.25.yaml`..`v1.38.yaml`:
+     *
+     *     file      fileBytes  treeEnd   coverage  rootType
+     *     v1.25        260,742    72,809     27.9%  ERROR
+     *     v1.28        278,336    79,276     28.5%  ERROR
+     *     v1.38        354,991   110,341     31.1%  ERROR
+     *
+     * So the parser does not lose containment to one bad token — it STOPS. Between 69%
+     * and 72% of each file is never parsed at all, which is why the analyzer publishes
+     * 1,991-2,637 key-tree paths where an independent reader finds 7,249-9,001. The
+     * distinction is not cosmetic: "one 58-byte token" is a narrow upstream bug report,
+     * "the root node is an ERROR and 70% of the file is unparsed" says the parser gives
+     * up, and only the second is true. The trigger is still the multi-line double-quoted
+     * scalar — the 58-byte node is where it starts.
+  
+     */
+  descendThroughDamage(node, current, ctx, stack) {
+    const site = { line: node.startPosition.row + 1, width: node.endIndex - node.startIndex };
+    this.addPattern(ctx, "Grammar Error Recovery");
+    if (!current.parent) {
+      const documentName = this.documentName(ctx.filePath, ctx.documentCount + 1, ctx.projectRoot);
+      this.pushChildren(stack, node, {
+        parent: null,
+        parentPath: documentName,
+        pointerPath: "",
+        document: documentName,
+        depth: current.depth + 1,
+        siblingKeys: /* @__PURE__ */ new Set(),
+        inSensitiveSubtree: current.inSensitiveSubtree,
+        recoveredThrough: site
+      });
+      return;
+    }
+    this.pushChildren(stack, node, { ...current, depth: current.depth + 1, recoveredThrough: site });
+  }
+  /**
+   * The index a sequence item carries when it is reached WITHOUT an enclosing
+   * sequence — which is exactly the damaged case above. Counted by node TYPE and
+   * byte position, never by wrapper identity: web-tree-sitter returns a FRESH
+   * wrapper per call, so `sibling === itemNode` can never hold and an identity scan
+   * is dead code that silently returns a file-wide count instead.
+   */
+  itemIndexAmongSiblings(itemNode) {
+    const parent = itemNode.parent;
+    if (!parent) return 0;
+    let index = 0;
+    for (let i = 0; i < parent.namedChildCount; i++) {
+      const sibling = parent.namedChild(i);
+      if (!sibling) continue;
+      if (sibling.startIndex === itemNode.startIndex) return index;
+      if (SEQUENCE_ITEM_TYPES.has(sibling.type)) index++;
+    }
+    return index;
+  }
+  visitMappingPair(node, current, ctx, stack) {
+    const keyNode = this.mappingKeyNode(node);
+    if (!keyNode) return;
+    const key = this.scalarText(keyNode);
+    if (!key) return;
+    const valueNode = node.childForFieldName("value") || this.mappingValueNode(node);
+    const tag = this.tagOf(valueNode, ctx);
+    const rawType = this.valueType(valueNode);
+    const valueType = tag?.typeOverride ?? rawType;
+    const isMerge = key === "<<";
+    const isDuplicate = current.siblingKeys.has(key);
+    if (isDuplicate) current.siblingKeys.add(`${key}\0dup`);
+    else current.siblingKeys.add(key);
+    const keyLine = keyNode.startPosition.row + 1;
+    const path = this.uniquePath(current.parentPath, current.document, key, isDuplicate, ctx);
+    if (isDuplicate) {
+      const base = current.parentPath ? `${current.parentPath}.${key}` : key;
+      const ordinal = ctx.duplicateCounters.get(`${current.document}\0${base}`) ?? 1;
+      const overridden = ordinal === 1 ? base : `${base}#${ordinal}`;
+      this.addRelationship(
+        ctx,
+        path,
+        overridden,
+        ASTEngine.RelationshipType.Overrides,
+        {
+          relationshipType: "yaml_duplicate_key",
+          duplicateKey: key,
+          occurrence: ordinal + 1,
+          overriddenPath: overridden,
+          isDuplicateKey: true,
+          // Both endpoints are symbols of THIS file, so this resolves; the uncertainty
+          // is in the semantics, which is why `resolved` and `confidence` disagree here.
+          resolved: true,
+          yamlSpecStatus: "duplicate mapping keys are undefined in YAML 1.2; last-wins is conventional loader behaviour"
+        },
+        keyLine,
+        0.8,
+        "duplicate-mapping-key-last-wins"
+      );
+    }
+    const pointerPath = `${current.pointerPath}/${this.escapePointer(key)}`;
+    const symbolKind = valueType === "object" ? ASTEngine.SymbolKind.Class : valueType === "array" ? ASTEngine.SymbolKind.Variable : ASTEngine.SymbolKind.Property;
+    const sensitive = SENSITIVE_KEY_NAMES.has(key.toLowerCase()) || current.inSensitiveSubtree === true || current.inSecretDocument === true && SECRET_PAYLOAD_KEYS.has(key);
+    const line = keyNode.startPosition.row + 1;
+    const symbol = this.createSymbol(
+      key,
+      symbolKind,
+      keyNode,
+      current.parent,
+      current.parentPath,
+      ctx,
+      {
+        yamlSpecific: true,
+        nodeType: node.type,
+        valueType,
+        rawValueType: tag?.typeOverride ? rawType : void 0,
+        valueTypeSource: tag?.typeOverride ? "tag" : rawType === "untyped" ? "default" : "grammar",
+        fullPath: path,
+        pointerPath,
+        isObject: valueType === "object",
+        isArray: valueType === "array",
+        isMergeKey: isMerge,
+        isAlias: valueType === "alias",
+        isDuplicateKey: isDuplicate || void 0,
+        isSensitive: sensitive || void 0,
+        sensitivityReason: sensitive ? SENSITIVE_KEY_NAMES.has(key.toLowerCase()) ? `key-name:${key.toLowerCase()}` : current.inSecretDocument === true && SECRET_PAYLOAD_KEYS.has(key) ? "secret-document-payload" : "sensitive-subtree" : void 0,
+        recovered: current.recoveredThrough !== void 0 || current.parent?.metadata?.recovered === true || void 0,
+        recoveredThrough: current.recoveredThrough,
+        declaredType: this.tagTypeName(tag),
+        tagUri: tag?.uri,
+        tagLine: tag?.line,
+        tagIncludePath: tag?.includePath,
+        tagIncludeQuoted: tag?.includeQuoted,
+        scalarType: SCALAR_SHAPES.has(valueType) ? valueType : void 0,
+        line
+      },
+      path
+    );
+    symbol.complexity = this.nodeComplexity(valueNode, valueType);
+    const docstring = this.docstringFor(line, keyNode.startPosition.column + 1, ctx);
+    if (docstring) symbol.docstring = docstring;
+    this.assignApiContractPath(symbol);
+    ctx.shapeIndex.set(path, valueType);
+    this.indexShape(current.document, current.parentPath, path, valueType, ctx, key);
+    if (valueType === "object" || valueType === "array") ctx.pointerIndex.set(pointerPath, path);
+    this.emitKeySemantics(key, symbol, valueNode, valueType, keyNode, line, current, ctx);
+    if (valueNode) {
+      stack.push({
+        node: valueNode,
+        context: {
+          parent: symbol,
+          parentPath: path,
+          pointerPath,
+          document: current.document,
+          depth: current.depth + 1,
+          siblingKeys: /* @__PURE__ */ new Set(),
+          inSensitiveSubtree: sensitive || current.inSensitiveSubtree
+        }
+      });
+    }
+  }
+  /**
+   * The semantics a mapping KEY carries. Every decision here comes from the key
+   * node's text, the value node's type, or the value node's position — never from
+   * scanning the value's characters.
+   */
+  emitKeySemantics(key, symbol, valueNode, valueType, keyNode, line, current, ctx) {
+    const path = symbol.qualifiedName || symbol.id;
+    this.recordStepWithFacts(key, valueNode, current, ctx, line);
+    if (key === "extends") this.emitConfigExtends(valueNode, line, current, ctx);
+    if (valueType === "string" && valueNode) {
+      const pointer = this.scalarText(valueNode);
+      if (key === "$ref" || this.isJsonPointer(pointer)) {
+        this.addRelationship(ctx, path, pointer, ASTEngine.RelationshipType.References, {
+          relationshipType: "yaml_json_pointer",
+          ...this.pointerClaim(pointer, ctx),
+          pointer: pointer.startsWith("#/") ? pointer.slice(1) : pointer,
+          referencedName: pointer
+        }, line);
+      }
+    }
+    if (DEPENDS_ON_KEYS.has(key) && this.isDependencyPosition(key, current)) {
+      for (const name of this.dependencyTargets(valueNode)) {
+        if (_RealYamlAnalyzer.markerNamespaceTarget(name)) continue;
+        ctx.pendingReferences.push({ source: path, target: name, kind: "yaml_depends_on", line, document: current.document });
+      }
+    }
+    if (RESOURCE_REF_WRAPPERS.has(key)) {
+      for (const name of this.wrapperRefNames(valueNode)) {
+        ctx.pendingReferences.push({ source: path, target: name, kind: "yaml_resource_ref", line, resourceKind: _RealYamlAnalyzer.KIND_FOR_RESOURCE_KEY[key] });
+      }
+    } else if (RESOURCE_REF_SOURCES.has(key)) {
+      const nameKey = RESOURCE_REF_SOURCES.get(key);
+      const direct = valueNode ? this.scalarNode(valueNode) : null;
+      if (direct && SCALAR_TYPES.has(direct.type)) {
+        const name = this.scalarText(direct);
+        if (name) ctx.pendingReferences.push({ source: path, target: name, kind: "yaml_resource_ref", line, resourceKind: _RealYamlAnalyzer.KIND_FOR_RESOURCE_KEY[key] });
+      } else {
+        const named = this.mappingEntryScalar(valueNode, nameKey);
+        if (named) ctx.pendingReferences.push({ source: path, target: named, kind: "yaml_resource_ref", line });
+      }
+    } else if (RESOURCE_REF_SCALARS.has(key)) {
+      const direct = valueNode ? this.scalarNode(valueNode) : null;
+      if (direct && SCALAR_TYPES.has(direct.type)) {
+        const name = this.scalarText(direct);
+        if (name) ctx.pendingReferences.push({ source: path, target: name, kind: "yaml_resource_ref", line, resourceKind: _RealYamlAnalyzer.KIND_FOR_RESOURCE_KEY[key] });
+      }
+    }
+    if (FILE_IMPORT_KEYS.has(key) && !this.isIncludeSelectorKey(key, current, ctx)) {
+      for (const name of this.fileImportTargets(key, valueNode, current.parentPath, current.document)) {
+        const roleEntry = ROLE_IMPORT_KEYS.has(key) ? this.roleEntryTarget(name, ctx, this.roleEntryFileHint(valueNode)) : null;
+        const inlineFallback = ROLE_IMPORT_KEYS.has(key) && roleEntry === null && this.inlineRoleParams(valueNode) !== null ? this.scalarValues(valueNode).slice(0, 1)[0] : void 0;
+        const target = roleEntry ?? inlineFallback ?? name;
+        const claim = roleEntry !== null ? { importProjectFile: [roleEntry] } : this.keywordIncludeClaim(name, ctx, key);
+        this.addImport(ctx, target, "yaml_keyword_include", keyNode, true);
+        this.addRelationship(ctx, path, target, ASTEngine.RelationshipType.Imports, {
+          relationshipType: "yaml_keyword_include",
+          ...roleEntry !== null ? { roleName: name } : {},
+          // THE CLAIM IS DECIDED, NOT ASSUMED. This site used to hard-code `isExternal: true`,
+          // which the arbiter reads as "look this target's OWNER up" — the wrong question for a
+          // path, and the source of the 107 refuted external claims the whole-population run
+          // found. `keywordIncludeClaim` states the file claim when the target is a file this
+          // project's admitted list can answer for, and nothing weaker than before when it is
+          // not. See the helper for the measurement and the two refusals.
+          ...claim
+        }, line);
+      }
+    }
+    if (key === "uses" && valueType === "string" && valueNode) {
+      const role = isJobLevelPath(current.parentPath, current.document) ? "workflow-call" : "other";
+      const written = this.scalarText(valueNode);
+      ctx.pendingActionUses.push({
+        source: path,
+        action: _RealYamlAnalyzer.rootAnchoredActionPath(written) ?? written,
+        written,
+        line,
+        role
+      });
+    }
+    const publication = schemaPublicationRole(current.parentPath, current.document);
+    if (publication) {
+      ctx.pendingSchemaPublications.push({ document: current.document, container: publication, name: key, path, line });
+    }
+    const declaredType = symbol.metadata?.declaredType;
+    if (declaredType) {
+      this.addRelationship(ctx, path, declaredType, ASTEngine.RelationshipType.References, {
+        relationshipType: "declared_type",
+        tagUri: symbol.metadata?.tagUri ?? declaredType,
+        isExternal: true
+      }, symbol.metadata?.tagLine ?? line);
+    }
+    const includePath = symbol.metadata?.tagIncludePath;
+    if (includePath) {
+      this.addImport(ctx, includePath, "yaml_tag_include", keyNode, true);
+      this.addRelationship(ctx, path, includePath, ASTEngine.RelationshipType.Imports, {
+        relationshipType: "yaml_tag_include",
+        ...this.tagIncludeClaim(includePath, ctx, symbol.metadata?.tagIncludeQuoted === true)
+      }, symbol.metadata?.tagLine ?? line);
+    }
+  }
+  visitSequence(node, current, ctx, stack) {
+    const total = node.namedChildCount;
+    let assigned = 0;
+    for (let i = total - 1; i >= 0; i--) {
+      const child = node.namedChild(i);
+      if (child) {
+        stack.push({
+          node: child,
+          context: { ...current, depth: current.depth + 1, sequenceItem: true, sequenceIndex: i }
+        });
+        assigned++;
+      }
+    }
+    if (current.parent) {
+      current.parent.metadata = { ...current.parent.metadata || {}, itemCount: assigned };
+      if (assigned > 0 && !current.parent.complexity) current.parent.complexity = assigned;
+    }
+  }
+  visitSequenceItem(node, itemNode, current, ctx, stack, index) {
+    const valueNode = SEQUENCE_ITEM_TYPES.has(node.type) ? this.firstNamedChild(node) : node;
+    if (!valueNode) return;
+    const itemPath = `${current.parentPath}[${index}]`;
+    const pointerPath = `${current.pointerPath}/${index}`;
+    const tag = this.tagOf(valueNode, ctx);
+    const rawType = this.valueType(valueNode);
+    const valueType = tag?.typeOverride ?? rawType;
+    const line = itemNode.startPosition.row + 1;
+    if (valueType === "object" || valueType === "array") {
+      const item = this.createSymbol(
+        `item_${index}`,
+        valueType === "object" ? ASTEngine.SymbolKind.Class : ASTEngine.SymbolKind.Variable,
+        itemNode,
+        current.parent,
+        current.parentPath,
+        ctx,
+        {
+          yamlSpecific: true,
+          nodeType: itemNode.type,
+          valueType,
+          valueTypeSource: tag?.typeOverride ? "tag" : rawType === "untyped" ? "default" : "grammar",
+          fullPath: itemPath,
+          pointerPath,
+          isArrayItem: true,
+          arrayIndex: index,
+          recovered: current.recoveredThrough !== void 0 || current.parent?.metadata?.recovered === true || void 0,
+          recoveredThrough: current.recoveredThrough,
+          declaredType: this.tagTypeName(tag),
+          tagUri: tag?.uri,
+          tagLine: tag?.line,
+          tagIncludePath: tag?.includePath,
+          tagIncludeQuoted: tag?.includeQuoted,
+          isSensitive: current.inSensitiveSubtree === true || void 0,
+          sensitivityReason: current.inSensitiveSubtree === true ? "sensitive-subtree" : void 0,
+          line
+        },
+        itemPath
+      );
+      item.complexity = this.nodeComplexity(valueNode, valueType);
+      const docstring = this.docstringFor(line, itemNode.startPosition.column + 1, ctx);
+      if (docstring) item.docstring = docstring;
+      this.assignApiContractPath(item);
+      ctx.shapeIndex.set(itemPath, valueType);
+      ctx.pointerIndex.set(pointerPath, itemPath);
+      this.emitTagSemantics(itemPath, tag, itemNode, line, ctx);
+      stack.push({
+        node: valueNode,
+        context: {
+          parent: item,
+          parentPath: itemPath,
+          pointerPath,
+          document: current.document,
+          depth: current.depth + 1,
+          siblingKeys: /* @__PURE__ */ new Set(),
+          inSensitiveSubtree: current.inSensitiveSubtree
+        }
+      });
+      return;
+    }
+    ctx.pointerIndex.set(pointerPath, itemPath);
+    if (tag?.includePath) {
+      this.addImport(ctx, tag.includePath, "yaml_tag_include", itemNode, true);
+      this.addRelationship(ctx, current.parentPath, tag.includePath, ASTEngine.RelationshipType.Imports, {
+        relationshipType: "yaml_tag_include",
+        ...this.tagIncludeClaim(tag.includePath, ctx, tag.includeQuoted === true)
+      }, tag.line);
+    } else if (this.tagTypeName(tag)) {
+      this.addRelationship(ctx, current.parentPath, tag.shortName, ASTEngine.RelationshipType.References, {
+        relationshipType: "declared_type",
+        tagUri: tag.uri,
+        isExternal: true
+      }, tag.line);
+    }
+    stack.push({ node: valueNode, context: { ...current, depth: current.depth + 1, sequenceItem: false } });
+  }
+  /** The declared-type and include-import edges a tag implies, for a sequence item. */
+  emitTagSemantics(source, tag, node, line, ctx) {
+    if (!tag) return;
+    if (tag.includePath) {
+      this.addImport(ctx, tag.includePath, "yaml_tag_include", node, true);
+      this.addRelationship(ctx, source, tag.includePath, ASTEngine.RelationshipType.Imports, {
+        relationshipType: "yaml_tag_include",
+        ...this.tagIncludeClaim(tag.includePath, ctx, tag.includeQuoted === true)
+      }, tag.line);
+      return;
+    }
+    if (this.tagTypeName(tag)) {
+      this.addRelationship(ctx, source, tag.shortName, ASTEngine.RelationshipType.References, {
+        relationshipType: "declared_type",
+        tagUri: tag.uri,
+        isExternal: true
+      }, tag.line);
+    }
+    void line;
+  }
+  visitAnchor(node, current, ctx, stack) {
+    const nameNode = this.findNamedChild(node, "anchor_name");
+    const name = nameNode ? this.scalarText(nameNode) : "";
+    if (name) {
+      const anchorScope = current.parent?.qualifiedName || current.parent?.id || current.parent?.name || current.document;
+      const key = `${anchorScope}#${name}`;
+      if (!ctx.symbolIds.has(key)) {
+        ctx.symbolIds.add(key);
+        const anchor = this.createSymbol(
+          name,
+          ASTEngine.SymbolKind.Constant,
+          nameNode || node,
+          current.parent,
+          current.parentPath,
+          ctx,
+          {
+            yamlSpecific: true,
+            nodeType: "anchor",
+            isAnchor: true,
+            anchorName: name,
+            anchorDocument: current.document,
+            anchorScope,
+            fullPath: key,
+            line: node.startPosition.row + 1
+          },
+          key
+        );
+        const documentAnchors = ctx.anchors.get(current.document) ?? /* @__PURE__ */ new Map();
+        documentAnchors.set(name, anchor);
+        ctx.anchors.set(current.document, documentAnchors);
+        this.addPattern(ctx, "Anchors and Aliases");
+      }
+    }
+    for (let i = node.namedChildCount - 1; i >= 0; i--) {
+      const child = node.namedChild(i);
+      if (child && child.type !== "anchor_name") stack.push({ node: child, context: current });
+    }
+  }
+  visitAlias(node, current, ctx) {
+    const nameNode = this.findNamedChild(node, "alias_name");
+    const target = nameNode ? this.scalarText(nameNode) : "";
+    if (!target) return;
+    this.addPattern(ctx, "Anchors and Aliases");
+    const merge = current.parent?.metadata?.isMergeKey === true;
+    const source = merge ? current.parent?.ownerName || current.parent?.qualifiedName || current.parent?.id || current.parent?.name || "" : current.parent?.qualifiedName || current.parent?.id || current.parent?.name || "";
+    if (!source) return;
+    ctx.aliasRefs.push({ source, target, merge, document: current.document, line: node.startPosition.row + 1 });
+  }
+  resolveAliases(ctx) {
+    for (const alias of ctx.aliasRefs) {
+      const anchor = ctx.anchors.get(alias.document)?.get(alias.target);
+      const target = anchor?.qualifiedName || alias.target;
+      const type = alias.merge ? ASTEngine.RelationshipType.Extends : ASTEngine.RelationshipType.Uses;
+      const crossDocument = !anchor && this.anchorExistsElsewhere(alias.target, alias.document, ctx);
+      this.addRelationship(ctx, alias.source, target, type, {
+        relationshipType: alias.merge ? "yaml_merge" : "yaml_alias",
+        aliasName: alias.target,
+        aliasDocument: alias.document,
+        resolved: !!anchor,
+        unresolvedReason: anchor ? void 0 : crossDocument ? "anchor-defined-in-another-document" : "anchor-not-declared",
+        isExternal: false
+      }, alias.line, anchor ? 1 : crossDocument ? 0.5 : 0.8, crossDocument ? "cross-document-alias" : "unresolved-alias");
+      if (alias.merge) this.addPattern(ctx, "Configuration Inheritance");
+    }
+  }
+  anchorExistsElsewhere(name, document, ctx) {
+    for (const [doc, anchors] of ctx.anchors) {
+      if (doc !== document && anchors.has(name)) return true;
+    }
+    return false;
+  }
+  /**
+   * ONE STEP'S SHAPE, READ ONCE — `uses:`, and the `with:` keys that decide what a LATER local
+   * `uses:` names.
+   *
+   * WHY IT IS COLLECTED AND NOT LOOKED UP LATER. The question `materializedActionSource` answers is
+   * about the steps BEFORE this one IN THE SAME JOB, and a step's own keys do not come in a fixed
+   * order: measured over the whole admitted corpus, `with:` follows `uses:` in the HashiCorp-style
+   * files and PRECEDES it in others (control arm 7). So both are recorded into one record per step
+   * as the walk passes them, and the join happens after the walk, where no key order can matter.
+   * Only four key names are read, and only when they sit at a position that makes them a step's:
+   * `uses:` at `…steps[i]`, and `path:`/`repository:`/`ref:` at `…steps[i].with`.
+   */
+  recordStepWithFacts(key, valueNode, current, ctx, line) {
+    const suffix = key === "uses" ? "" : key === "path" || key === "repository" || key === "ref" ? ".with" : null;
+    if (suffix === null) return;
+    if (valueNode === null) return;
+    const node = this.scalarNode(valueNode);
+    if (!SCALAR_TYPES.has(node.type)) return;
+    const value = this.scalarText(node);
+    if (value.length === 0) return;
+    const m = parseStepsPath(current.parentPath, suffix);
+    if (m === null) return;
+    const container = m[0], index = m[1];
+    const byIndex = ctx.stepWithFacts.get(container) ?? /* @__PURE__ */ new Map();
+    const entry = byIndex.get(index) ?? { usesLine: line };
+    if (key === "uses") {
+      entry.uses = value;
+      entry.usesLine = line;
+    } else entry[key] = value;
+    byIndex.set(index, entry);
+    ctx.stepWithFacts.set(container, byIndex);
+  }
+  /**
+   * WHAT A LOCAL `uses:` TARGET NAMES, once the RUNNER'S OWN ORDER AND SCOPE are read.
+   *
+   * ## The defect this fixes
+   *
+   * `uses: ./security-scanner` in a job whose earlier step ran `actions/checkout@<sha>` with
+   * `with: {repository: hashicorp/security-scanner, path: security-scanner, ref: main}` names a
+   * directory that does not exist in the repository — because it is not supposed to: the checkout
+   * PUTS that repository's content there before the step runs. The lane emitted `isExternal: true`
+   * on the path, which the arbiter can only answer `externalUnverified` about, so 10 edges of the
+   * EXT-Q class were claims no check could ever reach. A site making an unsupportable claim is a
+   * FIX, not a ruling — and the claim IS supportable: the referent is a NAMED REPOSITORY at a NAMED
+   * REF, which `verifyRemoteRefClaim` verifies.
+   *
+   * MEASURED over the whole admitted population before this was written, from the text and
+   * independently of this analyzer (`validation/m14/fixtures/yaml/materialized-action-price.ts`):
+   * 523 local `uses: ./…` sites, 10 matched to a prior same-job checkout, 9 convertible and 1
+   * honestly left unverifiable:
+   *
+   *     ./security-scanner                    ×7  boundary, consul ×4, nomad, vault -> repo@main
+   *     ./ci-actions/.github/actions/setup      ×2  nimony        -> the project's own file
+   *     ./integration-release-action            ×1  waypoint      -> REFUSED: no `ref:` in the
+   *                                              checkout, and the shared rule refuses a ref-less
+   *                                              remoteRef, so the edge stays `isExternal`
+   *
+   * ## The two families, and why both are the same question
+   *
+   * A checkout WITH `repository: R` puts R's tree at `path:`; a checkout WITHOUT `repository:` puts
+   * THE CALLING REPOSITORY's tree there (nimony's own comment says the checkout exists so the local
+   * `uses:` has its file on disk). So the second family's `./ci-actions/.github/actions/setup` IS
+   * the project's `.github/actions/setup`, and the claim is the file claim the project's admitted
+   * list answers — the stripped path is handed to `actionUseClaim` as an extra candidate.
+   *
+   * ## What it refuses, because these are the shapes a wrong answer wears
+   *
+   * ONLY EARLIER STEPS COUNT: the runner materializes in step order, so a checkout AFTER the use
+   * cannot be its referent (control arm 4). ONLY THE SAME JOB: another job runs on another machine
+   * and materializes nothing for this one (arm 3). ONLY `./…`: a `../` target leaves the workspace,
+   * which a `path:` never does. ONLY AN `actions/checkout@…` STEP — an unrelated action carrying the
+   * same `with: path:` materializes nothing (arm 6). Key order inside the step is NOT evidence
+   * (arm 7). Where an in-repo `action.yml` also exists the MATERIALIZED repository wins, because a
+   * checkout REPLACES that directory at run time (arm 10, whose falsifier is arm 10b).
+   *
+   * NOT CLAIMED, and stated as refusals rather than implemented unmeasured (0 corpus sites each): a
+   * `../` target, a SUBPATH of a named repository, and an exact match against a checkout of the
+   * calling repository (which would name the project root as an action).
+   */
+  materializedActionSource(use, ctx) {
+    if (!use.action.startsWith("./")) return null;
+    const m = parseStepsPath(use.source, ".uses");
+    if (m === null) return null;
+    const byIndex = ctx.stepWithFacts.get(m[0]);
+    if (byIndex === void 0) return null;
+    const useIndex = m[1];
+    const dir = stripTrailingSlashes(use.action.slice(2));
+    if (dir.length === 0) return null;
+    let best = null;
+    for (const [index, facts] of byIndex) {
+      if (index >= useIndex) continue;
+      if (facts.uses === void 0 || !isCheckoutAction(facts.uses)) continue;
+      if (facts.path === void 0) continue;
+      const checkoutPath = stripTrailingSlashes(stripDotSlash(facts.path));
+      if (checkoutPath.length === 0) continue;
+      const rest = dir === checkoutPath ? "" : dir.startsWith(checkoutPath + "/") ? dir.slice(checkoutPath.length + 1) : null;
+      if (rest === null) continue;
+      if (best === null || index > best.index) best = { index, facts, rest };
+    }
+    if (best === null) return null;
+    const repository = best.facts.repository !== void 0 && best.facts.repository.length > 0 ? best.facts.repository : null;
+    const ref = best.facts.ref !== void 0 && best.facts.ref.length > 0 ? best.facts.ref : null;
+    if (repository !== null && best.rest.length > 0) return null;
+    if (repository === null && best.rest.length === 0) return null;
+    return { repository, ref: repository === null ? null : ref, stripped: repository === null ? best.rest : null, line: best.facts.usesLine };
+  }
+  /** A job-level `uses:` is a CALL of a reusable workflow, and never an import. */
+  resolveActionUses(ctx) {
+    if (ctx.pendingActionUses.length === 0) return;
+    const isWorkflow = ctx.frameworks.includes("GitHub Actions");
+    for (const use of ctx.pendingActionUses) {
+      const spelling = use.written !== use.action ? { actionSpelling: use.written } : {};
+      if (use.role === "workflow-call") {
+        if (!isWorkflow) {
+          this.addRelationship(ctx, use.source, use.action, ASTEngine.RelationshipType.References, {
+            relationshipType: "yaml_workflow_call_unverified",
+            isExternal: true,
+            resolved: false,
+            unresolvedReason: "file-shape-is-not-a-github-workflow"
+          }, use.line, 0.7, "shape-not-workflow");
+          continue;
+        }
+        const local = use.action.startsWith("./") || use.action.startsWith("../");
+        this.addRelationship(ctx, use.source, use.action, ASTEngine.RelationshipType.Calls, {
+          relationshipType: "yaml_workflow_call",
+          evidenceClass: "structural",
+          ...spelling,
+          // A REUSABLE-WORKFLOW CALL NAMES A FILE, not an action directory — see
+          // `workflowCallClaim`. Routed through `actionUseClaim` it looked for
+          // `<file>/action.yml`, found nothing, and claimed `isExternal` about a workflow
+          // file this project has (208 edges over the whole admitted population).
+          ...this.workflowCallClaim(use.action, ctx),
+          resolved: false,
+          unresolvedReason: local ? "workflow-in-same-repository-not-indexed" : "workflow-in-another-repository"
+        }, use.line);
+        continue;
+      }
+      const materialized = this.materializedActionSource(use, ctx);
+      const claim = materialized === null ? this.actionUseClaim(use.action, ctx) : {
+        // The claim IS the checked-out repository at its ref, and the `./D` spelling it
+        // replaced travels in metadata so a reader can audit the re-route from the edge alone.
+        ...materialized.repository !== null ? { remoteRef: true } : this.actionUseClaim(use.action, ctx, materialized.stripped !== null ? [materialized.stripped] : []),
+        materializedPath: use.action,
+        materializedAtLine: materialized.line
+      };
+      const target = materialized !== null && materialized.repository !== null ? materialized.ref !== null ? `${materialized.repository}@${materialized.ref}` : materialized.repository : use.action;
+      if (!isWorkflow) {
+        this.addRelationship(ctx, use.source, target, ASTEngine.RelationshipType.References, {
+          relationshipType: "yaml_action_use_unverified",
+          ...claim,
+          ...spelling,
+          resolved: false,
+          unresolvedReason: "file-shape-is-not-a-github-workflow"
+        }, use.line, 0.7, "shape-not-workflow");
+        continue;
+      }
+      this.addImport(ctx, target, "yaml_action_use", void 0, materialized !== null || !use.action.startsWith("./") && !use.action.startsWith("docker://"), use.line);
+      this.addRelationship(ctx, use.source, target, ASTEngine.RelationshipType.Imports, {
+        relationshipType: "yaml_action_use",
+        ...claim,
+        ...spelling
+      }, use.line);
+    }
+  }
+  /**
+   * `exports`: the named definitions a document publishes for other documents to
+   * `$ref`. The document is the exporting unit and the definition is the exported
+   * name, and BOTH are symbols of this file — so unlike every external edge in this
+   * analyzer, this one resolves at both ends.
+   *
+   * Gated on the document declaring `openapi:` or `swagger:` at its top level, read
+   * from the shape index rather than from the text: a `components.schemas.X` path
+   * inside a file that never claims to be an API description is a coincidence of
+   * naming, and a publication edge on a coincidence is a fabricated edge.
+   */
+  resolveSchemaExports(ctx) {
+    if (ctx.pendingSchemaPublications.length === 0) return;
+    let emitted = 0;
+    for (const pub of ctx.pendingSchemaPublications) {
+      const shapes = ctx.documentShapes.get(pub.document);
+      if (!shapes || !(shapes.has("openapi") || shapes.has("swagger"))) continue;
+      this.addRelationship(ctx, pub.document, pub.path, ASTEngine.RelationshipType.Exports, {
+        relationshipType: "yaml_schema_publication",
+        evidenceClass: "structural",
+        container: pub.container,
+        definitionName: pub.name,
+        isExternal: false,
+        resolved: true
+      }, pub.line);
+      emitted++;
+    }
+    if (emitted > 0) this.addPattern(ctx, "Published Schema Components");
+  }
+  /**
+   * A `$ref` WHOSE VALUE IS A BARE NAME, RESOLVED AGAINST THE `test-data:` BLOCK IT LIVES IN.
+   *
+   * The convention is documented by the file's own consumer (gql-sangria's `CatsSupport.resolveRef`,
+   * cited at the call site): inside a `test-data:` block, `{$ref: name}` means the entry `name` of
+   * THAT block, not a JSON pointer. It is a REFERENCE convention rather than a path, so the target
+   * must be the published declaration path, which is what makes the edge resolve instead of
+   * appearing as an ambiguous bare leaf.
+   *
+   * Refuses more than it accepts:
+   *   * the value must be a bare name — a '.', '/', ':' or '#' anywhere means a path, URI or JSON
+   *     pointer and this rule does not apply (`isBareRefName`);
+   *   * the read site must be INSIDE a `test-data:` block (the nearest ancestor, found from the
+   *     shape index), so a `$ref` elsewhere in a file that happens to have one is untouched;
+   *   * the target path must EXIST in the document's shape index — a name the block does not
+   *     declare returns null and the pre-existing `external-file` reading is kept.
+   *
+   * MEASURED corpus-wide: the only `test-data`-nested bare `$ref` values are gql-sangria's four
+   * (`data` ×3, `deepData` ×1); the other bare spellings corpus-wide are 26 `$ref: null` in the
+   * Grace OpenAPI documents, which have no `test-data` block and therefore never reach this rule.
+   *
+   * Both endpoints are therefore existing declarations of this one file, and the target is a
+   * qualified path — so this can move an edge out of the ambiguous/unresolved columns and cannot
+   * put one into a collision.
+   */
+  resolveTestDataReference(source, pointer, ctx) {
+    if (!isBareRefName(pointer)) return null;
+    let block = null;
+    for (const [path, valueType] of ctx.shapeIndex) {
+      if (valueType !== "object") continue;
+      if (!path.endsWith(".test-data")) continue;
+      if (!source.startsWith(`${path}.`)) continue;
+      if (block === null || path.length > block.length) block = path;
+    }
+    if (block === null) return null;
+    const target = `${block}.${pointer}`;
+    return ctx.shapeIndex.has(target) ? target : null;
+  }
+  /** `$ref` targets that point outside this file, or at a pointer nothing declares. */
+  resolvePointerReferences(ctx) {
+    for (const r of ctx.relationships) {
+      if (r.metadata?.relationshipType !== "yaml_json_pointer") continue;
+      const pointer = r.metadata.pointer;
+      if (typeof pointer !== "string") continue;
+      if (!pointer.startsWith("/")) {
+        const testDataTarget = this.resolveTestDataReference(String(r.source ?? ""), pointer, ctx);
+        if (testDataTarget !== null) {
+          r.target = testDataTarget;
+          r.metadata.resolved = true;
+          r.metadata.resolvedIn = "file";
+          r.metadata.resolvedVia = "test-data-reference";
+          r.confidence = 1;
+          delete r.metadata.isExternal;
+          delete r.metadata.unresolvedReason;
+          continue;
+        }
+        r.metadata.resolved = false;
+        r.metadata.unresolvedReason = "external-file";
+        continue;
+      }
+      const hit = ctx.pointerIndex.get(pointer);
+      if (hit) {
+        r.target = hit;
+        r.metadata.resolved = true;
+        r.metadata.resolvedIn = "file";
+        r.confidence = 1;
+      } else {
+        const recovered = this.resolvePointerOnRecoveredTree(pointer, String(r.source ?? ""), ctx);
+        if (recovered !== null) {
+          r.target = recovered;
+          r.metadata.resolved = true;
+          r.metadata.resolvedIn = "file";
+          r.metadata.resolvedVia = "document-shape-suffix";
+          r.confidence = 0.95;
+          continue;
+        }
+        r.metadata.resolved = false;
+        r.metadata.unresolvedReason = ctx.parseHadError ? "parse-error-in-document" : "pointer-not-declared-in-file";
+        r.confidence = 0.9;
+        r.metadata.confidenceReason = r.metadata.unresolvedReason;
+      }
+    }
+  }
+  /**
+   * WHAT A `$ref` MEANT WHEN THE GRAMMAR FLATTENED THE TREE IT POINTS INTO.
+   *
+   * Consulted only for a pointer the exact index missed, and ONLY on a tree the grammar errored
+   * on: on a clean parse the pointer key is the answer and this never runs, so no existing
+   * resolution can move. The evidence is the document's OWN declared paths (`documentShapes`,
+   * keyed by the symbol path the walk built) — the analyzer's published name for the same
+   * declaration, which is what the edge must target to be resolved at all by production.
+   *
+   * The rule, and it refuses more than it accepts:
+   *
+   *   * decode the pointer's segments (`~1` -> `/`, `~0` -> `~`) and join them with `.`;
+   *   * a declared path matches when it IS that string, or when the string ENDS WITH `.` + it —
+   *     i.e. the declaration sits at or below the path the pointer names, which is the shape a
+   *     hoisted level produces (`definitions.MountType` ends with `.MountType`);
+   *   * take the LONGEST match, so the most specific declaration wins;
+   *   * if two declared paths tie at that length, or the winner is not a published symbol path,
+   *     return null and let the edge stay unresolved. A recovered binding that is not unique is
+   *     a fabrication, and an ambiguous `$ref` is not a resolved one.
+   */
+  resolvePointerOnRecoveredTree(pointer, source, ctx) {
+    if (!ctx.parseHadError) return null;
+    const document = this.documentOfPath(source, ctx);
+    if (document === null) return null;
+    const shapes = ctx.documentShapes.get(document);
+    if (!shapes) return null;
+    const decoded = pointer.slice(1).split("/").map((seg) => seg.split("~1").join("/").split("~0").join("~")).join(".");
+    if (decoded.length === 0) return null;
+    let longest = -1;
+    let winner = null;
+    let ties = 0;
+    for (const key of shapes.keys()) {
+      if (key.length === 0) continue;
+      if (key !== decoded && !decoded.endsWith(`.${key}`)) continue;
+      if (key.length > longest) {
+        longest = key.length;
+        winner = key;
+        ties = 1;
+        continue;
+      }
+      if (key.length === longest) ties++;
+    }
+    if (winner === null || ties !== 1) return null;
+    const target = `${document}.${winner}`;
+    return ctx.shapeIndex.has(target) ? target : null;
+  }
+  /** The document a symbol path belongs to: the longest document name that prefixes it. */
+  documentOfPath(source, ctx) {
+    let best = null;
+    for (const document of ctx.documentShapes.keys()) {
+      if (source !== document && !source.startsWith(`${document}.`)) continue;
+      if (best === null || document.length > best.length) best = document;
+    }
+    return best;
+  }
+  /**
+   * Sibling references: a key that names another thing declared in the same file.
+   * The target set is what the walk actually saw — document `metadata.name` values and
+   * top-level `services` keys — so a resolution claimed here is a resolution that was
+   * measured, and an unresolved one says so with a reason and a sub-1.0 confidence.
+   */
+  /**
+   * A `needs:` TARGET NAMES A JOB OF ITS OWN DOCUMENT, and the document-scoped identity is what
+   * makes it resolvable.
+   *
+   * `needs: [test]` inside `.github/workflows/build.yml` means `jobs.test` of THAT FILE, and
+   * every workflow in a project may declare a job named `test` — so the bare name carries N
+   * declarations in the project and production's resolver, which fills a bare name only when
+   * `COUNT(*) = 1` within the project, can never bind it. The lane already publishes each job as
+   * `<document>.jobs.<id>`; targeting that is unique, and it is what the edge MEANT.
+   *
+   * Measured before the change, whole corpus: 802 of the lane's 879 ambiguous `references` are
+   * this shape. The lookup is gated on the document's OWN shape index, so a Compose `depends_on`
+   * (which resolves through `serviceIndex` instead) and a name that merely looks like a job are
+   * both untouched — the check is "does this document declare `jobs.<target>`", not "does the
+   * target look like a job".
+   */
+  resolveJobInDocument(ref, ctx) {
+    if (typeof ref.document !== "string" || ref.document.length === 0) return null;
+    const shapes = ctx.documentShapes.get(ref.document);
+    if (!shapes || !shapes.has(`jobs.${ref.target}`)) return null;
+    return `${ref.document}.jobs.${ref.target}`;
+  }
+  /**
+   * A KUBERNETES OBJECT REFERENCED BY NAME, DECLARED IN A SIBLING FILE OF THE SAME DIRECTORY.
+   *
+   * ## The defect this fixes, and it was found by this lane's own falsifier
+   *
+   * `serviceAccountName: apiserver` in
+   * `staging/src/k8s.io/sample-apiserver/artifacts/example/deployment.yaml` was UNRESOLVED, while
+   * `.../artifacts/example/sa.yaml` declares `kind: ServiceAccount, metadata.name: apiserver` — the
+   * same directory, one manifest set, and `kubectl apply -f <dir>` reads both. `name-collision-
+   * falsifier.ts` proved it with a non-zero exit before this existed.
+   *
+   * ## The rule, PRICED before it was applied (the falsifier counts instead of asserting)
+   *
+   *   CEILING  1 ambiguous edge a same-directory, same-kind resolution can reach
+   *   CONTROL  0 of them sit in a directory declaring that kind+name TWICE (ambiguous even scoped)
+   *   CONTROL  117 MORE would be bound by a PROJECT-WIDE version of the rule, and every one of them
+   *            is refused: another manifest set is another cluster. The directory scope is the whole
+   *            claim, and that is what makes 117 a control rather than a ceiling.
+   *
+   * ## What it reads, and why that is not a contract violation
+   *
+   * `analyze()` is SYNCHRONOUS and the only parser accessor (`engine.getParser`) is async, so a
+   * sibling cannot be parsed here. The two candidate spellings of a sibling's declaration
+   * (`kind:` at column 0, `name:` inside a top-level `metadata:` block) are therefore read from the
+   * sibling's TEXT — and the important part is what the read is FOR: it is a CANDIDATE FILTER, never
+   * an extraction. The value it produces is a DOCUMENT IDENTITY, and the ARBITER then has to
+   * resolve that name against the project's own key space. A wrong sibling makes the edge
+   * unresolved again, not wrong; the only way text can turn into a fact here is through a lookup
+   * this analyzer does not perform. The current file's OWN structure still comes from the tree.
+   *
+   * It is bounded and refuses more than it accepts: only a `yaml_resource_ref` whose referring key
+   * maps to a KIND, only with a project root, only `.yaml`/`.yml` siblings, and it returns null the
+   * moment a SECOND sibling matches — two same-kind, same-name objects in one directory is exactly
+   * the case where the rule would be a guess.
+   */
+  resolveSameDirectoryResource(ref, ctx) {
+    if (ref.kind !== "yaml_resource_ref") return null;
+    const key = ref.source.slice(ref.source.lastIndexOf(".") + 1);
+    const kind = _RealYamlAnalyzer.KIND_FOR_RESOURCE_KEY[key];
+    if (kind === void 0) return null;
+    const root = ctx.projectRoot;
+    if (typeof root !== "string" || root.length === 0) return null;
+    const rel = _RealYamlAnalyzer.projectRelativePath(ctx.filePath, ctx.projectRoot);
+    if (rel === null) return null;
+    const cut = rel.lastIndexOf("/");
+    const dirRel = cut >= 0 ? rel.slice(0, cut) : "";
+    const dirAbs = dirRel.length > 0 ? join(root, ...dirRel.split("/")) : root;
+    let entries;
+    try {
+      entries = readdirSync(dirAbs);
+    } catch {
+      return null;
+    }
+    const hits = [];
+    for (const entry of entries.sort()) {
+      if (!isYamlSpelling(entry)) continue;
+      const siblingRel = dirRel.length > 0 ? `${dirRel}/${entry}` : entry;
+      if (siblingRel === rel) continue;
+      let text;
+      try {
+        text = readFileSync(join(dirAbs, entry), "utf8");
+      } catch {
+        continue;
+      }
+      const parser = ASTEngine.getCachedParser("yaml");
+      if (!parser) return null;
+      let siblingTree = null;
+      try {
+        siblingTree = parser.parse(text);
+      } catch {
+        continue;
+      }
+      let declares = false;
+      try {
+        declares = siblingTree?.rootNode ? this.declaresResourceInTree(siblingTree.rootNode, kind, ref.target) : false;
+      } finally {
+        try {
+          siblingTree?.delete?.();
+        } catch {
+        }
+      }
+      if (!declares) continue;
+      if (hits.length > 0) return null;
+      hits.push(this.documentName(join(dirAbs, entry), 1, ctx.projectRoot));
+    }
+    return hits.length === 1 ? hits[0] : null;
+  }
+  /**
+   * DOES THIS SIBLING DECLARE `kind`/`name`? ASKED OF ITS TREE, NOT OF ITS TEXT.
+   *
+   * THE DEFECT THIS REPLACES WAS MEASURED BY THE FLEET'S OWN RULE, not by taste: the old version
+   * matched `/^kind:[ \t]*["']?([A-Za-z][\w.-]*)["']?[ \t]*$/m` and
+   * `/^[ \t]+name:[ \t]*["']?([^"'\n#]+?)["']?[ \t]*$/m` over the sibling's SOURCE TEXT. Regex over
+   * source text MATCHES COMMENTS AND STRING LITERALS, MISSES NESTED SYNTAX, AND BREAKS SILENTLY ON
+   * THE NEXT GRAMMAR VERSION — so a commented-out `# kind: Deployment` matched, and so did a
+   * `description: "kind: Pod"` value, which is a string ABOUT a kind rather than a kind.
+   *
+   * THE TREE CANNOT SEE EITHER. The pair's `key` field gives `kind` and `metadata` exactly, the
+   * `value` field gives the scalar with its QUOTING ALREADY RESOLVED BY THE GRAMMAR (so `kind:
+   * "Deployment"` and `kind: Deployment` read the same, which the regex only approximated), and a
+   * comment is not a node. The rules are unchanged and are the reason this is anchored at the
+   * document's top level: only the document's OWN `kind`, and only the `name` INSIDE ITS OWN
+   * `metadata` block — a nested pod-template `metadata.name` is not the document's own.
+   *
+   * IT DESCENDS THE STREAM THE GRAMMAR ACTUALLY PRODUCES: the root is a `stream` of `document`
+   * nodes, not a mapping, so a reader that assumed a mapping would silently find nothing.
+   */
+  declaresResourceInTree(root, kind, name) {
+    const document = this.firstChildOfType(root, "document");
+    if (!document) return false;
+    const mapping = this.firstMappingUnder(document);
+    if (!mapping) return false;
+    if (this.mappingEntryScalar(mapping, "kind") !== kind) return false;
+    const metadata = this.mappingValueForKey(mapping, "metadata");
+    if (!metadata) return false;
+    const inner = this.firstMappingUnder(this.scalarNode(metadata));
+    if (!inner) return false;
+    return this.mappingEntryScalar(inner, "name") === name;
+  }
+  /** The first descendant of a given type, in tree order. */
+  firstChildOfType(node, type) {
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const child = node.namedChild(i);
+      if (!child) continue;
+      if (child.type === type) return child;
+      const deeper = this.firstChildOfType(child, type);
+      if (deeper) return deeper;
+    }
+    return null;
+  }
+  /** The mapping a document (or a wrapper) holds: the first mapping-shaped named child. */
+  firstMappingUnder(node) {
+    const unwrapped = this.scalarNode(node);
+    if (MAPPING_TYPES.has(unwrapped.type)) return unwrapped;
+    for (let i = 0; i < unwrapped.namedChildCount; i++) {
+      const child = unwrapped.namedChild(i);
+      if (!child) continue;
+      const inner = this.firstMappingUnder(child);
+      if (inner) return inner;
+    }
+    return null;
+  }
+  /** The VALUE NODE of a mapping's entry for `keyName` — the counterpart of `mappingEntryScalar`. */
+  mappingValueForKey(node, keyName) {
+    if (!node) return null;
+    const mapping = this.scalarNode(node);
+    if (!MAPPING_TYPES.has(mapping.type)) return null;
+    for (let i = 0; i < mapping.namedChildCount; i++) {
+      const pair = mapping.namedChild(i);
+      if (!pair || !MAPPING_PAIR_TYPES.has(pair.type)) continue;
+      const keyNode = pair.childForFieldName("key") || this.firstNonDecorationChild(pair);
+      if (!keyNode || this.scalarText(keyNode) !== keyName) continue;
+      const value = pair.childForFieldName("value") || this.mappingValueNode(pair);
+      if (value) return value;
+    }
+    return null;
+  }
+  /** The referring KEY -> the object KIND it names. One source of truth: the falsifier imports it,
+   *  so the instrument that PRICES this rule and the analyzer that APPLIES it cannot drift. */
+  static KIND_FOR_RESOURCE_KEY = {
+    secretName: "Secret",
+    secretRef: "Secret",
+    secretKeyRef: "Secret",
+    secret: "Secret",
+    claimName: "PersistentVolumeClaim",
+    configMap: "ConfigMap",
+    configMapRef: "ConfigMap",
+    configMapKeyRef: "ConfigMap",
+    serviceAccountName: "ServiceAccount"
+  };
+  /**
+   * JSON SCHEMA COMPOSITION, as `extends`.
+   *
+   * `allOf` means "must satisfy ALL of these" — a superset-of relationship, and the only schema
+   * keyword that means one. `anyOf` and `oneOf` are ALTERNATIVES, which have no ontology type, so
+   * their `$ref`s correctly contribute only the `references` they already produce.
+   *
+   * THIS IS THE JSON LANE'S OWN SETTLED RULING, applied to the same construct in the YAML
+   * spelling: `script/m14/spec/json-completeness.json` records `BD-allof-extends` — "`allOf` is the
+   * only JSON Schema keyword that means 'must satisfy all of these' … a superset relation, which is
+   * why it is `extends` and not `implements`" — and the JSON analyzer emits it over 1,432 edges.
+   * The YAML corpus carries the same construct in the same documents, because a JSON Schema or an
+   * OpenAPI document is routinely written as YAML, and this lane already reads those documents
+   * (it publishes their schema definitions as `exports` and their `$ref`s as `references`).
+   *
+   * MEASURED over the admitted population (the count is the TEXT sweep's, and the tree census's
+   * number is the one the spec cites): `allOf` appears **974** times, against `anyOf` **446** and
+   * `oneOf` **154** — the shape the reading predicts, composition common and alternatives rare.
+   *
+   * THE SOURCE IS THE SCHEMA THAT COMPOSES, not the `allOf` array that records the composition.
+   * `allOf` is a keyword shared by every schema in the file, so an edge whose source were the
+   * array would bind a consumer resolving by name to an arbitrary one of them. The thing that
+   * inherits is `Request`, not `Request.allOf`.
+   *
+   * THE RULE IS THE PATH'S TAIL, and it is exact on purpose: the `$ref` must be a DIRECT member
+   * of an `allOf` item. A `$ref` DEEPER inside an item — `…allOf[1].properties.OnTimeout.$ref` —
+   * is a property reference, not a composition, and the corpus has both: measured on
+   * `Grace/src/OpenAPI/Approval.Components.OpenAPI.yaml`, `CreateApprovalPolicyParameters.allOf[1]`
+   * holds a `properties` mapping whose members carry their own `$ref`s. A rule that matched
+   * "inside an allOf" would have claimed those as compositions; a rule that matched "the parent
+   * ends with `.allOf`" would have missed the object form (`allOf: {$ref: X}`), which is legal
+   * JSON Schema and which the corpus also carries.
+   *
+   * THE CLAIM IS THE POINTER EDGE'S OWN, because it is the same statement: a local `#/…` pointer
+   * resolves inside the file and the target is the resolved symbol path; a SIBLING-FILE pointer
+   * (`Shared.Components.OpenAPI.yaml#/components/schemas/CommonParameters`) names a file this
+   * document composes with, and the file claim is the one the project can check.
+   */
+  /**
+   * THE COMPOSER OF A SCHEMA PATH, or null when the path is not a DIRECT member of an `allOf`.
+   *
+   * `…allOf[N].$ref` and `…allOf.$ref` are compositions; `…allOf[1].properties.X.$ref` is a property
+   * reference and is NOT. THE RULE IS THE TAIL, and the walk says so in one pass: find the LAST
+   * `.allOf`, then require the rest of the string to be exactly `[N]?.$ref`. A path with a deeper
+   * `$ref` fails that requirement at the first character after `.allOf`.
+   *
+   * A STRING WALK AND NOT A REGEX — the token is already in hand, and the fleet's rule is that
+   * pattern-matching a value you already have is a second implementation of a question already
+   * answered. Returns the composer (everything before `.allOf`), or null.
+   */
+  allOfComposerOf(source) {
+    const marker = ".allOf";
+    const at = source.lastIndexOf(marker);
+    if (at <= 0) return null;
+    let i = at + marker.length;
+    if (source[i] === "[") {
+      const close = source.indexOf("]", i);
+      if (close < 0) return null;
+      const digits = source.slice(i + 1, close);
+      if (digits.length === 0) return null;
+      for (let d = 0; d < digits.length; d++) {
+        const c = digits[d];
+        if (c < "0" || c > "9") return null;
+      }
+      i = close + 1;
+    }
+    if (source[i] === ".") i++;
+    if (source.slice(i) !== "$ref") return null;
+    return source.slice(0, at);
+  }
+  emitSchemaComposition(ctx) {
+    for (const r of ctx.relationships) {
+      if (r?.metadata?.relationshipType !== "yaml_json_pointer") continue;
+      const source = String(r.source ?? "");
+      const composer = this.allOfComposerOf(source);
+      if (composer === null) continue;
+      const target = String(r.target ?? "");
+      if (!composer || !target) continue;
+      const md = r.metadata ?? {};
+      const resolved = md.resolved === true;
+      this.addRelationship(ctx, composer, target, ASTEngine.RelationshipType.Extends, {
+        relationshipType: "yaml_schema_composition",
+        compositionOperator: "allOf",
+        evidenceClass: "structural",
+        resolved,
+        ...md.pointer !== void 0 ? { pointer: md.pointer } : {},
+        ...md.importProjectFile !== void 0 ? { importProjectFile: md.importProjectFile } : {},
+        ...md.isExternal !== void 0 ? { isExternal: md.isExternal } : {},
+        ...resolved ? {} : { unresolvedReason: md.unresolvedReason ?? "external-file" }
+      }, r.line_number ?? 0, resolved ? 1 : 0.9, resolved ? void 0 : "composition-target-not-resolved");
+    }
+  }
+  /**
+   * CONFIGURATION INHERITANCE — the `extends:` key — as `extends`.
+   *
+   * `extends` on a YAML mapping is the same relation the merge key carries, written the other way
+   * round: "this thing inherits that thing's configuration". A merge key says it with a `<<` and
+   * an anchor; these dialects say it with a KEY, and the key's VALUE SHAPE says what the base is.
+   *
+   * MEASURED over the admitted population (18,997 YAML files read; the count is the census's, the
+   * shape split is the sweep's), the `extends:` key occurs **80** times in five shapes:
+   *
+   *   `extends: .hidden-job`            33   GitLab CI — a SIBLING KEY in the same file
+   *   `extends: {file: F, service: S}`  17   Docker Compose — a service in ANOTHER file
+   *   `extends: {template: T}`          15   Azure Pipelines — a TEMPLATE FILE
+   *   `extends: name`                    8   yamllint — a config of another tool
+   *   `extends: {service: S}`            6   Docker Compose — a SIBLING service in the same file
+   *   `extends: {…}`                     1   a mapping this lane does not recognise
+   *
+   * AND THE CONTRAST THAT KEEPS THE RULING HONEST: the same sweep found the OTHER supertype-
+   * candidate keys in the corpus — `implements` 59, `inherits` 38, `base` 30, `superclass` 2 —
+   * and each of them names something that is NOT a YAML supertype clause: the `implements:` keys
+   * are Dart package plugin lists in Flutter `pubspec.yaml` files, the `inherits:` keys are
+   * `pnpm-lock.yaml` entries, and the `base:` keys are Ansible filter-plugin bases. The `extends:`
+   * key is the only one of the five whose value names another thing whose CONFIGURATION is
+   * inherited, and the four shapes above are read as that.
+   *
+   * THE SOURCE IS THE THING THAT INHERITS, not the `extends` key: the owner of the key. The
+   * `extends` key is shared by every job in the file, so an edge whose source were the key would
+   * bind a consumer resolving by name to an arbitrary one of them.
+   *
+   * THE TARGET IS THE BASE, and the base is named the way the dialect names it — which is why
+   * the shape decides the claim and not the spelling:
+   *
+   *   - A SIBLING in this file (`.hidden-job`, `{service: S}` with no `file:`) resolves to that
+   *     sibling's SYMBOL, because the analyzer can see it. `resolved: true`.
+   *   - A FILE (`{file: F}`, `{template: T}`) is the base, and the file is what the project can
+   *     check: the claim is the same file claim every other file claim in this lane makes
+   *     (`relativePathCandidates` + `projectCarriesFile`), so a file the project carries is
+   *     `importProjectFile` and one it does not is `isExternal`. The base's NAME inside that file
+   *     (`service: S`, the part after `@` in an Azure template ref) rides in the metadata, because
+   *     the analyzer analyses ONE file at a time and cannot name another file's symbols.
+   *   - A CONFIG NAME (`extends: default`) is a name the document does not declare, so the edge
+   *     says so: `isExternal: true`, `resolved: false`, `unresolvedReason: "not-declared-in-file"`
+   *     — the same shape the lane's unresolved sibling names already use.
+   *
+   * WHAT WOULD OVERTURN THIS: a corpus site where `extends:` names something that is NOT a
+   * configuration base — a version, a label, a metric. The measured population has five shapes
+   * and every one of them names a base, so the falsifier is a sixth shape with a different
+   * meaning.
+   */
+  emitConfigExtends(valueNode, line, current, ctx) {
+    if (!valueNode) return;
+    const composer = current.parentPath;
+    if (!composer) return;
+    const node = this.scalarNode(valueNode);
+    if (MAPPING_TYPES.has(node.type)) {
+      const service = this.mappingEntryScalar(node, "service");
+      const file = this.mappingEntryScalar(node, "file");
+      const template = this.mappingEntryScalar(node, "template");
+      if (template !== null) {
+        const at = template.indexOf("@");
+        const templateFile = at >= 0 ? template.slice(0, at) : template;
+        const templateName = at >= 0 ? template.slice(at + 1) : null;
+        this.emitExtendsToFile(composer, templateFile, line, ctx, "template", templateName);
+        return;
+      }
+      if (file !== null) {
+        this.emitExtendsToFile(composer, file, line, ctx, "service", service);
+        return;
+      }
+      if (service !== null) {
+        const sibling = ctx.serviceKeyIndex.get(service) ?? ctx.serviceIndex.get(service);
+        if (!sibling) return;
+        this.addRelationship(ctx, composer, sibling, ASTEngine.RelationshipType.Extends, {
+          relationshipType: "yaml_config_extends",
+          evidenceClass: "structural",
+          resolved: true,
+          isExternal: false,
+          baseName: service,
+          baseKind: "service"
+        }, line);
+        return;
+      }
+      return;
+    }
+    if (!SCALAR_TYPES.has(node.type)) return;
+    const written = this.scalarValueText(node);
+    if (!written) return;
+    if (written.includes("\n")) return;
+    if (written.startsWith(".")) {
+      const sibling = ctx.topLevelObjectIndex.get(written);
+      if (!sibling) return;
+      this.addRelationship(ctx, composer, sibling, ASTEngine.RelationshipType.Extends, {
+        relationshipType: "yaml_config_extends",
+        evidenceClass: "structural",
+        resolved: true,
+        isExternal: false,
+        baseName: written,
+        baseKind: "hidden-job"
+      }, line);
+      return;
+    }
+    this.addRelationship(ctx, composer, written, ASTEngine.RelationshipType.Extends, {
+      relationshipType: "yaml_config_extends",
+      evidenceClass: "structural",
+      resolved: false,
+      isExternal: true,
+      unresolvedReason: "not-declared-in-file",
+      baseName: written,
+      baseKind: "config"
+    }, line, 0.8, "unresolved-sibling-name");
+  }
+  /**
+   * The `extends:` edge whose base is a FILE — Docker Compose's `{file: F, service: S}` and Azure
+   * Pipelines' `{template: T}`.
+   *
+   * The FILE is the base the project can check, and the file claim is the one every other file
+   * claim in this lane makes, so the edge can carry `importProjectFile` when the project carries
+   * the file and `isExternal` when it does not. The base's NAME inside that file rides in the
+   * metadata, because the analyzer analyses one file at a time and cannot name another file's
+   * symbols — a claim it could make would be a fabrication.
+   *
+   * THE FILE IS ALSO READ, and that is an `imports` edge: Azure's template is included, and
+   * Compose's `file:` is read. So the same site publishes BOTH, which is what the JSON lane does
+   * for the sibling-file form of a composition ("the file form is still composition: 'inherits
+   * from the schema in that file'"), and the two edges are distinguishable by their marker.
+   */
+  emitExtendsToFile(composer, file, line, ctx, baseKind, baseName) {
+    if (!file) return;
+    const claim = this.relativePathCandidates(file, ctx);
+    const carries = claim !== null && this.projectCarriesFile(ctx, claim);
+    this.addRelationship(ctx, composer, file, ASTEngine.RelationshipType.Extends, {
+      relationshipType: "yaml_config_extends",
+      evidenceClass: "structural",
+      resolved: false,
+      baseKind,
+      ...baseName ? { baseName } : {},
+      ...carries ? { importProjectFile: claim } : { isExternal: true },
+      unresolvedReason: carries ? "base-symbol-in-another-file" : "external-file"
+    }, line, 0.9, "base-symbol-in-another-file");
+    this.addRelationship(ctx, composer, file, ASTEngine.RelationshipType.Imports, {
+      relationshipType: "yaml_extends_file",
+      evidenceClass: "import_based",
+      ...carries ? { importProjectFile: claim, isExternal: false } : { isExternal: true },
+      ...baseName ? { baseName } : {}
+    }, line);
+  }
+  resolveSiblingReferences(ctx) {
+    for (const ref of ctx.pendingReferences) {
+      const resolved = ref.kind === "yaml_resource_ref" ? this.resolveDeclaredName(ref.target, ctx, ref.resourceKind) ?? this.resolveSameDirectoryResource(ref, ctx) : this.resolveDeclaredName(ref.target, ctx) ?? this.resolveJobInDocument(ref, ctx) ?? this.resolveSameDirectoryResource(ref, ctx);
+      if (resolved) {
+        this.addRelationship(ctx, ref.source, resolved, ASTEngine.RelationshipType.References, {
+          relationshipType: ref.kind,
+          isExternal: false,
+          resolved: true,
+          referencedName: ref.target
+        }, ref.line);
+      } else {
+        this.addRelationship(ctx, ref.source, ref.target, ASTEngine.RelationshipType.References, {
+          relationshipType: ref.kind,
+          isExternal: true,
+          resolved: false,
+          unresolvedReason: "not-declared-in-file",
+          referencedName: ref.target
+        }, ref.line, 0.8, "unresolved-sibling-name");
+      }
+    }
+  }
+  resolveDeclaredName(name, ctx, wantKind) {
+    if (ctx.declaredNames.has(name)) {
+      if (wantKind === void 0) return ctx.declaredNames.get(name);
+      return ctx.documentKinds.get(name) === wantKind ? ctx.declaredNames.get(name) : null;
+    }
+    if (wantKind !== void 0) return null;
+    return ctx.serviceIndex.get(name) ?? null;
+  }
+  /**
+   * Record one symbol's shape in the two indexes the post-passes read. Called once per
+   * emitted key, so both indexes are O(1) to build and O(1) to query.
+   */
+  indexShape(document, parentPath, path, valueType, ctx, key) {
+    let shapes = ctx.documentShapes.get(document);
+    if (!shapes) {
+      shapes = /* @__PURE__ */ new Map();
+      ctx.documentShapes.set(document, shapes);
+    }
+    const relative = path.startsWith(`${document}.`) ? path.slice(document.length + 1) : path;
+    shapes.set(relative, valueType);
+    if (valueType === "object" && parentPath.endsWith("services")) {
+      ctx.serviceIndex.set(path.slice(path.lastIndexOf(".") + 1), path);
+      if (key !== void 0) ctx.serviceKeyIndex.set(key, path);
+    }
+    if (valueType === "object" && parentPath === document && key !== void 0) {
+      ctx.topLevelObjectIndex.set(key, path);
+    }
+  }
+  /**
+   * Matrix 1b `qualified_calls`, filled honestly for a data language: the reference,
+   * alias and import targets a declaration carries. Containment is excluded — a child
+   * is not something a key "calls".
+   */
+  attachQualifiedCalls(ctx) {
+    const byId = /* @__PURE__ */ new Map();
+    for (const s of ctx.symbols) byId.set(String(s.qualifiedName ?? s.id), s);
+    for (const r of ctx.relationships) {
+      if (r.type === ASTEngine.RelationshipType.Contains || r.type === ASTEngine.RelationshipType.Exports) continue;
+      const symbol = byId.get(String(r.source));
+      if (!symbol) continue;
+      const target = String(r.target);
+      if (!target) continue;
+      const list = symbol.qualified_calls ?? [];
+      if (!list.includes(target)) list.push(target);
+      symbol.qualified_calls = list;
+    }
+  }
+  // ------------------------------------------------------------- frameworks
+  /**
+   * Framework detection is a SET OF EXACT PATHS WITH SHAPES, not a set of names
+   * anywhere in the file. The previous implementation tested a whole-file name set,
+   * so a seven-line file carrying `version`, `services`, `jobs`, `on` and `stages`
+   * claimed three frameworks. The shape index this reads is built from the walk, so
+   * `nested.version` is not `version` and cannot match.
+   */
+  detectFrameworks(ctx) {
+    const path = ctx.filePath.toLowerCase();
+    for (const signature of FRAMEWORK_SIGNATURES) {
+      const patterns = [];
+      let matched = true;
+      for (const requirement of signature.all) {
+        const hit = this.matchRequirement(requirement, path, ctx);
+        if (!hit) {
+          matched = false;
+          break;
+        }
+        patterns.push(hit);
+      }
+      if (matched && signature.any) {
+        const hits = signature.any.map((requirement) => this.matchRequirement(requirement, path, ctx)).filter((hit) => hit !== null);
+        if (hits.length === 0) matched = false;
+        else patterns.push(hits[0]);
+      }
+      if (!matched) continue;
+      if (!ctx.frameworks.includes(signature.name)) {
+        ctx.frameworks.push(signature.name);
+        for (const p of patterns) if (!ctx.frameworkPatterns.includes(p)) ctx.frameworkPatterns.push(p);
+        ctx.metadata.devOpsMaturity = (ctx.metadata.devOpsMaturity || 0) + signature.maturity;
+        const insights = ctx.metadata.architecturalInsights;
+        if (!insights.includes(signature.insight)) insights.push(signature.insight);
+      }
+    }
+    if (ctx.pendingReferences.length > 0 || ctx.shapeIndex.has("services")) this.addPattern(ctx, "Service Dependencies");
+  }
+  /**
+   * Match one signature requirement against one document. The lookup is on the
+   * DOCUMENT-RELATIVE path in `documentShapes`, which is what makes two things true at
+   * once: it is O(1) per requirement rather than a scan of the file's shapes, and
+   * `version` can only match the key `version` at the document's top level — never
+   * `nested.version`. A suffix comparison alone is exactly what let the previous
+   * detector fire on a key at any depth, so the exactness is the point, not a detail.
+   */
+  matchRequirement(requirement, filePath, ctx) {
+    if (requirement.pathHint && !filePath.includes(requirement.pathHint)) return null;
+    for (const [document, shapes] of ctx.documentShapes) {
+      const shape = shapes.get(requirement.path);
+      if (shape === void 0) continue;
+      if (requirement.shape === "any" || shape === requirement.shape) return `${document}.${requirement.path}`;
+    }
+    return null;
+  }
+  // --------------------------------------------------------------- security
+  /**
+   * Sensitivity is structural, from two signals only: the key node's own text is a
+   * known sensitive spelling, or the document's `kind` is `Secret`. No value text is
+   * read, so `"^\d+$"` cannot be mistaken for a secret and `password: hunter2`
+   * cannot be missed.
+   */
+  applySecurityScore(ctx) {
+    let score = 100;
+    let sensitiveCount = 0;
+    for (const symbol of ctx.symbols) if (symbol.metadata?.isSensitive === true) sensitiveCount++;
+    if (sensitiveCount > 0) {
+      score -= Math.min(40, sensitiveCount * 4);
+      this.addPattern(ctx, "Sensitive Values");
+    }
+    if (ctx.sensitiveDocuments.size > 0) score -= Math.min(25, ctx.sensitiveDocuments.size * 10);
+    ctx.metadata.securityScore = Math.max(0, score);
+    ctx.metadata.sensitiveValueCount = sensitiveCount;
+  }
+  // -------------------------------------------------------------- utilities
+  /**
+   * Matrix 1b `apiContractPath`, only for the two shapes that genuinely ARE a
+   * contract: an OpenAPI operation, and a GitHub Actions job step. A YAML key is not
+   * an API surface, so the field stays absent everywhere else rather than carrying a
+   * constant.
+   */
+  assignApiContractPath(symbol) {
+    const path = String(symbol.qualifiedName ?? symbol.id);
+    const segments = path.split(".");
+    const last = segments[segments.length - 1] ?? "";
+    const pathsAt = segments.lastIndexOf("paths");
+    if (pathsAt >= 0 && OPENAPI_METHODS.has(last.toLowerCase()) && segments.length === pathsAt + 3) {
+      symbol.apiContractPath = `${last.toUpperCase()} ${segments[pathsAt + 1]}`;
+      return;
+    }
+    if (symbol.metadata?.isArrayItem === true && last.startsWith("steps[") && segments.length >= 3) {
+      symbol.apiContractPath = `github-actions:${segments[segments.length - 2]}#${String(symbol.metadata.arrayIndex)}`;
+    }
+  }
+  createSymbol(name, kind, node, parent, parentPath, ctx, metadata, qualifiedName) {
+    const qualified = qualifiedName || (parentPath ? `${parentPath}.${name}` : name);
+    const symbol = {
+      id: qualified,
+      name,
+      kind,
+      qualifiedName: qualified,
+      ownerName: parent ? parent.qualifiedName || parent.id || parent.name : void 0,
+      ownerKind: parent?.kind,
+      scope: parent ? parent.qualifiedName || parent.id || parent.name : void 0,
+      parentId: parent?.id,
+      visibility: "public",
+      range: this.nodeToRange(node),
+      metadata
+    };
+    symbol.complexity = 1;
+    ctx.symbols.push(symbol);
+    if (parent) {
+      const role = metadata.isAnchor ? "yaml_anchor" : metadata.isArrayItem ? "yaml_sequence_item" : metadata.recovered ? "yaml_recovered_member" : "yaml_mapping_key";
+      this.addRelationship(ctx, parent.qualifiedName || parent.id || parent.name, qualified, ASTEngine.RelationshipType.Contains, {
+        role,
+        fullPath: qualified
+      }, node.startPosition.row + 1);
+    }
+    return symbol;
+  }
+  /**
+   * Every relationship is emitted here, so two things are guaranteed for all of them
+   * without an emission site being able to forget either:
+   *
+   *  - `line_number` is a TOP-LEVEL field, 1-based, on the name-bearing node. It is
+   *    deliberately not inside `metadata`: the store binds the `line_number` COLUMN
+   *    from `rel.line_number` (src/ast/parallel-indexer.ts:2870), so a value parked in
+   *    metadata would reach the index as NULL and the whole navigation payload would
+   *    die silently at the seam. That is the M60 P1 rot-check's exact failure mode.
+   *  - `metadata.evidenceClass` is set from the relationship type.
+   *
+   * A sub-1.0 confidence always carries a machine-readable reason (M14 §4).
+   */
+  addRelationship(ctx, source, target, type, metadata, line, confidence, reasonCode) {
+    if (!source || !target) return;
+    const key = `${source}\0${type}\0${target}`;
+    if (ctx.relationshipKeys.has(key)) return;
+    ctx.relationshipKeys.add(key);
+    const conf = confidence ?? 1;
+    const md = { ...metadata };
+    if (conf < 1) md.confidenceReason = reasonCode ?? metadata.unresolvedReason ?? "heuristic-edge";
+    const relationship = { source, target, type, confidence: conf, metadata: md };
+    if (typeof line === "number" && line >= 1) relationship.line_number = line;
+    ctx.relationships.push(relationship);
+  }
+  /**
+   * WHICH SCALARS AN INCLUDE KEY ACTUALLY NAMES — the fix for the over-emission.
+   *
+   * `scalarValues` recurses into a mapping and returns every nested VALUE scalar, which is right
+   * for a bag of names and wrong for these keys: one
+   * `- import_role: {name: role1, tasks_from: x.yml, allow_duplicates: true}` published the role
+   * name, its sub-file and a BOOLEAN as three imports of this file. MEASURED over the whole
+   * admitted ansible population by attributing every include edge to the key on its own
+   * `line_number`: of 891 `imports` edges carrying `yaml_keyword_include`, only **567** came from
+   * a key that names a file at all — 149 from a nested `name:`, 45 from `tasks_from:`, 18 from
+   * `role_name:`, and 51 from keys a role import happens to contain (`hosts:`, `public:`,
+   * `gather_facts:`, `command:` …). The over-emission is not cosmetic: it is what put bare
+   * identifiers such as `a` (29 declarations), `c`, `foo` and `include_role` (123 declarations)
+   * into `imports`, where the arbiter can only read them as ambiguous.
+   *
+   * The rule now follows the key's meaning, which is the same thing the claim already follows:
+   *
+   *   a FILE key   `include_tasks`, `import_tasks`, `import_playbook`, `import_values`,
+   *                `include`, `import` — the file is the scalar value, or the `file:` sub-key
+   *                when the value is a mapping (ansible's documented long form).
+   *   a ROLE key   `include_role`, `import_role` — the value names a ROLE: its `name:`, or the
+   *                scalar shorthand. `tasks_from`/`vars_from`/`defaults_from`/`handlers_from`
+   *                name files inside a role DIRECTORY this analyzer does not resolve, so they are
+   *                not this file's imports, and a boolean is not a target at all.
+   */
+  fileImportTargets(key, valueNode, parentPath, document) {
+    if (ROLE_IMPORT_KEYS.has(key)) {
+      const named = this.mappingEntryScalar(valueNode, "name");
+      if (named !== null) return [named];
+      const inline = this.inlineRoleParams(valueNode);
+      if (inline !== null) return [inline.get("name")];
+      return this.scalarValues(valueNode).slice(0, 1);
+    }
+    if (key === "include" && parentPath !== document && isMatrixPathKey(parentPath)) return [];
+    const file = this.mappingEntryScalar(valueNode, "file");
+    if (file !== null) return [file];
+    const node = valueNode ? this.scalarNode(valueNode) : null;
+    if (node && MAPPING_TYPES.has(node.type)) return [];
+    if (node && SEQUENCE_TYPES.has(node.type)) {
+      const out = [];
+      for (let i = 0; i < node.namedChildCount; i++) {
+        const item = node.namedChild(i);
+        if (!item) continue;
+        const unwrapped = item.type === "block_sequence_item" ? this.firstNonDecorationChild(item) : item;
+        const scalar = unwrapped ? this.scalarNode(unwrapped) : null;
+        if (!scalar || !SCALAR_TYPES.has(scalar.type)) continue;
+        const text = this.scalarText(scalar);
+        if (text) out.push(text);
+      }
+      return out;
+    }
+    return this.scalarValues(valueNode);
+  }
+  addImport(ctx, target, importType, node, isExternal, lineOverride) {
+    if (!target) return;
+    if (ctx.imports.some((i) => i.module === target && i.importType === importType)) return;
+    ctx.imports.push({
+      module: target,
+      path: target,
+      importType,
+      isExternal,
+      isNamespace: false,
+      // `lineOverride` exists because one emission site has no node to read a position
+      // from — an action `uses:` is recorded in a pending list during the walk and
+      // resolved afterwards — and it was passing `undefined`, so 329 of this lane's 540
+      // corpus imports (every GitHub Actions `uses:`) reached the store with no line at
+      // all. The row is otherwise complete, which is the worst shape for a data loss:
+      // a count of imports looked perfectly healthy.
+      line_number: lineOverride ?? (node ? node.startPosition.row + 1 : void 0),
+      metadata: { yamlSpecific: true, evidenceClass: "import_based" }
+    });
+  }
+  /**
+   * M14 Matrix 1d: every edge states its epistemic status. Set centrally so an
+   * emission site cannot forget it, and it runs after every relationship exists.
+   */
+  classifyEvidenceTier(ctx) {
+    for (const r of ctx.relationships) {
+      const md = r.metadata ?? (r.metadata = {});
+      if (md.evidenceClass) continue;
+      const t = String(r.type ?? "");
+      if (t === "contains" || t === "exports") {
+        md.evidenceClass = "structural";
+        continue;
+      }
+      if (t === "imports") {
+        md.evidenceClass = "import_based";
+        continue;
+      }
+      if (t === "references") {
+        if (md.relationshipType === "declared_type" || md.relationshipType === "yaml_json_pointer") {
+          md.evidenceClass = "reference_qualified";
+          continue;
+        }
+        md.evidenceClass = md.resolved === false ? "inferred" : "usage_contextual";
+        continue;
+      }
+      if (t === "extends" || t === "implements" || t === "overrides") {
+        const conf = typeof r.confidence === "number" ? r.confidence : 1;
+        md.evidenceClass = conf >= 1 ? "structural" : conf >= 0.85 ? "usage_contextual" : "inferred";
+        continue;
+      }
+      if (t === "instantiates") {
+        md.evidenceClass = "structural";
+        continue;
+      }
+      if (t === "calls") {
+        md.evidenceClass = md.relationshipType === "yaml_workflow_call" ? "structural" : "inferred";
+        continue;
+      }
+      md.evidenceClass = "usage_contextual";
+    }
+  }
+  addPattern(ctx, pattern) {
+    const patterns = ctx.metadata.patterns;
+    if (!patterns.includes(pattern)) patterns.push(pattern);
+  }
+  // ------------------------------------------------------------ value typing
+  /**
+   * The resolved shape of a value, over a CLOSED vocabulary. A node the analyzer does
+   * not classify is `untyped` — YAML's own name for a plain scalar with no tag — and
+   * never a placeholder string. The previous implementation returned the literal
+   * `"unknown"`, which the M60 R7 sentinel census records as a violation.
+   */
+  valueType(node) {
+    if (!node) return "null";
+    if (MAPPING_TYPES.has(node.type)) return "object";
+    if (SEQUENCE_TYPES.has(node.type)) return "array";
+    if (node.type === "alias") return "alias";
+    if (node.type === "anchor") return "anchor";
+    if (SEQUENCE_ITEM_TYPES.has(node.type)) {
+      const first = this.firstNamedChild(node);
+      return first ? this.valueType(first) : "untyped";
+    }
+    if (WRAPPER_TYPES.has(node.type)) {
+      for (let i = 0; i < node.namedChildCount; i++) {
+        const nested = this.valueType(node.namedChild(i));
+        if (nested === "object" || nested === "array") return nested;
+      }
+      for (let i = 0; i < node.namedChildCount; i++) {
+        const child = node.namedChild(i);
+        if (!child || child.type === "tag" || child.type === "anchor") continue;
+        const nested = this.valueType(child);
+        if (nested !== "untyped") return nested;
+      }
+      return "untyped";
+    }
+    switch (node.type) {
+      case "integer_scalar":
+        return "integer";
+      case "float_scalar":
+        return "float";
+      case "boolean_scalar":
+        return "boolean";
+      case "null_scalar":
+        return "null";
+      // The core schema resolves a plain scalar by which typed child it carries.
+      case "timestamp_scalar":
+        return "timestamp";
+      case "plain_scalar":
+        for (let i = 0; i < node.namedChildCount; i++) {
+          const nested = this.valueType(node.namedChild(i));
+          if (nested !== "untyped") return nested;
+        }
+        return "untyped";
+      case "string_scalar":
+      case "single_quote_scalar":
+      case "double_quote_scalar":
+      case "block_scalar":
+      case "string":
+        return "string";
+      default:
+        for (let i = 0; i < node.namedChildCount; i++) {
+          const nested = this.valueType(node.namedChild(i));
+          if (nested !== "untyped") return nested;
+        }
+        return RESOLVED_VALUE_VOCABULARY.has(node.type) ? node.type : "untyped";
+    }
+  }
+  /**
+   * A tag on a value, parsed into what a consumer needs: the short name (what a
+   * `declared_type` edge targets), the resolved URI (what a `%TAG` handle expands to),
+   * the type the tag forces, and the file an include-family tag names. The tag node
+   * carries its own text and range, so nothing here scans the value.
+   */
+  tagOf(node, ctx) {
+    if (!node) return null;
+    let tagNode = null;
+    if (node.type === "tag") tagNode = node;
+    else {
+      for (let i = 0; i < node.namedChildCount; i++) {
+        const child = node.namedChild(i);
+        if (child?.type === "tag") {
+          tagNode = child;
+          break;
+        }
+      }
+    }
+    if (!tagNode) return null;
+    const parsed = this.parseTag(tagNode.text, ctx);
+    if (!parsed) return null;
+    const shortName = parsed.shortName;
+    let includePath;
+    let includeQuoted = false;
+    if (INCLUDE_TAGS.has(shortName)) {
+      const sibling = this.firstNonDecorationChild(node);
+      if (sibling) {
+        const text = this.scalarText(sibling);
+        if (looksLikePath(text, QUOTED_SCALAR_TYPES.has(sibling.type))) {
+          includePath = text;
+          includeQuoted = QUOTED_SCALAR_TYPES.has(sibling.type);
+        }
+      }
+    }
+    return { shortName, uri: parsed.uri, typeOverride: TAG_TYPE_OVERRIDES[shortName], includePath, includeQuoted, line: tagNode.startPosition.row + 1 };
+  }
+  /**
+   * THE TYPE NAME A TAG DECLARES, or undefined when the tag declares no type at all.
+   *
+   * An include-family tag names a FILE — `functions: !include "s1/functions/functions.yaml"` is an
+   * import and nothing else. Reading its short name as the name of a TYPE (which is what a
+   * `declared_type` edge says) was a category error the arbiter could see: the edges targeted the
+   * literal string `include`, which collides with ordinary keys spelled `include`, so ten of them
+   * were reported AMBIGUOUS against three unrelated declarations. The `includePath` marker is the
+   * same fact, but it is only set when the value was readable as a path, and a tag whose path the
+   * lane refuses still does not name a type — so the test is the tag's own membership in the closed
+   * include set, not the presence of a readable path.
+   *
+   * One definition, read at every `declared_type` site, so a new site cannot reintroduce the error.
+   */
+  tagTypeName(tag) {
+    if (!tag || INCLUDE_TAGS.has(tag.shortName)) return void 0;
+    return tag.shortName;
+  }
+  /**
+   * Tag text to (short name, URI), by index arithmetic alone. Four shapes:
+   *   `!<tag:example.com,2000:str>`  verbatim -> uri is the body, short is after the last ':'
+   *   `!!str`                        local    -> tag:yaml.org,2002:str, short `str`
+   *   `!e!thing`                     named    -> handle `!e!` expands through the %TAG map
+   *   `!Foo`                         custom   -> uri is the name itself
+   */
+  parseTag(text, ctx) {
+    if (text.length < 2 || text[0] !== "!") return null;
+    if (text.startsWith("!<") && text.endsWith(">")) {
+      const uri = text.slice(2, -1);
+      const colon = uri.lastIndexOf(":");
+      return { uri, shortName: colon >= 0 ? uri.slice(colon + 1) : uri };
+    }
+    const body = text.slice(1);
+    const bang = body.indexOf("!");
+    if (bang >= 0) {
+      const handle = `!${body.slice(0, bang + 1)}`;
+      const suffix = body.slice(bang + 1);
+      const prefix = handle === "!!" ? YAML_CORE_PREFIX : ctx.tagHandles.get(handle);
+      return { uri: prefix ? `${prefix}${suffix}` : `${handle}${suffix}`, shortName: suffix };
+    }
+    if (body.startsWith("!")) {
+      const short = body.slice(1);
+      return { uri: `${YAML_CORE_PREFIX}${short}`, shortName: short };
+    }
+    return { uri: body, shortName: body };
+  }
+  // ------------------------------------------------------------- node access
+  mappingKeyNode(node) {
+    const field = node.childForFieldName("key");
+    if (field) return this.scalarNode(field);
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const child = node.namedChild(i);
+      if (child && this.isScalarLike(child)) return this.scalarNode(child);
+    }
+    return null;
+  }
+  mappingValueNode(node) {
+    const field = node.childForFieldName("value");
+    if (field) return field;
+    if (node.namedChildCount > 1) return node.namedChild(node.namedChildCount - 1);
+    return null;
+  }
+  scalarNode(node) {
+    let current = node;
+    while (WRAPPER_TYPES.has(current.type) && current.namedChildCount > 0) {
+      const next = this.firstNonDecorationChild(current);
+      if (!next) break;
+      current = next;
+    }
+    return current;
+  }
+  firstNonDecorationChild(node) {
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const child = node.namedChild(i);
+      if (child && child.type !== "tag" && child.type !== "anchor" && child.type !== "anchor_name") return child;
+    }
+    return null;
+  }
+  /**
+   * THE TEXT OF A SCALAR VALUE, with a BLOCK SCALAR's indicator stripped.
+   *
+   * `scalarText` reads a node's own text, and a `block_scalar`'s own text starts with the block
+   * INDICATOR — `>` for a folded scalar, `|` for a literal one — with the content after it. The
+   * indicator is not part of the value, so a scalar read as raw text carries `>` into the name.
+   *
+   * THIS IS THE SAME DEFECT THE `include_vars` FIX HAD, IN A SECOND SITE: the include-family path
+   * was corrected and the `extends:` key family was left reading raw text, so `extends: >` would
+   * have published the target ">\n  default" — a name that is a folded YAML scalar, not a config
+   * name. ONE reader for both sites, so the second one cannot drift.
+   */
+  scalarValueText(node) {
+    return this.blockScalarValue(node) ?? this.scalarText(node);
+  }
+  /**
+   * THE SHAPE-GREP, APPLIED TO THIS FILE — AND IT FOUND TWO MORE SITES.
+   *
+   * The fleet's rule is that a defect found once in a SHAPE is a defect in every site of that shape,
+   * and that the fix is to GREP THE SHAPE, not the site. The block-scalar shape was found in the
+   * include-family path and then in the `extends:` family — two sites, two fixes — and the grep of
+   * the shape (`SCALAR_TYPES` CONTAINS `block_scalar`, so any site that reads a scalar's own text
+   * can receive a block scalar) found two MORE: the RESOURCE-REFERENCE path
+   * (`RESOURCE_REF_SCALARS` ⇒ `yaml_resource_ref`) and the reference-WRAPPER path
+   * (`wrapperRefNames`). Both read `scalarText` on a node that `SCALAR_TYPES` admits, and both
+   * would have published a name carrying the indicator.
+   *
+   * ⇒ ⇒ ⇒ THE FIX IS AT THE READER, NOT AT THE SITES: `scalarText` itself now reads a block
+   * scalar's CONTENT, so every one of the eighteen call sites is fixed by construction and a
+   * future site cannot drift. THE SHAPE WAS ONE LINE LONG; IT WAS IN FOUR PLACES.
+   */
+  scalarText(node) {
+    const inner = this.scalarNode(node);
+    const value = (this.blockScalarValue(inner) ?? inner.text).trim();
+    if (value.length >= 2) {
+      const first = value[0];
+      const last = value[value.length - 1];
+      if ((first === '"' || first === "'") && first === last) return value.slice(1, -1);
+    }
+    return value;
+  }
+  /**
+   * THE VALUE OF A BLOCK SCALAR, or null when the node is not one.
+   *
+   * A `block_scalar` node's own text starts with the block INDICATOR on its first line — `>` for
+   * a folded scalar, `|` for a literal one, with any chomping and indentation modifiers attached
+   * — and the CONTENT follows. The indicator is not part of the value, so a scalar read as raw
+   * text carries `>` into the name.
+   *
+   * MEASURED over the whole corpus: the only include-family value in the admitted population
+   * written this way is `include_vars: >` in
+   * `ansible/test/integration/targets/include_vars/tasks/main.yml:192`, whose value names the
+   * vars file `services/service_vars.yml`. Read as raw text the import target was the string
+   * `>\n    services/service_vars.yml` — a name no project has, so the edge could carry no file
+   * claim and a reader could not tell what was imported.
+   *
+   * THE FOLDING IS DONE AS YAML DEFINES IT, AND THE LIMIT IS STATED: `>` folds the content's
+   * line breaks into spaces and `|` keeps them, and the block's indentation (the DEEPEST
+   * indentation in the block) is stripped from every line. A chomping modifier is not applied,
+   * because a chomped block's trailing newlines are not part of a file name in any spelling this
+   * lane reads, and the caller trims what it is given.
+   */
+  blockScalarValue(node) {
+    if (node.type !== "block_scalar") return null;
+    const raw = node.text;
+    const nl = raw.indexOf("\n");
+    if (nl < 0) return null;
+    const indicator = raw.slice(0, nl).trim();
+    const folded = indicator.startsWith(">");
+    const body = raw.slice(nl + 1);
+    const lines = body.split("\n");
+    let indent = Number.POSITIVE_INFINITY;
+    for (const l of lines) {
+      if (l.trim() === "") continue;
+      indent = Math.min(indent, l.length - l.trimStart().length);
+    }
+    if (!Number.isFinite(indent)) return "";
+    const content = lines.map((l) => l.slice(indent)).filter((l) => l.trim() !== "");
+    return (folded ? content.join(" ") : content.join("\n")).trim();
+  }
+  /**
+   * The names a reference WRAPPER holds: the scalar shorthand (`configMapRef: cm`) or
+   * the `name` field of its payload. Never a walk — see `RESOURCE_REF_SOURCES` for the
+   * shape this deliberately does not serve.
+   */
+  wrapperRefNames(node) {
+    if (!node) return [];
+    const direct = this.scalarNode(node);
+    if (direct && SCALAR_TYPES.has(direct.type)) {
+      const text = this.scalarText(direct);
+      return text ? [text] : [];
+    }
+    const named = this.mappingEntryScalar(node, "name");
+    return named ? [named] : [];
+  }
+  /**
+   * The scalar VALUE of one named entry of a mapping payload, or null when the node is
+   * not a mapping, the entry is absent, or its value is itself a mapping or sequence.
+   * Keys are read through the grammar's own `key` field, so a quoted key
+   * (`"name": cm`) and a plain one match identically.
+   */
+  mappingEntryScalar(node, keyName) {
+    if (!node) return null;
+    let mapping = this.scalarNode(node);
+    if (!MAPPING_TYPES.has(mapping.type)) {
+      mapping = this.firstNonDecorationChild(node);
+      if (!mapping || !MAPPING_TYPES.has(mapping.type)) return null;
+    }
+    for (let i = 0; i < mapping.namedChildCount; i++) {
+      const pair = mapping.namedChild(i);
+      if (!pair || !MAPPING_PAIR_TYPES.has(pair.type)) continue;
+      const keyNode = pair.childForFieldName("key") || this.firstNonDecorationChild(pair);
+      if (!keyNode || this.scalarText(keyNode) !== keyName) continue;
+      const value = this.mappingValueNode(pair);
+      if (!value) return null;
+      const scalar = this.scalarNode(value);
+      if (!SCALAR_TYPES.has(scalar.type)) return null;
+      const text = this.scalarValueText(scalar);
+      return text || null;
+    }
+    return null;
+  }
+  /**
+   * Every scalar VALUE under a node, in order — used for the lists `depends_on` and
+   * the `*Ref` objects hold. Mapping KEYS are skipped via the grammar's own `key`
+   * field, because `configMapRef: { name: cm }` must yield `cm` and not `name`: a
+   * descendant walk without that skip returns both, and the first one emitted is the
+   * key.
+   */
+  scalarValues(node) {
+    if (!node) return [];
+    const out = [];
+    const collect = (n, isKey) => {
+      if (n.type === "tag") return;
+      if (MAPPING_PAIR_TYPES.has(n.type)) {
+        const value = n.childForFieldName("value") || this.mappingValueNode(n);
+        if (value) collect(this.scalarNode(value), false);
+        return;
+      }
+      if (SCALAR_TYPES.has(n.type)) {
+        if (isKey) return;
+        const text = n.type === "block_scalar" ? this.blockScalarValue(n) ?? "" : this.scalarText(n);
+        if (text) out.push(text);
+        return;
+      }
+      for (let i = 0; i < n.namedChildCount; i++) {
+        const child = n.namedChild(i);
+        if (child) collect(child, false);
+      }
+    };
+    collect(this.scalarNode(node), false);
+    return out;
+  }
+  /** A top-level scalar of a document, by dotted key path (`kind`, `metadata.name`). */
+  topLevelScalar(document, keyPath) {
+    const parts = keyPath.split(".");
+    let mapping = null;
+    for (let i = 0; i < document.namedChildCount; i++) {
+      const child = document.namedChild(i);
+      if (!child) continue;
+      if (MAPPING_TYPES.has(child.type)) {
+        mapping = child;
+        break;
+      }
+      if (child.type === "block_node") {
+        for (let j = 0; j < child.namedChildCount; j++) {
+          const inner = child.namedChild(j);
+          if (inner && MAPPING_TYPES.has(inner.type)) {
+            mapping = inner;
+            break;
+          }
+        }
+        if (mapping) break;
+      }
+    }
+    if (!mapping) return null;
+    return this.scalarAtPath(mapping, parts);
+  }
+  topLevelScalarFromMapping(document, outer, inner) {
+    return this.topLevelScalar(document, `${outer}.${inner}`);
+  }
+  scalarAtPath(mapping, parts) {
+    let current = mapping;
+    for (let i = 0; i < parts.length; i++) {
+      const part = parts[i];
+      const isLast = i === parts.length - 1;
+      let next = null;
+      for (let j = 0; j < current.namedChildCount; j++) {
+        const child = current.namedChild(j);
+        if (!child || !MAPPING_PAIR_TYPES.has(child.type)) continue;
+        const keyNode = this.mappingKeyNode(child);
+        if (!keyNode || this.scalarText(keyNode) !== part) continue;
+        next = this.mappingValueNode(child);
+        break;
+      }
+      if (!next) return null;
+      current = WRAPPER_TYPES.has(next.type) ? this.scalarNode(next) : next;
+      if (isLast) {
+        if (MAPPING_TYPES.has(current.type) || SEQUENCE_TYPES.has(current.type)) return null;
+        const text = this.scalarText(current);
+        return text || null;
+      }
+      if (!MAPPING_TYPES.has(current.type)) return null;
+    }
+    return null;
+  }
+  isScalarLike(node) {
+    return SCALAR_TYPES.has(node.type) || WRAPPER_TYPES.has(node.type);
+  }
+  isJsonPointer(value) {
+    return value.length > 2 && value.startsWith("#/") && !value.includes(" ");
+  }
+  firstNamedChild(node) {
+    return node.namedChildCount > 0 ? node.namedChild(0) : null;
+  }
+  findNamedChild(node, type) {
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const child = node.namedChild(i);
+      if (child?.type === type) return child;
+    }
+    return null;
+  }
+  pushChildren(stack, node, context) {
+    for (let i = node.namedChildCount - 1; i >= 0; i--) {
+      const child = node.namedChild(i);
+      if (child) stack.push({ node: child, context: { ...context, depth: context.depth + 1 } });
+    }
+  }
+  pushMappingChildren(stack, node, context, ctx) {
+    for (let i = node.namedChildCount - 1; i >= 0; i--) {
+      const child = node.namedChild(i);
+      if (!child) continue;
+      if (MAPPING_PAIR_TYPES.has(child.type)) {
+        stack.push({ node: child, context: { ...context, depth: context.depth + 1 } });
+        continue;
+      }
+      if (child.type === "comment") continue;
+      if (this.tagIn(child, ctx)) {
+        const tag = this.tagOf(child, ctx);
+        const owner = context.parent?.qualifiedName || context.parent?.id || context.document;
+        this.emitTagSemantics(owner, tag, child, child.startPosition.row + 1, ctx);
+        if (tag.typeOverride && context.parent && context.parent.metadata) {
+          context.parent.metadata = {
+            ...context.parent.metadata,
+            declaredType: this.tagTypeName(tag),
+            tagUri: tag.uri,
+            tagLine: tag.line
+          };
+        }
+      }
+    }
+  }
+  /** Whether a node carries a tag, looking through one level of wrapper. */
+  tagIn(node, ctx) {
+    void ctx;
+    if (node.type === "tag") return true;
+    if (!WRAPPER_TYPES.has(node.type)) return false;
+    for (let i = 0; i < node.namedChildCount; i++) {
+      if (node.namedChild(i)?.type === "tag") return true;
+    }
+    return false;
+  }
+  /**
+   * A duplicate mapping key is invalid YAML that tree-sitter recovers. Two symbols
+   * sharing one id makes every relationship endpoint ambiguous, because the graph
+   * resolves endpoints by qualified name while the store's own primary key includes
+   * the start line. Later occurrences are therefore disambiguated and the collision
+   * is recorded rather than tolerated.
+   */
+  uniquePath(parentPath, document, key, isDuplicate, ctx) {
+    const base = parentPath ? `${parentPath}.${key}` : key;
+    if (!isDuplicate) return base;
+    const counterKey = `${document}\0${base}`;
+    const n = (ctx.duplicateCounters.get(counterKey) ?? 0) + 1;
+    ctx.duplicateCounters.set(counterKey, n);
+    return `${base}#${n + 1}`;
+  }
+  escapePointer(segment) {
+    return segment.split("~").join("~0").split("/").join("~1");
+  }
+  /**
+   * A symbol's own review cost: how many keys or items it directly holds. O(children)
+   * once per symbol, therefore O(n) across the file. The previous file-level
+   * `configurationComplexity = visitedNodes` said nothing about any individual node,
+   * and no symbol carried a complexity at all.
+   */
+  nodeComplexity(valueNode, valueType) {
+    if (!valueNode) return 1;
+    const node = this.scalarNode(valueNode);
+    if (valueType === "object") {
+      let count = 0;
+      for (let i = 0; i < node.namedChildCount; i++) {
+        const child = node.namedChild(i);
+        if (child && MAPPING_PAIR_TYPES.has(child.type)) count++;
+      }
+      return Math.max(1, count);
+    }
+    if (valueType === "array") {
+      let count = 0;
+      for (let i = 0; i < node.namedChildCount; i++) {
+        const child = node.namedChild(i);
+        if (child && (SEQUENCE_ITEM_TYPES.has(child.type) || child.type === "flow_node")) count++;
+      }
+      return Math.max(1, count);
+    }
+    return 1;
+  }
+  /**
+   * A document's PROJECT-RELATIVE directory chain, dot-joined, or "" when it cannot be known.
+   *
+   * Dot-joined rather than slash-joined on purpose: everything downstream treats a dotted
+   * string as a path (`Schema.X.properties`, `spec.containers[0]`), so a slash here would
+   * introduce a second, undeclared convention into the same key space.
+   *
+   * Empty when the root is unknown OR the file does not sit under it (a relative filePath
+   * against an absolute root, which is how several callers run). Refusing to guess is the
+   * point: a WRONG scope is worse than no scope, because the scope's whole job is to be the
+   * part of the identity that cannot collide.
+   */
+  static documentDirScope(filePath, projectRoot) {
+    const rel = _RealYamlAnalyzer.projectRelativePath(filePath, projectRoot);
+    if (rel === null) return "";
+    const cut = rel.lastIndexOf("/");
+    if (cut < 0) return "";
+    return rel.slice(0, cut).split("/").filter((s) => s.length > 0).join(".");
+  }
+  /**
+   * A filesystem path in the POSIX convention this analyzer's key space uses: every `\` becomes
+   * `/`, and TRAILING separators are dropped.
+   *
+   * WHY THIS IS A CHARACTER WALK AND NOT TWO `replace` CALLS. The two substitutions it replaces
+   * were `replace(/\\/g, "/")` followed by `replace(/\/+$/, "")` — two regex literals on each of
+   * two lines, i.e. four of the twelve regex usages the fleet's no-regex gate counted on this
+   * lane. The rule is mechanically enforced on ANALYZER source, so the walk is the form that keeps
+   * the gate's statement TRUE rather than waived. This is a predicate about a string the SOURCE
+   * wrote, not a node type the grammar never emits — the distinction the fsharp lane's fix
+   * (b3623467b) draws.
+   *
+   * THE ORDER IS LOAD-BEARING and is preserved exactly. Backslashes fold to `/` FIRST, so a path
+   * ending in `\` is still stripped by the trailing-separator pass; stripping first would leave the
+   * backslash and produce a key with a trailing `\` in it. Semantics are otherwise identical,
+   * including the degenerate cases: `""` stays `""`, and a string of nothing but separators
+   * (`"/"`, `"///"`) becomes `""` because the second pass removes every one of them.
+   */
+  static toPosixPath(p) {
+    let out = "";
+    for (let i = 0; i < p.length; i++) {
+      const ch = p[i];
+      out += ch === "\\" ? "/" : ch;
+    }
+    let end = out.length;
+    while (end > 0 && out[end - 1] === "/") end--;
+    return out.slice(0, end);
+  }
+  /** The file's own path relative to its project root, POSIX-normalised, or null when unknown. */
+  static projectRelativePath(filePath, projectRoot) {
+    if (!projectRoot) return null;
+    const root = _RealYamlAnalyzer.toPosixPath(projectRoot);
+    const file = _RealYamlAnalyzer.toPosixPath(filePath);
+    if (root.length === 0 || file === root || !file.startsWith(root + "/")) return null;
+    return file.slice(root.length + 1);
+  }
+  /** Collapse `.`, `..` and duplicate separators; null when the path escapes its root. */
+  static normalizePosix(p) {
+    const parts = [];
+    for (const seg of p.split("/")) {
+      if (seg.length === 0 || seg === ".") continue;
+      if (seg === "..") {
+        if (parts.length === 0) return null;
+        parts.pop();
+        continue;
+      }
+      parts.push(seg);
+    }
+    return parts.length > 0 ? parts.join("/") : null;
+  }
+  /**
+   * THE CANDIDATE SPELLINGS a tag include could name INSIDE this project.
+   *
+   * A `!include` path is resolved by the LOADER, and the corpus runs two live conventions — Hasura
+   * resolves it against the including FILE's directory (`metadata/databases/databases.yaml`
+   * includes `s1/functions/functions.yaml`, and that file exists beside it), while pyyaml-include's
+   * test data resolves it against the REPO ROOT (`tests/data/0.yaml` includes
+   * `tests/data/include.d/1.yaml`). Both were read off the corpus, not guessed, and an analyzer
+   * cannot know which loader will read the file. So it states both candidate spellings and the
+   * ARBITER decides: the gate's file claim verifies when any candidate is an admitted file of the
+   * project (script/m14/incoming-rule.ts, `FILE_CLAIM_KEY`), and is REFUTED when none is.
+   *
+   * Null means "no claim can be made", and it is returned rather than an empty list so the caller
+   * keeps the weaker `isExternal` marker it used before: a URL include, or a file whose project
+   * root this run does not know (every fixture that passes no root), is exactly the case where the
+   * candidate set would be a fabrication.
+   *
+   * AND A SPELLING THAT IS NOT A PATH AT ALL GETS NO CANDIDATE EITHER, which is the guard
+   * `isLiteralPathSpelling` adds. Measured on the ansible population before it existed: a
+   * templated include (`'{{ service_type }}_cleanup.yml'`, 6 sites) and an ansible free-form
+   * `include_tasks: file=x.yml` (5 sites) both used to walk straight into a candidate set, and a
+   * candidate containing `{{ }}` can never be an admitted file — so the arbiter would have
+   * REFUTED the lane on 11 edges whose target was never a literal path. A claim has to be spelled
+   * as the thing it claims before a lookup can say anything about it, which is also why the
+   * gate's own `verifyRemoteRefClaim` refuses shapes it cannot read.
+   */
+  relativePathCandidates(written, ctx, quoted = false) {
+    if (!_RealYamlAnalyzer.isLiteralPathSpelling(written, quoted)) return null;
+    const rel = _RealYamlAnalyzer.projectRelativePath(ctx.filePath, ctx.projectRoot);
+    if (rel === null) return null;
+    const cut = rel.lastIndexOf("/");
+    const dir = cut >= 0 ? rel.slice(0, cut) : "";
+    const trimmed = written.startsWith("./") ? written.slice(2) : written;
+    const rooted = trimmed.startsWith("/");
+    const out = [];
+    const add = (p) => {
+      const n = _RealYamlAnalyzer.normalizePosix(p);
+      if (n !== null && !out.includes(n)) out.push(n);
+    };
+    add(rooted ? trimmed.slice(1) : dir.length > 0 ? `${dir}/${trimmed}` : trimmed);
+    if (!rooted) add(trimmed);
+    const base = rooted ? null : _RealYamlAnalyzer.roleSubdirBase(rel);
+    if (base !== null && base.length > 0) {
+      add(`${base}/tasks/${trimmed}`);
+      if (ROLE_SUBDIR_NAMES.has(trimmed.split("/")[0])) add(`${base}/${trimmed}`);
+    }
+    return out.length > 0 ? out : null;
+  }
+  /**
+   * THE ROLE ROOT of the file that is including something, or null when it is not inside a role.
+   *
+   * A role is a directory carrying `tasks/`, `handlers/`, `vars/`, `defaults/`, `meta/` — so the
+   * role root is the path BEFORE the LAST such segment. `roles/role1/handlers/main.yml` ->
+   * `roles/role1`; `roles/role1/tasks/sub/x.yml` -> `roles/role1`, which is what makes the
+   * fallback work for a nested task file too.
+   */
+  static roleSubdirBase(rel) {
+    const segs = rel.split("/");
+    segs.pop();
+    for (let i = segs.length - 1; i >= 0; i--) {
+      if (!ROLE_SUBDIR_NAMES.has(segs[i])) continue;
+      return segs.slice(0, i).join("/");
+    }
+    return null;
+  }
+  /**
+   * The claim a tag-include import carries. The file claim when the candidates are known (the
+   * project's own file list can confirm it), and the older `isExternal` marker otherwise — never
+   * both, because the rule routes the file claim first and an edge carrying both would be excused
+   * by the weaker one (`incoming-rule.ts`'s control plants exactly that pairing).
+   */
+  tagIncludeClaim(includePath, ctx, quoted = false) {
+    const candidates = this.relativePathCandidates(includePath, ctx, quoted);
+    return candidates !== null && this.projectCarriesFile(ctx, candidates) ? { importProjectFile: candidates } : { isExternal: true };
+  }
+  /**
+   * DOES THE PROJECT ACTUALLY CARRY ONE OF THESE CANDIDATES? A STAT, not a read.
+   *
+   * THE RULE, and it is now the same rule in json, toml and yaml: **a file claim is made only
+   * where the analyzer has evidence for it.** `verifyFileClaim` returning `externalRefuted` on a
+   * miss is pinned by the gate's own positive control (arms 4 and 5), and that is right — a file
+   * claim is a checkable statement and the check is its whole purpose. What was wrong was WHICH
+   * edges asserted it: 18 of them named paths this project does not have (a directory
+   * materialised at run time by a checkout step, a CodeQL query directory holding no yaml, files
+   * ansible's integration tests deliberately omit), and each one made a claim the analyzer had
+   * no evidence for. They now carry `isExternal` instead, which on a path-shaped target is
+   * `externalUnverified` — the honest outcome for a path the corpus does not contain — and the
+   * gate's rule is not weakened by one arm.
+   *
+   * Mirrors `real-json-analyzer.ts`'s `projectCarriesFile` exactly, including its two
+   * non-obvious decisions: this is a STAT and never a read (the lane's contract is that
+   * decisions come from the tree, and asking the filesystem whether a path exists asserts
+   * nothing about that file's contents), and an error that is NOT `ENOENT`/`ENOTDIR` counts as
+   * PRESENT, because "I could not look" must not be recorded as "it is not there".
+   */
+  projectCarriesFile(ctx, candidates) {
+    const root = ctx.projectRoot;
+    if (typeof root !== "string" || root.length === 0) return false;
+    for (const candidate of candidates) {
+      try {
+        if (statSync(join(root, candidate)).isFile()) return true;
+      } catch (e) {
+        if (!(e?.code === "ENOENT" || e?.code === "ENOTDIR")) return true;
+      }
+    }
+    return false;
+  }
+  /**
+   * THE CLAIM A `$ref` CARRIES — and for a cross-FILE pointer, `isExternal: true` was FALSE.
+   *
+   * `$ref` is spelled two ways and the difference is not cosmetic: `#/x` names a pointer into
+   * THIS document (nothing external about it), while `<file>#/x` names a pointer into ANOTHER
+   * DOCUMENT. The emit site stated `isExternal: !pointer.startsWith("#/")`, so the second shape
+   * claimed to be outside the declared population — and over the whole admitted population
+   * (18,364 `.yaml`/`.yml`, 189 repos) that claim is false **1,356 times**, every one of them in
+   * one repository's OpenAPI set:
+   *
+   *     references  "./Responses.OpenAPI.yaml#/400"                    681 edges (relative path)
+   *     references  "Shared.Components.OpenAPI.yaml#/components/…"     675 edges (bare sibling)
+   *
+   * `Grace/src/OpenAPI/Responses.OpenAPI.yaml` is an ADMITTED FILE of that project, and the
+   * arbiter said so: `pathLikeTarget` refuses to believe an "external" claim about a path, so all
+   * 1,356 read `externalUnverified` — the outcome that blocks a PASS. They were 71% of this lane's
+   * entire unverifiable population (`externalUnverified` 1,903).
+   *
+   * So the claim is the one the project can CHECK: the file part of the pointer, run through the
+   * same candidate builder and the same `statSync` evidence rule the `!include` sites use. The
+   * fragment is dropped — it addresses a position INSIDE the file, and a claim has to be spelled
+   * as the thing it claims before a lookup can say anything about it (the same reason
+   * `isLiteralPathSpelling` refuses a template). A pointer whose file this project does not carry
+   * (a URL, a runtime-materialised path, a `../` past the root, or a file that is genuinely
+   * absent) keeps the weaker `isExternal` marker, which on a path-shaped target is
+   * `externalUnverified` — the honest outcome, and the direction this fix cannot reverse.
+   *
+   * NOT CLAIMED: that the pointer RESOLVES. The target document is not indexed by this analyzer,
+   * so the edge still reports `unresolvedReason: "external-file"` (see
+   * `resolvePointerReferences`); what changed is that the file dependency it names is now a
+   * statement the project confirms instead of a false statement that it is outside the population.
+   */
+  pointerClaim(pointer, ctx) {
+    if (pointer.startsWith("#/")) return { isExternal: false };
+    const hash = pointer.indexOf("#");
+    const file = hash >= 0 ? pointer.slice(0, hash) : pointer;
+    if (file.length === 0) return { isExternal: false };
+    const candidates = this.relativePathCandidates(file, ctx);
+    return candidates !== null && this.projectCarriesFile(ctx, candidates) ? { importProjectFile: candidates } : { isExternal: true };
+  }
+  /**
+   * THE CLAIM A REUSABLE-WORKFLOW CALL CARRIES — a FILE, not an action DIRECTORY.
+   *
+   * `jobs.<id>.uses: ./.github/workflows/build.yml` calls a workflow declared in another FILE of
+   * this repository, and it was routed through `actionUseClaim`, which for a `./` target resolves
+   * the ACTION's manifest (`action.yml`/`action.yaml`) inside it. That rule is right for
+   * `steps[].uses: ./dir` and wrong here in the one way that matters: the target IS the file, so
+   * the manifest lookup asks for `./.github/workflows/build.yml/action.yml`, finds nothing, and
+   * the edge falls back to `isExternal: true` — a false statement about a file the project has.
+   * MEASURED over the whole admitted population: **208** `calls` edges, this lane's entire `calls`
+   * unverifiable population, every one of them an admitted `.yml`:
+   *
+   *     "./.github/workflows/reusable-get-go-version.yml"   11 edges (consul)
+   *     "./.github/workflows/build.yml"                     10 (consul, cython, …)
+   *     "./.github/workflows/ci-job.yml"                    10 (cython)
+   *
+   * The file claim is the statement the project can check, and the candidates are built the same
+   * way every other file claim in this lane is (`relativePathCandidates` + `projectCarriesFile`).
+   * A remote call keeps the reference claim, and a local one the project does not carry keeps
+   * `isExternal` — the same two directions as `pointerClaim` above.
+   */
+  workflowCallClaim(action, ctx) {
+    if (!action.startsWith("./") && !action.startsWith("../")) return this.actionUseClaim(action, ctx);
+    const candidates = this.relativePathCandidates(action, ctx);
+    if (candidates === null) return this.actionUseClaim(action, ctx);
+    return this.projectCarriesFile(ctx, candidates) ? { importProjectFile: candidates } : { isExternal: true };
+  }
+  /**
+   * IS THIS KEY, AT THIS POSITION, A DEPENDENCY? A KEY NAME IS NOT A POSITION.
+   *
+   * `DEPENDS_ON_KEYS` fires on `depends_on|dependsOn|needs|requires` at ANY depth, and the corpus
+   * contains the counter-example the sibling `uses:` site already guards against with
+   * `isJobLevelPath`: GitHub Actions admits an action INPUT named `needs`,
+   *
+   *     - uses: r-lib/actions/setup-r-dependencies@v2
+   *       with:
+   *         needs: check          <- an input, NOT a job dependency
+   *
+   * so the analyzer emitted a `yaml_depends_on` reference for a key that names no dependency.
+   * MEASURED over the whole admitted population — every `yaml_depends_on` edge grouped by the
+   * position it was emitted from (1,938 edges, 413 candidate files, `yaml-depends-position`):
+   *
+   *     jobs.<id>.needs            1,655   TRUE  (a job dependency)
+   *     services.<svc>.depends_on     74   mixed — see `dependencyTargets`
+   *     steps[].with.needs            48   FALSE (an action input: check 14, website 12, …)
+   *     Azure stages[].dependsOn      22   TRUE
+   *     CircleCI jobs[].requires      38   TRUE
+   *
+   * So `needs` is gated to `jobs.<id>` and nothing else is: `depends_on`/`dependsOn`/`requires` are
+   * the spellings of OTHER loaders (Compose, Azure Pipelines, CircleCI) whose containers this
+   * analyzer has no shape index for, and every measured position for them is a true dependency.
+   * The gate is the same predicate the `uses:` site uses, so one notion of "job level" governs both.
+   *
+   * The 46 of the 48 that read `externalVerified` are why this is a FIX and not a ruling: a false
+   * edge that RESOLVES is worse than one that does not, and these were sitting in the VERIFIED
+   * column as claims about `check`, `website`, `pr-document` and `coverage`.
+   */
+  /**
+   * Is this an `include:` that selects a SET rather than naming a file? See
+   * `INCLUDE_SELECTOR_PARENT_KEYS` for the measurement behind each parent.
+   *
+   * For `branches` the document's own top-level claim (`trigger:`/`pr:`) is required as well, and it
+   * is read from the shape index rather than from the text: the ancestor is always visited before
+   * its descendant, so the shape is already indexed when the `include` key is read — no second pass,
+   * no text scan.
+   */
+  isIncludeSelectorKey(key, current, ctx) {
+    if (key !== "include") return false;
+    const parentPath = current.parentPath ?? "";
+    const document = current.document;
+    let rest = parentPath;
+    if (rest === document) rest = "";
+    else if (rest.startsWith(`${document}.`)) rest = rest.slice(document.length + 1);
+    if (rest.length === 0) return false;
+    let selector = false;
+    let branches = false;
+    for (const seg of rest.split(".")) {
+      if (!INCLUDE_SELECTOR_SEGMENTS.has(seg)) continue;
+      selector = true;
+      if (seg === "branches") branches = true;
+    }
+    if (!selector) return false;
+    if (!branches) return true;
+    const shapes = ctx.documentShapes.get(document);
+    return shapes ? shapes.has("trigger") || shapes.has("pr") : false;
+  }
+  isDependencyPosition(key, current) {
+    if (key === "needs") return isJobLevelPath(current.parentPath, current.document);
+    return true;
+  }
+  /**
+   * WHICH NAMES A DEPENDENCY KEY NAMES, decided by the VALUE'S SHAPE.
+   *
+   * Compose's `depends_on` has two spellings, and they put the dependency name in different places:
+   *
+   *     depends_on: [db, cache]                  the names are the SEQUENCE ITEMS
+   *     depends_on:                              the names are the MAPPING KEYS
+   *       db:
+   *         condition: service_healthy           <- CONFIGURATION, not a name
+   *
+   * `scalarValues` walks a mapping's VALUES (it is built for payloads), so on the second form it
+   * returned the dependency's own settings — `service_healthy`, `service_started`,
+   * `service_completed_successfully` — and DROPPED the dependency. MEASURED over the whole admitted
+   * population: **31** such edges, all in `depends_on`, every one of them a false dependency on a
+   * condition string (22 `service_healthy`, 7 `service_started`, 2
+   * `service_completed_successfully`). The long form's keys are real services, so the fix ADDS the
+   * true edges while removing the false ones — and the delta is reported in BOTH directions.
+   *
+   * A sequence, a scalar, or a mapping with no pair keys falls through to `scalarValues` unchanged,
+   * so every shape that worked before still works.
+   */
+  /**
+   * A DEPENDENCY VALUE THAT NAMES A MARKER, not a member of any document.
+   *
+   * `DEPENDS_ON_KEYS` fires on four loader spellings (Compose `depends_on`, GitHub `needs`,
+   * Azure `dependsOn`, CircleCI `requires`), and in every one of them the value names a
+   * DECLARATION the same document carries — a service, a job, a stage. One corpus position
+   * breaks that premise: kube-api-linter's config spells a rule-to-marker requirement
+   *
+   *     dependenttags:
+   *       rules:
+   *         - identifier: "k8s:unionMember"
+   *           dependsOn: ["k8s:optional"]        <- a kubebuilder MARKER, not a key
+   *
+   * where the value is a Go-comment annotation (`+k8s:optional` in Go struct docs) — not a
+   * key any analyzer publishes in any lane, so the `references` edge it produced (target
+   * `k8s:optional`, `isExternal: true`) was structurally unverifiable: no symbol named
+   * `k8s:optional` can exist in the key space, and no instrument could ever confirm it.
+   * Same class as `steps[].with.needs` (an action INPUT read as a job dependency) and the
+   * 31 `service_healthy` condition strings: the key is spelled `dependsOn`, but the value
+   * at this position names no dependency the graph indexes.
+   *
+   * MEASURED, whole admitted population, every `yaml_depends_on` target counted UNTRUNCATED
+   * (1,895 edges over 413 candidate files, `.tmp-probe/yaml-depends-position-r16.txt`):
+   * **1,892 carry no colon; the only colon-bearing, template-free targets are the 3
+   * `k8s:optional` sites above** (kubernetes' `hack/golangci{,-hints}.yaml` and
+   * `hack/kube-api-linter/kube-api-linter.yaml`, every one under `dependenttags.rules[]`),
+   * so the rule fires on exactly the measured class with ZERO collateral. The shape is
+   * loader-independent and vocabulary-free — no list of marker namespaces, which is what
+   * made the previously-named candidate guard ("an ancestor segment names a marker-rule
+   * container") unpriceable at 3 edges:
+   *
+   *   * a colon is legal in no member name any of the four loaders admits (GitHub job ids,
+   *     Compose service names, Azure stage names, CircleCI job names are colon-free by
+   *     their formats' own rules), and
+   *   * every template spelling that could carry a colon (`${{ … }}`) contains `{{` and is
+   *     excluded — a template edge stays a RULED external claim, unchanged.
+   *
+   * A lookup-first variant (refuse only when the name is ALSO undeclared in the file) was
+   * considered and measured equivalent on this population: `k8s:optional` occurs as a KEY
+   * declaration in 0 of the three emitting files (grep, all sites are VALUES beside
+   * `identifier:`/`conflicts:`), so shape-first and lookup-first refuse the same 3 edges.
+   * Shape-first is chosen because it fires at capture with no dependence on walk order.
+   */
+  static markerNamespaceTarget(name) {
+    return name.includes(":") && !name.includes("{{");
+  }
+  dependencyTargets(valueNode) {
+    if (!valueNode) return [];
+    const node = this.scalarNode(valueNode);
+    const pairs = [];
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const child = node.namedChild(i);
+      if (child && MAPPING_PAIR_TYPES.has(child.type)) pairs.push(child);
+    }
+    if (pairs.length > 0) {
+      const names = [];
+      for (const pair of pairs) {
+        const keyNode = pair.childForFieldName("key") || this.firstNonDecorationChild(pair);
+        const text = keyNode ? this.scalarText(keyNode) : "";
+        if (text) names.push(text);
+      }
+      if (names.length > 0) return names;
+    }
+    return this.scalarValues(valueNode);
+  }
+  /**
+   * THE MANIFEST A LOCAL ACTION DIRECTORY IS FOR, confirmed to exist.
+   *
+   * `uses: ./dir` names a DIRECTORY, and the gate admits a directory claim by PREFIX over its
+   * admitted files — which can only ever be right for this lane when the directory holds a yaml
+   * file. Claiming the directory itself was measured wrong twice over: HashiCorp's
+   * `./security-scanner` and nimony's `./ci-actions/.github/actions/setup` are checked out AT RUN
+   * TIME and are not in the repository at all (7 + 2 edges), and gh-cli's CodeQL query directory
+   * exists but holds `.ql`/`.md` only (1 edge) — all of them REFUTED claims about directories the
+   * project cannot be asked about. The dependency a `uses: ./dir` really has is the action's
+   * DEFINITION FILE, which is `action.yml`/`action.yaml` by GitHub's own rule, so that is the
+   * candidate now — the same shape toml-lane landed on (claim the manifest FILE, not the
+   * directory). Null when no candidate carries one, and the caller then states `isExternal`.
+   */
+  localActionManifest(ctx, candidates) {
+    const root = ctx.projectRoot;
+    if (typeof root !== "string" || root.length === 0) return null;
+    for (const dir of candidates) {
+      for (const manifest of ["action.yml", "action.yaml"]) {
+        const candidate = `${dir}/${manifest}`;
+        try {
+          if (statSync(join(root, candidate)).isFile()) return [candidate];
+        } catch (e) {
+          if (!(e?.code === "ENOENT" || e?.code === "ENOTDIR")) return [candidate];
+        }
+      }
+    }
+    return null;
+  }
+  /**
+   * IS THIS SPELLING A LITERAL PATH, before anything is claimed about where it points?
+   *
+   * The arbiter checks a file claim by looking the candidate up in the project's ADMITTED file
+   * list. That lookup can only be evidence about a string that is a path: run it on a Jinja
+   * template and the miss is a fact about the template, not about the project.
+   *
+   *   `https://x/y.yaml`          a URL, refused by `://`      (already refused before this guard)
+   *   `{{ item }}`                a template — the `{`, `}`, `$` set covers `{{ }}` and `${ }`
+   *   `name=a`                    ansible's free-form `key=value`, which is a parameter list
+   *   `file=x.yml`                the same, and MEASURED: 5 sites in the ansible population
+   *   `'{{ svc }}_cleanup.yml'`   the same, and MEASURED: 6 sites
+   *   `package:lints/core.yaml`   A URI SCHEME, not a path. MEASURED over the whole corpus:
+   *                               **85 refuted edges** — `package:lints/recommended.yaml` 56,
+   *                               `package:dart_flutter_team_lints/analysis_options.yaml` 18,
+   *                               `package:lints/core.yaml` 5, `package:flutter_lints/flutter.yaml`
+   *                               4, `package:foo/foo_package_options.yaml` 1 — every one an
+   *                               `include:` in a Dart `analysis_options.yaml`, whose target is a
+   *                               PUB package resolved by pub, never a path in this project.
+   *   `.vsts-ci/windows/*.yml`    A GLOB. MEASURED: 1 refuted edge (powershell's azure-pipelines
+   *                               path filter). A glob names a SET, so no single candidate can be
+   *                               the thing it names.
+   *
+   * Everything else is admissible, including a bare `apt.yml` and a `subdir/x.yaml`.
+   */
+  static isLiteralPathSpelling(written, quoted = false) {
+    if (written.length === 0) return false;
+    if (written.includes("://")) return false;
+    if (hasTemplateOrGlobChar(written)) return false;
+    if (!quoted && hasJsWhitespace(written)) return false;
+    if (hasUriSchemePrefix(written)) return false;
+    if (hasParamKeyPrefix(written)) return false;
+    return true;
+  }
+  /**
+   * THE CLAIM A KEY-SPELLING INCLUDE CARRIES — and this is the fix for the 107 refuted external
+   * claims the whole-population run found.
+   *
+   * `- import_tasks: apt.yml` names a FILE in this project. Until this helper existed the edge
+   * carried `isExternal: true` and nothing else, so the arbiter asked its OWNER question —
+   * `targetOwner("apt.yml")` is `apt` — and ansible publishes a module named `apt`, so the claim
+   * "this is outside the corpus" was judged FALSE and the edge was counted against the lane. The
+   * refutation was an artefact of asking an owner question about a path.
+   *
+   * MEASURED over the whole admitted ansible population (2,082 files, 891 include edges, the
+   * key attributed from each edge's own `line_number`): 96 of the 107 refuted edges come from
+   * `include_tasks`/`import_tasks` and name a file — 95 of them a file the project HAS. This
+   * helper makes the claim the evidence can actually answer, and the arbiter verifies those 95
+   * against the project's own file list instead of refuting them against a module's name.
+   *
+   * TWO REFUSALS, each measured rather than assumed:
+   *
+   *   1. A ROLE KEY gets no file claim (`ROLE_IMPORT_KEYS`). `tasks_from: canary2.yml` is
+   *      relative to a role directory this analyzer does not resolve, so a claim that THIS
+   *      file's directory holds it would be refuted — 10 edges measured.
+   *   2. A TARGET THAT IS NOT SPELLED AS AN ADMITTED SPELLING gets no file claim. The arbiter's
+   *      file list is the lane's admitted population, `.yaml`/`.yml` only, so a claim about any
+   *      other suffix could never be confirmed and would be refuted by the claim rather than by
+   *      the project. `isLiteralPathSpelling` also refuses templates and free-form spellings.
+   *
+   * When no candidate can be stated the edge keeps the weaker `isExternal` marker it had — the
+   * pre-existing behaviour, unchanged, so this fix can only ADD verifiable claims, never remove
+   * an edge or silently re-label one.
+   */
+  /**
+   * THE ENTRY FILE A ROLE IMPORT RESOLVES TO — and the reason the lane can stop emitting a bare
+   * role name, which is never a symbol.
+   *
+   * Ansible resolves `include_role`/`import_role` `name: X` against a SEARCH PATH: for each
+   * directory from the importing file's own directory up to the project root, `roles/X`. The entry
+   * file of the resolved role is its `tasks/main.yml`. The lane's `imports` relation is file to
+   * file, so that file — not the role's NAME — is what an edge can point at, and pointing at it is
+   * what makes the edge checkable: a bare `X` collides with every mapping key spelled `X` (measured:
+   * `a` 29 declarations, `include_role` 123, `no_log` 42), so the arbiter had no disposition for it
+   * other than AMBIGUOUS.
+   *
+   * RETURNS NULL UNLESS THE FILE IS ACTUALLY THERE, checked with the same `statSync` evidence rule
+   * every other file claim in this lane uses. That ordering is the whole safety property: a role
+   * whose entry file cannot be found keeps the pre-existing bare-name marker, so the change can
+   * only ADD a verifiable claim and can never manufacture a refutation.
+   *
+   * The candidate is normalised segment by segment so that a role spelled with `..` cannot escape
+   * the project (`include_role: name=../x` occurs in ansible), and a candidate that escapes returns
+   * null rather than a path the arbiter's file list could never hold.
+   */
+  roleEntryTarget(name, ctx, tasksFrom = null) {
+    if (typeof name !== "string" || name.length === 0) return null;
+    const rel = _RealYamlAnalyzer.projectRelativePath(ctx.filePath, ctx.projectRoot);
+    if (rel === null) return null;
+    const parts = rel.split("/");
+    parts.pop();
+    const spellings = [`roles/${name}/tasks/main.yml`];
+    if (typeof tasksFrom === "string" && tasksFrom.length > 0) {
+      spellings.push(`roles/${name}/tasks/${tasksFrom}`);
+    }
+    for (let depth = parts.length; depth >= 0; depth--) {
+      const base = parts.slice(0, depth).join("/");
+      for (const spelling of spellings) {
+        const raw = (base === "" ? "" : base + "/") + spelling;
+        const segs = [];
+        let escaped = false;
+        for (const seg of raw.split("/")) {
+          if (seg === "" || seg === ".") continue;
+          if (seg === "..") {
+            if (segs.length === 0) {
+              escaped = true;
+              break;
+            }
+            segs.pop();
+            continue;
+          }
+          segs.push(seg);
+        }
+        if (escaped) continue;
+        const cand = segs.join("/");
+        if (cand.length === 0) continue;
+        if (this.projectCarriesFile(ctx, [cand])) return cand;
+      }
+    }
+    return null;
+  }
+  /**
+   * THE PARAMETERS OF AN INLINE ROLE IMPORT — `import_role: name=a public=no`.
+   *
+   * Ansible accepts the parameters of `include_role`/`import_role` as an inline `k=v` list as well
+   * as a mapping, and the lane read the whole list as ONE role name. This parses the list and
+   * returns it, or null unless EVERY whitespace-separated token is a `key=value` pair with a
+   * lowercase parameter name AND the list carries `name`:
+   *
+   *   * a plain scalar role name (`- include_role: some_role`) has no '=' → null, pre-existing path;
+   *   * a templated value (`name={{ role }}`) keeps its '{{' spelling as the VALUE of `name` and is
+   *     returned as the name — it will not resolve to a directory, and the caller keeps the
+   *     pre-existing target in that case (the fallback in `emitKeySemantics`);
+   *   * only the tokens are scanned; there is no regex and no guessing at quoting.
+   *
+   * The two parameters that name an entry FILE are read by `roleEntryFileHint`.
+   */
+  inlineRoleParams(node) {
+    const scalar = node ? this.scalarNode(node) : null;
+    if (!scalar || !SCALAR_TYPES.has(scalar.type)) return null;
+    const text = this.scalarText(scalar);
+    if (text.length === 0) return null;
+    const params = /* @__PURE__ */ new Map();
+    let i = 0;
+    while (i < text.length) {
+      while (i < text.length && hasJsWhitespace(text[i])) i++;
+      const start = i;
+      while (i < text.length && !hasJsWhitespace(text[i])) i++;
+      if (i === start) continue;
+      const token = text.slice(start, i);
+      const eq = token.indexOf("=");
+      if (eq <= 0 || eq === token.length - 1) return null;
+      const key = token.slice(0, eq);
+      if (!isAnsibleParamName(key)) return null;
+      params.set(key, token.slice(eq + 1));
+    }
+    return params.size > 0 && params.has("name") ? params : null;
+  }
+  /** The `tasks_from:` file a role import names, in EITHER spelling ansible accepts: the mapping
+   *  form (`import_role: {name: X, tasks_from: y.yml}`) or the inline form
+   *  (`import_role: name=X tasks_from=y.yml`). Null when no entry file is named, which is the
+   *  common case and keeps the pre-existing `tasks/main.yml` target. */
+  roleEntryFileHint(valueNode) {
+    const named = this.mappingEntryScalar(valueNode, "tasks_from");
+    if (named !== null) return named;
+    return this.inlineRoleParams(valueNode)?.get("tasks_from") ?? null;
+  }
+  keywordIncludeClaim(written, ctx, key) {
+    if (ROLE_IMPORT_KEYS.has(key)) return { isExternal: true };
+    if (!isYamlSpelling(written)) return { isExternal: true };
+    const candidates = this.relativePathCandidates(written, ctx);
+    return candidates !== null && this.projectCarriesFile(ctx, candidates) ? { importProjectFile: candidates } : { isExternal: true };
+  }
+  /**
+   * THE CLAIM A `uses:` TARGET CARRIES, decided by what the target actually names.
+   *
+   * Three shapes, measured over this corpus's workflow files rather than assumed: **7,265**
+   * remote actions (`actions/checkout@v6`, `r-lib/actions/setup-r@v2`), **501** local ones
+   * (`./ci-actions/.github/actions/setup` — a DIRECTORY), and **13** container images
+   * (`docker://hashicorp/terraform:1.9`).
+   *
+   *   docker://…            a container image                -> the REFERENCE claim (spelling)
+   *   ./… or ../…           a path in THIS project           -> the FILE claim (the project's list)
+   *   anything else         a pinned remote action reference -> the REFERENCE claim (spelling)
+   *
+   * The alternative for the first and third is what the lane did until now — `isExternal: true` on
+   * a target with no identifier-shaped owner — which the gate reads as UNVERIFIABLE, blocks a PASS
+   * on, and can say nothing else about. The alternative for the second is worse: it was marked NOT
+   * external and resolved to nothing, so a local action read as a broken edge. All three now carry
+   * a claim the arbiter can check, and a claim it can refute.
+   *
+   * When no project root is known the local shape keeps `isExternal: false` — the pre-existing
+   * behaviour — because a candidate set without a root would be a fabrication, and the file claim
+   * with no evidence is exactly what the rule's control refuses.
+   *
+   * AND THE LOCAL SHAPE CLAIMS THE MANIFEST, NOT THE DIRECTORY, confirmed to exist. Measured over
+   * the whole corpus: 11 residual refutations were local directories this project cannot be asked
+   * about — two of them checked out at run time by an earlier step (`path: security-scanner`,
+   * `path: ci-actions`), one holding `.ql`/`.md` and no yaml at all. A directory claim can only be
+   * admitted by prefix over the admitted YAML population, so it was a claim with no possible
+   * evidence. A `uses: ./dir` depends on the action's definition file (`action.yml`/`action.yaml`
+   * by GitHub's rule), which is a statement the arbiter's file list can actually answer. Where
+   * that manifest is absent the edge states `isExternal: true` — on a path-shaped target that is
+   * `externalUnverified`, not a refutation.
+   */
+  /**
+   * `$/…` IS A ROOT-ANCHORED PATH, the spelling one repository in the corpus uses where every
+   * other repository writes `./…`.
+   *
+   * WHAT WAS WRONG. A `uses:` value that is not `docker://` and does not begin `./`/`../` fell
+   * through to `actionUseClaim`'s last line, `return { remoteRef: true }` — a claim that `$/` is a
+   * GitHub OWNER and `.github` the repository under it. `$` is not an owner, and the target is not
+   * an action reference at all: it is a path in the checked-out tree. So the edge asserted an
+   * external remote action that does not exist, was read as `externalUnverified`, and the lane's
+   * `ext?` population carried it as unnamed. MEASURED over the whole corpus, this was **18 edges**, all
+   * of them terragrunt's (`uses: $/.github/actions/go-cache-restore` 15, `…/go-cache-save` 3).
+   *
+   * WHY THE REFERENT IS SUPPORTABLE, and the two places it could have been a ruling instead:
+   * `terragrunt/.github/actions/go-cache-restore/action.yml` and `…/go-cache-save/action.yml` are
+   * FILES THE PROJECT CARRIES, each a composite action whose name is exactly the last segment of
+   * the `uses:` value, and no `$/.github` directory exists anywhere in the tree. The rewrite is
+   * unconditional, so it manufactures nothing: a `$/…` action with no manifest in the project
+   * still lands in `actionUseClaim`'s local branch and falls back to `isExternal: true`, which is
+   * the weaker claim it carried before — the same refusal the `./…` spelling already has.
+   *
+   * WHAT IT DOES NOT DO. It does not read `$` as a GitHub expression, does not touch a target that
+   * merely CONTAINS `$/`, and does not apply to any other key: over the whole admitted population a
+   * `$/` spelling occurs only in a step-level `uses:`. Null means "not a root-anchored spelling", so
+   * a caller keeps the written text.
+   */
+  static rootAnchoredActionPath(action) {
+    return action.startsWith("$/") ? `./${action.slice(2)}` : null;
+  }
+  actionUseClaim(action, ctx, extraProjectPaths = []) {
+    if (action.startsWith("docker://")) return { remoteRef: true };
+    if (action.startsWith("./") || action.startsWith("../")) {
+      const candidates = this.relativePathCandidates(action, ctx);
+      if (candidates === null) return { isExternal: false };
+      const all = extraProjectPaths.length > 0 ? [...extraProjectPaths, ...candidates] : candidates;
+      const manifest = this.localActionManifest(ctx, all);
+      if (manifest !== null) return { importProjectFile: manifest };
+      if (isYamlSpelling(action) && this.projectCarriesFile(ctx, all)) {
+        return { importProjectFile: all };
+      }
+      return { isExternal: true };
+    }
+    return { remoteRef: true };
+  }
+  /**
+   * A document's IDENTITY, and it is scoped to the file.
+   *
+   * ## The defect this fixes
+   *
+   * The identity was the filesystem BASENAME, and a basename is not unique in a project.
+   * Measured on a 60-file stride of the yaml corpus: `hostports0.yaml` occurs **156 times**
+   * in one repository (Kubernetes' pod-security-admission testdata, once per API version
+   * and once per pass directory) and `Chart.yaml` **243 times** across the helm charts.
+   * Every member of every one of those documents was published under the same name —
+   * `hostports0.spec.containers[0]` had 156 declarations — so the `contains` edge asserting
+   * that containment could not be walked in either direction: the shared resolver resolves a
+   * bare name only under `HAVING COUNT(*) = 1`, and an exact-key match has to be unique too.
+   * The incoming gate read **78 ambiguous edges of 1,512** on that stride.
+   *
+   * ## The rule, and why it is the only sound one
+   *
+   * A file-scoped symbol's identity must contain the file. The basename is the ONE part of
+   * the path that is not unique; the project-relative directory chain is the part that is,
+   * and it is stable across machines in a way the absolute path is not. The BASENAME STAYS
+   * THE LAST SEGMENT, which is what keeps the leaf of every member path (`...v1.37.fail` +
+   * `hostports0` -> `hostports0`) unchanged for the store's leaf matching.
+   *
+   * ## Price, measured before the code was written
+   *
+   * `script/m14/incoming-gate.ts yaml yaml 60` with the identity scoped: **ambiguous 78 -> 0,
+   * unresolved 0 -> 0, resolved 1,432 -> 1,510** (+78, i.e. every previously-ambiguous edge
+   * now resolves and NO edge that resolved before stopped resolving). That last clause is the
+   * one the fleet worklist asked to be checked rather than assumed: it is the evidence that
+   * nothing in this corpus spells a document by its basename, so scoping the identity cannot
+   * break an incoming reference.
+   *
+   * ## What it does NOT do
+   *
+   * It does not make the BASENAME key unique — `hostports0` is still published by 156 files,
+   * because the basename is the readable name a human uses. It makes the QUALIFIED PATH
+   * unique, and that path is what `contains` emits and what strategy 1 matches exactly.
+   */
+  documentName(filePath, documentIndex, projectRoot) {
+    const slash = filePath.lastIndexOf("/");
+    const base = slash >= 0 ? filePath.slice(slash + 1) : filePath;
+    let stem = base;
+    const lower = base.toLowerCase();
+    if (lower.endsWith(".yaml.template")) stem = base.slice(0, -13);
+    else if (lower.endsWith(".yml.template")) stem = base.slice(0, -12);
+    else if (lower.endsWith(".yaml")) stem = base.slice(0, -5);
+    else if (lower.endsWith(".yml")) stem = base.slice(0, -4);
+    stem = stem.trim() || "document";
+    const scope = _RealYamlAnalyzer.documentDirScope(filePath, projectRoot);
+    const scoped = scope.length > 0 ? `${scope}.${stem}` : stem;
+    return documentIndex === 1 ? scoped : `${scoped}#${documentIndex}`;
+  }
+  nodeToRange(node) {
+    return {
+      startLine: node.startPosition.row + 1,
+      startColumn: node.startPosition.column + 1,
+      endLine: node.endPosition.row + 1,
+      endColumn: node.endPosition.column + 1,
+      startIndex: node.startIndex,
+      endIndex: node.endIndex
+    };
+  }
+};
+export {
+  RealYamlAnalyzer
+};