code-auditor-mcp 4.1.1 → 5.0.2

package/dist/phase/receiverConsumers.js

@@ -0,0 +1,1063 @@
+/**
+ * Spec 70 Item 4 (step 3) — the corpus-side reductions for the four receiver
+ * consumers, over the `receiver-activity` file fact + the `receiver-provenance`
+ * fixed point.
+ *
+ * The collapse makes each receiver consumer a corpus producer: it reads (a) a raw
+ * file fact extracted while the AST lived, and (b) the provenance fixed point, and
+ * re-derives the file's `buildProvenanceContext().dbProvenanced` with no AST via
+ * `classifyBuildProvenance`. This module holds the shared rehydration + the gate
+ * mirror those reductions need, so each consumer's `process` is a thin projection
+ * over pre-rehydrated provenance. The rehydrators are the inverse of the file
+ * producers' serialization: `evidenceFromFact`/`tsExtractFromFact` rebuild the
+ * `ProvenanceEvidence`/`TsWithinFileProvenanceExtract` the classify seam reads, and
+ * `rehydrateReceiverActivity` rebuilds the `Binding`/`R3Site` inputs
+ * `classifyBuildProvenance` folds R3 over.
+ */
+import picomatch from 'picomatch';
+import { barePackageName } from '../analyzers/receiverRoot.js';
+import { classifyBuildProvenance, evidenceFromFact, rehydrateWithinFileProvenance, bindingFromFact } from './receiverProvenance.js';
+import { DEFAULT_SCHEMA_CONFIG } from '../analyzers/universal/schema/config.js';
+import { identifyHandle } from '../analyzers/handleIdentification.js';
+import { handleTypesForPackage } from '../analyzers/tsEcosystem.js';
+import { parseSqlTables } from '../analyzers/universal/schema/codeAnalysis.js';
+import { dialectForPackage } from '../languages/sql/dialectDetection.js';
+import { parseSql, DEFAULT_SQL_DIALECT, extractTableNames, whereFacts, isWriteStatement, isMassWriteStatement, isUpsertStatement, whereColumnRefs, isDdlStatementKind, } from '../languages/sql/sqlAst.js';
+import { rawInsertColumnsFromAst } from '../analyzers/universal/UniversalDataAccessAnalyzer.js';
+import { describeUnprovenReceiver, resolveSpecifier, makeHeritageResolver } from '../analyzers/receiverResolution.js';
+/** Merge a file's local `interfaceFields` with the corpus-wide ambient map:
+ *  local declarations win, and ambient (global-script) declarations fill in only
+ *  the names the file does not itself declare. Ordering is name-level, not
+ *  field-level — a name the file declares is used whole, so an `interface Env`
+ *  declared in-file shadows the global-script `Env` rather than being merged
+ *  field-by-field (that is how TypeScript's own declaration merging resolves a
+ *  local declaration against an ambient one in practice). */
+function mergeInterfaceFields(local, ambient) {
+    if (!local)
+        return ambient;
+    if (!ambient || ambient.size === 0)
+        return local;
+    const merged = new Map(ambient);
+    for (const [name, fields] of local)
+        merged.set(name, fields);
+    return merged;
+}
+/** Assemble a `FileReceiverEnv` from the per-file fold and the resolution tail.
+ *  Single constructor — the five consumers previously each built a near-identical
+ *  nine-field literal, which `dry/similar-expression` flagged as the same object
+ *  built five times. */
+function fileReceiverEnv(fold, tail) {
+    const { dbProvenanced, bindings, bindingsByScope, goEnv, interfaceFields } = fold;
+    const { sqlDialect, declaredTypePackages, ambientInterfaceFields, resolveImport, resolveHeritageField } = tail;
+    const mergedFields = mergeInterfaceFields(interfaceFields, ambientInterfaceFields);
+    return { dbProvenanced, bindings, bindingsByScope, goEnv, interfaceFields: mergedFields, sqlDialect, declaredTypePackages, resolveImport, resolveHeritageField };
+}
+/**
+ * Build the single specifier-resolution seam the consumers thread into
+ * `identifyHandle`'s TS env: one `filesByPath` set derived once from the
+ * within-file facts, so the four specifier kinds (relative, tsconfig-`paths`,
+ * bare vendor, and the `@/`/`~/` fallback) all answer through `resolveSpecifier`
+ * (Spec 70 B1). Returns null when there is no project root to resolve against —
+ * the env's `resolveImport` stays undefined and the classifier abstains as it did
+ * before the seam was threaded.
+ */
+function makeSpecifierResolver(withinFacts, projectRoot, tsconfig) {
+    if (!projectRoot)
+        return null;
+    const filesByPath = new Set(withinFacts.map((f) => f.file));
+    // Memoize the resolution keyed on (source, importerPath) so a specifier that
+    // resolved once in the run is never re-probed. `resolveSpecifier`'s vendor arm
+    // walks up from the importer's directory doing `readFileSync`/`existsSync`
+    // probes, and the same bare import is resolved once per candidate that
+    // references it; without the cache that filesystem work is repeated for every
+    // candidate across every file. The importer is part of the key because the
+    // relative arm (and a monorepo's nested `node_modules`) resolve per-directory.
+    const cache = new Map();
+    return (source, importerPath) => {
+        const key = `${source}\u0000${importerPath}`;
+        const hit = cache.get(key);
+        if (hit !== undefined)
+            return hit;
+        const resolved = resolveSpecifier(source, importerPath, filesByPath, projectRoot, tsconfig);
+        cache.set(key, resolved);
+        return resolved;
+    };
+}
+// ── Rehydrators — fact → the corpus-side classify input, no translation ──────
+/** Rehydrate one file's `receiver-activity` fact back to the three provenance
+ *  inputs `classifyBuildProvenance` reads: the `Binding` map (`identifyHandle`'s
+ *  declaration resolution), the `R3Site[]` (`applyR3FromSites`), and the DB-shaped
+ *  activity set (`passesFileGate`'s `dbActivity` signal).
+ * @param fact - The serialized `receiver-activity` fact (may be absent).
+ * @returns The rehydrated bindings, R3 sites, and DB-activity set. */
+export function rehydrateReceiverActivity(fact) {
+    if (!fact)
+        return { bindings: new Map(), bindingsByScope: new Map(), r3Sites: [], dbActivity: new Set() };
+    const bindings = new Map();
+    const bindingsByScope = new Map();
+    for (const b of fact.bindings) {
+        const binding = bindingFromFact(b);
+        // First wins (fact order == declaration order) — the flat map matches the
+        // legacy `buildBindingEnv` collapse for scope-agnostic consumers.
+        if (!bindings.has(b.name))
+            bindings.set(b.name, binding);
+        const scope = binding.scope ?? 0;
+        let byScope = bindingsByScope.get(b.name);
+        if (!byScope) {
+            byScope = new Map();
+            bindingsByScope.set(b.name, byScope);
+        }
+        if (!byScope.has(scope))
+            byScope.set(scope, binding);
+    }
+    return {
+        bindings,
+        bindingsByScope,
+        r3Sites: fact.r3Sites.map((s) => ({
+            root: s.root,
+            receiver: s.receiver,
+            method: s.method,
+            sqlArgument: s.sqlArgument,
+            thisField: s.thisField,
+            thisHeritage: s.thisHeritage,
+        })),
+        dbActivity: new Set(fact.dbActivity),
+    };
+}
+/** Rehydrate the `receiver-provenance` fact's `files` back to a per-file seed
+ *  map — the exact `FileProvenance[file]` the legacy `file.receiverProvenance`
+ *  carried, keyed by file path so a consumer can look up its seed.
+ * @param fact - The serialized `receiver-provenance` fixed point.
+ * @returns A per-file map of provenanced-name → evidence. */
+export function rehydrateReceiverProvenance(fact) {
+    const byFile = new Map();
+    for (const f of fact.files) {
+        byFile.set(f.file, new Map(f.provenance.map((e) => [e.identifier, evidenceFromFact(e)])));
+    }
+    return byFile;
+}
+/** Rehydrate the TS-family `within-file-provenance` facts back to a per-file
+ *  `TsWithinFileProvenanceExtract` map (Go facts are skipped — the receiver
+ *  consumers are TS-family-only).
+ * @param withinFacts - The `within-file-provenance` facts (TS-family + Go).
+ * @returns A per-file map of rehydrated `TsWithinFileProvenanceExtract` (Go skipped). */
+export function rehydrateWithinTsExtracts(withinFacts) {
+    const byFile = new Map();
+    for (const fact of withinFacts) {
+        if (fact.format === 'go')
+            continue;
+        const rehydrated = rehydrateWithinFileProvenance(fact);
+        if (rehydrated.kind === 'ts')
+            byFile.set(fact.file, rehydrated.projection);
+    }
+    return byFile;
+}
+/** Rehydrate the Go `within-file-provenance` facts back to a per-file
+ *  `GoWithinFileProvenanceExtract` map (TS facts are skipped). The Go extract is
+ *  the binding + import env the Go arm of `identifyHandle` reads — `data-access-calls`
+ *  is the one receiver consumer that runs for the `go` format, so its corpus
+ *  producer needs the Go extracts in addition to the TS ones.
+ * @param withinFacts - The `within-file-provenance` facts (TS-family + Go).
+ * @returns A per-file map of rehydrated `GoWithinFileProvenanceExtract` (TS skipped). */
+export function rehydrateWithinGoExtracts(withinFacts) {
+    const byFile = new Map();
+    for (const fact of withinFacts) {
+        if (fact.format !== 'go')
+            continue;
+        const rehydrated = rehydrateWithinFileProvenance(fact);
+        if (rehydrated.kind === 'go')
+            byFile.set(fact.file, rehydrated.projection);
+    }
+    return byFile;
+}
+/** Re-fold one file's DB-receiver environment from the rehydrated within-file
+ *  extracts + the cross-file seed — the shared setup for the `data-access-calls`
+ *  and `unproven-query-receivers` consumers. Go: the seed is the provenanced set
+ *  and the extract supplies the binding/import env. TS: `classifyBuildProvenance`
+ *  folds the seed + activity R3 sites + function wrappers into `dbProvenanced`,
+ *  and the activity supplies the bindings. */
+function foldReceiverEnvironment(opts) {
+    const { file, isGo, tsExtracts, goExtracts, seeds, activityByFile, sqlDialect } = opts;
+    if (isGo) {
+        const seed = seeds.get(file) ?? new Map();
+        const goExtract = goExtracts.get(file);
+        return {
+            dbProvenanced: seed,
+            bindings: new Map(),
+            bindingsByScope: new Map(),
+            goEnv: {
+                provenance: seed,
+                bindings: goExtract?.bindings ?? new Map(),
+                imports: goExtract?.imports ?? new Map(),
+            },
+            interfaceFields: undefined,
+        };
+    }
+    const extract = tsExtracts.get(file);
+    const activity = rehydrateReceiverActivity(activityByFile.get(file));
+    return {
+        dbProvenanced: extract
+            ? classifyBuildProvenance(extract, seeds.get(file) ?? new Map(), activity.bindings, activity.r3Sites, sqlDialect)
+            : new Map(),
+        bindings: activity.bindings,
+        bindingsByScope: activity.bindingsByScope,
+        goEnv: undefined,
+        interfaceFields: extract?.interfaceFields,
+    };
+}
+// ── The gate mirror ──────────────────────────────────────────────────────────
+/**
+ * The corpus-side mirror of `passesFileGate` for `mode !== 'names'` (the
+ * producers always build `mode: 'hybrid'`). The `names` arm never runs, and
+ * `hasSqlTag` — the one input the corpus producer cannot re-derive (it scans
+ * source text) — arrives pre-extracted in the raw fact. The glob + provenance +
+ * activity arms are byte-identical to the legacy gate.
+ */
+function passesFileGateRehydrated(filePath, hasSqlTag, dbProvenanced, dbActivity) {
+    const gateGlobs = DEFAULT_SCHEMA_CONFIG.fileGateGlobs ?? ['**/*.sql', '**/migrations/**'];
+    if (gateGlobs.some((glob) => picomatch.isMatch(filePath, glob)))
+        return true;
+    if (dbProvenanced.size > 0)
+        return true;
+    if (dbActivity.size > 0)
+        return true;
+    return hasSqlTag;
+}
+// ── `query-sites` reduction ──────────────────────────────────────────────────
+/**
+ * The corpus `query-sites` producer: re-derive each file's gate (glob ||
+ * dbProvenanced || dbActivity || hasSqlTag) from the raw `query-site-candidates`
+ * fact + the provenance fixed point, and emit the sites of the files that pass.
+ *
+ * A file's `dbProvenanced` is re-derived by `classifyBuildProvenance` from its
+ * within-file extract, its cross-file seed (`receiver-provenance`), and its
+ * `receiver-activity` inputs. Files are iterated in the raw fact's (file-sorted)
+ * order, so the emitted site array — and every finding derived from it — is
+ * byte-identical to the legacy gated extraction.
+ *
+ * @param candidates the raw `query-site-candidates` facts (one per TS-family file)
+ * @param withinFacts the `within-file-provenance` facts (TS-family)
+ * @param provenance the `receiver-provenance` fixed point
+ * @param activityFacts the `receiver-activity` facts
+ * @param sqlDialect the corpus's named dialect, or null to skip R3
+ * @returns the classified query-site facts (one per admitted TS-family site)
+ */
+export function classifyQuerySites(candidates, withinFacts, provenance, activityFacts, sqlDialect) {
+    const extracts = rehydrateWithinTsExtracts(withinFacts);
+    const seeds = rehydrateReceiverProvenance(provenance);
+    const activityByFile = new Map(activityFacts.map((f) => [f.file, f]));
+    const out = [];
+    for (const cand of candidates) {
+        const extract = extracts.get(cand.file);
+        // A file with no within-file extract (should not happen — both facts are
+        // TS-family, emitted for the same files) cannot re-derive provenance; its
+        // gate falls through to dbActivity/hasSqlTag/glob, matching a file with no
+        // within-file DB seed.
+        const activity = rehydrateReceiverActivity(activityByFile.get(cand.file));
+        const dbProvenanced = extract
+            ? classifyBuildProvenance(extract, seeds.get(cand.file) ?? new Map(), activity.bindings, activity.r3Sites, sqlDialect)
+            : new Map();
+        if (passesFileGateRehydrated(cand.file, cand.hasSqlTag, dbProvenanced, activity.dbActivity)) {
+            out.push(...cand.sites);
+        }
+    }
+    return out;
+}
+// ── `schema-usage` reduction ─────────────────────────────────────────────────
+/** True when `loc` falls inside the span [start, end] (all 1-based line/column). */
+function contains(start, end, loc) {
+    const afterStart = start.line < loc.line || (start.line === loc.line && start.column <= loc.column);
+    const beforeEnd = end.line > loc.line || (end.line === loc.line && end.column >= loc.column);
+    return afterStart && beforeEnd;
+}
+/** True when `a` starts at or after `b` — the "innermost wins" tiebreak. */
+function startsAtOrAfter(a, b) {
+    return a.line > b.line || (a.line === b.line && a.column >= b.column);
+}
+/** The corpus-side mirror of `dialectForEvidence` (private in provenance.ts):
+ *  the SQL dialect a DB-driver package's evidence names, or null. */
+function dialectForEvidence(evidence) {
+    if (!evidence?.packageName)
+        return null;
+    return dialectForPackage(evidence.packageName);
+}
+/** The corpus-side mirror of `resolveSiteDialect`'s member arm (provenance.ts):
+ *  the receiver text's package, then each dotted segment, first non-null wins. */
+function resolveSiteDialectFromReceiver(receiver, dbProvenanced) {
+    if (!receiver)
+        return null;
+    for (const candidate of [receiver, ...receiver.split('.')]) {
+        const dialect = dialectForEvidence(dbProvenanced.get(candidate));
+        if (dialect)
+            return dialect;
+    }
+    return null;
+}
+/**
+ * The corpus-side mirror of `findClosestNodeAt` + `findEnclosingFunctionIdentity`
+ * (the legacy re-home), over the projected spans. For an in-function reference
+ * the identity is the innermost enclosing function (the containing span with the
+ * latest start); for a top-level reference it is the `string_fragment` containing
+ * the reference — the deepest node `findClosestNodeAt` returns for a table name
+ * inside a SQL string — whose start becomes the coordinate.
+ */
+function rehomeReference(ref, filePath, functions, stringFragments) {
+    const loc = ref.location;
+    let fn = null;
+    for (const f of functions) {
+        const start = { line: f.startLine, column: f.startColumn };
+        if (contains(start, { line: f.endLine, column: f.endColumn }, loc) &&
+            (fn === null || startsAtOrAfter(start, { line: fn.startLine, column: fn.startColumn }))) {
+            fn = f;
+        }
+    }
+    if (fn) {
+        return {
+            tableName: ref.table,
+            filePath,
+            functionName: fn.name,
+            functionStartLine: fn.startLine,
+            functionStartColumn: fn.startColumn,
+            usageType: ref.type,
+            line: loc.line,
+            column: loc.column,
+            rawQuery: ref.context,
+            origin: ref.origin,
+        };
+    }
+    let frag = null;
+    for (const fr of stringFragments) {
+        const start = { line: fr.startLine, column: fr.startColumn };
+        if (contains(start, { line: fr.endLine, column: fr.endColumn }, loc) &&
+            (frag === null || startsAtOrAfter(start, { line: frag.startLine, column: frag.startColumn }))) {
+            frag = fr;
+        }
+    }
+    return {
+        tableName: ref.table,
+        filePath,
+        functionName: 'top-level',
+        functionStartLine: frag?.startLine ?? null,
+        functionStartColumn: frag?.startColumn ?? null,
+        usageType: ref.type,
+        line: loc.line,
+        column: loc.column,
+        rawQuery: ref.context,
+        origin: ref.origin,
+    };
+}
+/**
+ * The corpus-side mirror of `dbCallVerdict`'s provenance-dependent admission
+ * (`identifyHandle`). The raw producer already applied the structural gates
+ * (callee shape, method gate, root gate, resolvable SQL); this re-folds the
+ * handle verdict over the re-derived `dbProvenanced` + rehydrated bindings and
+ * drops `not-handle` (and, for a bare-identifier call, a name that is neither
+ * provenanced nor type-annotated). Returns the verdict plus the site dialect the
+ * caller's `parseSqlTables` needs, or null when the call is not admitted.
+ */
+function admitDbCall(call, env) {
+    const { dbProvenanced, bindings, sqlDialect, interfaceFields, declaredTypePackages, resolveImport, resolveHeritageField } = env;
+    const siteDialect = call.calleeType === 'identifier'
+        ? dialectForEvidence(dbProvenanced.get(call.name))
+        : resolveSiteDialectFromReceiver(call.receiver, dbProvenanced);
+    const dialect = siteDialect ?? sqlDialect ?? null;
+    const resolutionEnv = { provenance: dbProvenanced, bindings, interfaceFields, declaredTypePackages, resolveImport, resolveHeritageField, adapter: undefined, sourceCode: '' };
+    const facts = {
+        imports: new Map(),
+        typeAnnotations: new Map(),
+        bindings: new Map(),
+        withinFileProvenance: new Map(),
+        sqlDialect: dialect,
+        resolution: { dialect: 'ts', env: resolutionEnv },
+    };
+    if (call.calleeType === 'identifier') {
+        const binding = bindings.get(call.name);
+        const isProvenanced = dbProvenanced.has(call.name);
+        const isTypeAnnotated = !!binding && !!binding.typeText;
+        // A named import from a manifest DB package is a DB *signal* even when the
+        // name isn't a handle — admit it so `identifyHandle` proves `not-handle`
+        // rather than dropping the site for want of evidence (Spec 70).
+        const isDbPackageImport = !!binding && binding.kind === 'import' && handleTypesForPackage(binding.source ?? '') !== undefined;
+        if (!isProvenanced && !isTypeAnnotated && !isDbPackageImport)
+            return null;
+        const verdict = identifyHandle({
+            format: 'typescript',
+            root: call.name,
+            receiver: call.name,
+            method: call.name,
+            sqlArgument: call.sqlArgument,
+            thisField: false,
+        }, facts);
+        return verdict.kind === 'not-handle' ? null : { dialect };
+    }
+    const verdict = identifyHandle({
+        format: 'typescript',
+        root: call.root,
+        receiver: call.receiver ?? call.root,
+        method: call.method,
+        sqlArgument: call.sqlArgument,
+        thisField: call.thisField,
+    }, facts);
+    return verdict.kind === 'not-handle' ? null : { dialect };
+}
+/**
+ * The corpus `schema-usage` producer: re-derive each file's gate and its
+ * `dbProvenanced` from the raw `schema-usage-candidates` fact + the provenance
+ * fixed point, then re-admit and re-home the provenance-dependent references
+ * (tagged-template + DB-call) and append the provenance-free references the raw
+ * producer already re-homed (ORM / query-builder / collection-adapter).
+ *
+ * The emitted array is the legacy `extractSchemaUsage` output, byte-identical:
+ * strategy (1) tagged, (2) DB-call, (4) ORM, (5) query-builder, (6)
+ * collection-adapter — in that order, gated the same way, re-homed the same way.
+ *
+ * @param candidates the raw `schema-usage-candidates` facts (one per TS-family file)
+ * @param resolution the per-corpus resolution inputs (facts + dialect/project tail)
+ * @returns the classified schema-usage facts (strategies 1/2/4/5/6, in order)
+ */
+export function classifySchemaUsage(candidates, resolution) {
+    const { withinFacts, provenance, activityFacts, sqlDialect, declaredTypePackages, ambientInterfaceFields, projectRoot, tsconfig } = resolution;
+    const extracts = rehydrateWithinTsExtracts(withinFacts);
+    const seeds = rehydrateReceiverProvenance(provenance);
+    const activityByFile = new Map(activityFacts.map((f) => [f.file, f]));
+    const resolver = makeSpecifierResolver(withinFacts, projectRoot, tsconfig);
+    const heritageResolver = makeHeritageResolver(projectRoot, declaredTypePackages) ?? undefined;
+    const out = [];
+    for (const cand of candidates) {
+        const extract = extracts.get(cand.file);
+        const activity = rehydrateReceiverActivity(activityByFile.get(cand.file));
+        const dbProvenanced = extract
+            ? classifyBuildProvenance(extract, seeds.get(cand.file) ?? new Map(), activity.bindings, activity.r3Sites, sqlDialect)
+            : new Map();
+        if (!passesFileGateRehydrated(cand.file, cand.hasSqlTag, dbProvenanced, activity.dbActivity)) {
+            continue;
+        }
+        const sourceCode = cand.sourceCode;
+        const resolveImport = resolver ? (source) => resolver(source, cand.file) : undefined;
+        const env = fileReceiverEnv({ dbProvenanced, bindings: activity.bindings, bindingsByScope: activity.bindingsByScope, goEnv: undefined, interfaceFields: extract?.interfaceFields }, { sqlDialect, declaredTypePackages, ambientInterfaceFields, resolveImport, resolveHeritageField: heritageResolver });
+        // (1) Tagged-template SQL — re-admit by the tag's package dialect, parse.
+        for (const t of cand.tagged) {
+            const siteDialect = dialectForEvidence(dbProvenanced.get(t.tagName));
+            const dialect = siteDialect ?? sqlDialect ?? null;
+            const parsed = parseSqlTables(t.templateText, t.location, sourceCode, undefined, dialect, null);
+            for (const ref of parsed.references) {
+                out.push(rehomeReference(ref, cand.file, cand.functions, cand.stringFragments));
+            }
+        }
+        // (2) DB-call patterns — re-admit via `identifyHandle`, then parse. An
+        // unresolved candidate (`sqlText === null`) contributes no table references
+        // here; its `unresolved` record is re-derived by `classifyUnresolvedQuerySites`.
+        for (const call of cand.dbCalls) {
+            if (call.sqlText === null)
+                continue;
+            const admitted = admitDbCall(call, env);
+            if (!admitted)
+                continue;
+            const parsed = parseSqlTables(call.sqlText, call.location, sourceCode, undefined, admitted.dialect, null);
+            for (const ref of parsed.references) {
+                out.push(rehomeReference(ref, cand.file, cand.functions, cand.stringFragments));
+            }
+        }
+        // (4)(5)(6) ORM / query-builder / collection-adapter — re-homed raw-side.
+        out.push(...cand.ormRefs, ...cand.queryBuilderRefs, ...cand.collectionAdapterRefs);
+    }
+    return out;
+}
+/**
+ * Spec 70 1b — the corpus `unresolved-query` reduction. The legacy `schema-code`
+ * visitor emitted `checkUnresolvedQueries` for DB-calls `findTableReferences`
+ * admitted via `dbCallVerdict` (i.e. `identifyHandle` said "DB handle") but whose
+ * SQL argument was held in an unresolvable identifier. The collapse re-derives
+ * that surface with no AST: for each raw `schema-usage-candidates` fact, re-derive
+ * `dbProvenanced` (as `classifySchemaUsage` does), re-apply the file gate, then
+ * re-admit every `unresolved` candidate via `identifyHandle` — dropping any that
+ * are not DB handles — and emit the `unresolved-query` site record.
+ *
+ * @param candidates the raw `schema-usage-candidates` facts (one per TS-family file)
+ * @param resolution the per-corpus resolution inputs (facts + dialect/project tail)
+ * @returns the unresolved-query site records re-admitted via `identifyHandle`
+ */
+export function classifyUnresolvedQuerySites(candidates, resolution) {
+    const { withinFacts, provenance, activityFacts, sqlDialect, declaredTypePackages, ambientInterfaceFields, projectRoot, tsconfig } = resolution;
+    const extracts = rehydrateWithinTsExtracts(withinFacts);
+    const seeds = rehydrateReceiverProvenance(provenance);
+    const activityByFile = new Map(activityFacts.map((f) => [f.file, f]));
+    const resolver = makeSpecifierResolver(withinFacts, projectRoot, tsconfig);
+    const heritageResolver = makeHeritageResolver(projectRoot, declaredTypePackages) ?? undefined;
+    const out = [];
+    for (const cand of candidates) {
+        const extract = extracts.get(cand.file);
+        const activity = rehydrateReceiverActivity(activityByFile.get(cand.file));
+        const dbProvenanced = extract
+            ? classifyBuildProvenance(extract, seeds.get(cand.file) ?? new Map(), activity.bindings, activity.r3Sites, sqlDialect)
+            : new Map();
+        if (!passesFileGateRehydrated(cand.file, cand.hasSqlTag, dbProvenanced, activity.dbActivity)) {
+            continue;
+        }
+        const resolveImport = resolver ? (source) => resolver(source, cand.file) : undefined;
+        const env = fileReceiverEnv({ dbProvenanced, bindings: activity.bindings, bindingsByScope: activity.bindingsByScope, goEnv: undefined, interfaceFields: extract?.interfaceFields }, { sqlDialect, declaredTypePackages, ambientInterfaceFields, resolveImport, resolveHeritageField: heritageResolver });
+        for (const call of cand.dbCalls) {
+            if (call.unresolved === null)
+                continue;
+            // Re-admit via `identifyHandle` — mirror the legacy `dbCallVerdict` gate so
+            // a non-DB receiver (`page.$`, `$('.foo')`) never emits `unresolved-query`.
+            const admitted = admitDbCall(call, env);
+            if (!admitted)
+                continue;
+            out.push({ file: cand.file, identifier: call.unresolved.identifier, location: call.unresolved.location });
+        }
+    }
+    return out;
+}
+/**
+ * Spec 70 R2 — the corpus `unparseable` reduction. The legacy `schema-code`
+ * visitor emitted `checkUnparseableSql` for every DB-call / tagged-template SQL
+ * argument `findTableReferences` admitted but whose static text the named
+ * dialect could not parse (e.g. SQLite `PRAGMA`/`VACUUM`/`ANALYZE`). The collapse
+ * re-derives that surface with no AST: for each raw `schema-usage-candidates`
+ * fact, re-derive `dbProvenanced` (as `classifySchemaUsage` does), re-apply the
+ * file gate, then re-admit and re-parse every tagged template and DB-call
+ * candidate — collecting `parseSqlTables().unparseable` (which
+ * `classifySchemaUsage` discards) instead of its references. This is the
+ * `unparseable` sibling of {@link classifyUnresolvedQuerySites} (the
+ * `unresolved` half): the same re-derivation shape, a distinct output record.
+ *
+ * @param candidates the raw `schema-usage-candidates` facts (one per TS-family file)
+ * @param resolution the per-corpus resolution inputs (facts + dialect/project tail)
+ * @returns the unparseable-SQL records re-admitted via `identifyHandle`, each
+ *   stamped with its `file` (the legacy visitor emitted `checkUnparseableSql`
+ *   per-file, so the caller must be able to re-group by file)
+ */
+export function classifyUnparseableSql(candidates, resolution) {
+    const { withinFacts, provenance, activityFacts, sqlDialect, sqlDialectReason, declaredTypePackages, ambientInterfaceFields, projectRoot, tsconfig } = resolution;
+    const extracts = rehydrateWithinTsExtracts(withinFacts);
+    const seeds = rehydrateReceiverProvenance(provenance);
+    const activityByFile = new Map(activityFacts.map((f) => [f.file, f]));
+    const resolver = makeSpecifierResolver(withinFacts, projectRoot, tsconfig);
+    const heritageResolver = makeHeritageResolver(projectRoot, declaredTypePackages) ?? undefined;
+    const out = [];
+    for (const cand of candidates) {
+        const extract = extracts.get(cand.file);
+        const activity = rehydrateReceiverActivity(activityByFile.get(cand.file));
+        const dbProvenanced = extract
+            ? classifyBuildProvenance(extract, seeds.get(cand.file) ?? new Map(), activity.bindings, activity.r3Sites, sqlDialect)
+            : new Map();
+        if (!passesFileGateRehydrated(cand.file, cand.hasSqlTag, dbProvenanced, activity.dbActivity)) {
+            continue;
+        }
+        const sourceCode = cand.sourceCode;
+        const resolveImport = resolver ? (source) => resolver(source, cand.file) : undefined;
+        const env = fileReceiverEnv({ dbProvenanced, bindings: activity.bindings, bindingsByScope: activity.bindingsByScope, goEnv: undefined, interfaceFields: extract?.interfaceFields }, { sqlDialect, declaredTypePackages, ambientInterfaceFields, resolveImport, resolveHeritageField: heritageResolver });
+        // (1) Tagged-template SQL — re-admit by the tag's package dialect, parse.
+        for (const t of cand.tagged) {
+            const siteDialect = dialectForEvidence(dbProvenanced.get(t.tagName));
+            const dialect = siteDialect ?? sqlDialect ?? null;
+            const parsed = parseSqlTables(t.templateText, t.location, sourceCode, undefined, dialect, sqlDialectReason ?? null);
+            for (const u of parsed.unparseable)
+                out.push({ ...u, file: cand.file });
+        }
+        // (2) DB-call patterns — re-admit via `identifyHandle`, then parse. An
+        // unresolved candidate (`sqlText === null`) contributes no unparseable record
+        // here; its `unresolved` record is re-derived by `classifyUnresolvedQuerySites`.
+        for (const call of cand.dbCalls) {
+            if (call.sqlText === null)
+                continue;
+            const admitted = admitDbCall(call, env);
+            if (!admitted)
+                continue;
+            const parsed = parseSqlTables(call.sqlText, call.location, sourceCode, undefined, admitted.dialect, sqlDialectReason ?? null);
+            for (const u of parsed.unparseable)
+                out.push({ ...u, file: cand.file });
+        }
+    }
+    return out;
+}
+/** Project a candidate's `handle*` fields into the corpus-side `HandleIdentity`.
+ *  The two candidates differ only in `format` (data-access carries the raw
+ *  producer's format; loop-query is TS-only) and which field is the handle SQL
+ *  argument (`handleSqlArg` vs `sqlArg`) — everything else is the shared shape. */
+function handleIdentity(source, format, sqlArg) {
+    return {
+        format,
+        calleeType: source.handleCalleeType,
+        name: source.handleName,
+        root: source.handleRoot,
+        receiver: source.handleReceiver,
+        method: source.handleMethod,
+        thisField: source.handleThisField,
+        thisHeritage: source.handleThisHeritage,
+        sqlArg,
+        siteReceiver: source.handleSiteReceiver,
+        scope: source.handleRootScope ?? 0,
+    };
+}
+/** The identity of one data-access-call candidate (the `handle*` fields). */
+function dataAccessIdentity(cand) {
+    return handleIdentity(cand, cand.format, cand.handleSqlArg);
+}
+/** The identity of one loop-query candidate (TS-only; `sqlArg` is the handle
+ *  SQL-argument source, `handleSiteReceiver` the site-dialect receiver). */
+function loopQueryIdentity(cand) {
+    return handleIdentity(cand, 'typescript', cand.sqlArg);
+}
+/**
+ * The corpus-side mirror of `handleVerdictForCall` — re-fold `identifyHandle`
+ * over the re-derived `dbProvenanced` + rehydrated bindings (TS) or the Go
+ * resolution env (Go). The raw producer already applied every structural gate
+ * (callee shape, method/root gate, template → enclosing-call resolution), so the
+ * identity is already narrowed to a query-shaped call; what remains is the
+ * provenance-dependent gate the identifier arm alone carries (a bare name that is
+ * neither provenanced nor type-annotated is rejected before `identifyHandle`) and
+ * the verdict itself. Returns the tri-state verdict, or null when the shape is
+ * not query-shaped.
+ */
+/** A stable string key for one candidate's handle identity, for the shared
+ *  verdict cache. `sqlArg` and `siteReceiver` are part of the key because both
+ *  feed `identifyHandle` (the SQL-argument parse and the site-dialect parse). */
+function handleIdentityKey(id) {
+    return [
+        id.format,
+        id.calleeType ?? '',
+        id.name ?? '',
+        id.root ?? '',
+        id.receiver ?? '',
+        id.method ?? '',
+        id.thisField ? '1' : '0',
+        id.thisHeritage ?? '',
+        id.sqlArg ?? '',
+        id.siteReceiver ?? '',
+        String(id.scope),
+    ].join('\u0000');
+}
+function reFoldHandleVerdict(id, env, file, verdictCache) {
+    const key = verdictCache ? `${file}\u0000${handleIdentityKey(id)}` : null;
+    if (key !== null) {
+        const hit = verdictCache.get(key);
+        if (hit !== undefined)
+            return hit;
+    }
+    const result = foldHandleVerdict(id, env);
+    if (key !== null)
+        verdictCache.set(key, result);
+    return result;
+}
+function foldHandleVerdict(id, env) {
+    const { dbProvenanced, bindings, bindingsByScope, goEnv, sqlDialect, interfaceFields, declaredTypePackages, resolveImport, resolveHeritageField } = env;
+    if (id.format === 'go') {
+        if (!goEnv || id.calleeType !== 'member' || !id.root || !id.method)
+            return null;
+        return identifyHandle({
+            format: 'go',
+            root: id.root,
+            receiver: id.receiver ?? id.root,
+            method: id.method,
+            sqlArgument: id.sqlArg,
+            thisField: false,
+        }, {
+            imports: new Map(),
+            typeAnnotations: new Map(),
+            bindings: new Map(),
+            withinFileProvenance: new Map(),
+            sqlDialect: sqlDialect ?? null,
+            resolution: { dialect: 'go', env: goEnv },
+        });
+    }
+    if (id.calleeType === 'identifier') {
+        const name = id.name;
+        if (!name)
+            return null;
+        const binding = bindings.get(name);
+        const isProvenanced = dbProvenanced.has(name);
+        const isTypeAnnotated = !!binding &&
+            (binding.kind === 'variable' || binding.kind === 'field' || binding.kind === 'parameter') &&
+            !!binding.typeText;
+        if (!isProvenanced && !isTypeAnnotated)
+            return null;
+        const dialect = dialectForEvidence(dbProvenanced.get(name)) ?? sqlDialect ?? null;
+        const resolutionEnv = { provenance: dbProvenanced, bindings, bindingsByScope, interfaceFields, declaredTypePackages, resolveImport, resolveHeritageField, adapter: undefined, sourceCode: '' };
+        return identifyHandle({
+            format: 'typescript',
+            root: name,
+            receiver: name,
+            method: name,
+            sqlArgument: id.sqlArg,
+            thisField: false,
+            scope: id.scope,
+        }, {
+            imports: new Map(),
+            typeAnnotations: new Map(),
+            bindings: new Map(),
+            withinFileProvenance: new Map(),
+            sqlDialect: dialect,
+            resolution: { dialect: 'ts', env: resolutionEnv },
+        });
+    }
+    if (id.calleeType === 'member') {
+        if (!id.root || !id.method)
+            return null;
+        const dialect = resolveSiteDialectFromReceiver(id.siteReceiver, dbProvenanced) ?? sqlDialect ?? null;
+        const resolutionEnv = { provenance: dbProvenanced, bindings, bindingsByScope, interfaceFields, declaredTypePackages, resolveImport, resolveHeritageField, adapter: undefined, sourceCode: '' };
+        return identifyHandle({
+            format: 'typescript',
+            root: id.root,
+            receiver: id.receiver ?? id.root,
+            method: id.method,
+            sqlArgument: id.sqlArg,
+            thisField: id.thisField,
+            thisHeritage: id.thisHeritage,
+            scope: id.scope,
+        }, {
+            imports: new Map(),
+            typeAnnotations: new Map(),
+            bindings: new Map(),
+            withinFileProvenance: new Map(),
+            sqlDialect: dialect,
+            resolution: { dialect: 'ts', env: resolutionEnv },
+        });
+    }
+    return null;
+}
+/** The corpus-side mirror of `classifyCallType` (private in the analyzer): a
+ *  non-decision label — `sql` for a raw SQL query, `orm` for a query-builder
+ *  shape, `unknown` otherwise. No rule reads it. */
+function classifyCallType(isSqlQuery, isOrmCall) {
+    if (isSqlQuery)
+        return 'sql';
+    if (isOrmCall)
+        return 'orm';
+    return 'unknown';
+}
+/** The corpus-side mirror of `nextSymbol` (private in the analyzer): the next
+ *  stable per-file symbol key for a (function, method) pair. */
+function nextSymbol(fnName, method, ordinals) {
+    const base = `${fnName}:${method}`;
+    const ordinal = (ordinals.get(base) ?? 0) + 1;
+    ordinals.set(base, ordinal);
+    return ordinal > 1 ? `${base}:${ordinal}` : base;
+}
+/** Re-fold one candidate into a resolved query, mirroring `buildDatabaseCall`
+ *  byte-identically over the pre-extracted provenance-free fields plus the
+ *  already-re-folded handle verdict. */
+function buildDataAccessCall(cand, verdict, dbProvenanced, sqlDialect, learnedWrappers) {
+    // A call_expression rediscovered via its template argument is dropped in favour
+    // of the template (path 2).
+    if (cand.skipCallForTemplateArg)
+        return null;
+    const sqlArg = cand.sqlArg;
+    // `resolveSiteDialect` reads the node's *own* callee — the `site*` identity —
+    // distinct from the handle verdict's enclosing-call identity.
+    const siteDialect = cand.siteCalleeType === 'identifier'
+        ? cand.siteName
+            ? dialectForEvidence(dbProvenanced.get(cand.siteName))
+            : null
+        : resolveSiteDialectFromReceiver(cand.siteReceiver, dbProvenanced);
+    const dialect = siteDialect ?? sqlDialect ?? null;
+    const parsed = sqlArg !== null ? parseSql(sqlArg, dialect ?? DEFAULT_SQL_DIALECT) : null;
+    const sqlOk = parsed && parsed.ok ? parsed : null;
+    // DDL statements (CREATE/ALTER/DROP/USE) are schema definition, not a
+    // row-level data-access query: they carry no rows to filter and no tenant
+    // predicate to check. A variable assignment holding a migration body
+    // (`const up = \`CREATE TABLE …\``) must not surface as a data-access call —
+    // schema is read separately by the `.sql` visitor and Durable Object DDL.
+    if (sqlOk && isDdlStatementKind(sqlOk.kind))
+        return null;
+    const isOrmCall = cand.isOrmCall;
+    const isTaggedSqlCall = cand.isTaggedSqlCall;
+    const handleAdmits = verdict !== null && verdict.kind !== 'not-handle';
+    const isSqlPosition = handleAdmits || cand.isQueryBuilderShape;
+    const isSqlQuery = sqlOk !== null || isSqlPosition || isTaggedSqlCall;
+    if (!isSqlQuery && !isOrmCall)
+        return null;
+    const sqlAstNode = sqlOk ? sqlOk.ast : null;
+    const builderVerb = sqlAstNode ? null : cand.builderVerb;
+    const sqlTables = sqlAstNode ? extractTableNames(sqlAstNode) : [];
+    const ormTables = isOrmCall ? cand.ormTables : [];
+    const tables = [...new Set([...sqlTables, ...ormTables])];
+    const facts = sqlAstNode ? whereFacts(sqlAstNode) : null;
+    const hasFilter = (facts
+        ? (facts.hasWhere && !facts.whereIsTautology) || facts.hasHaving || facts.hasLimit
+        : false) ||
+        (isOrmCall && cand.ormHasFilter);
+    // Security: static arms 1–3 ran raw-side; arm 4 (a learned DB wrapper carrying
+    // bind params) is the one cross-file dependency, corrected here.
+    let security = {
+        parameterized: cand.staticParameterized,
+        injectionRisk: cand.staticInjectionRisk,
+        escaped: cand.staticEscaped,
+    };
+    if (cand.arm4CalleeName && learnedWrappers.has(cand.arm4CalleeName)) {
+        security = { parameterized: true, injectionRisk: false, escaped: false };
+    }
+    const injectionRisk = security.injectionRisk && verdict?.kind === 'handle';
+    return {
+        type: classifyCallType(isSqlQuery, isOrmCall),
+        method: cand.method,
+        file: cand.file,
+        line: cand.line,
+        column: cand.column,
+        tables,
+        queryText: cand.nodeText,
+        hasOrganizationFilter: cand.hasOrganizationFilter,
+        hasFilter,
+        isWrite: sqlAstNode ? isWriteStatement(sqlAstNode) : builderVerb !== null,
+        isMassWrite: sqlAstNode ? isMassWriteStatement(sqlAstNode) : builderVerb === 'update',
+        isUpsert: sqlAstNode
+            ? isUpsertStatement(sqlAstNode) || sqlOk?.conflictClauseTruncated === true
+            : false,
+        isRawInsert: sqlAstNode ? (sqlAstNode.type === 'insert' || sqlAstNode.type === 'replace') : false,
+        insertColumns: sqlAstNode ? rawInsertColumnsFromAst(sqlAstNode) : null,
+        sqlWhereColumns: sqlAstNode ? [...whereColumnRefs(sqlAstNode)] : null,
+        hasParameterizedQuery: security.parameterized,
+        hasSqlInjectionRisk: injectionRisk,
+        sqlEscaped: security.escaped,
+        enclosingFunction: cand.enclosingFunction,
+        resolvedWhere: cand.resolvedWhere ?? undefined,
+        handleVerdict: verdict ?? undefined,
+    };
+}
+/**
+ * The corpus `data-access-calls` producer: re-derive each file's `dbProvenanced`
+ * (TS via `classifyBuildProvenance`; Go via the fixed-point seed) from the raw
+ * `data-access-calls-candidates` fact + the provenance fixed point, then re-fold
+ * the legacy `extractDatabaseCalls` pipeline — discovery filter (`isDbCallCandidate`)
+ * → line dedup (template preferred, else first in pre-order) → `buildDatabaseCall`
+ * — with no AST. The dedup runs on the *discovered* set, not the built set, so a
+ * discovered-but-rejected node still shadows an admitted node on the same line
+ * exactly as the legacy pass did.
+ *
+ * @param candidates the raw `data-access-calls-candidates` facts (one per file)
+ * @param resolution the per-corpus resolution inputs (facts + dialect/project tail)
+ * @returns the resolved DB calls, deduped and rebuilt with no AST
+ */
+export function classifyDataAccessCalls(candidates, resolution) {
+    const { withinFacts, provenance, activityFacts, sqlDialect, declaredTypePackages, ambientInterfaceFields, projectRoot, tsconfig, verdictCache } = resolution;
+    const tsExtracts = rehydrateWithinTsExtracts(withinFacts);
+    const goExtracts = rehydrateWithinGoExtracts(withinFacts);
+    const seeds = rehydrateReceiverProvenance(provenance);
+    const activityByFile = new Map(activityFacts.map((f) => [f.file, f]));
+    const resolver = makeSpecifierResolver(withinFacts, projectRoot, tsconfig);
+    const heritageResolver = makeHeritageResolver(projectRoot, declaredTypePackages) ?? undefined;
+    // Group candidates by file, preserving the raw fact's (input-file) order.
+    const byFile = new Map();
+    for (const cand of candidates) {
+        let list = byFile.get(cand.file);
+        if (!list) {
+            list = [];
+            byFile.set(cand.file, list);
+        }
+        list.push(cand);
+    }
+    const out = [];
+    for (const [file, fileCands] of byFile) {
+        const isGo = fileCands[0].format === 'go';
+        const { dbProvenanced, bindings, bindingsByScope, goEnv, interfaceFields } = foldReceiverEnvironment({
+            file, isGo, tsExtracts, goExtracts, seeds, activityByFile, sqlDialect,
+        });
+        const learnedWrappers = new Set([...dbProvenanced.values()].filter((ev) => ev.reason === 'wrapper').map((ev) => ev.identifier));
+        const resolveImport = resolver ? (source) => resolver(source, file) : undefined;
+        const env = fileReceiverEnv({ dbProvenanced, bindings, bindingsByScope, goEnv, interfaceFields }, { sqlDialect, declaredTypePackages, ambientInterfaceFields, resolveImport, resolveHeritageField: heritageResolver });
+        // 1. Discovery filter — `isDbCallCandidate`, re-folding the handle verdict.
+        const discovered = [];
+        for (const cand of fileCands) {
+            const verdict = reFoldHandleVerdict(dataAccessIdentity(cand), env, file, verdictCache);
+            const handleAdmits = verdict !== null && verdict.kind !== 'not-handle';
+            const isCandidate = handleAdmits || cand.isQueryBuilderShape || cand.isTaggedSqlCall || cand.isVariableAssignmentSql;
+            if (isCandidate)
+                discovered.push({ cand, verdict });
+        }
+        // 2. Line dedup — `dedupeCandidateNodes` (template preferred, else first).
+        const byLine = new Map();
+        for (const d of discovered) {
+            const line = d.cand.line;
+            if (!byLine.has(line))
+                byLine.set(line, []);
+            byLine.get(line).push(d);
+        }
+        const unique = [];
+        for (const items of byLine.values()) {
+            if (items.length === 1) {
+                unique.push(items[0]);
+            }
+            else {
+                unique.push(items.find((it) => it.cand.isTemplateLiteral) ?? items[0]);
+            }
+        }
+        // 3. Build — `buildDatabaseCall` over the deduped set.
+        for (const { cand, verdict } of unique) {
+            const built = buildDataAccessCall(cand, verdict, dbProvenanced, sqlDialect, learnedWrappers);
+            if (built)
+                out.push(built);
+        }
+    }
+    return out;
+}
+/**
+ * The corpus `loop-queries` producer: re-derive each file's `dbProvenanced` (TS
+ * via `classifyBuildProvenance`), re-fold the strict-handle filter
+ * (`isDbCallNode`'s `identifyHandle`), dedup by loop byte-offset (one finding per
+ * loop, first wins), and assign the stable symbol. The provenance-free
+ * discriminators already ran in the raw producer; only the three
+ * provenance-dependent steps remain.
+ *
+ * @param candidates the raw `loop-query-candidates` facts (one per file)
+ * @param resolution the per-corpus resolution inputs (facts + dialect/project tail)
+ * @returns the resolved loop-query facts (deduped, stable symbols assigned)
+ */
+export function classifyLoopQueries(candidates, resolution) {
+    const { withinFacts, provenance, activityFacts, sqlDialect, declaredTypePackages, ambientInterfaceFields, projectRoot, tsconfig, verdictCache } = resolution;
+    const tsExtracts = rehydrateWithinTsExtracts(withinFacts);
+    const seeds = rehydrateReceiverProvenance(provenance);
+    const activityByFile = new Map(activityFacts.map((f) => [f.file, f]));
+    const resolver = makeSpecifierResolver(withinFacts, projectRoot, tsconfig);
+    const heritageResolver = makeHeritageResolver(projectRoot, declaredTypePackages) ?? undefined;
+    const byFile = new Map();
+    for (const cand of candidates) {
+        let list = byFile.get(cand.file);
+        if (!list) {
+            list = [];
+            byFile.set(cand.file, list);
+        }
+        list.push(cand);
+    }
+    const out = [];
+    for (const [file, fileCands] of byFile) {
+        const extract = tsExtracts.get(file);
+        const activity = rehydrateReceiverActivity(activityByFile.get(file));
+        const dbProvenanced = extract
+            ? classifyBuildProvenance(extract, seeds.get(file) ?? new Map(), activity.bindings, activity.r3Sites, sqlDialect)
+            : new Map();
+        const reported = new Set();
+        const loopOrdinals = new Map();
+        const resolveImport = resolver ? (source) => resolver(source, file) : undefined;
+        const env = fileReceiverEnv({ dbProvenanced, bindings: activity.bindings, bindingsByScope: activity.bindingsByScope, goEnv: undefined, interfaceFields: extract?.interfaceFields }, { sqlDialect, declaredTypePackages, ambientInterfaceFields, resolveImport, resolveHeritageField: heritageResolver });
+        for (const cand of fileCands) {
+            const verdict = reFoldHandleVerdict(loopQueryIdentity(cand), env, file, verdictCache);
+            if (!verdict || verdict.kind !== 'handle')
+                continue;
+            const dedupKey = String(cand.loopStartOffset);
+            if (reported.has(dedupKey))
+                continue;
+            reported.add(dedupKey);
+            const symbol = nextSymbol(cand.enclosingFunction, 'loop-query', loopOrdinals);
+            out.push({
+                file: cand.file,
+                line: cand.line,
+                column: cand.column,
+                symbol,
+                loopLine: cand.loopLine,
+                depth: cand.depth,
+            });
+        }
+    }
+    return out;
+}
+// ── `unproven-query-receivers` reduction (Spec 70 2c) ────────────────────────
+/**
+ * The corpus `unproven-query-receivers` reduction (Spec 70 2c) — the fifth
+ * receiver consumer, re-derived from the raw `data-access-calls-candidates` fact
+ * + the provenance fixed point with no AST. It re-folds `identifyHandle` per
+ * member candidate and emits an `UnprovenQueryReceiver` when the verdict is
+ * `unproven` and the call is query-shaped — mirroring the pre-pass's candidacy
+ * filter (language-independent string-arg, the SQL literal as admission proof)
+ * and its `root === null` skip (re-folded
+ * via `reFoldHandleVerdict`'s null on a missing root). This is the source for the
+ * `cannot-fire` coverage diagnostic, re-homed from `collectCannotFireDiagnostics`
+ * (which read the pre-pass's `unprovenQueryReceivers`).
+ *
+ * @param candidates the raw `data-access-calls-candidates` facts (one per file)
+ * @param resolution the per-corpus resolution inputs (facts + dialect/project tail)
+ * @returns the unproven query-receiver records, deduped and rebuilt
+ */
+export function classifyUnprovenQueryReceivers(candidates, resolution) {
+    const { withinFacts, provenance, activityFacts, sqlDialect, declaredTypePackages, ambientInterfaceFields, projectRoot, tsconfig, verdictCache } = resolution;
+    const tsExtracts = rehydrateWithinTsExtracts(withinFacts);
+    const goExtracts = rehydrateWithinGoExtracts(withinFacts);
+    const seeds = rehydrateReceiverProvenance(provenance);
+    const activityByFile = new Map(activityFacts.map((f) => [f.file, f]));
+    const resolver = makeSpecifierResolver(withinFacts, projectRoot, tsconfig);
+    const heritageResolver = makeHeritageResolver(projectRoot, declaredTypePackages) ?? undefined;
+    const byFile = new Map();
+    for (const cand of candidates) {
+        let list = byFile.get(cand.file);
+        if (!list) {
+            list = [];
+            byFile.set(cand.file, list);
+        }
+        list.push(cand);
+    }
+    const out = [];
+    for (const [file, fileCands] of byFile) {
+        const isGo = fileCands[0].format === 'go';
+        const { dbProvenanced, bindings, bindingsByScope, goEnv, interfaceFields } = foldReceiverEnvironment({
+            file, isGo, tsExtracts, goExtracts, seeds, activityByFile, sqlDialect,
+        });
+        // Re-fold each member candidate to its unproven verdict, then line-dedup —
+        // mirroring `classifyDataAccessCalls`'s step 2 (template preferred, else
+        // first). The broadened discovery matches both the `call_expression` node and
+        // its `template_string` child, so without the dedup one query-shaped site
+        // emits two identical cannot-fire diagnostics and doubles the coverage count.
+        const resolveImport = resolver ? (source) => resolver(source, file) : undefined;
+        const env = fileReceiverEnv({ dbProvenanced, bindings, bindingsByScope, goEnv, interfaceFields }, { sqlDialect, declaredTypePackages, ambientInterfaceFields, resolveImport, resolveHeritageField: heritageResolver });
+        const admitted = [];
+        for (const cand of fileCands) {
+            const id = dataAccessIdentity(cand);
+            // Candidacy filter only — mirror the pre-pass's member-callee gate (an
+            // identifier callee is not a query-shaped *call site*). A member call is
+            // *nominated* when it carries a static SQL argument (the sql-argument
+            // evidence source, `handleSqlArg`) or is genuinely query-shaped (the real
+            // `isQueryBuilderShape` test, carried on the candidate) — nomination is not
+            // admission. `reFoldHandleVerdict` → `identifyHandle` re-folds the
+            // discriminant over the re-derived provenance, so a null-arg `not-handle`
+            // root resolves to `not-handle` below.
+            if (id.calleeType !== 'member')
+                continue;
+            if (cand.handleSqlArg === null && !cand.isQueryBuilderShape)
+                continue;
+            const verdict = reFoldHandleVerdict(id, env, file, verdictCache);
+            if (!verdict || verdict.kind !== 'unproven')
+                continue;
+            // Fix 1 — admission requires evidence; the evidence test is on the SITE,
+            // not the receiver root. A candidate is a data-access site when it carries
+            // a SQL argument (the sql-argument source, `handleSqlArg`) OR its receiver
+            // is reached by declaration-resolution (a bare-package import). A SQL
+            // argument qualifies the site on its own — whatever the receiver resolves
+            // to, the site reports `unproven` (cannot-fire), never a silent clean.
+            // Only a candidate with *neither* source — no SQL argument, and a receiver
+            // root that does not reach a package (a local opaque type, an un-annotated
+            // parameter/factory-return/field, or a relative in-repo re-export) — is
+            // dropped as not-a-site.
+            if (cand.handleSqlArg === null) {
+                const rootBinding = id.root === null
+                    ? undefined
+                    : ((id.scope !== undefined ? bindingsByScope.get(id.root)?.get(id.scope) : undefined) ?? bindings.get(id.root));
+                if (!rootBinding ||
+                    rootBinding.kind !== 'import' ||
+                    barePackageName(rootBinding.source ?? '') === null) {
+                    continue;
+                }
+            }
+            admitted.push({ cand, verdict });
+        }
+        const byLine = new Map();
+        for (const a of admitted) {
+            const line = a.cand.line;
+            if (!byLine.has(line))
+                byLine.set(line, []);
+            byLine.get(line).push(a);
+        }
+        const unique = [];
+        for (const items of byLine.values()) {
+            unique.push(items.length === 1 ? items[0] : (items.find((it) => it.cand.isTemplateLiteral) ?? items[0]));
+        }
+        for (const { cand, verdict } of unique) {
+            const id = dataAccessIdentity(cand);
+            const receiver = id.receiver ?? id.root ?? '(unknown)';
+            const root = id.root ?? receiver;
+            const method = id.method ?? '';
+            const reason = describeUnprovenReceiver(receiver, method, root, verdict.reason, cand.isQueryBuilderShape, isGo ? 'go' : 'typescript');
+            out.push({ file, line: cand.line, receiver, root, method, reason });
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=receiverConsumers.js.map