code-auditor-mcp 4.1.0 → 5.0.1

package/dist/pipelineAdapters.js

@@ -7,8 +7,6 @@
  *
  * Key patterns:
  *   - Per-file (solid, data-access, doc, schema): wrap analyzeAST()
- *   - DRY: wraps analyzeAST(), accumulates dryPairs internally →
- *     factory returns { visitor, getDryPairs } for post-pipeline extraction
  *   - React: wraps scanFile() per file, accumulates scan results →
  *     factory returns { visitor, finalizeCrossComponent }
  *   - DB-based (styles, conventions, cross-domain): reducers call
@@ -17,21 +15,21 @@
  */
 import { createHash } from 'crypto';
 import path from 'path';
-import { RULE_REGISTRY } from './analyzers/ruleRegistry.js';
+import { MIGRATED_RULES } from './phase/rules/registry.js';
 import { TYPESCRIPT_EXTENSIONS, JAVASCRIPT_EXTENSIONS, getLanguageFromPath } from './utils/fileDiscovery.js';
+import { computeContentHash } from './utils/contentHash.js';
 import { walkAST, isExported, getNodeText, getFieldNode, getLineAndColumn, calculateComplexity, getFunctionBody, } from './languages/adapterBridge.js';
 import { buildImportMap, extractFunctionCalls, } from './utils/dependencyExtractor.js';
 import { classifyImportSpecifier, DEFAULT_VIRTUAL_MODULES } from './graph/importClassification.js';
 import { isReactComponent, detectComponentType, getComponentName, } from './utils/reactDetection.js';
-import { findTableReferences, checkNamingConventions, checkQueryPatterns, checkSQLInjection, checkUnresolvedQueries, getNearestTableSuggestions, } from './analyzers/universal/schema/codeAnalysis.js';
+import { findTableReferences, checkNamingConventions, checkQueryPatterns, checkSQLInjection, getNearestTableSuggestions, } from './analyzers/universal/schema/codeAnalysis.js';
 import { passesFileGate, extractTablesFromRegistry, } from './analyzers/universal/schema/discovery.js';
+import { buildBindingEnv } from './analyzers/receiverRoot.js';
 import { applyMigrationOps, stripIdentifier } from './analyzers/universal/schema/migrations.js';
 import { buildOrgFilterTierSet, tableRequiresOrgFilter, } from './analyzers/orgFilterTiers.js';
 // ── Rule ID helpers ──────────────────────────────────────────────────────────
 function getRuleIdsFor(name) {
-    return Object.entries(RULE_REGISTRY)
-        .filter(([, entry]) => entry.analyzer === name)
-        .map(([id]) => id);
+    return MIGRATED_RULES.filter((r) => r.analyzer === name).map((r) => r.id);
 }
 /** Join a list of names as prose: "a", "a and b", "a, b and c". */
 function joinEnglish(names) {
@@ -50,94 +48,62 @@ function lazySingleton(loader) {
         return promise;
     };
 }
-export function createSolidVisitor() {
-    const getAnalyzer = lazySingleton(() => import('./analyzers/universal/UniversalSOLIDAnalyzer.js').then((m) => new m.UniversalSOLIDAnalyzer()));
-    const visitor = {
-        name: 'solid',
-        stage: 'visitor',
-        getRuleIds: () => getRuleIdsFor('solid'),
-        async visit(ast, adapter, context, sourceCode) {
-            const a = await getAnalyzer();
-            const violations = await a.analyzeAST(ast, adapter, context.config, sourceCode);
-            return {
-                violations,
-                facts: {},
-            };
-        },
-        defaultConfig: {},
-        description: 'Detects violations of SOLID principles',
-        category: 'architecture',
-    };
+function createAnalyzerAstVisitor(spec) {
     return {
-        visitor,
-        getSizeSamples: async () => {
-            try {
-                const a = await getAnalyzer();
-                return a.sizeSamples ?? [];
-            }
-            catch {
-                return [];
-            }
-        },
-    };
-}
-export function createDryVisitor(fullFunctionIndex) {
-    const getAnalyzer = lazySingleton(() => import('./analyzers/universal/UniversalDRYAnalyzer.js').then((m) => new m.UniversalDRYAnalyzer()));
-    const visitor = {
-        name: 'dry',
+        name: spec.name,
         stage: 'visitor',
-        getRuleIds: () => getRuleIdsFor('dry'),
+        getRuleIds: () => getRuleIdsFor(spec.name),
         async visit(ast, adapter, context, sourceCode) {
-            const a = await getAnalyzer();
-            const config = fullFunctionIndex
-                ? { ...context.config, fullFunctionIndex }
-                : context.config;
-            const violations = await a.analyzeAST(ast, adapter, config, sourceCode);
+            const a = await spec.getAnalyzer();
+            const violations = await a.analyzeAST(ast, adapter, context.config, sourceCode);
             return { violations, facts: {} };
         },
         defaultConfig: {},
-        description: 'Detects code duplication across the codebase',
-        category: 'maintainability',
-    };
-    return {
-        visitor,
-        getDryPairs: async () => {
-            try {
-                const a = await getAnalyzer();
-                return a.dryPairs ?? [];
-            }
-            catch {
-                return [];
-            }
-        },
+        description: spec.description,
+        category: spec.category,
     };
 }
-// ── Data-Access visitor ──────────────────────────────────────────────────────
-export function createDataAccessVisitor() {
-    const getAnalyzer = lazySingleton(() => import('./analyzers/universal/UniversalDataAccessAnalyzer.js').then((m) => new m.UniversalDataAccessAnalyzer()));
+/** Read the analyzer's accumulated samples/pairs, swallowing a load failure. */
+async function readAccumulated(getAnalyzer, pick) {
+    try {
+        const a = await getAnalyzer();
+        return pick(a) ?? [];
+    }
+    catch {
+        return [];
+    }
+}
+/** A bundle visitor: an analyzeAST visitor plus a getter for the analyzer's
+ *  accumulated samples/pairs. The bundle creators (SOLID, DRY) share one lazy
+ *  analyzer instance between the visitor and the getter. */
+function createAnalyzerBundle(spec) {
+    const getAnalyzer = lazySingleton(spec.loader);
     return {
-        name: 'data-access',
-        stage: 'visitor',
-        getRuleIds: () => getRuleIdsFor('data-access'),
-        async visit(ast, adapter, context, sourceCode) {
-            const a = await getAnalyzer();
-            // Spec 62 Amendment B — emit the extracted query facts (per-file) for the
-            // Stage-4 missing-org-filter reducer to join against the tenant tiers.
-            // The violations returned here exclude missing-org-filter (moved to the
-            // derived reducer); the calls carry resolved table + filter presence +
-            // DB provenance + the query-site location.
-            const { violations, calls } = await a.analyzeWithFacts(ast, adapter, context.config, sourceCode);
-            const facts = {};
-            if (calls.length > 0) {
-                facts[context.filePath] = { calls };
-            }
-            return { violations, facts };
-        },
-        defaultConfig: {},
-        description: 'Analyzes database access patterns and data layer interactions',
-        category: 'security',
+        visitor: createAnalyzerAstVisitor({
+            name: spec.name,
+            getAnalyzer,
+            description: spec.description,
+            category: spec.category,
+        }),
+        getAccumulated: () => readAccumulated(getAnalyzer, spec.pick),
     };
 }
+/**
+ * Create the SOLID stage-2 visitor, which lazily loads the SOLID analyzer and
+ * also exposes its accumulated size samples.
+ *
+ * @returns The SOLID visitor bundle.
+ */
+export function createSolidVisitor() {
+    const { visitor, getAccumulated } = createAnalyzerBundle({
+        name: 'solid',
+        loader: () => import('./analyzers/universal/UniversalSOLIDAnalyzer.js').then((m) => new m.UniversalSOLIDAnalyzer()),
+        description: 'Detects violations of SOLID principles',
+        category: 'architecture',
+        pick: (a) => a.sizeSamples,
+    });
+    return { visitor, getSizeSamples: getAccumulated };
+}
 // ── Data-Access org-filter reducer (Spec 62 Amendment B) ─────────────────────
 /**
  * Stage-4 derived reducer for `missing-org-filter`. It joins the data-access
@@ -151,6 +117,8 @@ export function createDataAccessVisitor() {
  *
  * Firing and applicability both derive from {@link buildOrgFilterTierSet}, so
  * they read the identical tier set (Tier 1 config / Tier 2 schema / Tier 3 DDL).
+ *
+ * @returns The data-access org-filter stage-4 reducer.
  */
 export function createOrgFilterReducer() {
     return {
@@ -158,9 +126,8 @@ export function createOrgFilterReducer() {
         stage: 'derivedReducer',
         // Hard dependency on the data-access visitor's per-query facts. The schema
         // table catalog (`allFacts['schema'].tableColumns`) is read opportunistically
-        // so an MCP-default run (which omits `schema`) degrades to Tier 1–2
-        // (config-only) instead of throwing — see buildOrgFilterTierSet.
-        consumes: ['data-access'],
+        // so a run without `schema` facts degrades to Tier 1–2 (config-only) instead
+        // of throwing — see buildOrgFilterTierSet.
         getRuleIds: () => getRuleIdsFor('data-access-org-filter'),
         async reduce(allFacts, context) {
             const violations = [];
@@ -195,7 +162,7 @@ export function createOrgFilterReducer() {
                         },
                         rule: 'missing-org-filter',
                         analyzer: 'data-access',
-                        functionName: symbol,
+                        symbol,
                     });
                 }
             }
@@ -206,41 +173,28 @@ export function createOrgFilterReducer() {
         category: 'security',
     };
 }
-// ── Documentation visitor ────────────────────────────────────────────────────
-export function createDocumentationVisitor() {
-    const getAnalyzer = lazySingleton(() => import('./analyzers/universal/UniversalDocumentationAnalyzer.js').then((m) => new m.UniversalDocumentationAnalyzer()));
-    return {
-        name: 'documentation',
-        stage: 'visitor',
-        getRuleIds: () => getRuleIdsFor('documentation'),
-        async visit(ast, adapter, context, sourceCode) {
-            const a = await getAnalyzer();
-            const violations = await a.analyzeAST(ast, adapter, context.config, sourceCode);
-            return { violations, facts: {} };
-        },
-        defaultConfig: {},
-        description: 'Checks documentation completeness',
-        category: 'style',
-    };
-}
 // ── Secrets visitor ──────────────────────────────────────────────────────────
+/**
+ * Create the secrets stage-2 visitor, which detects hardcoded credentials,
+ * API keys, and tokens.
+ *
+ * @returns The secrets stage-2 visitor.
+ */
 export function createSecretsVisitor() {
-    const getAnalyzer = lazySingleton(() => import('./analyzers/universal/UniversalSecretsAnalyzer.js').then((m) => new m.UniversalSecretsAnalyzer()));
-    return {
+    return createAnalyzerAstVisitor({
         name: 'secrets',
-        stage: 'visitor',
-        getRuleIds: () => getRuleIdsFor('secrets'),
-        async visit(ast, adapter, context, sourceCode) {
-            const a = await getAnalyzer();
-            const violations = await a.analyzeAST(ast, adapter, context.config, sourceCode);
-            return { violations, facts: {} };
-        },
-        defaultConfig: {},
+        getAnalyzer: lazySingleton(() => import('./analyzers/universal/UniversalSecretsAnalyzer.js').then((m) => new m.UniversalSecretsAnalyzer())),
         description: 'Detects hardcoded credentials, API keys, and tokens',
         category: 'security',
-    };
+    });
 }
 // ── Security visitor (Spec 61 R6) ────────────────────────────────────────────
+/**
+ * Create the security stage-2 visitor, which detects command injection,
+ * dynamic require of project paths, and unescaped HTML interpolation.
+ *
+ * @returns The security stage-2 visitor.
+ */
 export function createSecurityVisitor() {
     const getAnalyzer = lazySingleton(() => import('./analyzers/universal/UniversalSecurityAnalyzer.js').then((m) => new m.UniversalSecurityAnalyzer()));
     return {
@@ -250,23 +204,276 @@ export function createSecurityVisitor() {
         async visit(ast, adapter, context, sourceCode) {
             const a = await getAnalyzer();
             const violations = await a.analyzeAST(ast, adapter, context.config, sourceCode);
-            return { violations, facts: {} };
+            // Emit a fact per trigger construct the file contained. These fold
+            // corpus-wide (only keys seen in ≥1 file survive the spread-merge) and
+            // feed securityInputApplicability, so a rule whose construct is absent
+            // reads `notApplicable` instead of `clean`.
+            const saw = a.inputPresence;
+            const facts = {};
+            if (saw.shellProcess)
+                facts.shellProcessSeen = true;
+            if (saw.dynamicRequire)
+                facts.dynamicRequireSeen = true;
+            if (saw.htmlSink)
+                facts.htmlSinkSeen = true;
+            return { violations, facts };
         },
         defaultConfig: {},
         description: 'Detects command injection, dynamic require of project paths, and unescaped HTML interpolation',
         category: 'security',
     };
 }
-// ── Function-Index visitor (infrastructure) ──────────────────────────────────
-// Always-on Stage 2 visitor that populates the `functions` table with
-// per-file definitions so the conventions and cross-domain reducers have data
-// to mine — even on a cold run with no prior `index sync`.
-// The function_calls table is rebuilt post-pipeline after functions rows have
-// their auto-increment IDs assigned.
-function computeContentHash(body, signature) {
-    const normalized = (body ?? '').replace(/\s+/g, ' ').trim() + '|' + (signature ?? '').trim();
-    return createHash('sha256').update(normalized).digest('hex');
+/**
+ * Collect function/method/component entries from an AST in three passes:
+ * (1) named function declarations and methods, (2) arrow functions assigned
+ * to variables, (3) React component detection. Returns the deduplicated list
+ * of `FunctionIndexEntry` rows destined for the `functions` index table.
+ */
+function collectFunctionEntries(root, sourceCode, importMap, filePath) {
+    const fnEntries = [];
+    // Pass 1 — named function declarations and methods
+    walkAST(root, (node) => {
+        if (node.type === 'function_declaration') {
+            const nameNode = node.children?.find((c) => c.type === 'identifier');
+            if (!nameNode)
+                return;
+            const name = getNodeText(nameNode, sourceCode);
+            if (!name)
+                return;
+            const { line } = getLineAndColumn(node);
+            const endLine = node.location.end.line;
+            const body = getFunctionBody(node, sourceCode);
+            const calls = extractFunctionCalls(node, sourceCode, importMap);
+            const callNames = [...new Set(calls.map((c) => c.callee))];
+            fnEntries.push({
+                name,
+                line,
+                endLine,
+                entityType: 'function',
+                componentType: null,
+                isExported: isExported(node),
+                complexity: calculateComplexity(node),
+                body,
+                functionCalls: callNames,
+            });
+        }
+        // Class methods
+        if (node.type === 'method_definition') {
+            const nameNode = node.children?.find((c) => c.type === 'identifier');
+            if (!nameNode)
+                return;
+            const methodName = getNodeText(nameNode, sourceCode);
+            if (!methodName)
+                return;
+            // Walk up to find class name
+            let parent = node.parent;
+            let className = 'AnonymousClass';
+            while (parent) {
+                if (parent.type === 'class_declaration') {
+                    const cn = parent.children?.find((c) => c.type === 'identifier');
+                    if (cn)
+                        className = getNodeText(cn, sourceCode);
+                    break;
+                }
+                parent = parent.parent;
+            }
+            const { line } = getLineAndColumn(node);
+            const endLine = node.location.end.line;
+            const body = getFunctionBody(node, sourceCode);
+            const calls = extractFunctionCalls(node, sourceCode, importMap);
+            const callNames = [...new Set(calls.map((c) => c.callee))];
+            fnEntries.push({
+                name: `${className}.${methodName}`,
+                line,
+                endLine,
+                entityType: 'method',
+                componentType: null,
+                isExported: isExported(node),
+                complexity: calculateComplexity(node),
+                body,
+                functionCalls: callNames,
+            });
+        }
+    });
+    // Pass 2 — arrow functions assigned to variables
+    walkAST(root, (node) => {
+        if (node.type !== 'variable_declarator')
+            return;
+        const nameNode = node.children?.find((c) => c.type === 'identifier');
+        const arrowFunc = node.children?.find((c) => c.type === 'arrow_function');
+        if (!nameNode || !arrowFunc)
+            return;
+        const name = getNodeText(nameNode, sourceCode);
+        if (!name)
+            return;
+        // Don't duplicate if already covered as function_declaration
+        // (shouldn't happen — function_declaration is a different node type)
+        const { line } = getLineAndColumn(arrowFunc);
+        const endLine = arrowFunc.location.end.line;
+        const body = getFunctionBody(arrowFunc, sourceCode);
+        const calls = extractFunctionCalls(arrowFunc, sourceCode, importMap);
+        const callNames = [...new Set(calls.map((c) => c.callee))];
+        fnEntries.push({
+            name,
+            line,
+            endLine,
+            entityType: 'function',
+            componentType: null,
+            isExported: isExported(node),
+            complexity: calculateComplexity(arrowFunc),
+            body,
+            functionCalls: callNames,
+        });
+    });
+    // Pass 3 — React component detection
+    // Detect JSX-returning functions to set entity_type='component' and
+    // component_type, matching what functionScanner's deepSync produces.
+    // The convention miner's classifyExportKind() uses these columns to
+    // partition naming conventions.
+    const hasReactImport = [...importMap.values()].some((v) => v.modulePath === 'react');
+    if (filePath.endsWith('.tsx') ||
+        filePath.endsWith('.jsx') ||
+        (filePath.endsWith('.js') && hasReactImport)) {
+        walkAST(root, (node) => {
+            if (!isReactComponent(node, sourceCode))
+                return;
+            const ct = detectComponentType(node, sourceCode);
+            if (!ct)
+                return;
+            const cName = getComponentName(node, sourceCode);
+            if (!cName || cName === 'AnonymousComponent')
+                return;
+            const existing = fnEntries.find((f) => f.name === cName);
+            if (existing) {
+                // Upgrade existing function_declaration or arrow-function entry
+                existing.entityType = 'component';
+                existing.componentType = ct;
+            }
+            else {
+                // New entry — class component, function_expression, or memo/forwardRef
+                // wrapper not already captured by passes 1 or 2.
+                const { line } = getLineAndColumn(node);
+                const endLine = node.location.end.line;
+                const body = getFunctionBody(node, sourceCode);
+                fnEntries.push({
+                    name: cName,
+                    line,
+                    endLine,
+                    entityType: 'component',
+                    componentType: ct,
+                    isExported: isExported(node),
+                    complexity: calculateComplexity(node),
+                    body,
+                    functionCalls: [],
+                });
+            }
+        });
+    }
+    return fnEntries;
 }
+/**
+ * Extract static/dynamic imports and exports for a single file, emitting
+ * classified `import_specifiers` rows (Spec 60.1) into `indexFacts`. Returns
+ * the import/export facts for the file's stage-2 fact map.
+ */
+function collectImportExportFacts(opts) {
+    const { ast, adapter, sourceCode, filePath, context, isTsJs, indexFacts } = opts;
+    const langAdapter = adapter;
+    const langAst = ast;
+    // Static imports via the adapter's canonical extractImports()
+    const staticImportInfos = langAdapter.extractImports(langAst);
+    const staticImports = staticImportInfos.map((imp) => ({
+        moduleSpecifier: imp.source,
+        isStatic: true,
+        isDynamic: false,
+        isRequire: false,
+        line: imp.location.start.line,
+    }));
+    // Spec 60.1 — classify each static import specifier and emit one row per
+    // occurrence to `import_specifiers`. The corpus file set is the stage-1
+    // discovery list, threaded here as `_infra.files` (merged into
+    // `context.config` by pipeline.ts). Existence is checked against that
+    // in-memory set, never `fs.existsSync`. Virtual-module list + tsconfig
+    // `paths` patterns are threaded via `_infra` and passed to the classifier.
+    if (isTsJs) {
+        // Spec 60.1 Correction 1 — corpus set is the unfiltered discovery list
+        // (`_infra.corpusFiles`), not the narrowed `_infra.files`. The latter is
+        // the audit's analysis list (already pruned by includePaths/excludePaths),
+        // which drops `.json`/other non-analyzed extensions and would mis-classify
+        // a real `./invariant-rules.schema.json` as `internal-broken`.
+        const corpusFiles = new Set((context.config.corpusFiles) ??
+            (context.config.files) ??
+            []);
+        const virtualModules = context.config.importVirtualModules
+            ?? DEFAULT_VIRTUAL_MODULES;
+        const tsconfigAliases = context.config.tsconfigAliases;
+        for (const imp of staticImportInfos) {
+            const { classification, resolvedPath } = classifyImportSpecifier(imp.source, filePath, corpusFiles, {
+                virtualModules,
+                aliasPatterns: tsconfigAliases?.pathPatterns ?? [],
+                pathMappings: tsconfigAliases?.paths ?? {},
+                baseUrl: tsconfigAliases?.baseUrl,
+                projectRoot: context.projectRoot,
+            });
+            indexFacts.push({
+                table: 'import_specifiers',
+                data: {
+                    file_path: filePath,
+                    specifier: imp.source,
+                    classification,
+                    resolved_path: resolvedPath ?? null,
+                    line: imp.location.start.line,
+                },
+                conflictKey: 'file_path, specifier, line',
+            });
+        }
+    }
+    // Dynamic import() and require() — first attempt with pure NodePattern
+    // Plan note: import keyword is an anonymous tree-sitter node, so
+    // hasChild cannot see it.  We use `custom` with raw node access.
+    const dynamicCallNodes = langAdapter.findNodes(langAst, {
+        type: 'call_expression',
+        custom: (node) => {
+            const fn = node.children?.[0];
+            return (fn?.type === 'import') ||
+                (fn?.type === 'identifier' && getNodeText(fn, sourceCode) === 'require');
+        },
+    });
+    const dynamicImports = [];
+    for (const node of dynamicCallNodes) {
+        const fn = node.children?.[0];
+        const isImport = fn?.type === 'import';
+        const isRequire = !isImport && (fn?.type === 'identifier' && getNodeText(fn, sourceCode) === 'require');
+        // Walk the AST children to find the string argument
+        const argsNode = node.children?.find((c) => c.type === 'arguments');
+        const stringNode = argsNode?.children?.find((c) => c.type === 'string');
+        if (stringNode) {
+            const text = getNodeText(stringNode, sourceCode);
+            if (text.length >= 2) {
+                dynamicImports.push({
+                    moduleSpecifier: text.slice(1, -1), // strip quotes
+                    isStatic: false,
+                    isDynamic: isImport,
+                    isRequire,
+                    line: node.location.start.line,
+                });
+            }
+        }
+    }
+    // Exports via the adapter's canonical extractExports()
+    // Returns ExportInfo[] with isDefault — used by both invariants and conventions (B2)
+    const exportInfos = langAdapter.extractExports(langAst);
+    return {
+        imports: [...staticImports, ...dynamicImports],
+        exports: exportInfos,
+    };
+}
+/**
+ * Create the function-index stage-2 visitor, which populates the `functions`
+ * and `import_specifiers` index tables for the downstream reducers.
+ *
+ * @returns The function-index stage-2 visitor.
+ */
 export function createFunctionIndexVisitor() {
     return {
         name: 'function-index',
@@ -278,9 +485,12 @@ export function createFunctionIndexVisitor() {
             if (!filePath)
                 return { violations: [], facts: {} };
             const indexFacts = [];
-            // Only index TS/JS files
+            // Only index TS/JS files. The registry now maps `.json`/`.css` to their
+            // adapter language ids rather than `unknown`, so gate on the two languages
+            // this visitor indexes instead of on `unknown` (which would newly admit
+            // JSON/CSS ASTs to `buildImportMap`/`collectFunctionEntries`).
             const lang = getLanguageFromPath(filePath);
-            if (lang === 'unknown')
+            if (lang !== 'typescript' && lang !== 'javascript')
                 return { violations: [], facts: {} };
             // Clear existing entries for this file
             indexFacts.push({
@@ -299,148 +509,12 @@ export function createFunctionIndexVisitor() {
             }
             // Build import map once per file for resolving call targets
             const importMap = buildImportMap(root, sourceCode);
-            // Collect function-like nodes in two passes:
-            //  1) function_declaration + method_definition nodes
-            //  2) arrow functions assigned to variables (variable_declarator children)
-            const fnEntries = [];
-            // Pass 1 — named function declarations and methods
-            walkAST(root, (node) => {
-                if (node.type === 'function_declaration') {
-                    const nameNode = node.children?.find((c) => c.type === 'identifier');
-                    if (!nameNode)
-                        return;
-                    const name = getNodeText(nameNode, sourceCode);
-                    if (!name)
-                        return;
-                    const { line } = getLineAndColumn(node);
-                    const endLine = node.location.end.line;
-                    const body = getFunctionBody(node, sourceCode);
-                    const calls = extractFunctionCalls(node, sourceCode, importMap);
-                    const callNames = [...new Set(calls.map((c) => c.callee))];
-                    fnEntries.push({
-                        name,
-                        line,
-                        endLine,
-                        entityType: 'function',
-                        componentType: null,
-                        isExported: isExported(node),
-                        complexity: calculateComplexity(node),
-                        body,
-                        functionCalls: callNames,
-                    });
-                }
-                // Class methods
-                if (node.type === 'method_definition') {
-                    const nameNode = node.children?.find((c) => c.type === 'identifier');
-                    if (!nameNode)
-                        return;
-                    const methodName = getNodeText(nameNode, sourceCode);
-                    if (!methodName)
-                        return;
-                    // Walk up to find class name
-                    let parent = node.parent;
-                    let className = 'AnonymousClass';
-                    while (parent) {
-                        if (parent.type === 'class_declaration') {
-                            const cn = parent.children?.find((c) => c.type === 'identifier');
-                            if (cn)
-                                className = getNodeText(cn, sourceCode);
-                            break;
-                        }
-                        parent = parent.parent;
-                    }
-                    const { line } = getLineAndColumn(node);
-                    const endLine = node.location.end.line;
-                    const body = getFunctionBody(node, sourceCode);
-                    const calls = extractFunctionCalls(node, sourceCode, importMap);
-                    const callNames = [...new Set(calls.map((c) => c.callee))];
-                    fnEntries.push({
-                        name: `${className}.${methodName}`,
-                        line,
-                        endLine,
-                        entityType: 'method',
-                        componentType: null,
-                        isExported: isExported(node),
-                        complexity: calculateComplexity(node),
-                        body,
-                        functionCalls: callNames,
-                    });
-                }
-            });
-            // Pass 2 — arrow functions assigned to variables
-            walkAST(root, (node) => {
-                if (node.type !== 'variable_declarator')
-                    return;
-                const nameNode = node.children?.find((c) => c.type === 'identifier');
-                const arrowFunc = node.children?.find((c) => c.type === 'arrow_function');
-                if (!nameNode || !arrowFunc)
-                    return;
-                const name = getNodeText(nameNode, sourceCode);
-                if (!name)
-                    return;
-                // Don't duplicate if already covered as function_declaration
-                // (shouldn't happen — function_declaration is a different node type)
-                const { line } = getLineAndColumn(arrowFunc);
-                const endLine = arrowFunc.location.end.line;
-                const body = getFunctionBody(arrowFunc, sourceCode);
-                const calls = extractFunctionCalls(arrowFunc, sourceCode, importMap);
-                const callNames = [...new Set(calls.map((c) => c.callee))];
-                fnEntries.push({
-                    name,
-                    line,
-                    endLine,
-                    entityType: 'function',
-                    componentType: null,
-                    isExported: isExported(node),
-                    complexity: calculateComplexity(arrowFunc),
-                    body,
-                    functionCalls: callNames,
-                });
-            });
-            // Pass 3 — React component detection
-            // Detect JSX-returning functions to set entity_type='component' and
-            // component_type, matching what functionScanner's deepSync produces.
-            // The convention miner's classifyExportKind() uses these columns to
-            // partition naming conventions.
-            const hasReactImport = [...importMap.values()].some((v) => v.modulePath === 'react');
-            if (filePath.endsWith('.tsx') ||
-                filePath.endsWith('.jsx') ||
-                (filePath.endsWith('.js') && hasReactImport)) {
-                walkAST(root, (node) => {
-                    if (!isReactComponent(node, sourceCode))
-                        return;
-                    const ct = detectComponentType(node, sourceCode);
-                    if (!ct)
-                        return;
-                    const cName = getComponentName(node, sourceCode);
-                    if (!cName || cName === 'AnonymousComponent')
-                        return;
-                    const existing = fnEntries.find((f) => f.name === cName);
-                    if (existing) {
-                        // Upgrade existing function_declaration or arrow-function entry
-                        existing.entityType = 'component';
-                        existing.componentType = ct;
-                    }
-                    else {
-                        // New entry — class component, function_expression, or memo/forwardRef
-                        // wrapper not already captured by passes 1 or 2.
-                        const { line } = getLineAndColumn(node);
-                        const endLine = node.location.end.line;
-                        const body = getFunctionBody(node, sourceCode);
-                        fnEntries.push({
-                            name: cName,
-                            line,
-                            endLine,
-                            entityType: 'component',
-                            componentType: ct,
-                            isExported: isExported(node),
-                            complexity: calculateComplexity(node),
-                            body,
-                            functionCalls: [],
-                        });
-                    }
-                });
-            }
+            const fnEntries = collectFunctionEntries(root, sourceCode, importMap, filePath);
+            // File-level content hash, shared by every function row this file emits.
+            // detectChangedFunctions stores the same value (from its own read of the
+            // file) so a later `changed` run can skip the re-scan when the file's
+            // whole content is unchanged.
+            const fileHash = computeContentHash(sourceCode);
             // Build IndexFactsEntry for each function
             for (const fn of fnEntries) {
                 const metadata = {
@@ -449,7 +523,7 @@ export function createFunctionIndexVisitor() {
                     complexity: fn.complexity,
                     functionCalls: fn.functionCalls,
                 };
-                const contentHash = computeContentHash(fn.body, '');
+                const contentHash = computeContentHash(fn.body);
                 const now = new Date().toISOString();
                 indexFacts.push({
                     table: 'functions',
@@ -462,7 +536,6 @@ export function createFunctionIndexVisitor() {
                         language: lang,
                         entity_type: fn.entityType,
                         component_type: fn.componentType,
-                        signature: '',
                         return_type: null,
                         complexity: fn.complexity,
                         is_exported: fn.isExported ? 1 : 0,
@@ -471,105 +544,27 @@ export function createFunctionIndexVisitor() {
                         parameters: null,
                         body: fn.body ?? null,
                         content_hash: contentHash,
+                        file_hash: fileHash,
                         last_modified: now,
                         metadata_json: JSON.stringify(metadata),
                     },
                     conflictKey: 'name, file_path, line_number',
                 });
             }
-            // ── Extract imports and exports from AST for downstream consumers ──
-            // B1: Replaces regex-based extractImports()/extractExportedSymbols() in
-            // ruleEngine.ts.  Also consumed by conventions (B2: detectExportForm).
-            const langAdapter = _adapter;
-            const langAst = ast;
-            // Static imports via the adapter's canonical extractImports()
-            const staticImportInfos = langAdapter.extractImports(langAst);
-            const staticImports = staticImportInfos.map((imp) => ({
-                moduleSpecifier: imp.source,
-                isStatic: true,
-                isDynamic: false,
-                isRequire: false,
-                line: imp.location.start.line,
-            }));
-            // Spec 60.1 — classify each static import specifier and emit one row per
-            // occurrence to `import_specifiers`. The corpus file set is the stage-1
-            // discovery list, threaded here as `_infra.files` (merged into
-            // `context.config` by pipeline.ts). Existence is checked against that
-            // in-memory set, never `fs.existsSync`. Virtual-module list + tsconfig
-            // `paths` patterns are threaded via `_infra` and passed to the classifier.
-            if (isTsJs) {
-                // Spec 60.1 Correction 1 — corpus set is the unfiltered discovery list
-                // (`_infra.corpusFiles`), not the narrowed `_infra.files`. The latter is
-                // the audit's analysis list (already pruned by includePaths/excludePaths),
-                // which drops `.json`/other non-analyzed extensions and would mis-classify
-                // a real `./invariant-rules.schema.json` as `internal-broken`.
-                const corpusFiles = new Set((context.config.corpusFiles) ??
-                    (context.config.files) ??
-                    []);
-                const virtualModules = context.config.importVirtualModules
-                    ?? DEFAULT_VIRTUAL_MODULES;
-                const tsconfigAliases = context.config.tsconfigAliases;
-                for (const imp of staticImportInfos) {
-                    const { classification, resolvedPath } = classifyImportSpecifier(imp.source, filePath, corpusFiles, {
-                        virtualModules,
-                        aliasPatterns: tsconfigAliases?.pathPatterns ?? [],
-                        pathMappings: tsconfigAliases?.paths ?? {},
-                        baseUrl: tsconfigAliases?.baseUrl,
-                        projectRoot: context.projectRoot,
-                    });
-                    indexFacts.push({
-                        table: 'import_specifiers',
-                        data: {
-                            file_path: filePath,
-                            specifier: imp.source,
-                            classification,
-                            resolved_path: resolvedPath ?? null,
-                            line: imp.location.start.line,
-                        },
-                        conflictKey: 'file_path, specifier, line',
-                    });
-                }
-            }
-            // Dynamic import() and require() — first attempt with pure NodePattern
-            // Plan note: import keyword is an anonymous tree-sitter node, so
-            // hasChild cannot see it.  We use `custom` with raw node access.
-            const dynamicCallNodes = langAdapter.findNodes(langAst, {
-                type: 'call_expression',
-                custom: (node) => {
-                    const fn = node.children?.[0];
-                    return (fn?.type === 'import') ||
-                        (fn?.type === 'identifier' && getNodeText(fn, sourceCode) === 'require');
-                },
+            const { imports: importFacts, exports: exportInfos } = collectImportExportFacts({
+                ast: ast,
+                adapter: _adapter,
+                sourceCode,
+                filePath,
+                context,
+                isTsJs,
+                indexFacts,
             });
-            const dynamicImports = [];
-            for (const node of dynamicCallNodes) {
-                const fn = node.children?.[0];
-                const isImport = fn?.type === 'import';
-                const isRequire = !isImport && (fn?.type === 'identifier' && getNodeText(fn, sourceCode) === 'require');
-                // Walk the AST children to find the string argument
-                const argsNode = node.children?.find((c) => c.type === 'arguments');
-                const stringNode = argsNode?.children?.find((c) => c.type === 'string');
-                if (stringNode) {
-                    const text = getNodeText(stringNode, sourceCode);
-                    if (text.length >= 2) {
-                        dynamicImports.push({
-                            moduleSpecifier: text.slice(1, -1), // strip quotes
-                            isStatic: false,
-                            isDynamic: isImport,
-                            isRequire,
-                            line: node.location.start.line,
-                        });
-                    }
-                }
-            }
-            // Exports via the adapter's canonical extractExports()
-            // Returns ExportInfo[] with isDefault — used by both invariants and conventions (B2)
-            const exportInfos = langAdapter.extractExports(langAst);
             return {
                 violations: [],
                 facts: {
                     [filePath]: {
-                        imports: [...staticImports, ...dynamicImports],
+                        imports: importFacts,
                         exports: exportInfos,
                     },
                 },
@@ -581,6 +576,12 @@ export function createFunctionIndexVisitor() {
         category: 'infrastructure',
     };
 }
+/**
+ * Create the React stage-2 visitor, which scans React components and exposes
+ * cross-component checks to run after stage 2 completes.
+ *
+ * @returns The React visitor bundle.
+ */
 export function createReactVisitor() {
     const scanResults = [];
     const visitor = {
@@ -662,6 +663,8 @@ export function createReactVisitor() {
  * Styles CSS visitor — extracts declarations, tokens, and class usage from
  * tree-sitter-css and tree-sitter-scss parsed ASTs. Replaces the regex-based
  * CSS/SCSS extraction in styleExtractor.ts for .css and .scss files.
+ *
+ * @returns The styles-css stage-2 visitor.
  */
 export function createStylesCssVisitor() {
     return {
@@ -702,6 +705,8 @@ export function createStylesCssVisitor() {
  * emitting a fact (with a content hash) even when it yields no declarations.
  * The reducer uses that fact to (a) drop stale rows for files that *lost* their
  * styles and (b) skip re-writing files whose stored rows are already current.
+ *
+ * @returns The styles-source stage-2 visitor.
  */
 export function createStylesSourceVisitor() {
     // Spec 61 R3.4 — a project tailwind config that exists but cannot be read
@@ -747,6 +752,44 @@ export function createStylesSourceVisitor() {
         category: 'style',
     };
 }
+// Style-table SQL, hoisted so the two inserters (source CSS-in-JS facts and
+// compiled-CSS facts) and each one's prepare-once fast path + `indexHandle.run`
+// fallback cannot drift on a statement string.
+const SQL_STYLE_GET_HASH = 'SELECT content_hash FROM style_declarations WHERE file_path = ? LIMIT 1';
+const SQL_STYLE_DEL_DECL = 'DELETE FROM style_declarations WHERE file_path = ?';
+const SQL_STYLE_DEL_USAGE = 'DELETE FROM style_class_usage WHERE file_path = ?';
+const SQL_STYLE_DEL_TOKEN = 'DELETE FROM style_tokens WHERE file_path = ?';
+const SQL_STYLE_DEL_CLASS = 'DELETE FROM style_defined_classes WHERE file_path = ?';
+const SQL_STYLE_INS_DECL = 'INSERT INTO style_declarations (property, raw_value, normalized_value, mechanism, file_path, line, context, variant_context, token_ref, content_hash) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)';
+const SQL_STYLE_INS_CLASS = 'INSERT OR IGNORE INTO style_defined_classes (class_name, file_path) VALUES (?, ?)';
+const SQL_STYLE_INS_USAGE = 'INSERT INTO style_class_usage (class_name, file_path, line, mechanism, unresolvable) VALUES (?, ?, ?, ?, ?)';
+const SQL_STYLE_INS_TOKEN = 'INSERT INTO style_tokens (name, value, file_path, mechanism) VALUES (?, ?, ?, ?)';
+/** Run a style write through its prepared statement. The index handle always
+ *  exposes a raw better-sqlite3 DB (`pipelineIndexHandle` in auditRunner is the
+ *  only construction and always sets `rawDb`), so the prepared statements are
+ *  always available — the former `else indexHandle.run(sql, params)` per-call
+ *  fallback was unreachable and has been removed. */
+function runStyleWrite(stmts, stmtKey, params) {
+    stmts[stmtKey].run(...params);
+}
+/** Read a file's stored style content hash through its prepared statement. */
+function getStyleHash(stmts, filePath) {
+    return stmts.getHash.get(filePath);
+}
+/** Prepare the statements shared by both style inserters (source CSS-in-JS and
+ *  compiled CSS). Each site layers its own extras (`getHash` for the source path,
+ *  `insTok` for the compiled-CSS path) on top of this common set. */
+function prepareCommonStyleStatements(rawDb) {
+    return {
+        delDecl: rawDb.prepare(SQL_STYLE_DEL_DECL),
+        delUsage: rawDb.prepare(SQL_STYLE_DEL_USAGE),
+        delTok: rawDb.prepare(SQL_STYLE_DEL_TOKEN),
+        delClass: rawDb.prepare(SQL_STYLE_DEL_CLASS),
+        insDecl: rawDb.prepare(SQL_STYLE_INS_DECL),
+        insClass: rawDb.prepare(SQL_STYLE_INS_CLASS),
+        insUsage: rawDb.prepare(SQL_STYLE_INS_USAGE),
+    };
+}
 /**
  * Insert TS/JS CSS-in-JS facts (from the styles-source visitor) into the
  * style_* tables. Mirrors the TS/JS branch the style indexer used to run
@@ -767,19 +810,10 @@ function insertSourceStyleFacts(indexHandle, sourceFacts, isScoped) {
     if (entries.length === 0)
         return false;
     const rawDb = indexHandle.rawDb;
-    const stmts = rawDb
-        ? {
-            getHash: rawDb.prepare('SELECT content_hash FROM style_declarations WHERE file_path = ? LIMIT 1'),
-            delDecl: rawDb.prepare('DELETE FROM style_declarations WHERE file_path = ?'),
-            delUsage: rawDb.prepare('DELETE FROM style_class_usage WHERE file_path = ?'),
-            delTok: rawDb.prepare('DELETE FROM style_tokens WHERE file_path = ?'),
-            delUnread: rawDb.prepare('DELETE FROM style_unread_sources WHERE file_path = ?'),
-            delClass: rawDb.prepare('DELETE FROM style_defined_classes WHERE file_path = ?'),
-            insDecl: rawDb.prepare('INSERT INTO style_declarations (property, raw_value, normalized_value, mechanism, file_path, line, context, variant_context, token_ref, content_hash) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)'),
-            insClass: rawDb.prepare('INSERT OR IGNORE INTO style_defined_classes (class_name, file_path) VALUES (?, ?)'),
-            insUsage: rawDb.prepare('INSERT INTO style_class_usage (class_name, file_path, line, mechanism, unresolvable) VALUES (?, ?, ?, ?, ?)'),
-        }
-        : null;
+    const stmts = {
+        ...prepareCommonStyleStatements(rawDb),
+        getHash: rawDb.prepare(SQL_STYLE_GET_HASH),
+    };
     let contributed = false;
     const insertOne = (filePath, facts) => {
         if (facts.declarations.length > 0 || facts.classUsage.length > 0)
@@ -787,59 +821,32 @@ function insertSourceStyleFacts(indexHandle, sourceFacts, isScoped) {
         // Full-run content-hash skip: leave already-current rows untouched. Scoped
         // runs always re-write, matching the old style indexer's `if (!scoped)` guard.
         if (!isScoped) {
-            const stored = stmts
-                ? stmts.getHash.get(filePath)
-                : indexHandle.query('SELECT content_hash FROM style_declarations WHERE file_path = ? LIMIT 1', [filePath])[0];
+            const stored = getStyleHash(stmts, filePath);
             if (stored?.content_hash === facts.contentHash)
                 return;
         }
-        // Delete stale rows — all five tables, mirroring the old deleteFileEntries
-        // so a file that *lost* its styles also loses its stale unread-sources row.
-        if (stmts) {
-            stmts.delDecl.run(filePath);
-            stmts.delUsage.run(filePath);
-            stmts.delTok.run(filePath);
-            stmts.delUnread.run(filePath);
-            stmts.delClass.run(filePath);
-        }
-        else {
-            indexHandle.run('DELETE FROM style_declarations WHERE file_path = ?', [filePath]);
-            indexHandle.run('DELETE FROM style_class_usage WHERE file_path = ?', [filePath]);
-            indexHandle.run('DELETE FROM style_tokens WHERE file_path = ?', [filePath]);
-            indexHandle.run('DELETE FROM style_unread_sources WHERE file_path = ?', [filePath]);
-            indexHandle.run('DELETE FROM style_defined_classes WHERE file_path = ?', [filePath]);
-        }
+        // Delete stale rows — all four tables, mirroring the old deleteFileEntries
+        // so a file that *lost* its styles also loses its stale rows.
+        runStyleWrite(stmts, 'delDecl', [filePath]);
+        runStyleWrite(stmts, 'delUsage', [filePath]);
+        runStyleWrite(stmts, 'delTok', [filePath]);
+        runStyleWrite(stmts, 'delClass', [filePath]);
         // Insert declarations (and their defined-class catalog entries).
         for (const decl of facts.declarations) {
-            if (stmts) {
-                stmts.insDecl.run(decl.property, decl.rawValue, decl.normalizedValue ? JSON.stringify(decl.normalizedValue) : null, decl.mechanism, decl.filePath, decl.line, decl.context, decl.variantContext, decl.tokenRef, facts.contentHash);
-            }
-            else {
-                indexHandle.run('INSERT INTO style_declarations (property, raw_value, normalized_value, mechanism, file_path, line, context, variant_context, token_ref, content_hash) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)', [decl.property, decl.rawValue, decl.normalizedValue ? JSON.stringify(decl.normalizedValue) : null, decl.mechanism, decl.filePath, decl.line, decl.context, decl.variantContext, decl.tokenRef, facts.contentHash]);
-            }
+            runStyleWrite(stmts, 'insDecl', [decl.property, decl.rawValue, decl.normalizedValue ? JSON.stringify(decl.normalizedValue) : null, decl.mechanism, decl.filePath, decl.line, decl.context, decl.variantContext, decl.tokenRef, facts.contentHash]);
             if (decl.context) {
                 for (const m of decl.context.matchAll(/\.([a-zA-Z0-9_-]+)/g)) {
-                    if (stmts)
-                        stmts.insClass.run(m[1], decl.filePath);
-                    else
-                        indexHandle.run('INSERT OR IGNORE INTO style_defined_classes (class_name, file_path) VALUES (?, ?)', [m[1], decl.filePath]);
+                    runStyleWrite(stmts, 'insClass', [m[1], decl.filePath]);
                 }
             }
         }
         // Insert class usage.
         for (const cu of facts.classUsage) {
-            if (stmts)
-                stmts.insUsage.run(cu.className, cu.filePath, cu.line, cu.mechanism, cu.unresolvable ? 1 : 0);
-            else
-                indexHandle.run('INSERT INTO style_class_usage (class_name, file_path, line, mechanism, unresolvable) VALUES (?, ?, ?, ?, ?)', [cu.className, cu.filePath, cu.line, cu.mechanism, cu.unresolvable ? 1 : 0]);
+            runStyleWrite(stmts, 'insUsage', [cu.className, cu.filePath, cu.line, cu.mechanism, cu.unresolvable ? 1 : 0]);
         }
     };
-    if (stmts)
-        rawDb.transaction(() => { for (const [fp, f] of entries)
-            insertOne(fp, f); })();
-    else
-        for (const [fp, f] of entries)
-            insertOne(fp, f);
+    rawDb.transaction(() => { for (const [fp, f] of entries)
+        insertOne(fp, f); })();
     return contributed;
 }
 /**
@@ -850,6 +857,8 @@ function insertSourceStyleFacts(indexHandle, sourceFacts, isScoped) {
  * Spec 26 Phase 2: CSS facts from the styles-css visitor are inserted into
  * the DB before the analyzer runs. For .css files, the AST extraction replaces
  * the regex-based styleIndexer path (which now skips .css files).
+ *
+ * @returns The styles stage-3 reducer.
  */
 export function createStylesReducer() {
     return {
@@ -891,77 +900,44 @@ export function createStylesReducer() {
                     // statement — measured at 345ms for 5 files / ~13k declarations on
                     // recall-protocol. Prepare-once + one transaction collapses that.
                     const rawDb = context.indexHandle.rawDb;
-                    const stmts = rawDb
-                        ? {
-                            delDecl: rawDb.prepare('DELETE FROM style_declarations WHERE file_path = ?'),
-                            delTok: rawDb.prepare('DELETE FROM style_tokens WHERE file_path = ?'),
-                            delUsage: rawDb.prepare('DELETE FROM style_class_usage WHERE file_path = ?'),
-                            delClass: rawDb.prepare('DELETE FROM style_defined_classes WHERE file_path = ?'),
-                            insDecl: rawDb.prepare('INSERT INTO style_declarations (property, raw_value, normalized_value, mechanism, file_path, line, context, variant_context, token_ref, content_hash) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)'),
-                            insClass: rawDb.prepare('INSERT OR IGNORE INTO style_defined_classes (class_name, file_path) VALUES (?, ?)'),
-                            insTok: rawDb.prepare('INSERT INTO style_tokens (name, value, file_path, mechanism) VALUES (?, ?, ?, ?)'),
-                            insUsage: rawDb.prepare('INSERT INTO style_class_usage (class_name, file_path, line, mechanism, unresolvable) VALUES (?, ?, ?, ?, ?)'),
-                        }
-                        : null;
+                    const stmts = {
+                        ...prepareCommonStyleStatements(rawDb),
+                        insTok: rawDb.prepare(SQL_STYLE_INS_TOKEN),
+                    };
                     const insertAll = () => {
                         for (const [filePath, facts] of Object.entries(cssFacts)) {
                             // Delete old entries for this file (replaces the styleIndexer path)
-                            if (stmts) {
-                                stmts.delDecl.run(filePath);
-                                stmts.delTok.run(filePath);
-                                stmts.delUsage.run(filePath);
-                                stmts.delClass.run(filePath);
-                            }
-                            else {
-                                indexHandle.run('DELETE FROM style_declarations WHERE file_path = ?', [filePath]);
-                                indexHandle.run('DELETE FROM style_tokens WHERE file_path = ?', [filePath]);
-                                indexHandle.run('DELETE FROM style_class_usage WHERE file_path = ?', [filePath]);
-                                indexHandle.run('DELETE FROM style_defined_classes WHERE file_path = ?', [filePath]);
-                            }
+                            runStyleWrite(stmts, 'delDecl', [filePath]);
+                            runStyleWrite(stmts, 'delTok', [filePath]);
+                            runStyleWrite(stmts, 'delUsage', [filePath]);
+                            runStyleWrite(stmts, 'delClass', [filePath]);
                             // Compute content hash for the file
                             const contentStr = JSON.stringify({ declarations: facts.declarations.length, tokens: facts.tokens.length, classUsage: facts.classUsage.length });
                             const contentHash = createHash('sha256').update(contentStr).digest('hex').slice(0, 16);
                             // Insert declarations
                             for (const decl of facts.declarations) {
-                                if (stmts) {
-                                    stmts.insDecl.run(decl.property, decl.rawValue, JSON.stringify(decl.normalizedValue), decl.mechanism, decl.filePath, decl.line, decl.context, decl.variantContext, decl.tokenRef, contentHash);
-                                }
-                                else {
-                                    indexHandle.run('INSERT INTO style_declarations (property, raw_value, normalized_value, mechanism, file_path, line, context, variant_context, token_ref, content_hash) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)', [decl.property, decl.rawValue, JSON.stringify(decl.normalizedValue), decl.mechanism, decl.filePath, decl.line, decl.context, decl.variantContext, decl.tokenRef, contentHash]);
-                                }
+                                runStyleWrite(stmts, 'insDecl', [decl.property, decl.rawValue, JSON.stringify(decl.normalizedValue), decl.mechanism, decl.filePath, decl.line, decl.context, decl.variantContext, decl.tokenRef, contentHash]);
                                 // Populate the defined-class catalog (Spec 45) from any class
                                 // selectors in the rule's context so styles/undefined-class can
                                 // resolve names via `style_defined_classes` instead of a
                                 // full-corpus regex scan over every declaration.
                                 if (decl.context) {
                                     for (const m of decl.context.matchAll(/\.([a-zA-Z0-9_-]+)/g)) {
-                                        if (stmts)
-                                            stmts.insClass.run(m[1], decl.filePath);
-                                        else
-                                            indexHandle.run('INSERT OR IGNORE INTO style_defined_classes (class_name, file_path) VALUES (?, ?)', [m[1], decl.filePath]);
+                                        runStyleWrite(stmts, 'insClass', [m[1], decl.filePath]);
                                     }
                                 }
                             }
                             // Insert tokens
                             for (const tok of facts.tokens) {
-                                if (stmts)
-                                    stmts.insTok.run(tok.name, tok.value, tok.filePath, tok.mechanism);
-                                else
-                                    indexHandle.run('INSERT INTO style_tokens (name, value, file_path, mechanism) VALUES (?, ?, ?, ?)', [tok.name, tok.value, tok.filePath, tok.mechanism]);
+                                runStyleWrite(stmts, 'insTok', [tok.name, tok.value, tok.filePath, tok.mechanism]);
                             }
                             // Insert class usage
                             for (const cu of facts.classUsage) {
-                                if (stmts)
-                                    stmts.insUsage.run(cu.className, cu.filePath, cu.line, cu.mechanism, cu.unresolvable ? 1 : 0);
-                                else
-                                    indexHandle.run('INSERT INTO style_class_usage (class_name, file_path, line, mechanism, unresolvable) VALUES (?, ?, ?, ?, ?)', [cu.className, cu.filePath, cu.line, cu.mechanism, cu.unresolvable ? 1 : 0]);
+                                runStyleWrite(stmts, 'insUsage', [cu.className, cu.filePath, cu.line, cu.mechanism, cu.unresolvable ? 1 : 0]);
                             }
                         }
                     };
-                    if (rawDb)
-                        rawDb.transaction(insertAll)();
-                    else
-                        insertAll();
+                    rawDb.transaction(insertAll)();
                 }
                 // Short-circuit on non-style-bearing scoped runs — the source and CSS
                 // facts above are already written (so stale rows are dropped); only the
@@ -993,10 +969,32 @@ export function createStylesReducer() {
     };
 }
 // ── Conventions reducer (stage 3) ────────────────────────────────────────────
+/**
+ * Builds the shared analyzer-config bag for reducers that query the code
+ * index: the reducer's own namespaced config spread over the index handle,
+ * project root, in-scope file set, and scope flag. Reducers that need extra
+ * inputs (`readSource`, `exportsMap`) spread this and layer them on top.
+ *
+ * Scoped/diff audits thread `_infra.files` (absolute) as `scopedFiles` so the
+ * analyzer scopes its function/file queries to only the changed files;
+ * `functions.file_path` is also absolute, so the IN clause matches directly.
+ */
+function makeIndexAnalyzerConfig(context) {
+    const scopedFiles = context.isScoped ? (context.config.files ?? []) : undefined;
+    return {
+        ...context.config,
+        indexHandle: context.indexHandle,
+        projectRoot: context.projectRoot,
+        scopedFiles,
+        isScoped: context.isScoped,
+    };
+}
 /**
  * Conventions reducer — queries conventions table and flags deviations
  * (usage-pair, import-form, error-handling, export-shape, naming).
  * Uses analyzer.analyze([]) with rawDb injected.
+ *
+ * @returns The conventions stage-3 reducer.
  */
 export function createConventionsReducer() {
     return {
@@ -1017,12 +1015,7 @@ export function createConventionsReducer() {
                         .filter(([, data]) => data?.exports?.length)
                         .map(([filePath, data]) => [filePath, data.exports]))
                     : undefined;
-                // Scoped/diff audits: thread the in-scope file set so the analyzer scopes
-                // its function/file queries to only the changed files. `_infra.files` are
-                // absolute; `functions.file_path` is also absolute (function-index visitor
-                // stores `context.filePath`), so the IN clause matches directly.
-                const scopedFiles = context.isScoped ? (context.config.files ?? []) : undefined;
-                const config = { ...context.config, indexHandle: context.indexHandle, projectRoot: context.projectRoot, readSource: context.readSource, exportsMap, scopedFiles, isScoped: context.isScoped };
+                const config = { ...makeIndexAnalyzerConfig(context), readSource: context.readSource, exportsMap };
                 const result = await analyzer.analyze([], config);
                 // Count the INPUT the conventions analyzer reads (the function index the
                 // function-index visitor populated), not the derived `conventions` table it
@@ -1031,7 +1024,12 @@ export function createConventionsReducer() {
                 // analyzer — counting it as "facts consumed" misreports a present input as
                 // notApplicable. (Spec 39 R2/R3 bug B)
                 const factsConsumed = context.indexHandle.count('functions');
-                return { violations: result.violations ?? [], facts: {}, factsConsumed };
+                return {
+                    violations: result.violations ?? [],
+                    facts: {},
+                    factsConsumed,
+                    ...(result.diagnostics && result.diagnostics.length > 0 && { diagnostics: result.diagnostics }),
+                };
             }
             catch {
                 return { violations: [], facts: {} };
@@ -1047,12 +1045,13 @@ export function createConventionsReducer() {
  * Cross-domain reducer — runs written-never-read, read-never-written,
  * transaction-boundary risk, no-validator-reachable, and uncovered-risk detectors.
  * Uses analyzer.analyze([]) with rawDb injected.
+ *
+ * @returns The cross-domain stage-4 reducer.
  */
 export function createCrossDomainReducer() {
     return {
         name: 'cross-domain',
         stage: 'derivedReducer',
-        consumes: [],
         getRuleIds: () => getRuleIdsFor('cross-domain'),
         async reduce(_allFacts, context) {
             if (!context.indexHandle)
@@ -1060,11 +1059,7 @@ export function createCrossDomainReducer() {
             try {
                 const { CrossDomainAnalyzer } = await import('./analyzers/crossDomain/CrossDomainAnalyzer.js');
                 const analyzer = new CrossDomainAnalyzer();
-                // Thread the in-scope file set (absolute, from _infra.files) so detectors
-                // anchor to changed files on diff audits; full audits keep the root-LIKE
-                // scope (resolveFileScope falls back when isScoped is false).
-                const scopedFiles = context.isScoped ? (context.config.files ?? []) : undefined;
-                const config = { ...context.config, indexHandle: context.indexHandle, projectRoot: context.projectRoot, scopedFiles, isScoped: context.isScoped };
+                const config = makeIndexAnalyzerConfig(context);
                 const result = await analyzer.analyze([], config);
                 // Count DB rows consumed across primary cross-domain tables
                 let factsConsumed = 0;
@@ -1098,7 +1093,7 @@ export function createCrossDomainReducer() {
 // DependencyGraphBuilder) are corpus-wide: they compare schemas/endpoints/cycles
 // across files and languages. They run as Stage-4 derived reducers over a single
 // shared entity-extraction visitor, so each analyzer's rule IDs map to its own
-// result row (coverage resolves by RULE_REGISTRY analyzer name — one reducer per
+// result row (coverage resolves by each rule's analyzer — one reducer per
 // analyzer, not one reducer fanning out to three names).
 //
 // Scope-awareness ("Stage 4, and measure the gate"): the corpus-wide graph/cycle
@@ -1183,10 +1178,11 @@ function clCollectFileReferences(node, sourceCode) {
         }
         else if (t === 'identifier') {
             // A bare identifier used as a value — an argument to a call
-            // (`arr.map(singularize)`) or an array element (`[missedClose, …]`) — is a
-            // function reference. Declaration names (`name` fields) and member
-            // accesses (`property_identifier`) are separate node types and are not
-            // captured here.
+            // (`arr.map(singularize)`), an array element (`[missedClose, …]`), or an
+            // object-literal value (`{ hostname: isValidHostname }`) — is a function
+            // reference. Declaration names (`name` fields) and member accesses
+            // (`property_identifier`) are separate node types and are not captured
+            // here.
             const parent = n.parent;
             if (parent && (parent.type === 'arguments' || parent.type === 'array')) {
                 const text = getNodeText(n, sourceCode).trim();
@@ -1194,13 +1190,34 @@ function clCollectFileReferences(node, sourceCode) {
                     names.add(text);
             }
         }
+        else if (t === 'shorthand_property_identifier') {
+            // `{ isValidHostname }` — the shorthand key doubles as a reference to the
+            // in-scope function of the same name. A function wired up only through an
+            // object literal (`FORMAT_VALIDATORS`) has no call edge, so without this
+            // it reads orphaned even though it is genuinely referenced.
+            const text = getNodeText(n, sourceCode).trim();
+            if (text && /^[A-Za-z_$][\w$]*$/.test(text))
+                names.add(text);
+        }
+        else if (t === 'pair') {
+            // `{ key: value }` — the *value* may be a bare identifier referencing a
+            // function (`{ hostname: isValidHostname }`); the key is a property name,
+            // not a reference, and must not be added.
+            const value = getFieldNode(n, 'value');
+            if (value?.type === 'identifier') {
+                const text = getNodeText(value, sourceCode).trim();
+                if (text && /^[A-Za-z_$][\w$]*$/.test(text))
+                    names.add(text);
+            }
+        }
         for (const child of n.children ?? [])
             walk(child);
     };
     walk(node);
     return [...names];
 }
-function clMakeFunction(filePath, lang, name, line, signature, purpose, params, callees, exported, complexity, isMethod = false) {
+function clMakeFunction(opts) {
+    const { filePath, lang, name, line, signature, purpose, params, callees, exported, complexity, isMethod = false } = opts;
     return {
         id: clEntityId(filePath, 'function', name, line),
         name,
@@ -1248,7 +1265,7 @@ function clDynamicImport(node, sourceCode) {
     // not a computed specifier — `import(\`@babel/plugin-syntax-jsx\`)` resolves
     // to an edge just like `import('@babel/plugin-syntax-jsx')`. Only an
     // interpolated template (`` import(`./${name}.js`) ``) is genuinely computed.
-    const templateNode = args?.children?.find((c) => c.type === 'template_string' || c.type === 'template_literal');
+    const templateNode = args?.children?.find((c) => c.type === 'template_string');
     if (templateNode) {
         const hasSubstitution = (templateNode.children ?? []).some((c) => c.type === 'template_substitution');
         if (!hasSubstitution) {
@@ -1378,7 +1395,16 @@ function clExtractTSEntities(root, filePath, sourceCode, lang, out) {
                 }
             }
             const line = node.location.start.line;
-            const entity = clMakeFunction(filePath, lang, displayName, line, clSignatureText(node, sourceCode) || getNodeText(node, sourceCode), clBodyText(node, sourceCode), clExtractTSParams(node, sourceCode), clCollectCallees(node, sourceCode), isExported(node), calculateComplexity(node), node.type === 'method_definition');
+            const entity = clMakeFunction({
+                filePath, lang, name: displayName, line,
+                signature: clSignatureText(node, sourceCode) || getNodeText(node, sourceCode),
+                purpose: clBodyText(node, sourceCode),
+                params: clExtractTSParams(node, sourceCode),
+                callees: clCollectCallees(node, sourceCode),
+                exported: isExported(node),
+                complexity: calculateComplexity(node),
+                isMethod: node.type === 'method_definition',
+            });
             entity.metadata.fileReferences = fileReferences;
             out.push(entity);
             return;
@@ -1392,7 +1418,15 @@ function clExtractTSEntities(root, filePath, sourceCode, lang, out) {
             if (!name)
                 return;
             const line = node.location.start.line;
-            const entity = clMakeFunction(filePath, lang, name, line, clSignatureText(arrow, sourceCode) || getNodeText(arrow, sourceCode), clBodyText(arrow, sourceCode), [], clCollectCallees(arrow, sourceCode), isExported(node), calculateComplexity(node));
+            const entity = clMakeFunction({
+                filePath, lang, name, line,
+                signature: clSignatureText(arrow, sourceCode) || getNodeText(arrow, sourceCode),
+                purpose: clBodyText(arrow, sourceCode),
+                params: [],
+                callees: clCollectCallees(arrow, sourceCode),
+                exported: isExported(node),
+                complexity: calculateComplexity(node),
+            });
             entity.metadata.fileReferences = fileReferences;
             out.push(entity);
             return;
@@ -1452,18 +1486,24 @@ function clExtractGoParams(node, sourceCode) {
 }
 function clExtractGoStructFields(structNode, sourceCode) {
     const fields = [];
-    for (const f of structNode.children ?? []) {
-        if (f.type !== 'field_declaration')
-            continue;
-        const nameNode = getFieldNode(f, 'name');
-        const name = nameNode ? getNodeText(nameNode, sourceCode) : undefined;
-        if (!name)
-            continue;
-        const typeNode = getFieldNode(f, 'type');
-        const type = typeNode ? getNodeText(typeNode, sourceCode).trim() : undefined;
-        const tagNode = getFieldNode(f, 'tag');
-        const tag = tagNode ? getNodeText(tagNode, sourceCode) : undefined;
-        fields.push({ name, type, isExported: clIsExportedGo(name), tag });
+    // A struct's fields are not direct children of `struct_type` — tree-sitter-go
+    // wraps them in a `field_declaration_list`. Iterate one level in so the
+    // per-field name/type/tag extraction actually sees them.
+    for (const child of structNode.children ?? []) {
+        const decls = child.type === 'field_declaration_list' ? (child.children ?? []) : [child];
+        for (const f of decls) {
+            if (f.type !== 'field_declaration')
+                continue;
+            const nameNode = getFieldNode(f, 'name');
+            const name = nameNode ? getNodeText(nameNode, sourceCode) : undefined;
+            if (!name)
+                continue;
+            const typeNode = getFieldNode(f, 'type');
+            const type = typeNode ? getNodeText(typeNode, sourceCode).trim() : undefined;
+            const tagNode = getFieldNode(f, 'tag');
+            const tag = tagNode ? getNodeText(tagNode, sourceCode) : undefined;
+            fields.push({ name, type, isExported: clIsExportedGo(name), tag });
+        }
     }
     return fields;
 }
@@ -1478,7 +1518,15 @@ function clExtractGoEntities(root, filePath, sourceCode, out) {
             const receiverType = receiver ? clGoReceiverType(receiver, sourceCode) : undefined;
             const displayName = receiverType ? `${receiverType}.${name}` : name;
             const line = node.location.start.line;
-            const entity = clMakeFunction(filePath, 'go', displayName, line, clSignatureText(node, sourceCode) || getNodeText(node, sourceCode), clBodyText(node, sourceCode), clExtractGoParams(node, sourceCode), clCollectCallees(node, sourceCode), clIsExportedGo(name), calculateComplexity(node));
+            const entity = clMakeFunction({
+                filePath, lang: 'go', name: displayName, line,
+                signature: clSignatureText(node, sourceCode) || getNodeText(node, sourceCode),
+                purpose: clBodyText(node, sourceCode),
+                params: clExtractGoParams(node, sourceCode),
+                callees: clCollectCallees(node, sourceCode),
+                exported: clIsExportedGo(name),
+                complexity: calculateComplexity(node),
+            });
             entity.metadata.fileReferences = fileReferences;
             out.push(entity);
             return;
@@ -1537,6 +1585,38 @@ function clExtractGoEntities(root, filePath, sourceCode, out) {
     });
 }
 // ── Shared entity visitor (Stage 2) ──────────────────────────────────────────
+/**
+ * Spec 68 §3.2 — the `cross-language-entities` FileProcessor extraction.
+ *
+ * The entity half of {@link createCrossLanguageEntityVisitor}, factored out so
+ * the phase-model producer can call it directly without the Stage-2 `visit`
+ * plumbing (violations/facts/indexFacts). Emits the same `CrossLanguageEntity[]`
+ * the visitor feeds the cross-language analyzers; the per-file imports/exports
+ * half of the visitor is the reachability/coverage concern (§8), not this fact.
+ *
+ * @param ast - The parsed file to extract entities from.
+ * @param filePath - The file path stamping each extracted entity.
+ * @param sourceCode - Source text used for names and signatures.
+ * @param lang - The resolved language (`go`, `typescript`, or `javascript`).
+ * @returns The cross-language entities extracted from the file.
+ */
+export function extractCrossLanguageEntities(ast, filePath, sourceCode, lang) {
+    const root = ast.root;
+    const entities = [];
+    if (lang === 'go') {
+        clExtractGoEntities(root, filePath, sourceCode, entities);
+    }
+    else {
+        clExtractTSEntities(root, filePath, sourceCode, lang, entities);
+    }
+    return entities;
+}
+/**
+ * Create the cross-language-entities stage-2 visitor, which extracts entities
+ * and import/export info for the cross-language analyzers.
+ *
+ * @returns The cross-language-entities stage-2 visitor.
+ */
 export function createCrossLanguageEntityVisitor() {
     return {
         name: 'cross-language-entities',
@@ -1548,7 +1628,7 @@ export function createCrossLanguageEntityVisitor() {
             if (!filePath)
                 return { violations: [], facts: {} };
             const lang = getLanguageFromPath(filePath);
-            if (lang === 'unknown')
+            if (lang !== 'typescript' && lang !== 'javascript' && lang !== 'go')
                 return { violations: [], facts: {} };
             const root = ast.root;
             const entities = [];
@@ -1689,6 +1769,11 @@ function clComputeReachability(fileFacts, options) {
  * nothing *and* not a framework entry point. `deadPreException` is the
  * empty-importers count before the entry-point exception, so the drop
  * (`deadPreException - untestedDead`) attributes the entry points exempted.
+ *
+ * @param fileFacts - Per-file import/export info keyed by project-relative path.
+ * @param importersOf - Map of file to the set of files that import it.
+ * @param packageEntrySet - Framework/package entry points exempted from the dead bucket.
+ * @returns The test-coverage classification report.
  */
 export function classifyTestCoverage(fileFacts, importersOf, packageEntrySet) {
     const result = {
@@ -1753,6 +1838,9 @@ export function classifyTestCoverage(fileFacts, importersOf, packageEntrySet) {
  * the same file name appearing in several sibling directories (e.g. two
  * `ErrorState.tsx`, three `services.ts` under separate `reports` folders). Only
  * basenames with ≥2 files become clusters; a singleton dead file is not a duplicate.
+ *
+ * @param deadFiles - Unreferenced module paths to cluster by basename.
+ * @returns Dead-module clusters (only basenames with two or more files).
  */
 export function clusterDeadModules(deadFiles) {
     const byBasename = new Map();
@@ -1792,6 +1880,15 @@ function clBuildReferences(entities) {
         const eDir = e.file.split('/').slice(0, -1).join('/');
         for (const callee of callees) {
             const name = (callee.split('.').pop() ?? callee).toLowerCase();
+            // A free function that calls itself by bare name is recursing. Resolving
+            // that name to a *different* same-named entity (a second `dfs` helper in
+            // the same file) fabricates a spurious mutual-recursion cycle between two
+            // unrelated functions and reports it as a circular dependency. Recursion
+            // is a self-reference, not a module cycle — drop it rather than resolve
+            // it sideways. (Methods are named `Class.method`, so a bare callee never
+            // matches their own name and this only affects free functions.)
+            if (name === e.name.toLowerCase())
+                continue;
             const others = (byName.get(name) ?? []).filter((t) => t.id !== e.id);
             if (others.length === 0)
                 continue;
@@ -1828,11 +1925,16 @@ function clBuildReferences(entities) {
     return refs;
 }
 // ── schema-validator reducer (Stage 4) ───────────────────────────────────────
+/**
+ * Create the schema-validator stage-4 reducer, which compares schemas across
+ * language boundaries (TS interfaces vs Go structs).
+ *
+ * @returns The schema-validator stage-4 reducer.
+ */
 export function createSchemaValidatorReducer() {
     return {
         name: 'schema-validator',
         stage: 'derivedReducer',
-        consumes: ['cross-language-entities'],
         getRuleIds: () => getRuleIdsFor('schema-validator'),
         async reduce(allFacts, context) {
             if (context.isScoped) {
@@ -1884,11 +1986,16 @@ export function createSchemaValidatorReducer() {
     };
 }
 // ── api-contract reducer (Stage 4) ───────────────────────────────────────────
+/**
+ * Create the api-contract stage-4 reducer, which compares frontend API calls
+ * against backend endpoints across languages.
+ *
+ * @returns The api-contract stage-4 reducer.
+ */
 export function createAPIContractReducer() {
     return {
         name: 'api-contract',
         stage: 'derivedReducer',
-        consumes: ['cross-language-entities'],
         getRuleIds: () => getRuleIdsFor('api-contract'),
         async reduce(allFacts, context) {
             if (context.isScoped) {
@@ -1920,11 +2027,39 @@ export function createAPIContractReducer() {
     };
 }
 // ── dependency-graph reducer (Stage 4) ───────────────────────────────────────
+/**
+ * Persist a `graph_cache` edge set in one transaction: delete the graph's
+ * existing rows, then insert `rows` as (node_key, neighbor_key, weight).
+ * Advisory — a failure here only degrades the post-pipeline hotspot ranking,
+ * so it is swallowed rather than surfaced as an audit error.
+ */
+function persistGraphEdges(rawDb, graphType, rows) {
+    try {
+        const db = rawDb;
+        const del = db.prepare(`DELETE FROM graph_cache WHERE graph_type = '${graphType}'`);
+        const ins = db.prepare(`INSERT OR REPLACE INTO graph_cache (graph_type, node_key, neighbor_key, weight) VALUES ('${graphType}', ?, ?, ?)`);
+        const tx = db.transaction(() => {
+            del.run();
+            for (const [nodeKey, neighborKey, weight] of rows) {
+                ins.run(nodeKey, neighborKey, weight);
+            }
+        });
+        tx();
+    }
+    catch {
+        // Advisory persistence — ranking falls back to a neutral default without it.
+    }
+}
+/**
+ * Create the dependency-graph stage-4 reducer, which detects dependency cycles,
+ * hubs, and orphaned nodes.
+ *
+ * @returns The dependency-graph stage-4 reducer.
+ */
 export function createDependencyGraphReducer() {
     return {
         name: 'dependency-graph',
         stage: 'derivedReducer',
-        consumes: ['cross-language-entities'],
         getRuleIds: () => getRuleIdsFor('dependency-graph'),
         async reduce(allFacts, context) {
             if (context.isScoped) {
@@ -1965,7 +2100,7 @@ export function createDependencyGraphReducer() {
                                 type: issue.type, // dependency-graph rules match on field: 'type'
                                 analyzer: 'dependency-graph',
                                 category: 'cross-language-dependency',
-                                functionName: orphan.name,
+                                symbol: orphan.name,
                                 details: { orphanId: id },
                             });
                         }
@@ -2004,45 +2139,21 @@ export function createDependencyGraphReducer() {
                     // Persist reachability to graph_cache so the post-pipeline reorder
                     // (auditRunner hotspot block) can rank every finding by live/dead.
                     if (context.indexHandle?.rawDb) {
-                        try {
-                            const db = context.indexHandle.rawDb;
-                            const del = db.prepare("DELETE FROM graph_cache WHERE graph_type = 'reachability'");
-                            const ins = db.prepare("INSERT OR REPLACE INTO graph_cache (graph_type, node_key, neighbor_key, weight) VALUES ('reachability', ?, '', ?)");
-                            const tx = db.transaction(() => {
-                                del.run();
-                                for (const [fp, score] of reachability) {
-                                    ins.run(fp, score);
-                                }
-                            });
-                            tx();
-                        }
-                        catch {
-                            // Reachability persistence is advisory — ranking falls back to a
-                            // neutral default without it.
-                        }
+                        const reachabilityRows = [...reachability].map(([fp, score]) => [fp, '', score]);
+                        persistGraphEdges(context.indexHandle.rawDb, 'reachability', reachabilityRows);
                     }
                     // Spec 60 R1 — persist the file-level import edges (reverse adjacency:
                     // module → its direct importers) so "what tests exercise this module"
                     // is answerable downstream from `importersOf`, not the symbol-level
                     // `function_dependencies` table.
                     if (context.indexHandle?.rawDb) {
-                        try {
-                            const db = context.indexHandle.rawDb;
-                            const del = db.prepare("DELETE FROM graph_cache WHERE graph_type = 'importers'");
-                            const ins = db.prepare("INSERT OR REPLACE INTO graph_cache (graph_type, node_key, neighbor_key, weight) VALUES ('importers', ?, ?, 1)");
-                            const tx = db.transaction(() => {
-                                del.run();
-                                for (const [fp, importers] of importersOf) {
-                                    for (const importer of importers) {
-                                        ins.run(fp, importer);
-                                    }
-                                }
-                            });
-                            tx();
-                        }
-                        catch {
-                            // Importer-edge persistence is advisory, like reachability.
+                        const importerRows = [];
+                        for (const [fp, importers] of importersOf) {
+                            for (const importer of importers) {
+                                importerRows.push([fp, importer, 1]);
+                            }
                         }
+                        persistGraphEdges(context.indexHandle.rawDb, 'importers', importerRows);
                     }
                     // Flag files that export symbols yet are imported by nothing and are
                     // not framework entry points — a dead module. This is the signal the
@@ -2100,7 +2211,6 @@ export function createDependencyGraphReducer() {
                 const HEALTH_SEVERITY = {
                     'break-cycles': 'severe',
                     'reduce-coupling': 'high',
-                    'split-responsibilities': 'high',
                     'review-orphans': 'severe',
                 };
                 for (const s of health.suggestions) {
@@ -2138,6 +2248,8 @@ export function createDependencyGraphReducer() {
  * Invariants reducer — enforces user-defined invariant rules from .codeauditor.json.
  * Receives the full file list via context.files and runs the rule engine across
  * all files at once (call-constraint rules inherently need cross-file scope).
+ *
+ * @returns The invariants stage-3 reducer.
  */
 export function createInvariantsReducer() {
     return {
@@ -2221,6 +2333,8 @@ async function _getProvenanceModule() {
  * Schema SQL visitor (.sql files) — extracts ordered DDL operations for the
  * Stage 3 reducer to replay into the known-tables catalog. Emits the parsed
  * ops, not raw source, so the reducer retains only state transitions.
+ *
+ * @returns The schema-sql stage-2 visitor.
  */
 export function createSchemaSqlVisitor() {
     const getMigrationExtractor = lazySingleton(() => import('./analyzers/universal/UniversalSchemaAnalyzer.js'));
@@ -2231,7 +2345,8 @@ export function createSchemaSqlVisitor() {
         getRuleIds: () => [],
         async visit(_ast, _adapter, context, sourceCode) {
             const { extractMigrationOpsFromFile } = await getMigrationExtractor();
-            const { ops, columns, tableColumns, skipped, bytes } = await extractMigrationOpsFromFile(context.filePath, sourceCode);
+            const dialect = context.config.sqlDialect;
+            const { ops, columns, tableColumns, skipped, bytes } = await extractMigrationOpsFromFile(context.filePath, sourceCode, dialect ?? null);
             return {
                 violations: [],
                 facts: {
@@ -2249,181 +2364,177 @@ export function createSchemaSqlVisitor() {
         category: 'database',
     };
 }
+/** The shared lazy `UniversalSchemaAnalyzer` for the schema-code visitor. Hoisted
+ *  to module scope so the factory below stays a thin descriptor and the analyzer
+ *  is constructed once, not per factory call. */
+const getSchemaCodeAnalyzer = lazySingleton(() => import('./analyzers/universal/UniversalSchemaAnalyzer.js').then((m) => ({
+    analyzer: new m.UniversalSchemaAnalyzer(),
+    defaults: m.DEFAULT_SCHEMA_CONFIG,
+    parseMigrationOps: m.parseMigrationOps,
+    extractDdlColumnNames: m.extractDdlColumnNames,
+    extractDdlTableColumns: m.extractDdlTableColumns,
+})));
+/** The schema-code visitor's per-file `visit` body, extracted from
+ *  `createSchemaCodeVisitor` (which exceeded the 200-line `function-length`
+ *  budget) so the factory stays a thin descriptor over the shared analyzer. */
+async function runSchemaCodeVisit(ast, adapter, context, sourceCode) {
+    const { defaults, parseMigrationOps, extractDdlColumnNames, extractDdlTableColumns } = await getSchemaCodeAnalyzer();
+    const pm = await _getProvenanceModule();
+    const violations = [];
+    // Pipeline config for this analyzer (moved before table extraction, needed
+    // by the table-source registry and provenance context).
+    const schemaConfig = (context.config ?? {});
+    // Spec 70 R1 — the corpus's named dialect (or null) threads to the DDL
+    // extractors so DO-local DDL parses instead of regex. A null dialect is
+    // cannot-fire (no DDL facts).
+    const dialect = schemaConfig.sqlDialect;
+    // Spec 29 R2: Extract ORM table names via declarative table-source registry.
+    // Adding an ORM is now a config entry, not code.  Falls back to Drizzle
+    // entries when no user-specified tableSources are configured.
+    const ormTables = [];
+    const tableProvenances = [];
+    const tableSources = schemaConfig.tableSources ?? [
+        { kind: 'callee', name: 'pgTable', arg: 0, description: 'Drizzle PostgreSQL table' },
+        { kind: 'callee', name: 'mysqlTable', arg: 0, description: 'Drizzle MySQL table' },
+        { kind: 'callee', name: 'sqliteTable', arg: 0, description: 'Drizzle SQLite table' },
+    ];
+    if (tableSources.length > 0) {
+        const registered = extractTablesFromRegistry(tableSources, {
+            ast: ast,
+            adapter: adapter,
+            sourceCode,
+            filePath: context.filePath,
+        });
+        for (const { table, source } of registered) {
+            ormTables.push(table);
+            tableProvenances.push({ table, source });
+        }
+    }
+    // Extract DDL from sql.exec(...) string literals inside Durable Object classes.
+    // These are CREATE TABLE / DROP TABLE statements at runtime that migration
+    // discovery never sees.  Extracting them completes the authoritative catalog
+    // so unknown-table doesn't false-positive on DO-local tables.
+    const doDDL = [];
+    const doTemplateDDL = /`([^`]*(?:CREATE|DROP|ALTER)\s+(?:TABLE|VIRTUAL\s+TABLE)\s+[^`]+)`/gis;
+    const doStringDDL = /(["'])((?:\s*(?:CREATE|DROP|ALTER)\s+(?:TABLE|VIRTUAL\s+TABLE)\s+[^"']+))\1/gis;
+    let ddlMatch;
+    while ((ddlMatch = doTemplateDDL.exec(sourceCode)) !== null) {
+        const sql = ddlMatch[1].trim();
+        if (sql)
+            doDDL.push(sql);
+    }
+    while ((ddlMatch = doStringDDL.exec(sourceCode)) !== null) {
+        const sql = ddlMatch[2].trim();
+        if (sql)
+            doDDL.push(sql);
+    }
+    const doDDLSql = doDDL.length > 0 ? doDDL.join(';\n') : null;
+    const doDDLColumns = doDDLSql ? extractDdlColumnNames(doDDLSql, dialect ?? null) : [];
+    const doDDLTableColumns = doDDLSql ? extractDdlTableColumns(doDDLSql, dialect ?? null) : {};
+    // Build provenance context for this file — defaults from DEFAULT_SCHEMA_CONFIG
+    const detectionMode = schemaConfig.detection?.mode ?? 'hybrid';
+    const provenanceContext = pm.buildProvenanceContext(ast, adapter, sourceCode, {
+        mode: detectionMode,
+        dbBindingNames: schemaConfig.dbBindingNames ?? defaults.dbBindingNames,
+        dbWrapperNames: schemaConfig.dbWrapperNames ?? defaults.dbWrapperNames,
+        // Spec 70 criterion 8 — thread the corpus's named dialect so R3 can prove
+        // a receiver by its parsed SQL argument (the criterion-9 type-annotation
+        // tests are gone). Mirrors buildSchemaProvenanceContext in the analyzer.
+        sqlDialect: dialect ?? null,
+    });
+    // Spec 70 criterion 2 — the declaration-resolution environment `identifyHandle`
+    // reads for handle admission (mirrors buildSchemaHandleEnv). Absent for Go,
+    // which has no local binding env and resolves cross-file.
+    const handleEnv = adapter.name === 'go'
+        ? undefined
+        : {
+            provenance: provenanceContext.dbProvenanced,
+            bindings: buildBindingEnv(ast, adapter, sourceCode),
+            adapter: adapter,
+            sourceCode,
+        };
+    // File gate — skip files without DB usage
+    if (!passesFileGate(context.filePath, sourceCode, schemaConfig, provenanceContext)) {
+        const facts = { [context.filePath]: { tableRefs: [], ormTables, tableProvenance: tableProvenances } };
+        if (doDDL.length > 0) {
+            facts[context.filePath].ddlOps = parseMigrationOps(doDDLSql, dialect ?? null);
+            if (doDDLColumns.length > 0)
+                facts[context.filePath].ddlColumns = doDDLColumns;
+            if (Object.keys(doDDLTableColumns).length > 0)
+                facts[context.filePath].ddlTableColumns = doDDLTableColumns;
+        }
+        return { violations: [], facts };
+    }
+    // Build known-tables set from schemas config (pre-pipeline + DB-loaded schemas)
+    const schemas = schemaConfig.schemas ?? [];
+    const knownTablesArr = schemaConfig.knownTables ?? [];
+    const allTables = new Set();
+    for (const t of knownTablesArr)
+        allTables.add(t);
+    for (const schema of schemas) {
+        for (const table of (schema.tables ?? [])) {
+            allTables.add(table.name);
+        }
+    }
+    // Find table references (per-file, uses allTables for short-id false-positive
+    // filtering). The `unresolved`/`unparseable` halves are no longer consumed
+    // here: both the `unresolved-query` (Spec 58 R1 / 70 1b) and `unparseable`
+    // (Spec 70 R2) coverage diagnostics are re-derived corpus-side
+    // (classifyUnresolvedQuerySites / classifyUnparseableSql →
+    // buildReceiverDiagnostics), so this visitor stops emitting them.
+    const { references: tableRefs } = findTableReferences(ast, adapter, sourceCode, { config: schemaConfig, provenanceContext, allTables, handleEnv });
+    // Check naming conventions
+    if (schemaConfig.checkNamingConventions !== false) {
+        violations.push(...checkNamingConventions(tableRefs, context.filePath));
+    }
+    // Check query patterns
+    if (schemaConfig.validateQueryPatterns !== false) {
+        violations.push(...checkQueryPatterns(ast, adapter, sourceCode, schemaConfig));
+    }
+    // Check SQL injection
+    violations.push(...checkSQLInjection(ast, adapter, sourceCode));
+    // Emit facts for the Stage 3 reducer. Fluent-builder references
+    // (`origin: 'query-builder'`) are excluded from the unknown-table check:
+    // a scratch/test table name carried by `db('t').select(...)` is not a
+    // schema catalog miss, and feeding it in flips the 10:1 fail-open ratio.
+    const fileFacts = {
+        tableRefs: tableRefs
+            .filter((r) => r.origin !== 'query-builder')
+            .map((r) => ({
+            table: r.table,
+            type: r.type,
+            line: r.location.line,
+            column: r.location.column,
+            context: r.context,
+        })),
+        ormTables,
+        tableProvenance: tableProvenances,
+    };
+    if (doDDL.length > 0) {
+        fileFacts.ddlOps = parseMigrationOps(doDDLSql, dialect ?? null);
+        if (doDDLColumns.length > 0)
+            fileFacts.ddlColumns = doDDLColumns;
+        if (Object.keys(doDDLTableColumns).length > 0)
+            fileFacts.ddlTableColumns = doDDLTableColumns;
+    }
+    return {
+        violations,
+        facts: { [context.filePath]: fileFacts },
+    };
+}
 /**
  * Schema code visitor (.ts/.tsx/.js/.jsx) — per-file analysis for naming conventions,
  * query patterns, SQL injection, table references, and ORM table extraction.
+ *
+ * @returns The schema-code stage-2 visitor.
  */
 export function createSchemaCodeVisitor() {
-    const getAnalyzer = lazySingleton(() => import('./analyzers/universal/UniversalSchemaAnalyzer.js').then((m) => ({
-        analyzer: new m.UniversalSchemaAnalyzer(),
-        defaults: m.DEFAULT_SCHEMA_CONFIG,
-        parseMigrationOps: m.parseMigrationOps,
-        extractDdlColumnNames: m.extractDdlColumnNames,
-        extractDdlTableColumns: m.extractDdlTableColumns,
-    })));
     return {
         name: 'schema-code',
         stage: 'visitor',
         extensions: ['.ts', '.tsx', '.js', '.jsx', '.mts', '.cts', '.mjs', '.cjs'],
         getRuleIds: () => getRuleIdsFor('schema'),
-        async visit(ast, adapter, context, sourceCode) {
-            const { analyzer: a, defaults, parseMigrationOps, extractDdlColumnNames, extractDdlTableColumns } = await getAnalyzer();
-            const pm = await _getProvenanceModule();
-            const violations = [];
-            const diagnostics = [];
-            const indexFacts = [];
-            // Pipeline config for this analyzer (moved before table extraction, needed
-            // by the table-source registry and provenance context).
-            const schemaConfig = (context.config ?? {});
-            // Spec 29 R2: Extract ORM table names via declarative table-source registry.
-            // Adding an ORM is now a config entry, not code.  Falls back to Drizzle
-            // entries when no user-specified tableSources are configured.
-            const ormTables = [];
-            const tableProvenances = [];
-            const tableSources = schemaConfig.tableSources ?? [
-                { kind: 'callee', name: 'pgTable', arg: 0, description: 'Drizzle PostgreSQL table' },
-                { kind: 'callee', name: 'mysqlTable', arg: 0, description: 'Drizzle MySQL table' },
-                { kind: 'callee', name: 'sqliteTable', arg: 0, description: 'Drizzle SQLite table' },
-            ];
-            if (tableSources.length > 0) {
-                const registered = extractTablesFromRegistry(tableSources, {
-                    ast: ast,
-                    adapter: adapter,
-                    sourceCode,
-                    filePath: context.filePath,
-                });
-                for (const { table, source } of registered) {
-                    ormTables.push(table);
-                    tableProvenances.push({ table, source });
-                }
-            }
-            // Extract DDL from sql.exec(...) string literals inside Durable Object classes.
-            // These are CREATE TABLE / DROP TABLE statements at runtime that migration
-            // discovery never sees.  Extracting them completes the authoritative catalog
-            // so unknown-table doesn't false-positive on DO-local tables.
-            const doDDL = [];
-            const doTemplateDDL = /`([^`]*(?:CREATE|DROP|ALTER)\s+(?:TABLE|VIRTUAL\s+TABLE)\s+[^`]+)`/gis;
-            const doStringDDL = /(["'])((?:\s*(?:CREATE|DROP|ALTER)\s+(?:TABLE|VIRTUAL\s+TABLE)\s+[^"']+))\1/gis;
-            let ddlMatch;
-            while ((ddlMatch = doTemplateDDL.exec(sourceCode)) !== null) {
-                const sql = ddlMatch[1].trim();
-                if (sql)
-                    doDDL.push(sql);
-            }
-            while ((ddlMatch = doStringDDL.exec(sourceCode)) !== null) {
-                const sql = ddlMatch[2].trim();
-                if (sql)
-                    doDDL.push(sql);
-            }
-            const doDDLSql = doDDL.length > 0 ? doDDL.join(';\n') : null;
-            const doDDLColumns = doDDLSql ? extractDdlColumnNames(doDDLSql) : [];
-            const doDDLTableColumns = doDDLSql ? extractDdlTableColumns(doDDLSql) : {};
-            // Build provenance context for this file — defaults from DEFAULT_SCHEMA_CONFIG
-            const detectionMode = schemaConfig.detection?.mode ?? 'hybrid';
-            const provenanceContext = pm.buildProvenanceContext(ast, adapter, sourceCode, {
-                mode: detectionMode,
-                dbReceiverNames: schemaConfig.dbReceiverNames ?? defaults.dbReceiverNames,
-                dbBindingNames: schemaConfig.dbBindingNames ?? defaults.dbBindingNames,
-                dbCallMethods: schemaConfig.dbCallMethods ?? defaults.dbCallMethods,
-                dbWrapperNames: schemaConfig.dbWrapperNames ?? defaults.dbWrapperNames,
-            });
-            // File gate — skip files without DB usage
-            if (!passesFileGate(context.filePath, sourceCode, schemaConfig, provenanceContext)) {
-                const facts = { [context.filePath]: { tableRefs: [], ormTables, tableProvenance: tableProvenances } };
-                if (doDDL.length > 0) {
-                    facts[context.filePath].ddlOps = parseMigrationOps(doDDLSql);
-                    if (doDDLColumns.length > 0)
-                        facts[context.filePath].ddlColumns = doDDLColumns;
-                    if (Object.keys(doDDLTableColumns).length > 0)
-                        facts[context.filePath].ddlTableColumns = doDDLTableColumns;
-                }
-                return { violations: [], facts };
-            }
-            // Build known-tables set from schemas config (pre-pipeline + DB-loaded schemas)
-            const schemas = schemaConfig.schemas ?? [];
-            const knownTablesArr = schemaConfig.knownTables ?? [];
-            const allTables = new Set();
-            for (const t of knownTablesArr)
-                allTables.add(t);
-            for (const schema of schemas) {
-                for (const table of (schema.tables ?? [])) {
-                    allTables.add(table.name);
-                }
-            }
-            // Find table references (per-file, uses allTables for short-id false-positive filtering)
-            const { references: tableRefs, unresolved } = findTableReferences(ast, adapter, sourceCode, { config: schemaConfig, provenanceContext, allTables });
-            // Record schema usage → emit as indexFacts via the shared instance
-            a.recordTableUsage(ast, adapter, context.filePath, tableRefs, sourceCode);
-            const pending = a.getPendingSchemaRecords();
-            // Emit clear-by-file + per-usage index facts
-            if (pending.clearFiles.length > 0) {
-                for (const filePath of pending.clearFiles) {
-                    indexFacts.push({ table: 'schema_usage', data: { _action: 'clear-by-file', file_path: filePath } });
-                }
-            }
-            for (const usage of pending.usages) {
-                indexFacts.push({
-                    table: 'schema_usage',
-                    data: {
-                        file_path: usage.filePath,
-                        table_name: usage.tableName,
-                        function_name: usage.functionName,
-                        function_start_line: usage.functionStartLine,
-                        function_start_column: usage.functionStartColumn,
-                        usage_type: usage.usageType,
-                        line: usage.line,
-                        column: usage.column,
-                        raw_query: usage.rawQuery,
-                        origin: usage.origin ?? null,
-                    },
-                });
-            }
-            // Check naming conventions
-            if (schemaConfig.checkNamingConventions !== false) {
-                violations.push(...checkNamingConventions(tableRefs, context.filePath));
-            }
-            // Spec 58 R1 — DB-call SQL held in an unresolvable identifier is a coverage
-            // diagnostic (the analyzer can't see the SQL), not a finding (the code isn't wrong).
-            if (schemaConfig.reportUnresolvedQueries !== false) {
-                diagnostics.push(...checkUnresolvedQueries(unresolved, context.filePath));
-            }
-            // Check query patterns
-            if (schemaConfig.validateQueryPatterns !== false) {
-                violations.push(...checkQueryPatterns(ast, adapter, sourceCode, schemaConfig));
-            }
-            // Check SQL injection
-            violations.push(...checkSQLInjection(ast, adapter, sourceCode));
-            // Emit facts for the Stage 3 reducer. Fluent-builder references
-            // (`origin: 'query-builder'`) are excluded from the unknown-table check:
-            // a scratch/test table name carried by `db('t').select(...)` is not a
-            // schema catalog miss, and feeding it in flips the 10:1 fail-open ratio.
-            const fileFacts = {
-                tableRefs: tableRefs
-                    .filter((r) => r.origin !== 'query-builder')
-                    .map((r) => ({
-                    table: r.table,
-                    type: r.type,
-                    line: r.location.line,
-                    column: r.location.column,
-                    context: r.context,
-                })),
-                ormTables,
-                tableProvenance: tableProvenances,
-            };
-            if (doDDL.length > 0) {
-                fileFacts.ddlOps = parseMigrationOps(doDDLSql);
-                if (doDDLColumns.length > 0)
-                    fileFacts.ddlColumns = doDDLColumns;
-                if (Object.keys(doDDLTableColumns).length > 0)
-                    fileFacts.ddlTableColumns = doDDLTableColumns;
-            }
-            return {
-                violations,
-                facts: { [context.filePath]: fileFacts },
-                indexFacts: indexFacts.length > 0 ? indexFacts : undefined,
-                ...(diagnostics.length > 0 && { diagnostics }),
-            };
-        },
+        visit: runSchemaCodeVisit,
         defaultConfig: {},
         description: 'Per-file schema analysis: naming conventions, query patterns, SQL injection, table references',
         category: 'database',
@@ -2431,6 +2542,8 @@ export function createSchemaCodeVisitor() {
 }
 /**
  * Schema Prisma visitor (.prisma files) — extracts model names for known-table catalog.
+ *
+ * @returns The schema-prisma stage-2 visitor.
  */
 export function createSchemaPrismaVisitor() {
     return {
@@ -2473,6 +2586,8 @@ export function createSchemaPrismaVisitor() {
 }
 /**
  * Schema JSON visitor (.json files) — parses JSON for the Stage 3 reducer to validate.
+ *
+ * @returns The schema-json stage-2 visitor.
  */
 export function createSchemaJsonVisitor() {
     return {
@@ -2494,11 +2609,329 @@ export function createSchemaJsonVisitor() {
         category: 'database',
     };
 }
+/**
+ * Flatten `allFacts` (keyed by visitor name, each value `{ [filePath]: facts }`)
+ * into per-file `[filePath, fact]` pairs.
+ */
+function* iteratePerFileFacts(allFacts) {
+    for (const [, visitorFacts] of Object.entries(allFacts)) {
+        if (typeof visitorFacts === 'object' && visitorFacts !== null) {
+            for (const [filePath, fact] of Object.entries(visitorFacts)) {
+                if (typeof fact === 'object' && fact !== null) {
+                    yield [filePath, fact];
+                }
+            }
+        }
+    }
+}
+/**
+ * Build the known-tables catalog (and derived column sets) from the schema-sql,
+ * schema-code, and schema-prisma facts. Also replays SQL migrations to compute
+ * drop provenance for stale-table-reference detection.
+ */
+function buildSchemaCatalog(allFacts) {
+    const knownTables = new Set();
+    const tableProvenances = new Map(); // table name → origins
+    // 1a. SQL DDL replay — collect all DDL facts, sort by numeric prefix, replay
+    const sqlFiles = [];
+    for (const [filePath, fact] of iteratePerFileFacts(allFacts)) {
+        if ('ddlOps' in fact) {
+            sqlFiles.push({ filePath, ops: fact.ddlOps });
+        }
+    }
+    // Sort by numeric prefix in basename: "009_something" < "0010_rename"
+    // Falls back to localeCompare for non-numeric-prefixed names.
+    const numericPrefix = (p) => {
+        const base = p.split('/').pop() ?? p;
+        const m = base.match(/^(\d+)/);
+        return m ? parseInt(m[1], 10) : 0;
+    };
+    sqlFiles.sort((a, b) => {
+        const na = numericPrefix(a.filePath);
+        const nb = numericPrefix(b.filePath);
+        if (na !== nb)
+            return na - nb;
+        return a.filePath.localeCompare(b.filePath);
+    });
+    // Drop provenance — the last migration that removed a table, and the tables
+    // that same migration introduced. Lets unknown-table detection distinguish
+    // "never existed" from "existed and was dropped": the latter is a stale code
+    // reference, not a typo. `dropProvenance` ends up holding exactly the tables
+    // dropped and not subsequently recreated (CREATE clears the entry).
+    const dropProvenance = new Map();
+    for (const sqlFile of sqlFiles) {
+        const before = new Set(knownTables);
+        applyMigrationOps(sqlFile.ops, knownTables);
+        // Record provenance for newly created tables
+        for (const table of knownTables) {
+            if (!before.has(table)) {
+                const sources = tableProvenances.get(table) ?? [];
+                sources.push({ table, tier: 'sql-migration', sourceFile: sqlFile.filePath, description: 'SQL migration' });
+                tableProvenances.set(table, sources);
+            }
+        }
+        // Genuinely-new tables introduced by this migration (excludes rename/rebuild
+        // churn like `ALTER … RENAME TO x_old` + re-CREATE of the same name).
+        const createdHere = [];
+        const createdTables = new Set();
+        const droppedTables = new Set();
+        for (const op of sqlFile.ops) {
+            const t = stripIdentifier(op.table);
+            if (op.op === 'CREATE') {
+                createdTables.add(t);
+                if (!before.has(t))
+                    createdHere.push(t);
+            }
+            else if (op.op === 'DROP') {
+                droppedTables.add(t);
+            }
+        }
+        for (const op of sqlFile.ops) {
+            const t = stripIdentifier(op.table);
+            if (op.op === 'DROP') {
+                dropProvenance.set(t, { migrationFile: sqlFile.filePath, createdInSameMigration: createdHere });
+            }
+            else if (op.op === 'CREATE') {
+                dropProvenance.delete(t);
+            }
+        }
+        // A table created and dropped within this same file is a self-contained
+        // fixture — a scratch table a test or script creates, uses, then tears
+        // down. Its DROP is teardown, not a migration, so it must neither surface
+        // as a stale-table-reference nor leave the name unknown: keep it known and
+        // clear the drop provenance this file recorded for it. (A genuine dropped
+        // table stays stale because its DROP lives in a migration that never also
+        // CREATEs it — e.g. recall's `generation_queue`, dropped in 0198.)
+        for (const t of createdTables) {
+            if (droppedTables.has(t)) {
+                knownTables.add(t);
+                if (dropProvenance.get(t)?.migrationFile === sqlFile.filePath) {
+                    dropProvenance.delete(t);
+                }
+            }
+        }
+    }
+    // 1b. ORM tables from code files — with provenance from the table-source registry
+    for (const [filePath, fact] of iteratePerFileFacts(allFacts)) {
+        const ormTables = fact.ormTables ?? [];
+        for (const t of ormTables)
+            knownTables.add(t);
+        const provenances = fact.tableProvenance ?? [];
+        for (const p of provenances) {
+            const sources = tableProvenances.get(p.table) ?? [];
+            sources.push(p.source);
+            tableProvenances.set(p.table, sources);
+        }
+    }
+    // 1c. Prisma models
+    for (const [filePath, fact] of iteratePerFileFacts(allFacts)) {
+        const prismaModels = fact.prismaModels ?? [];
+        for (const m of prismaModels) {
+            knownTables.add(m);
+            const sources = tableProvenances.get(m) ?? [];
+            sources.push({ table: m, tier: 'prisma-model', sourceFile: filePath, description: 'Prisma model' });
+            tableProvenances.set(m, sources);
+        }
+    }
+    // 1d. Aggregate DDL-declared columns (Spec 39 — derived applicability).
+    //      The schema-sql and schema-code visitors emit per-file `ddlColumns`;
+    //      the reducer folds them into a single case-insensitive, deduplicated
+    //      set so downstream applicability predicates can ask "does ANY table
+    //      carry a tenant-scoping column?" without per-table column lists.
+    //
+    //      Spec 62 Amendment B — additionally fold the per-table
+    //      `ddlTableColumns` into a corpus-wide `tableColumns` (Record<table,
+    //      string[]>) so the Stage-4 missing-org-filter reducer can answer the
+    //      per-query question "does THIS table carry a tenant column?" that the
+    //      flat set cannot.
+    const ddlColumns = new Set();
+    const tableColumnsMap = new Map();
+    for (const [filePath, fact] of iteratePerFileFacts(allFacts)) {
+        const cols = fact.ddlColumns ?? [];
+        for (const c of cols)
+            ddlColumns.add(String(c).toLowerCase());
+        const perTable = fact.ddlTableColumns ?? {};
+        for (const [table, tableCols] of Object.entries(perTable)) {
+            let set = tableColumnsMap.get(table);
+            if (!set) {
+                set = new Set();
+                tableColumnsMap.set(table, set);
+            }
+            for (const c of tableCols)
+                set.add(String(c).toLowerCase());
+        }
+    }
+    const tableColumns = {};
+    for (const [table, set] of tableColumnsMap)
+        tableColumns[table] = [...set];
+    return { knownTables, tableProvenances, dropProvenance, ddlColumns, tableColumns };
+}
+/**
+ * Merge external config tables into the catalog and detect table references
+ * that resolve to no known table. Emits `unknown-table` and
+ * `stale-table-reference` violations.
+ */
+function detectUnknownTables(opts) {
+    const { knownTables, tableProvenances, dropProvenance, allFacts, schemaConfig } = opts;
+    const violations = [];
+    // ── 2. Unknown-table detection ────────────────────────────────────────
+    //
+    // Fail-open guardrail: we can only accuse when the table catalog is
+    // built from authoritative sources.  Empty catalog → cannot accuse.
+    //
+    // Authoritative sources (independent of query sites, not circular):
+    //   • SQL migration files via schema-sql     (step 1a)
+    //   • ORM model definitions via schema-code  (step 1b)
+    //   • Prisma schemas via schema-prisma       (step 1c)
+    //
+    // External config tables (schemas from CodeIndexDB, wrangler.toml
+    // pre-discovered tables) are added as a bonus but are not required.
+    //
+    // NOT authoritative: tables inferred from query-text alone.  Those
+    // never enter the catalog (table refs are for checking, not building).
+    // Merge external tables from config (bonus, not required).
+    const externalKnownTables = schemaConfig.knownTables ?? [];
+    for (const t of externalKnownTables) {
+        knownTables.add(t);
+        const sources = tableProvenances.get(t) ?? [];
+        sources.push({ table: t, tier: 'external-config', description: 'External configuration' });
+        tableProvenances.set(t, sources);
+    }
+    // Also read the documented schemas config (structured {name, tables} objects).
+    // The standalone UniversalSchemaAnalyzer.analyze() path reads schemas; the
+    // pipeline reducer must read it too, otherwise configuring only schemas
+    // silently triggers fail-open (knownTables.size === 0).
+    const externalSchemas = schemaConfig.schemas ?? [];
+    for (const schema of externalSchemas) {
+        for (const table of schema.tables) {
+            knownTables.add(table.name);
+            const sources = tableProvenances.get(table.name) ?? [];
+            sources.push({ table: table.name, tier: 'external-config', description: `Schema: ${schema.name}` });
+            tableProvenances.set(table.name, sources);
+        }
+    }
+    if (knownTables.size > 0) {
+        // Collect all table references across all files
+        const allTableRefs = [];
+        for (const [filePath, fact] of iteratePerFileFacts(allFacts)) {
+            const refs = fact.tableRefs ?? [];
+            for (const ref of refs) {
+                allTableRefs.push({ file: filePath, ...ref });
+            }
+        }
+        // 10:1 fail-open ratio guard
+        const unknownRefs = allTableRefs.filter(ref => !knownTables.has(ref.table));
+        if (unknownRefs.length / Math.max(knownTables.size, 1) <= 10) {
+            for (const ref of unknownRefs) {
+                // The table existed and was dropped in a migration — a stale code
+                // reference, not a typo. Name the dropping migration and the tables
+                // that migration introduced (evidence, not proof of a successor).
+                const drop = dropProvenance.get(ref.table);
+                if (drop) {
+                    const migrationName = drop.migrationFile.split('/').pop() ?? drop.migrationFile;
+                    const created = drop.createdInSameMigration;
+                    const msg = created.length > 0
+                        ? `${ref.table} was dropped in ${migrationName}; that migration creates ${joinEnglish(created)}.`
+                        : `${ref.table} was dropped in ${migrationName} and was not recreated.`;
+                    violations.push({
+                        file: ref.file,
+                        line: ref.line,
+                        column: ref.column,
+                        severity: 'critical',
+                        message: msg,
+                        rule: 'stale-table-reference',
+                        analyzer: 'schema',
+                        symbol: ref.table,
+                        resolution: {
+                            action: 'update-stale-reference',
+                            // The tables `created` are evidence the migration replaced the
+                            // dropped table, not proof of a drop-in successor — schemas can
+                            // be split or changed incompatibly, in which case the file must
+                            // be removed rather than updated. The summary names them as
+                            // context and leaves update-vs-remove to the reviewer.
+                            summary: created.length > 0
+                                ? `The table '${ref.table}' was dropped in ${migrationName}. That migration introduces ${joinEnglish(created)} — review this reference and update or remove it.`
+                                : `The table '${ref.table}' was dropped in ${migrationName} and was not recreated — update or remove this reference.`,
+                            symbols: created.length > 0 ? created : [ref.table],
+                            files: [ref.file],
+                            lines: [ref.line],
+                        },
+                    });
+                    continue;
+                }
+                const suggestions = getNearestTableSuggestions(ref.table, knownTables, 2);
+                const msg = suggestions.length > 0
+                    ? `Reference to unknown table '${ref.table}' (${ref.type}). Did you mean: ${suggestions.join(', ')}?`
+                    : `Reference to unknown table '${ref.table}' (${ref.type})`;
+                const suggestionNames = suggestions.map((s) => s.replace(/^'|'$/g, ''));
+                violations.push({
+                    file: ref.file,
+                    line: ref.line,
+                    column: ref.column,
+                    severity: 'critical',
+                    message: msg,
+                    rule: 'unknown-table',
+                    analyzer: 'schema',
+                    symbol: ref.table,
+                    resolution: {
+                        action: suggestionNames.length > 0 ? 'use-known-table' : 'register-or-fix-table',
+                        summary: suggestionNames.length > 0
+                            ? `Rename the table reference '${ref.table}' to the nearest known table: ${suggestions.join(', ')}.`
+                            : `The table '${ref.table}' is not in the known catalog — register it, or fix the reference to a known table.`,
+                        symbols: suggestionNames.length > 0 ? suggestionNames : [ref.table],
+                        files: [ref.file],
+                        lines: [ref.line],
+                    },
+                });
+            }
+        }
+    }
+    return violations;
+}
+/**
+ * Validate JSON schemas found in the corpus. Best-effort: failures are non-fatal.
+ */
+function validateJsonSchemas(opts) {
+    const { schemaConfig, allFacts, context, analyzeJsonSchemas } = opts;
+    const violations = [];
+    if (schemaConfig.validateJsonSchemas !== false) {
+        try {
+            // Collect JSON file paths from the lightweight visitor markers, then
+            // parse each on demand so parsed objects never survive past this loop.
+            const jsonFiles = [];
+            for (const [filePath, fact] of iteratePerFileFacts(allFacts)) {
+                if ('isJson' in fact) {
+                    jsonFiles.push(filePath);
+                }
+            }
+            const readJson = (filePath) => {
+                const raw = context.readSource?.(filePath);
+                if (raw === undefined)
+                    return null;
+                try {
+                    const parsed = JSON.parse(raw);
+                    return parsed !== null && typeof parsed === 'object' ? parsed : null;
+                }
+                catch {
+                    return null;
+                }
+            };
+            const jsonResult = analyzeJsonSchemas(jsonFiles, readJson, schemaConfig);
+            violations.push(...(jsonResult?.violations ?? []));
+        }
+        catch (e) {
+            // JSON schema validation is best-effort (non-fatal)
+        }
+    }
+    return violations;
+}
 /**
  * Schema Stage 3 reducer — cross-file unknown-table detection and JSON schema validation.
  *
  * Consumes facts from schema-sql, schema-code, schema-prisma, and schema-json visitors.
  * Builds the complete known-tables catalog and checks all table references against it.
+ *
+ * @returns The schema stage-3 reducer.
  */
 export function createSchemaReducer() {
     const getAnalyzer = lazySingleton(() => import('./analyzers/universal/UniversalSchemaAnalyzer.js').then((m) => ({
@@ -2515,296 +2948,20 @@ export function createSchemaReducer() {
             const { analyzer: a, analyzeJsonSchemas } = await getAnalyzer();
             const violations = [];
             const schemaConfig = (context.config ?? {});
-            // allFacts is keyed by visitor name, each value is { [filePath]: { ...per-file facts } }
-            // Flatten to per-file iteration helpers.
-            const perFile = function* () {
-                for (const [, visitorFacts] of Object.entries(allFacts)) {
-                    if (typeof visitorFacts === 'object' && visitorFacts !== null) {
-                        for (const [filePath, fact] of Object.entries(visitorFacts)) {
-                            if (typeof fact === 'object' && fact !== null) {
-                                yield [filePath, fact];
-                            }
-                        }
-                    }
-                }
-            };
-            // ── 1. Build known-tables catalog ──────────────────────────────────────
-            const knownTables = new Set();
-            const tableProvenances = new Map(); // table name → origins
-            // 1a. SQL DDL replay — collect all DDL facts, sort by numeric prefix, replay
-            const sqlFiles = [];
-            for (const [filePath, fact] of perFile()) {
-                if ('ddlOps' in fact) {
-                    sqlFiles.push({ filePath, ops: fact.ddlOps });
-                }
-            }
-            // Sort by numeric prefix in basename: "009_something" < "0010_rename"
-            // Falls back to localeCompare for non-numeric-prefixed names.
-            const numericPrefix = (p) => {
-                const base = p.split('/').pop() ?? p;
-                const m = base.match(/^(\d+)/);
-                return m ? parseInt(m[1], 10) : 0;
-            };
-            sqlFiles.sort((a, b) => {
-                const na = numericPrefix(a.filePath);
-                const nb = numericPrefix(b.filePath);
-                if (na !== nb)
-                    return na - nb;
-                return a.filePath.localeCompare(b.filePath);
-            });
-            // Drop provenance — the last migration that removed a table, and the tables
-            // that same migration introduced. Lets unknown-table detection distinguish
-            // "never existed" from "existed and was dropped": the latter is a stale code
-            // reference, not a typo. `dropProvenance` ends up holding exactly the tables
-            // dropped and not subsequently recreated (CREATE clears the entry).
-            const dropProvenance = new Map();
-            for (const sqlFile of sqlFiles) {
-                const before = new Set(knownTables);
-                applyMigrationOps(sqlFile.ops, knownTables);
-                // Record provenance for newly created tables
-                for (const table of knownTables) {
-                    if (!before.has(table)) {
-                        const sources = tableProvenances.get(table) ?? [];
-                        sources.push({ table, tier: 'sql-migration', sourceFile: sqlFile.filePath, description: 'SQL migration' });
-                        tableProvenances.set(table, sources);
-                    }
-                }
-                // Genuinely-new tables introduced by this migration (excludes rename/rebuild
-                // churn like `ALTER … RENAME TO x_old` + re-CREATE of the same name).
-                const createdHere = [];
-                const createdTables = new Set();
-                const droppedTables = new Set();
-                for (const op of sqlFile.ops) {
-                    const t = stripIdentifier(op.table);
-                    if (op.op === 'CREATE') {
-                        createdTables.add(t);
-                        if (!before.has(t))
-                            createdHere.push(t);
-                    }
-                    else if (op.op === 'DROP') {
-                        droppedTables.add(t);
-                    }
-                }
-                for (const op of sqlFile.ops) {
-                    const t = stripIdentifier(op.table);
-                    if (op.op === 'DROP') {
-                        dropProvenance.set(t, { migrationFile: sqlFile.filePath, createdInSameMigration: createdHere });
-                    }
-                    else if (op.op === 'CREATE') {
-                        dropProvenance.delete(t);
-                    }
-                }
-                // A table created and dropped within this same file is a self-contained
-                // fixture — a scratch table a test or script creates, uses, then tears
-                // down. Its DROP is teardown, not a migration, so it must neither surface
-                // as a stale-table-reference nor leave the name unknown: keep it known and
-                // clear the drop provenance this file recorded for it. (A genuine dropped
-                // table stays stale because its DROP lives in a migration that never also
-                // CREATEs it — e.g. recall's `generation_queue`, dropped in 0198.)
-                for (const t of createdTables) {
-                    if (droppedTables.has(t)) {
-                        knownTables.add(t);
-                        if (dropProvenance.get(t)?.migrationFile === sqlFile.filePath) {
-                            dropProvenance.delete(t);
-                        }
-                    }
-                }
-            }
-            // 1b. ORM tables from code files — with provenance from the table-source registry
-            for (const [filePath, fact] of perFile()) {
-                const ormTables = fact.ormTables ?? [];
-                for (const t of ormTables)
-                    knownTables.add(t);
-                const provenances = fact.tableProvenance ?? [];
-                for (const p of provenances) {
-                    const sources = tableProvenances.get(p.table) ?? [];
-                    sources.push(p.source);
-                    tableProvenances.set(p.table, sources);
-                }
-            }
-            // 1c. Prisma models
-            for (const [filePath, fact] of perFile()) {
-                const prismaModels = fact.prismaModels ?? [];
-                for (const m of prismaModels) {
-                    knownTables.add(m);
-                    const sources = tableProvenances.get(m) ?? [];
-                    sources.push({ table: m, tier: 'prisma-model', sourceFile: filePath, description: 'Prisma model' });
-                    tableProvenances.set(m, sources);
-                }
-            }
-            // 1d. Aggregate DDL-declared columns (Spec 39 — derived applicability).
-            //      The schema-sql and schema-code visitors emit per-file `ddlColumns`;
-            //      the reducer folds them into a single case-insensitive, deduplicated
-            //      set so downstream applicability predicates can ask "does ANY table
-            //      carry a tenant-scoping column?" without per-table column lists.
-            //
-            //      Spec 62 Amendment B — additionally fold the per-table
-            //      `ddlTableColumns` into a corpus-wide `tableColumns` (Record<table,
-            //      string[]>) so the Stage-4 missing-org-filter reducer can answer the
-            //      per-query question "does THIS table carry a tenant column?" that the
-            //      flat set cannot.
-            const ddlColumns = new Set();
-            const tableColumnsMap = new Map();
-            for (const [filePath, fact] of perFile()) {
-                const cols = fact.ddlColumns ?? [];
-                for (const c of cols)
-                    ddlColumns.add(String(c).toLowerCase());
-                const perTable = fact.ddlTableColumns ?? {};
-                for (const [table, tableCols] of Object.entries(perTable)) {
-                    let set = tableColumnsMap.get(table);
-                    if (!set) {
-                        set = new Set();
-                        tableColumnsMap.set(table, set);
-                    }
-                    for (const c of tableCols)
-                        set.add(String(c).toLowerCase());
-                }
-            }
-            const tableColumns = {};
-            for (const [table, set] of tableColumnsMap)
-                tableColumns[table] = [...set];
-            // ── 2. Unknown-table detection ────────────────────────────────────────
-            //
-            // Fail-open guardrail: we can only accuse when the table catalog is
-            // built from authoritative sources.  Empty catalog → cannot accuse.
-            //
-            // Authoritative sources (independent of query sites, not circular):
-            //   • SQL migration files via schema-sql     (step 1a)
-            //   • ORM model definitions via schema-code  (step 1b)
-            //   • Prisma schemas via schema-prisma       (step 1c)
-            //
-            // External config tables (schemas from CodeIndexDB, wrangler.toml
-            // pre-discovered tables) are added as a bonus but are not required.
-            //
-            // NOT authoritative: tables inferred from query-text alone.  Those
-            // never enter the catalog (table refs are for checking, not building).
-            // Merge external tables from config (bonus, not required).
-            const externalKnownTables = schemaConfig.knownTables ?? [];
-            for (const t of externalKnownTables) {
-                knownTables.add(t);
-                const sources = tableProvenances.get(t) ?? [];
-                sources.push({ table: t, tier: 'external-config', description: 'External configuration' });
-                tableProvenances.set(t, sources);
-            }
-            // Also read the documented schemas config (structured {name, tables} objects).
-            // The standalone UniversalSchemaAnalyzer.analyze() path reads schemas; the
-            // pipeline reducer must read it too, otherwise configuring only schemas
-            // silently triggers fail-open (knownTables.size === 0).
-            const externalSchemas = schemaConfig.schemas ?? [];
-            for (const schema of externalSchemas) {
-                for (const table of schema.tables) {
-                    knownTables.add(table.name);
-                    const sources = tableProvenances.get(table.name) ?? [];
-                    sources.push({ table: table.name, tier: 'external-config', description: `Schema: ${schema.name}` });
-                    tableProvenances.set(table.name, sources);
-                }
-            }
-            if (knownTables.size > 0) {
-                // Collect all table references across all files
-                const allTableRefs = [];
-                for (const [filePath, fact] of perFile()) {
-                    const refs = fact.tableRefs ?? [];
-                    for (const ref of refs) {
-                        allTableRefs.push({ file: filePath, ...ref });
-                    }
-                }
-                // 10:1 fail-open ratio guard
-                const unknownRefs = allTableRefs.filter(ref => !knownTables.has(ref.table));
-                if (unknownRefs.length / Math.max(knownTables.size, 1) <= 10) {
-                    for (const ref of unknownRefs) {
-                        // The table existed and was dropped in a migration — a stale code
-                        // reference, not a typo. Name the dropping migration and the tables
-                        // that migration introduced (evidence, not proof of a successor).
-                        const drop = dropProvenance.get(ref.table);
-                        if (drop) {
-                            const migrationName = drop.migrationFile.split('/').pop() ?? drop.migrationFile;
-                            const created = drop.createdInSameMigration;
-                            const msg = created.length > 0
-                                ? `${ref.table} was dropped in ${migrationName}; that migration creates ${joinEnglish(created)}.`
-                                : `${ref.table} was dropped in ${migrationName} and was not recreated.`;
-                            violations.push({
-                                file: ref.file,
-                                line: ref.line,
-                                column: ref.column,
-                                severity: 'critical',
-                                message: msg,
-                                rule: 'stale-table-reference',
-                                analyzer: 'schema',
-                                symbol: ref.table,
-                                resolution: {
-                                    action: 'update-stale-reference',
-                                    // The tables `created` are evidence the migration replaced the
-                                    // dropped table, not proof of a drop-in successor — schemas can
-                                    // be split or changed incompatibly, in which case the file must
-                                    // be removed rather than updated. The summary names them as
-                                    // context and leaves update-vs-remove to the reviewer.
-                                    summary: created.length > 0
-                                        ? `The table '${ref.table}' was dropped in ${migrationName}. That migration introduces ${joinEnglish(created)} — review this reference and update or remove it.`
-                                        : `The table '${ref.table}' was dropped in ${migrationName} and was not recreated — update or remove this reference.`,
-                                    symbols: created.length > 0 ? created : [ref.table],
-                                    files: [ref.file],
-                                    lines: [ref.line],
-                                },
-                            });
-                            continue;
-                        }
-                        const suggestions = getNearestTableSuggestions(ref.table, knownTables, 2);
-                        const msg = suggestions.length > 0
-                            ? `Reference to unknown table '${ref.table}' (${ref.type}). Did you mean: ${suggestions.join(', ')}?`
-                            : `Reference to unknown table '${ref.table}' (${ref.type})`;
-                        const suggestionNames = suggestions.map((s) => s.replace(/^'|'$/g, ''));
-                        violations.push({
-                            file: ref.file,
-                            line: ref.line,
-                            column: ref.column,
-                            severity: 'critical',
-                            message: msg,
-                            rule: 'unknown-table',
-                            analyzer: 'schema',
-                            symbol: ref.table,
-                            resolution: {
-                                action: suggestionNames.length > 0 ? 'use-known-table' : 'register-or-fix-table',
-                                summary: suggestionNames.length > 0
-                                    ? `Rename the table reference '${ref.table}' to the nearest known table: ${suggestions.join(', ')}.`
-                                    : `The table '${ref.table}' is not in the known catalog — register it, or fix the reference to a known table.`,
-                                symbols: suggestionNames.length > 0 ? suggestionNames : [ref.table],
-                                files: [ref.file],
-                                lines: [ref.line],
-                            },
-                        });
-                    }
-                }
-            }
-            // ── 3. JSON schema validation ──────────────────────────────────────────
-            if (schemaConfig.validateJsonSchemas !== false) {
-                try {
-                    // Collect JSON file paths from the lightweight visitor markers, then
-                    // parse each on demand so parsed objects never survive past this loop.
-                    const jsonFiles = [];
-                    for (const [filePath, fact] of perFile()) {
-                        if ('isJson' in fact) {
-                            jsonFiles.push(filePath);
-                        }
-                    }
-                    const readJson = (filePath) => {
-                        const raw = context.readSource?.(filePath);
-                        if (raw === undefined)
-                            return null;
-                        try {
-                            const parsed = JSON.parse(raw);
-                            return parsed !== null && typeof parsed === 'object' ? parsed : null;
-                        }
-                        catch {
-                            return null;
-                        }
-                    };
-                    const jsonResult = analyzeJsonSchemas(jsonFiles, readJson, schemaConfig);
-                    violations.push(...(jsonResult?.violations ?? []));
-                }
-                catch (e) {
-                    // JSON schema validation is best-effort (non-fatal)
-                }
-            }
+            const { knownTables, tableProvenances, dropProvenance, ddlColumns, tableColumns } = buildSchemaCatalog(allFacts);
+            violations.push(...detectUnknownTables({
+                knownTables,
+                tableProvenances,
+                dropProvenance,
+                allFacts,
+                schemaConfig,
+            }));
+            violations.push(...validateJsonSchemas({
+                schemaConfig,
+                allFacts,
+                context,
+                analyzeJsonSchemas,
+            }));
             // ── 4. Build table catalog for metadata ───────────────────────────────
             const catalogEntries = [];
             for (const [table, sources] of tableProvenances) {
@@ -2813,7 +2970,7 @@ export function createSchemaReducer() {
             return {
                 violations,
                 facts: { tableCatalog: catalogEntries, ddlColumns: [...ddlColumns].sort(), tableColumns },
-                factsConsumed: [...perFile()].length,
+                factsConsumed: [...iteratePerFileFacts(allFacts)].length,
             };
         },
         defaultConfig: {},