code-auditor-mcp 4.1.1 → 5.0.2

package/dist/auditRunner.js

@@ -6,15 +6,16 @@ import { promises as fs } from 'fs';
 import path from 'path';
 import { execFileSync } from 'child_process';
 import { randomUUID } from 'node:crypto';
-import { AuditAbortedError, AuditHandoffError, } from './types.js';
-import { discoverFiles, discoverFilesDetailed } from './utils/fileDiscovery.js';
+import os from 'node:os';
+import { AuditAbortedError, } from './types.js';
+import { discoverFiles, discoverFilesDetailed, getSourceExtensions } from './utils/fileDiscovery.js';
 import { FileAccounting } from './services/fileAccounting.js';
 import { loadConfig, findConfigFileUp } from './config/configLoader.js';
 import { mergePathProfiles } from './config/defaults.js';
+import { resolvePathProfile } from './config/pathProfiles.js';
 import { checkThresholdRationales } from './config/thresholdRationales.js';
 import { readProjectLintThresholds, thresholdsToAnalyzerConfig } from './config/lintConfigReader.js';
 import { computeThresholdSources } from './config/effectiveConfig.js';
-import { ALL_ANALYZERS } from './analyzers/ruleRegistry.js';
 import { applyPresets, getPreset } from './presets/presets.js';
 import { generateReport } from './reporting/reportGenerator.js';
 import { extractFunctionsFromFile } from './functionScanner.js';
@@ -22,17 +23,27 @@ import { isMcpDebugEnabled, logMcpDebug, logMcpInfo } from './mcpDiagnostics.js'
 import { loadBaseline, matchFindings, hashBaseline } from './baseline.js';
 import { applyDismissals } from './dismissals.js';
 import { computeImpact, LATENCY_BUDGET_MS } from './graph/blastRadius.js';
-import { readTsconfigAliases, readPackageEntryPoints, DEFAULT_VIRTUAL_MODULES } from './graph/importClassification.js';
+import { buildResolutionEnvironment } from './graph/resolutionEnvironment.js';
 // Import universal analyzers
 import { initializeLanguages } from './languages/index.js';
 import { initializeOrmAdapters } from './analyzers/orm/index.js';
 import { syncStyleIndex } from './styles/styleIndexer.js';
 import { CodeIndexDB } from './codeIndexDB.js';
+import { notifyLegacyIndexLocation } from './legacyIndexNotice.js';
 import { writeAuditToLedger, detectRunInput } from './ledger.js';
 // Pipeline imports (Spec 25 — pipeline replaces hand-rolled analyzer loop)
-import { runPipeline, writeIndexFactsToDb, makeVisitorStatus, getFilesProcessed, isVisitorStatus, buildCoverageReport } from './pipeline.js';
-import { createSolidVisitor, createDryVisitor, createDataAccessVisitor, createOrgFilterReducer, createDocumentationVisitor, createSecretsVisitor, createSecurityVisitor, createFunctionIndexVisitor, createStylesCssVisitor, createStylesSourceVisitor, createReactVisitor, createStylesReducer, createConventionsReducer, createCrossDomainReducer, createInvariantsReducer, createSchemaSqlVisitor, createSchemaCodeVisitor, createSchemaPrismaVisitor, createSchemaJsonVisitor, createSchemaReducer, createCrossLanguageEntityVisitor, createSchemaValidatorReducer, createAPIContractReducer, createDependencyGraphReducer, } from './pipelineAdapters.js';
+import { runPipeline, makeVisitorStatus, getFilesProcessed, isVisitorStatus } from './pipeline.js';
+import { getRuleTimingSortedDesc } from './analyzers/ruleTiming.js';
+import { createFunctionIndexVisitor, createStylesCssVisitor, createStylesSourceVisitor, createStylesReducer, createInvariantsReducer, createSchemaCodeVisitor, } from './pipelineAdapters.js';
 import { computeSizeDistributions } from './reporting/sizeDistribution.js';
+import { splitRoutes, attributeRoutes, enabledMigratedRules } from './phase/routing.js';
+import { runPhaseModel } from './phase/phaseModel.js';
+import { resolvePhaseThresholds } from './phase/config.js';
+import { deriveCoverage, presentFormatsOf } from './phase/coverage.js';
+import { MIGRATED_RULES, RULE_ANALYZER } from './phase/rules/registry.js';
+import { seedDryPairs, resolveBlockConfig } from './phase/rules/dry.js';
+import { checkUnresolvedReceiverImports, checkUnprovenQueryReceivers, checkUnresolvedQueries, checkUnparseableSql, dedupeCannotFireByReceiver } from './analyzers/universal/schema/codeAnalysis.js';
+import { readProjectManifest, computeManifestStaleness } from './analyzers/manifestStaleness.js';
 // Package version — stamped into the build (see constants.ts), not read from
 // package.json at runtime, so a stale binary reports the version it was built as.
 import { PACKAGE_VERSION } from './constants.js';
@@ -44,1076 +55,1538 @@ initializeOrmAdapters();
 /** Schema sub-visitor names — shown as separate rows in the CLI table. */
 const SCHEMA_SUB_VISITORS = ['schema-sql', 'schema-code', 'schema-prisma', 'schema-json'];
 /**
- * Create an audit runner with the given options
+ * CPU time consumed since `start` (a prior `process.cpuUsage()` snapshot), in
+ * milliseconds. Load-independent: wall clock measures how long the run took on
+ * the wall (inflated by co-tenant load), CPU time measures how much processor
+ * the run's rules actually burned. The gate-budget check asserts on this.
  */
-export function createAuditRunner(options = {}) {
-    const analyzerRegistry = Object.fromEntries(ALL_ANALYZERS.map((name) => [name, { name }]));
-    /**
-     * Load configuration from file
-     */
-    async function loadConfiguration(configPath) {
-        const { config } = await loadConfig({ configPath, projectRoot: path.dirname(configPath) });
-        return { ...options, ...config };
+function cpuDurationMs(start) {
+    const cpu = process.cpuUsage(start);
+    return (cpu.user + cpu.system) / 1000;
+}
+/** An empty visitor result for an analyzer that emitted nothing this run. The
+ *  call sites below shared the same four-field object literal (violations,
+ *  status, executionTime, analyzerName); this factory keeps the shape in one
+ *  place so a new field can't drift between them. */
+function makeEmptyAnalyzerResult(analyzerName, filesProcessed) {
+    return {
+        violations: [],
+        status: makeVisitorStatus(filesProcessed),
+        executionTime: 0,
+        analyzerName,
+    };
+}
+/**
+ * Spec 68 §15 — the full pipeline stage set, always run. Derived from the
+ * migrated rules' own `analyzer` labels (each `RuleDefinition` carries the
+ * namespace it re-emits into) plus the pipeline-only `invariants` reducer
+ * (user-defined rules from `.codeauditor.json`; it auto-disables when none are
+ * configured). No selection remains: `indexOnly` skips analysis wholesale, but
+ * config cannot pick a subset of analyzers.
+ */
+const RUN_ANALYZERS = [
+    ...new Set(MIGRATED_RULES.map((r) => r.analyzer)),
+    'invariants',
+].sort();
+/**
+ * §6.6 — the phase-model pool size. Defaults to `max(1, cpus - 1)` and is a
+ * config threshold (env `CODE_AUDITOR_WORKERS`), never a selection gate: the
+ * fact merge is file-sorted, so the value never reorders findings (§6.4).
+ * `CODE_AUDITOR_WORKERS=1` is the determinism-test escape hatch that forces the
+ * serial path for byte-identical-report comparisons.
+ */
+function resolveWorkerCount() {
+    const env = Number(process.env.CODE_AUDITOR_WORKERS);
+    if (Number.isInteger(env) && env > 0)
+        return env;
+    return Math.max(1, os.cpus().length - 1);
+}
+/**
+ * Resolve the effective run configuration: load `.codeauditor.json` (walking up
+ * from the audit path so a scoped `--path src` still finds project-root config),
+ * enforce the Spec 36 R5 threshold-rationale guard, merge the project's own lint
+ * thresholds as a base layer, apply shareable presets, and merge built-in path
+ * profiles. Returns everything `run` needs to proceed plus the diagnostics that
+ * surface in result metadata (`rejected`, `lintConfigDiagnostics`).
+ */
+async function resolveRunConfig(baseOptions, runOptions) {
+    const rootForConfig = runOptions?.projectRoot || baseOptions.projectRoot || process.cwd();
+    const configPath = await findConfigFileUp(rootForConfig);
+    let fileConfig = {};
+    let rejected = [];
+    if (configPath) {
+        const loaded = await loadConfig({ configPath, projectRoot: rootForConfig });
+        fileConfig = loaded.config;
+        rejected = loaded.rejected;
     }
-    /**
-     * Run the audit
-     */
-    async function run(runOptions) {
-        // Auto-load .codeauditor.json so the programmatic API respects the same
-        // config the CLI surface reads. Walk UP from the audit path so a scoped
-        // audit (`--path src`) still finds the project-root config rather than
-        // silently using defaults. RunOptions (caller) override file config, and
-        // createAuditRunner options override both.
-        const rootForConfig = runOptions?.projectRoot || options.projectRoot || process.cwd();
-        const configPath = await findConfigFileUp(rootForConfig);
-        let fileConfig = {};
-        let rejected = [];
-        if (configPath) {
-            const loaded = await loadConfig({ configPath, projectRoot: rootForConfig });
-            fileConfig = loaded.config;
-            rejected = loaded.rejected;
-        }
-        const mergedOptions = { ...fileConfig, ...options, ...runOptions };
-        // Spec 36 R5 — a threshold change needs a written rationale. Check the
-        // user-facing analyzerConfigs layer (project config + inline options)
-        // BEFORE presets merge in, so curated presets never trip the guard. Any
-        // changed threshold without a rationale is a config error, not a warning.
-        const thresholdCheck = checkThresholdRationales(mergedOptions.analyzerConfigs, mergedOptions.rationales);
-        if (thresholdCheck.errors.length > 0) {
-            const message = [
-                'Configuration error — threshold changes require a rationale (Spec 36 R5):',
-                ...thresholdCheck.errors.map((e) => `  - ${e}`),
-            ].join('\n');
-            throw new Error(message);
-        }
-        const thresholdChanges = thresholdCheck.changes.map((c) => ({
-            key: c.key,
-            defaultValue: c.defaultValue,
-            effectiveValue: c.effectiveValue,
-        }));
-        // ── Spec 50 R2 — project lint config as threshold authority ──────────
-        // Read the project's own ESLint config (flat or legacy) and merge its size
-        // thresholds (max-lines-per-function, max-params, complexity) as a base layer
-        // UNDER the user's analyzerConfigs. Because we only fill keys the project did
-        // not set, `.codeauditor.json` always wins. Runs AFTER checkThresholdRationales
-        // so lint-sourced values (the project's own declared lint rules, not a
-        // code-auditor threshold decision) never trip the Spec 36 R5 guard. Fail-open:
-        // no config, or an unloadable config, is absent — defaults, not an error.
-        const projectAnalyzerConfigs = (mergedOptions.analyzerConfigs ?? {});
-        const lintRoot = path.resolve(mergedOptions.projectRoot || process.cwd());
-        const lintResult = await readProjectLintThresholds(lintRoot);
-        const lintThresholds = lintResult?.thresholds ?? {};
-        // Spec 61 R3.2 — an ESLint config that exists but could not be read
-        // statically is a `cannot-fire` coverage diagnostic, surfaced (never
-        // silently treated as "no config").
-        const lintConfigDiagnostics = lintResult?.diagnostic ? [lintResult.diagnostic] : [];
-        if (Object.keys(lintThresholds).length > 0) {
-            mergedOptions.analyzerConfigs = mergeLintUnderProject(thresholdsToAnalyzerConfig(lintThresholds), projectAnalyzerConfigs);
+    const mergedOptions = { ...fileConfig, ...baseOptions, ...runOptions };
+    // Spec 36 R5 — a threshold change needs a written rationale. Check the
+    // user-facing analyzerConfigs layer (project config + inline options)
+    // BEFORE presets merge in, so curated presets never trip the guard. Any
+    // changed threshold without a rationale is a config error, not a warning.
+    const thresholdCheck = checkThresholdRationales(mergedOptions.analyzerConfigs, mergedOptions.rationales);
+    if (thresholdCheck.errors.length > 0) {
+        const message = [
+            'Configuration error — threshold changes require a rationale (Spec 36 R5):',
+            ...thresholdCheck.errors.map((e) => `  - ${e}`),
+        ].join('\n');
+        throw new Error(message);
+    }
+    const thresholdChanges = thresholdCheck.changes.map((c) => ({
+        key: c.key,
+        defaultValue: c.defaultValue,
+        effectiveValue: c.effectiveValue,
+    }));
+    // ── Spec 50 R2 — project lint config as threshold authority ──────────
+    // Read the project's own ESLint config (flat or legacy) and merge its size
+    // thresholds (max-lines-per-function, max-params, complexity) as a base layer
+    // UNDER the user's analyzerConfigs. Because we only fill keys the project did
+    // not set, `.codeauditor.json` always wins. Runs AFTER checkThresholdRationales
+    // so lint-sourced values never trip the Spec 36 R5 guard. Fail-open: no config,
+    // or an unloadable config, is absent — defaults, not an error.
+    const projectAnalyzerConfigs = (mergedOptions.analyzerConfigs ?? {});
+    const lintRoot = path.resolve(mergedOptions.projectRoot || process.cwd());
+    const lintResult = await readProjectLintThresholds(lintRoot);
+    const lintThresholds = lintResult?.thresholds ?? {};
+    // Spec 61 R3.2 — an ESLint config that exists but could not be read
+    // statically is a `cannot-fire` coverage diagnostic, surfaced (never
+    // silently treated as "no config").
+    const lintConfigDiagnostics = lintResult?.diagnostic ? [lintResult.diagnostic] : [];
+    if (Object.keys(lintThresholds).length > 0) {
+        mergedOptions.analyzerConfigs = mergeLintUnderProject(thresholdsToAnalyzerConfig(lintThresholds), projectAnalyzerConfigs);
+    }
+    // Resolve shareable presets (Spec 38 R4). Unknown ids are dropped (matching
+    // mergePresets semantics); the merged preset layer becomes the base under
+    // the project config / run options already present in mergedOptions.
+    const presetIds = Array.isArray(mergedOptions.presets) ? mergedOptions.presets : [];
+    if (presetIds.length > 0) {
+        mergedOptions.analyzerConfigs = applyPresets(presetIds, mergedOptions.analyzerConfigs);
+    }
+    // Spec 50 R2 — which config layer supplied each size threshold (coverage output).
+    const resolvedPresets = presetIds
+        .map((id) => getPreset(id))
+        .filter((p) => p !== undefined);
+    const thresholdSources = computeThresholdSources({
+        projectConfig: projectAnalyzerConfigs,
+        lintThresholds,
+        presets: resolvedPresets,
+    });
+    // Always merge built-in path profiles — corpus audits and projects without
+    // .codeauditor.json must still get the built-in scripts-and-tests profile.
+    mergedOptions.pathProfiles = mergePathProfiles(mergedOptions.pathProfiles, mergedOptions.builtin);
+    return {
+        mergedOptions,
+        configPath,
+        rejected,
+        lintConfigDiagnostics,
+        thresholdChanges,
+        thresholdSources,
+    };
+}
+/**
+ * Resolve the audit's file set from the configured scope (`all`, `git:<ref>`,
+ * `changed`, or an explicit files array), detect changed functions for scoped
+ * runs, compute blast-radius impact for those functions, and re-walk discovery
+ * for the unfiltered corpus file list (the import classifier's input — see the
+ * Spec 60.1 Correction 1 comment below). Returns everything `run` needs to
+ * build the pipeline, plus `scope`/`isScoped`/`scopeResultType` for downstream
+ * metadata and the ledger.
+ */
+async function discoverAuditFiles(mergedOptions, root, fileAccounting) {
+    const scope = mergedOptions.scope ?? 'all';
+    const isScoped = scope !== 'all';
+    const scopeResultType = isScoped ? 'scoped' : 'full';
+    reportProgress(mergedOptions, {
+        phase: 'discovery',
+        message: `Discovering files... (scope: ${scopeResultType})`
+    });
+    const { files, skippedExtensions } = await resolveDiscoveryScope(mergedOptions, scope, fileAccounting);
+    throwIfAborted(mergedOptions.abortSignal);
+    // Detect changed functions for non-all scopes
+    let changedFunctions;
+    if (isScoped && files.length > 0) {
+        changedFunctions = await detectChangedFunctionsForScope(mergedOptions, files);
+    }
+    let blastRadius;
+    if (isScoped && changedFunctions && changedFunctions.length > 0) {
+        blastRadius = await computeBlastRadiusForScope(mergedOptions, changedFunctions);
+    }
+    const corpusFiles = await buildImportClassifierCorpus(mergedOptions, root, files, isScoped);
+    logMcpInfo('discovery', 'file discovery finished', {
+        projectRoot: path.resolve(root),
+        totalFiles: files.length,
+        corpusFiles: corpusFiles.length,
+        scope: scopeResultType,
+        indexFunctions: !!mergedOptions.indexFunctions
+    });
+    return {
+        files,
+        changedFunctions,
+        skippedExtensions,
+        blastRadius,
+        corpusFiles,
+        scope,
+        isScoped,
+        scopeResultType,
+    };
+}
+/**
+ * Resolve the audit scope into a concrete file list. This is the dispatch the
+ * orchestrator used to hold inline: `git:<ref>` diffs the worktree, `changed`
+ * reads the index's modified-file set, an array of paths/globs is an explicit
+ * files scope, and anything else is the full discovery walk.
+ */
+async function resolveDiscoveryScope(mergedOptions, scope, fileAccounting) {
+    let files;
+    // Extensions present on disk that discovery skipped (Spec 43 R5 follow-up).
+    // Populated only for the `all` scope — scoped runs are explicitly scoped by
+    // the user, so "what wasn't analyzed" there is the scope itself, not the
+    // extension filter.
+    let skippedExtensions;
+    if (typeof scope === 'string' && scope.startsWith('git:')) {
+        // git:<ref> scope
+        const gitRef = scope.slice(4);
+        files = resolveGitScopeFiles(mergedOptions, gitRef);
+        logMcpInfo('discovery', 'git scope resolved', {
+            ref: gitRef,
+            fileCount: files.length
+        });
+    }
+    else if (scope === 'changed') {
+        // Changed scope: detect modified files. Fail open on an unavailable index
+        // (a future schema version is the sharpest case): when the caller pinned
+        // explicit files we audit those without touching the index; otherwise there
+        // is nothing to diff against, so the run degrades to zero files and the
+        // analyze phase reports the index skip as a coverage diagnostic (never a
+        // fatal — the hook must complete with the exit code it would otherwise have).
+        let db;
+        try {
+            db = CodeIndexDB.getInstance(undefined, mergedOptions.projectRoot || process.cwd());
+            await db.initialize();
         }
-        // Resolve shareable presets (Spec 38 R4). Unknown ids are dropped (matching
-        // mergePresets semantics); the merged preset layer becomes the base under
-        // the project config / run options already present in mergedOptions.
-        const presetIds = Array.isArray(mergedOptions.presets) ? mergedOptions.presets : [];
-        if (presetIds.length > 0) {
-            mergedOptions.analyzerConfigs = applyPresets(presetIds, mergedOptions.analyzerConfigs);
+        catch (err) {
+            logMcpInfo('discovery', 'changed scope index unavailable (continuing)', {
+                error: err instanceof Error ? err.message : String(err)
+            });
         }
-        // Spec 50 R2 — which config layer supplied each size threshold (coverage output).
-        const resolvedPresets = presetIds
-            .map((id) => getPreset(id))
-            .filter((p) => p !== undefined);
-        const thresholdSources = computeThresholdSources({
-            projectConfig: projectAnalyzerConfigs,
-            lintThresholds,
-            presets: resolvedPresets,
+        const modifiedFiles = mergedOptions.explicitFiles !== undefined
+            ? mergedOptions.explicitFiles
+            : (db ? await db.detectModifiedFiles(path.resolve(mergedOptions.projectRoot || process.cwd())) : []);
+        files = [...new Set(modifiedFiles.map((f) => path.resolve(f)))].sort();
+        logMcpInfo('discovery', 'changed scope resolved', {
+            fileCount: files.length
         });
-        // Always merge built-in path profiles — corpus audits and projects without
-        // .codeauditor.json must still get the built-in scripts-and-tests profile.
-        mergedOptions.pathProfiles = mergePathProfiles(mergedOptions.pathProfiles, mergedOptions.builtin);
-        const startTime = Date.now();
-        // ── Scope resolution ─────────────────────────────────────────────
-        const scope = mergedOptions.scope ?? 'all';
-        const isScoped = scope !== 'all';
-        const scopeResultType = isScoped ? 'scoped' : 'full';
-        reportProgress(mergedOptions, {
-            phase: 'discovery',
-            message: `Discovering files... (scope: ${scopeResultType})`
+    }
+    else if (Array.isArray(scope)) {
+        // files scope: explicit file paths/globs
+        files = await resolveFilesScope(mergedOptions, scope);
+        logMcpInfo('discovery', 'files scope resolved', {
+            fileCount: files.length
         });
-        // Discover files based on scope
-        let files;
-        let changedFunctions;
-        // Extensions present on disk that discovery skipped (Spec 43 R5 follow-up).
-        // Populated only for the `all` scope — scoped runs are explicitly scoped by
-        // the user, so "what wasn't analyzed" there is the scope itself, not the
-        // extension filter.
-        let skippedExtensions;
-        // Spec 44 — file accounting accumulator, owned by the run. Threaded through
-        // discovery (full `all` scope) and the pipeline (stage 1/2) so every touched
-        // file lands in exactly one terminal state and the balance can be asserted.
-        const fileAccounting = new FileAccounting();
-        if (typeof scope === 'string' && scope.startsWith('git:')) {
-            // git:<ref> scope
-            const gitRef = scope.slice(4);
-            files = resolveGitScopeFiles(mergedOptions, gitRef);
-            logMcpInfo('discovery', 'git scope resolved', {
-                ref: gitRef,
-                fileCount: files.length
-            });
-        }
-        else if (scope === 'changed') {
-            // Changed scope: detect modified files
-            const db = CodeIndexDB.getInstance(undefined, mergedOptions.projectRoot || process.cwd());
-            await db.initialize();
-            const modifiedFiles = mergedOptions.explicitFiles !== undefined
-                ? mergedOptions.explicitFiles
-                : await db.detectModifiedFiles(path.resolve(mergedOptions.projectRoot || process.cwd()));
-            files = [...new Set(modifiedFiles.map((f) => path.resolve(f)))].sort();
-            logMcpInfo('discovery', 'changed scope resolved', {
-                fileCount: files.length
-            });
+    }
+    else {
+        // all scope: current behavior
+        const discovered = await discoverProjectFiles(mergedOptions, fileAccounting);
+        files = discovered.files;
+        skippedExtensions = discovered.skippedExtensions;
+    }
+    return { files, skippedExtensions };
+}
+/**
+ * Detect changed functions for a scoped run via the code index (Spec 60.1).
+ * Returns `undefined` when the index is unavailable — the caller treats that as
+ * "no diff to report", never a fatal.
+ */
+async function detectChangedFunctionsForScope(mergedOptions, files) {
+    try {
+        const db = CodeIndexDB.getInstance(undefined, mergedOptions.projectRoot || process.cwd());
+        await db.initialize();
+        const detection = await db.detectChangedFunctions(files);
+        logMcpInfo('discovery', 'changed function detection', {
+            changedFunctionCount: detection.changedFunctions.length,
+            deletedCount: detection.deletedFunctions.length,
+            errors: detection.errors.length
+        });
+        return detection.changedFunctions;
+    }
+    catch (err) {
+        logMcpInfo('discovery', 'changed function detection failed (continuing)', {
+            error: err instanceof Error ? err.message : String(err)
+        });
+        return undefined;
+    }
+}
+/**
+ * Compute transitive-caller impact for changed functions (Spec 14 R6). Advisory:
+ * on error, or when the 100ms budget is exceeded, this returns `undefined` and
+ * the feature is disabled for the run — never a fatal.
+ */
+async function computeBlastRadiusForScope(mergedOptions, changedFunctions) {
+    try {
+        const db = CodeIndexDB.getInstance(undefined, mergedOptions.projectRoot || process.cwd());
+        const rawDb = db.rawDb;
+        const functionIds = [];
+        // One batched query per chunk of changed functions, not one query per
+        // function (loop-query). `changedFunctions` can be large, so chunk to the
+        // SQLite bind-parameter cap; `ORDER BY id` + first-wins by (name, file_path)
+        // reproduces the old `.get` (first matching row) semantics exactly.
+        const idByKey = new Map();
+        const BATCH = 900;
+        for (let i = 0; i < changedFunctions.length; i += BATCH) {
+            const chunk = changedFunctions.slice(i, i + BATCH);
+            const orClause = chunk.map(() => '(name = ? AND file_path = ?)').join(' OR ');
+            const params = chunk.flatMap((fn) => [fn.name, fn.filePath]);
+            const rows = rawDb.prepare(`SELECT id, name, file_path FROM functions WHERE ${orClause} ORDER BY id`).all(...params);
+            for (const r of rows) {
+                const key = `${r.name}\0${r.file_path}`;
+                if (!idByKey.has(key))
+                    idByKey.set(key, r.id);
+            }
         }
-        else if (Array.isArray(scope)) {
-            // files scope: explicit file paths/globs
-            files = await resolveFilesScope(mergedOptions, scope);
-            logMcpInfo('discovery', 'files scope resolved', {
-                fileCount: files.length
-            });
+        for (const fn of changedFunctions) {
+            const id = idByKey.get(`${fn.name}\0${fn.filePath}`);
+            if (id != null)
+                functionIds.push(id);
         }
-        else {
-            // all scope: current behavior
-            const discovered = await discoverProjectFiles(mergedOptions, fileAccounting);
-            files = discovered.files;
-            skippedExtensions = discovered.skippedExtensions;
+        if (functionIds.length === 0)
+            return undefined;
+        const impact = computeImpact(rawDb, functionIds);
+        if (impact.latencyMs > LATENCY_BUDGET_MS) {
+            logMcpInfo('blast-radius', `latency ${impact.latencyMs}ms exceeds ${LATENCY_BUDGET_MS}ms budget — blast radius disabled for this run`, {});
+            return undefined;
         }
-        throwIfAborted(mergedOptions.abortSignal);
-        // Detect changed functions for non-all scopes
-        if (isScoped && files.length > 0) {
+        logMcpInfo('blast-radius', 'computed', {
+            editedFunctionCount: impact.editedFunctionCount,
+            transitiveCallers: impact.transitiveCallers,
+            reachableExports: impact.reachableExports,
+            latencyMs: impact.latencyMs,
+        });
+        return impact;
+    }
+    catch (err) {
+        // Blast radius is advisory — non-fatal
+        logMcpInfo('blast-radius', 'computation failed (continuing)', {
+            error: err instanceof Error ? err.message : String(err)
+        });
+        return undefined;
+    }
+}
+/**
+ * Build the import classifier's corpus file set (Spec 60.1 Correction 1). The
+ * classifier's corpus must be the UNFILTERED stage-1 discovery list, not the
+ * audit's `files` list, which is narrowed at two points before `_infra` is
+ * built:
+ *   1. The polyglot dispatch narrows `files` to the per-language list it
+ *      actually hands to the TypeScript analyzer — files with no detectable
+ *      language (`.json`, `.sql`) drop out here.
+ *   2. `filterFiles` (fileDiscovery.ts, called from `findFiles`) applies
+ *      `includePaths` as a positive-selection glob filter — a `.json` file that
+ *      survives step 1 is dropped here (or by the default `includePaths` from
+ *      config/defaults.ts, which omits `.json`).
+ * Either way `_infra.files` no longer contains `.json`, so a real
+ * `./invariant-rules.schema.json` import classifies `internal-broken`.
+ * Classification answers "does this import resolve to a real file", independent
+ * of what the audit chooses to analyze.
+ *
+ * For a full (`all`) audit the corpus is the unfiltered discovery walk. For a
+ * scoped run that walk is the defect Spec 68 §hook-contract names: a
+ * single-file scope must not enumerate the whole project. A scoped run's corpus
+ * is instead "the files in scope + whatever the index already holds about the
+ * rest" — the indexed source files (`functions.file_path`) plus every file the
+ * index has ever resolved an import to (`import_specifiers.resolved_path`, which
+ * is how non-function import targets like `.json`/`.css`/`.sql` stay classifiable
+ * without a walk). If the index is unavailable the corpus degrades to the
+ * in-scope files alone — out-of-scope imports then read `internal-broken`, never
+ * a fatal.
+ */
+async function buildImportClassifierCorpus(mergedOptions, root, files, isScoped) {
+    if (!isScoped) {
+        return discoverFiles(root);
+    }
+    const corpus = new Set(files);
+    try {
+        const db = CodeIndexDB.getInstance(undefined, mergedOptions.projectRoot || process.cwd());
+        await db.initialize();
+        const indexed = db.rawDb
+            .prepare('SELECT DISTINCT file_path AS p FROM functions')
+            .all();
+        for (const { p } of indexed)
+            corpus.add(p);
+        const resolved = db.rawDb
+            .prepare('SELECT DISTINCT resolved_path AS p FROM import_specifiers WHERE resolved_path IS NOT NULL')
+            .all();
+        for (const { p } of resolved)
+            corpus.add(p);
+    }
+    catch {
+        // Index unavailable — the in-scope files alone remain the corpus.
+    }
+    return [...corpus].sort();
+}
+/**
+ * Collect per-file function metadata for the index (Spec 44 / Spec 60.1). Only
+ * script files are extracted here; Go files are indexed by the SOLID analyzer
+ * directly. Threads the abort signal and a progress callback so a long extraction
+ * stays cancellable and observable.
+ */
+async function collectIndexedFunctions(mergedOptions, files) {
+    let collectedFunctions = [];
+    const fileToFunctionsMap = new Map(); // Track functions per file for sync
+    if (mergedOptions.indexFunctions) {
+        reportProgress(mergedOptions, {
+            phase: 'function-indexing',
+            message: 'Collecting functions from files...'
+        });
+        // Collect functions from TypeScript/JavaScript files
+        // Note: Go files will be indexed by the Universal SOLID analyzer directly
+        const scriptFiles = files.filter(f => f.endsWith('.ts') || f.endsWith('.tsx') ||
+            f.endsWith('.js') || f.endsWith('.jsx') ||
+            f.endsWith('.mts') || f.endsWith('.cts') ||
+            f.endsWith('.mjs') || f.endsWith('.cjs'));
+        logMcpInfo('function-indexing', 'extracting functions from script files', {
+            scriptFileCount: scriptFiles.length
+        });
+        for (let i = 0; i < scriptFiles.length; i++) {
             try {
-                const db = CodeIndexDB.getInstance(undefined, mergedOptions.projectRoot || process.cwd());
-                await db.initialize();
-                const detection = await db.detectChangedFunctions(files);
-                changedFunctions = detection.changedFunctions;
-                logMcpInfo('discovery', 'changed function detection', {
-                    changedFunctionCount: changedFunctions.length,
-                    deletedCount: detection.deletedFunctions.length,
-                    errors: detection.errors.length
+                if (i % 10 === 0) {
+                    throwIfAborted(mergedOptions.abortSignal);
+                }
+                if (i > 0 && i % 50 === 0) {
+                    logMcpInfo('function-indexing', 'progress', {
+                        current: i,
+                        total: scriptFiles.length
+                    });
+                }
+                const fileFunctions = await extractFunctionsFromFile(scriptFiles[i], {
+                    unusedImportsConfig: mergedOptions.unusedImportsConfig
                 });
-            }
-            catch (err) {
-                logMcpInfo('discovery', 'changed function detection failed (continuing)', {
-                    error: err instanceof Error ? err.message : String(err)
+                collectedFunctions.push(...fileFunctions);
+                fileToFunctionsMap.set(scriptFiles[i], fileFunctions); // Store for sync
+                reportProgress(mergedOptions, {
+                    phase: 'function-indexing',
+                    current: i + 1,
+                    total: scriptFiles.length,
+                    message: `Collected ${fileFunctions.length} items from ${scriptFiles[i]}`
                 });
-            }
-        }
-        // ── Blast-radius impact (Spec 14 R6) ──────────────────────────────
-        // Compute transitive-caller impact for changed functions.
-        // If latency exceeds the 100ms budget, skip and emit a warning;
-        // the feature is disabled-by-default when over budget.
-        let blastRadius;
-        if (isScoped && changedFunctions && changedFunctions.length > 0) {
-            try {
-                const db = CodeIndexDB.getInstance(undefined, mergedOptions.projectRoot || process.cwd());
-                const rawDb = db.rawDb;
-                const functionIds = [];
-                for (const fn of changedFunctions) {
-                    const row = rawDb.prepare('SELECT id FROM functions WHERE name = ? AND file_path = ?').get(fn.name, fn.filePath);
-                    if (row)
-                        functionIds.push(row.id);
-                }
-                if (functionIds.length > 0) {
-                    const impact = computeImpact(rawDb, functionIds);
-                    if (impact.latencyMs > LATENCY_BUDGET_MS) {
-                        logMcpInfo('blast-radius', `latency ${impact.latencyMs}ms exceeds ${LATENCY_BUDGET_MS}ms budget — blast radius disabled for this run`, {});
-                    }
-                    else {
-                        blastRadius = impact;
-                        logMcpInfo('blast-radius', 'computed', {
-                            editedFunctionCount: impact.editedFunctionCount,
-                            transitiveCallers: impact.transitiveCallers,
-                            reachableExports: impact.reachableExports,
-                            latencyMs: impact.latencyMs,
-                        });
-                    }
+                if (isMcpDebugEnabled()) {
+                    logMcpDebug('function-indexing', scriptFiles[i], {
+                        symbols: fileFunctions.length
+                    });
                 }
             }
-            catch (err) {
-                // Blast radius is advisory — non-fatal
-                logMcpInfo('blast-radius', 'computation failed (continuing)', {
-                    error: err instanceof Error ? err.message : String(err)
+            catch (error) {
+                logMcpInfo('function-indexing', 'extract failed (continuing)', {
+                    file: scriptFiles[i],
+                    error: error instanceof Error ? error.message : String(error)
                 });
             }
         }
-        const handoffRemaining = [];
-        const maxPerRun = mergedOptions.maxFilesPerRun;
-        if (typeof maxPerRun === 'number' && maxPerRun > 0 && files.length > maxPerRun) {
-            handoffRemaining.push(...files.slice(maxPerRun));
-            files = files.slice(0, maxPerRun);
-        }
-        const root = path.resolve(mergedOptions.projectRoot || process.cwd());
-        // Spec 60.1 Correction 1 — the import classifier's corpus file set must be
-        // the UNFILTERED stage-1 discovery list, not the audit's `files` list.
-        // `files` is narrowed at two points before `_infra` is built:
-        //   1. Polyglot (Go) path — `LanguageOrchestrator.discoverAndGroupFiles`
-        //      drops files with no detectable language (`.json`, `.sql`), then
-        //      `TypeScriptAnalyzer.analyze` (RuntimeManager.ts) re-runs `runAudit`
-        //      with `includePaths: files` = the TS-only list.
-        //   2. `filterFiles` (fileDiscovery.ts, called from `findFiles`) applies
-        //      `includePaths` as a positive-selection glob filter — a `.json` file
-        //      that survives step 1 is dropped here (or by the default `includePaths`
-        //      from config/defaults.ts, which omits `.json`).
-        // Either way `_infra.files` no longer contains `.json`, so a real
-        // `./invariant-rules.schema.json` import classifies `internal-broken`.
-        // Classification answers "does this import resolve to a real file",
-        // independent of what the audit chooses to analyze, so it re-walks
-        // discovery with ALL_EXTENSIONS and no include/exclude narrowing.
-        const corpusFiles = await discoverFiles(root);
-        logMcpInfo('discovery', 'file discovery finished', {
-            projectRoot: path.resolve(root),
-            totalFiles: files.length,
-            corpusFiles: corpusFiles.length,
-            scope: scopeResultType,
-            indexFunctions: !!mergedOptions.indexFunctions
-        });
-        // Collect functions if enabled
-        let collectedFunctions = [];
-        const fileToFunctionsMap = new Map(); // Track functions per file for sync
-        if (mergedOptions.indexFunctions) {
-            reportProgress(mergedOptions, {
-                phase: 'function-indexing',
-                message: 'Collecting functions from files...'
+    }
+    return { collectedFunctions, fileToFunctionsMap };
+}
+/**
+ * Sync style declarations, tokens, and class usage before the styles analyzer
+ * runs (Spec 10), mirroring the function index sync. Non-fatal: on failure the
+ * styles analyzer runs with whatever is already in the index.
+ */
+async function syncStyles(analyzers, root, files, isScoped) {
+    let styleConsumedFiles = [];
+    let styleContributingFiles;
+    if (analyzers.includes('styles')) {
+        try {
+            const styleDb = CodeIndexDB.getInstance(undefined, root);
+            await styleDb.initialize();
+            const styleSyncResult = await syncStyleIndex(styleDb.rawDb, files, root, { scoped: isScoped });
+            styleConsumedFiles = styleSyncResult.consumedFiles;
+            styleContributingFiles = styleSyncResult.contributingFiles;
+            logMcpInfo('style-index', 'style index sync complete', {
+                changed: styleSyncResult.changed,
+                skipped: styleSyncResult.skipped,
+                removed: styleSyncResult.removed,
+                errors: styleSyncResult.errors,
+                consumed: styleSyncResult.consumedFiles.length,
             });
-            // Collect functions from TypeScript/JavaScript files
-            // Note: Go files will be indexed by the Universal SOLID analyzer directly
-            const scriptFiles = files.filter(f => f.endsWith('.ts') || f.endsWith('.tsx') ||
-                f.endsWith('.js') || f.endsWith('.jsx') ||
-                f.endsWith('.mts') || f.endsWith('.cts') ||
-                f.endsWith('.mjs') || f.endsWith('.cjs'));
-            logMcpInfo('function-indexing', 'extracting functions from script files', {
-                scriptFileCount: scriptFiles.length
+        }
+        catch (err) {
+            // Non-fatal: styles analyzer will run with whatever is in the index
+            logMcpInfo('style-index', 'style index sync failed (continuing)', {
+                error: err instanceof Error ? err.message : String(err)
             });
-            for (let i = 0; i < scriptFiles.length; i++) {
+        }
+    }
+    return { styleConsumedFiles, styleContributingFiles };
+}
+/**
+ * Assemble the Stage-2 visitors / Stage-3 reducers / Stage-4 derived reducers
+ * for this run. Spec 68 §15 — once every registry rule is migrated, the legacy
+ * pipeline's rule-emitting visitors/reducers are skipped (their findings are
+ * stripped to zero at the both-paths split); only the infrastructure with a
+ * side-effect the phase model reads from the index keeps running.
+ */
+function buildPipelineAdapters(analyzers) {
+    const pipelineVisitors = [];
+    const pipelineReducers = [];
+    const pipelineDerivedReducers = [];
+    let reactBundle;
+    let solidBundle;
+    // Always-on infrastructure: function-index visitor populates the
+    // `functions` table so conventions + cross-domain reducers have data
+    // even on a cold run with no prior index sync.
+    pipelineVisitors.push(createFunctionIndexVisitor());
+    // styles-css visitor — AST-extracts .css files into style_* tables (Spec 26 Phase 2)
+    if (analyzers.includes('styles'))
+        pipelineVisitors.push(createStylesCssVisitor());
+    // styles-source visitor — AST-extracts TS/JS CSS-in-JS into style_* tables,
+    // reusing the stage-1 parse (eliminates the style-index re-parse).
+    if (analyzers.includes('styles'))
+        pipelineVisitors.push(createStylesSourceVisitor());
+    // The DRY visitor's findings are all migrated and stripped, and its pair-seed
+    // side-effect now comes from the phase `code-block` fact (`seedDryPairs`, Spec
+    // 70 2b), so there is no legacy DRY visitor to register.
+    // The invariant reducer is pipeline-only (its rules come from
+    // `.codeauditor.json`, not the registry), so it always runs — it is the one
+    // legacy path that still emits non-migrated findings.
+    if (analyzers.includes('invariants'))
+        pipelineReducers.push(createInvariantsReducer());
+    // The styles reducer persists the styles-css visitor's facts into the
+    // `style_*` tables (the styles-source visitor writes its own). The phase
+    // `defined-classes` / `unread-style-sources` corpus producers read those
+    // tables, so this reducer must keep running even though its *findings* are
+    // migrated and stripped.
+    if (analyzers.includes('styles'))
+        pipelineReducers.push(createStylesReducer());
+    // The schema-code visitor's findings are migrated and stripped, but it must
+    // keep running for its one remaining live emit: the `reserved-word` finding
+    // off `checkNamingConventions` (unregistered emission, §13 disposition) and the
+    // ORM/DDL table catalog. Its `unresolved-query` diagnostic (Spec 58 R1) and its
+    // `unparseable` cannot-fire diagnostic (Spec 70 R2) are both re-derived
+    // corpus-side (Spec 70 1b / R2), so this visitor no longer emits either.
+    if (analyzers.includes('schema'))
+        pipelineVisitors.push(createSchemaCodeVisitor());
+    return {
+        pipelineVisitors,
+        pipelineReducers,
+        pipelineDerivedReducers,
+        reactBundle,
+        solidBundle,
+    };
+}
+/**
+ * Build the per-analyzer namespaced config passed to every pipeline stage. Each
+ * analyzer gets its own namespace; `_infra` holds shared infrastructure keys.
+ */
+function buildPipelineAnalyzerConfig(analyzers, mergedOptions, root, files, corpusFiles, provenanceTiming) {
+    const pipelineAnalyzerConfig = {};
+    for (const name of analyzers) {
+        pipelineAnalyzerConfig[name] = { ...(mergedOptions.analyzerConfigs?.[name] ?? {}) };
+    }
+    // Spec 70 R1 — the corpus's dialect is threaded to the data-access analyzer
+    // (whose SQL-content facts parse rather than regex) and to DB-receiver
+    // resolution. Explicit config (`databaseType`) overrides detection; otherwise
+    // the dialect is *detected* from the dependency manifest (pg/neon → postgres,
+    // better-sqlite3/D1 → sqlite, mysql2 → mysql). A null dialect means the SQL
+    // facts `cannot-fire` — and `sqlDialectReason` names *why* (undetermined or
+    // ambiguous) so the abstention is visible rather than silent.
+    const resolution = buildResolutionEnvironment(root, {
+        databaseType: mergedOptions.databaseType,
+        importVirtualModules: mergedOptions.importVirtualModules,
+    });
+    const sqlDialect = resolution.sqlDialect;
+    const sqlDialectReason = resolution.sqlDialectReason;
+    // Spec 62 Amendment B — the missing-org-filter Stage-4 reducer reads the
+    // data-access config namespace, so it inherits the data-access analyzer's
+    // config rather than a fresh empty namespace.
+    if (analyzers.includes('data-access')) {
+        pipelineAnalyzerConfig['data-access'] = {
+            ...(pipelineAnalyzerConfig['data-access'] ?? {}),
+            dialect: sqlDialect,
+        };
+        pipelineAnalyzerConfig['data-access-org-filter'] = { ...(pipelineAnalyzerConfig['data-access'] ?? {}) };
+    }
+    // Pass invariant rules from .codeauditor.json into the invariants pipeline config.
+    if (analyzers.includes('invariants') && mergedOptions.rules) {
+        pipelineAnalyzerConfig['invariants'] = {
+            ...(pipelineAnalyzerConfig['invariants'] ?? {}),
+            rules: mergedOptions.rules,
+        };
+    }
+    // Cross-domain config lives at the top level (not analyzerConfigs)
+    if (analyzers.includes('cross-domain') && mergedOptions.crossDomain) {
+        pipelineAnalyzerConfig['cross-domain'] = {
+            ...(pipelineAnalyzerConfig['cross-domain'] ?? {}),
+            ...mergedOptions.crossDomain,
+        };
+    }
+    // Schema config: all table discovery flows through visitors and facts.
+    if (analyzers.includes('schema')) {
+        const scConfig = mergedOptions.analyzerConfigs?.schema ?? {};
+        const schemaConfig = {
+            ...(pipelineAnalyzerConfig['schema'] ?? {}),
+            sqlTagNames: scConfig.sqlTagNames ?? ['sql', 'db'],
+            dbBindingNames: scConfig.dbBindingNames ?? ['env.DB'],
+            fileGateGlobs: scConfig.fileGateGlobs,
+            maxQueriesPerFunction: scConfig.maxQueriesPerFunction,
+            validateQueryPatterns: scConfig.validateQueryPatterns,
+            checkNamingConventions: scConfig.checkNamingConventions,
+            tableSources: scConfig.tableSources,
+            dbWrapperNames: scConfig.dbWrapperNames,
+            detection: scConfig.detection,
+            schemas: scConfig.schemas,
+            knownTables: scConfig.knownTables,
+            // Spec 70 R2 — thread the corpus's named dialect so a provenanced static
+            // SQL argument that the dialect cannot parse (PRAGMA/VACUUM/ANALYZE) is
+            // reported as unreadable (cannot-fire), not silently "no tables".
+            sqlDialect,
+            // Spec 70 (detection) — the named reason when the dialect is null, so an
+            // undetermined/ambiguous corpus emits a "dialect undetermined" cannot-fire
+            // rather than reading the empty reference set as clean.
+            sqlDialectReason,
+        };
+        pipelineAnalyzerConfig['schema'] = schemaConfig;
+        // Pipeline resolves config by visitor name; the schema-* sub-visitors need
+        // the same namespace as the schema reducer.
+        for (const sub of ['schema-code', 'schema-sql', 'schema-prisma', 'schema-json']) {
+            pipelineAnalyzerConfig[sub] = schemaConfig;
+        }
+    }
+    // Global/infrastructure settings passed to all pipeline stages
+    pipelineAnalyzerConfig['_infra'] = {
+        pathProfiles: mergedOptions.pathProfiles,
+        projectRoot: root,
+        _provenanceTiming: provenanceTiming,
+        files,
+        corpusFiles,
+        importVirtualModules: resolution.importVirtualModules,
+        tsconfigAliases: resolution.tsconfigAliases,
+        packageEntryPoints: resolution.packageEntryPoints,
+        declaredTypePackages: resolution.declaredTypePackages,
+        // Spec 70 R1 — surfaced under `_infra` so `runPipeline` can hand the named
+        // dialect to the phase model's data-access producer without reading the
+        // data-access namespace.
+        sqlDialect,
+        // Spec 70 (detection) — the named reason when `sqlDialect` is null.
+        sqlDialectReason,
+    };
+    return pipelineAnalyzerConfig;
+}
+/**
+ * Assemble the `PipelineConfig` handed to `runPipeline`.
+ */
+function buildPipelineConfig(inputs) {
+    const { mergedOptions, root, files, isScoped, fileAccounting, styleConsumedFiles, styleContributingFiles, analyzers, auditIndex, pipelineAnalyzerConfig, pipelineVisitors, pipelineReducers, pipelineDerivedReducers, } = inputs;
+    return {
+        projectRoot: root,
+        explicitFiles: files,
+        visitors: pipelineVisitors,
+        reducers: pipelineReducers,
+        derivedReducers: pipelineDerivedReducers,
+        config: pipelineAnalyzerConfig,
+        abortSignal: mergedOptions.abortSignal,
+        progressCallback: (progress) => {
+            throwIfAborted(mergedOptions.abortSignal);
+            reportProgress(mergedOptions, progress);
+        },
+        isScoped,
+        fileAccounting,
+        consumedFilePaths: styleConsumedFiles,
+        styleContributingFiles,
+        onStage2Complete: async () => {
+            // Post-stage-2 setup: rebuild the call-graph from the functions table
+            // (populated by the function-index visitor).
+            if (auditIndex && analyzers.includes('conventions')) {
                 try {
-                    if (i % 10 === 0) {
-                        throwIfAborted(mergedOptions.abortSignal);
-                    }
-                    if (i > 0 && i % 50 === 0) {
-                        logMcpInfo('function-indexing', 'progress', {
-                            current: i,
-                            total: scriptFiles.length
-                        });
-                    }
-                    const fileFunctions = await extractFunctionsFromFile(scriptFiles[i], {
-                        unusedImportsConfig: mergedOptions.unusedImportsConfig
-                    });
-                    collectedFunctions.push(...fileFunctions);
-                    fileToFunctionsMap.set(scriptFiles[i], fileFunctions); // Store for sync
-                    reportProgress(mergedOptions, {
-                        phase: 'function-indexing',
-                        current: i + 1,
-                        total: scriptFiles.length,
-                        message: `Collected ${fileFunctions.length} items from ${scriptFiles[i]}`
-                    });
-                    if (isMcpDebugEnabled()) {
-                        logMcpDebug('function-indexing', scriptFiles[i], {
-                            symbols: fileFunctions.length
-                        });
-                    }
+                    await auditIndex.graph.updateDependencyGraph();
                 }
-                catch (error) {
-                    logMcpInfo('function-indexing', 'extract failed (continuing)', {
-                        file: scriptFiles[i],
-                        error: error instanceof Error ? error.message : String(error)
+                catch (err) {
+                    logMcpInfo('analysis', 'updateDependencyGraph failed (non-fatal)', {
+                        error: err instanceof Error ? err.message : String(err)
                     });
                 }
             }
+        },
+    };
+}
+/**
+ * Run the both-paths split (Spec 68 §11.1): strip migrated rules' legacy
+ * emission and re-emit phase findings into the correct analyzer buckets.
+ * Mutates `analyzerResults` and `pipelineAnalyzerConfig` (dry divergence).
+ */
+async function applyPhaseModelSplit(inputs) {
+    const { mergedOptions, root, files, isScoped, pipelineAnalyzerConfig, analyzerResults, pipelineIndexHandle } = inputs;
+    let phaseFindings = [];
+    let phaseIncompleteFacts = new Map();
+    let routeAttribution;
+    let receiverDiagnostics = [];
+    const { migrated } = splitRoutes();
+    routeAttribution = Object.fromEntries(attributeRoutes());
+    if (migrated.size > 0) {
+        // The `dry/diverging-clone` rule reads its knobs from `dry.divergence`.
+        const topLevelDivergence = mergedOptions.divergence;
+        if (topLevelDivergence && !pipelineAnalyzerConfig['dry']?.divergence) {
+            pipelineAnalyzerConfig['dry'] = { ...(pipelineAnalyzerConfig['dry'] ?? {}), divergence: topLevelDivergence };
         }
-        // Run analyzers
-        const analyzerResults = {};
-        const enabledAnalyzers = getEnabledAnalyzers(mergedOptions, analyzerRegistry);
-        // ── Style index sync (Spec 10) ────────────────────────────────────
-        // Sync style declarations, tokens, and class usage before the
-        // styles analyzer runs, mirroring the function index sync pattern.
-        // Spec 44: the indexer readFileSyncs every discovered file (except
-        // `.css`/`.scss`), so `consumedFiles` is the "any layer read it" evidence
-        // for files dropped at stage 2 — threaded into the pipeline below.
-        let styleConsumedFiles = [];
-        // In-scope files that contributed style data during the sync. Undefined when
-        // the sync did not run or failed — the styles reducer must not short-circuit
-        // on that (it falls back to full analysis), so we only assign on success.
-        let styleContributingFiles;
-        if (enabledAnalyzers.includes('styles')) {
-            try {
-                const styleDb = CodeIndexDB.getInstance(undefined, root);
-                await styleDb.initialize();
-                const styleSyncResult = await syncStyleIndex(styleDb.rawDb, files, root, { scoped: isScoped });
-                styleConsumedFiles = styleSyncResult.consumedFiles;
-                styleContributingFiles = styleSyncResult.contributingFiles;
-                logMcpInfo('style-index', 'style index sync complete', {
-                    changed: styleSyncResult.changed,
-                    skipped: styleSyncResult.skipped,
-                    removed: styleSyncResult.removed,
-                    errors: styleSyncResult.errors,
-                    consumed: styleSyncResult.consumedFiles.length,
-                });
+        const thresholds = resolvePhaseThresholds(pipelineAnalyzerConfig);
+        const profiles = mergedOptions.pathProfiles;
+        const profileByFile = new Map();
+        const resolveFileProfile = (file) => {
+            let resolved = profileByFile.get(file);
+            if (!resolved) {
+                resolved = profiles?.length
+                    ? resolvePathProfile(file, root, profiles)
+                    : { overrides: {}, excludeFromGate: false, excludeFromAnalysis: false, matchedProfileNames: [] };
+                profileByFile.set(file, resolved);
             }
-            catch (err) {
-                // Non-fatal: styles analyzer will run with whatever is in the index
-                logMcpInfo('style-index', 'style index sync failed (continuing)', {
-                    error: err instanceof Error ? err.message : String(err)
-                });
+            return resolved;
+        };
+        const phaseFiles = files.filter((f) => !resolveFileProfile(f).excludeFromAnalysis);
+        const infraConfig = (pipelineAnalyzerConfig['_infra'] ?? {});
+        const schemaPhaseConfig = (pipelineAnalyzerConfig['schema'] ?? {});
+        const externalTables = [];
+        for (const t of schemaPhaseConfig.knownTables ?? []) {
+            externalTables.push({ name: t, source: 'external-config', columns: [] });
+        }
+        for (const s of schemaPhaseConfig.schemas ?? []) {
+            for (const t of s.tables) {
+                externalTables.push({ name: t.name, source: `Schema: ${s.name}`, columns: t.columns.map((c) => c.name) });
             }
         }
-        // Spec 21: Shared timing accumulator for provenance resolution.
-        // Injected into data-access and schema analyzers so they can report
-        // per-file buildProvenanceContext() wall time (hook-latency measurement).
-        const provenanceTiming = { totalMs: 0 };
-        let pipelineCoverage;
-        let pipelineTableCatalog;
-        let pipelineStageTiming;
-        let pipelineSkippedFiles;
-        let pipelineUnparsedFiles;
-        let pipelineInputPresence;
-        let pipelineRuleTiming;
-        let pipelineFileAccounting;
-        let pipelineDiagnostics;
-        let pipelineTestCoverage;
-        let pipelineDeadClusters;
-        let pipelineSizeDistributions;
-        logMcpInfo('analysis', 'enabled analyzers', {
-            names: enabledAnalyzers,
-            fileCount: files.length,
-            scope: scopeResultType
+        const phaseResult = await runPhaseModel(phaseFiles, thresholds, {
+            projectRoot: root,
+            scoped: isScoped,
+            corpusFiles: infraConfig.corpusFiles,
+            importVirtualModules: infraConfig.importVirtualModules,
+            tsconfigAliases: infraConfig.tsconfigAliases,
+            packageEntryPoints: infraConfig.packageEntryPoints,
+            indexHandle: pipelineIndexHandle,
+            enabledRules: enabledMigratedRules(),
+            externalTables,
+            workerCount: resolveWorkerCount(),
+            sqlDialect: infraConfig.sqlDialect,
+            sqlDialectReason: infraConfig.sqlDialectReason,
+            declaredTypePackages: infraConfig.declaredTypePackages,
+            // Spec 70 2b — the diverging-clone write: seed `dry_pair_history` from the
+            // phase `code-block` fact (replacing `createDryVisitor`/`persistDryPairs`).
+            persistDryPairHistory: (facts) => {
+                const dryCfg = resolveBlockConfig(thresholds.get('dry/duplicate') ?? {});
+                const codeBlocks = facts.get('code-block') ?? [];
+                return persistDryPairs(seedDryPairs(codeBlocks, dryCfg), root);
+            },
         });
-        logMcpDebug('analysis', 'registry keys', { keys: Object.keys(analyzerRegistry) });
-        const requestedConcurrency = Number(mergedOptions.analyzerConcurrency);
-        const analyzerConcurrency = Number.isFinite(requestedConcurrency) && requestedConcurrency > 0
-            ? Math.min(Math.floor(requestedConcurrency), enabledAnalyzers.length || 1)
-            : 1;
-        logMcpInfo('analysis', 'analyzer concurrency', { analyzerConcurrency });
-        // ── Initialize CodeIndexDB for analyzer DB access ────────────────────
-        // Styles, conventions, and cross-domain analyzers read config.indexHandle
-        // for DB access. The singleton is shared — initialize once before the
-        // analyzer run loop so ensureInitialized() is a no-op for each call.
-        let auditIndex;
-        try {
-            auditIndex = CodeIndexDB.getInstance(undefined, root);
-            await auditIndex.initialize();
-            logMcpInfo('analysis', 'code index initialized for analyzers', { isInitialized: auditIndex.isInitialized, dbPath: auditIndex.dbPath });
+        phaseFindings = phaseResult.findings;
+        phaseIncompleteFacts = phaseResult.incompleteFacts;
+        // Spec 69 §10 + Part 2b — re-home the pre-pass's diagnostics (deleted from
+        // `pipeline.ts`) on the phase result. Cannot-fire: re-derive per file from
+        // `phaseResult.unprovenQueryReceivers` + `phaseResult.unresolvedImports`, keyed
+        // to the TS-family surface the legacy `schema-code` visitor covered (Go
+        // receivers/imports never reached it). Manifest-stale: the ecosystem-list
+        // self-check, unchanged from the deleted `buildPipelineResult` loop.
+        receiverDiagnostics = await buildReceiverDiagnostics(phaseResult.unprovenQueryReceivers, phaseResult.unresolvedImports, phaseResult.unresolvedQuerySites, phaseResult.unparseableSql, root);
+        // Strip the migrated rules' legacy emission from every analyzer result.
+        let strippedCount = 0;
+        for (const result of Object.values(analyzerResults)) {
+            const before = result.violations.length;
+            result.violations = result.violations.filter((v) => !migrated.has(v.rule));
+            strippedCount += before - result.violations.length;
         }
-        catch (err) {
-            // Non-fatal: analyzers that need indexHandle will skip DB-dependent
-            // checks and report "No index handle available" in their errors.
-            logMcpInfo('analysis', 'failed to initialize code index for analyzers (continuing)', {
-                error: err instanceof Error ? err.message : String(err)
+        // Re-emit phase findings as violations, bucketed by the rule's analyzer.
+        const byAnalyzer = new Map();
+        const ruleAnalyzerOverride = {
+            'table-naming-convention': 'schema-code',
+            'too-many-queries': 'schema-code',
+        };
+        for (const f of phaseFindings) {
+            const analyzer = ruleAnalyzerOverride[f.ruleId] ?? RULE_ANALYZER.get(f.ruleId) ?? 'phase';
+            const resolved = resolveFileProfile(f.file);
+            const profile = resolved.matchedProfileNames.length > 0
+                ? resolved.matchedProfileNames[resolved.matchedProfileNames.length - 1]
+                : undefined;
+            const bucket = byAnalyzer.get(analyzer) ?? [];
+            bucket.push({
+                file: f.file,
+                rule: f.ruleId,
+                severity: f.severity,
+                message: f.message,
+                line: f.line,
+                column: f.column,
+                symbol: f.symbol,
+                resolution: f.resolution,
+                analyzer,
+                ...(f.fix ? { fix: f.fix } : {}),
+                ...(f.details !== undefined ? { details: f.details } : {}),
+                ...(profile ? { profile } : {}),
+                ...(resolved.excludeFromGate ? { gateExcluded: true } : {}),
             });
+            byAnalyzer.set(analyzer, bucket);
         }
-        // ── Analyzer execution ──────────────────────────────────────────────
-        // Spec 25 R3: The pipeline replaces the hand-rolled concurrent
-        // analyzer loop. Visitors run per-file in stage 2, corpus reducers
-        // run in stage 3, and derived reducers (cross-domain) run in stage 4.
-        // Schema runs outside the pipeline because it needs ALL file types (SQL, JSON, TS).
-        // Invariants runs inside the pipeline as a Stage 3 reducer (Spec 41 Part C).
-        // Build IndexHandle for pipeline reducers
-        let pipelineIndexHandle;
-        if (auditIndex) {
-            pipelineIndexHandle = {
-                query: (sql, params) => auditIndex.query(sql, params),
-                count: (table, where, params) => auditIndex.count(table, where, params),
-                tableHasRows: (table) => auditIndex.tableHasRows(table),
-                run: (sql, params) => auditIndex.rawDb.prepare(sql).run(...(params ?? [])),
-                exec: (sql) => auditIndex.rawDb.exec(sql),
-                getMeta: (key) => auditIndex.getMeta(key),
-                getUntestedTopDecile: (td) => auditIndex.getUntestedTopDecile(td),
-                rawDb: auditIndex.rawDb,
-            };
-        }
-        // ── 1. Build pipeline adapters ───────────────────────────────────────
-        const pipelineVisitors = [];
-        const pipelineReducers = [];
-        const pipelineDerivedReducers = [];
-        let dryBundle;
-        let reactBundle;
-        let solidBundle;
-        // Always-on infrastructure: function-index visitor populates the
-        // `functions` table so conventions + cross-domain reducers have data
-        // even on a cold run with no prior index sync.
-        pipelineVisitors.push(createFunctionIndexVisitor());
-        // styles-css visitor — AST-extracts .css files into style_* tables (Spec 26 Phase 2)
-        if (enabledAnalyzers.includes('styles'))
-            pipelineVisitors.push(createStylesCssVisitor());
-        // styles-source visitor — AST-extracts TS/JS CSS-in-JS into style_* tables,
-        // reusing the stage-1 parse (eliminates the style-index re-parse).
-        if (enabledAnalyzers.includes('styles'))
-            pipelineVisitors.push(createStylesSourceVisitor());
-        if (enabledAnalyzers.includes('solid')) {
-            solidBundle = createSolidVisitor();
-            pipelineVisitors.push(solidBundle.visitor);
+        for (const [analyzer, violations] of byAnalyzer) {
+            if (analyzerResults[analyzer]) {
+                analyzerResults[analyzer].violations.push(...violations);
+            }
+            else {
+                analyzerResults[analyzer] = {
+                    ...makeEmptyAnalyzerResult(analyzer, phaseFiles.length),
+                    violations,
+                };
+            }
         }
-        if (enabledAnalyzers.includes('dry')) {
-            dryBundle = createDryVisitor();
-            pipelineVisitors.push(dryBundle.visitor);
+        // Every migrated analyzer must appear in the results map even when it
+        // emitted nothing this run.
+        for (const analyzer of new Set(RULE_ANALYZER.values())) {
+            if (!analyzerResults[analyzer]) {
+                analyzerResults[analyzer] = makeEmptyAnalyzerResult(analyzer, phaseFiles.length);
+            }
         }
-        if (enabledAnalyzers.includes('data-access')) {
-            pipelineVisitors.push(createDataAccessVisitor());
-            // Spec 62 Amendment B — the missing-org-filter rule is a Stage-4 derived
-            // reducer that joins the data-access query facts against the declared +
-            // DDL-discovered tenant tiers. Registered whenever data-access is enabled,
-            // mirroring the data-access visitor it consumes.
-            pipelineDerivedReducers.push(createOrgFilterReducer());
+        logMcpInfo('analysis', 'phase model (both paths)', {
+            migrated: migrated.size,
+            stripped: strippedCount,
+            reemitted: phaseFindings.length,
+        });
+    }
+    return { phaseFindings, phaseIncompleteFacts, routeAttribution, receiverDiagnostics };
+}
+/**
+ * Spec 69 §10 + Part 2b — re-derive the pre-pass's coverage diagnostics from the
+ * phase result: the `cannot-fire` surface (unproven query receivers + unresolved
+ * DB-looking imports, keyed to the TS-family files the legacy `schema-code`
+ * visitor covered) and the `manifest-stale` ecosystem-list self-check. Replaces
+ * `collectCannotFireDiagnostics` (deleted from `pipelineAdapters.ts`) and the
+ * `manifest-staleness` loop (deleted from `buildPipelineResult`).
+ */
+async function buildReceiverDiagnostics(unprovenQueryReceivers, unresolvedImports, unresolvedQuerySites, unparseableSql, projectRoot) {
+    const diagnostics = [];
+    // Group the two signals by file, then per-file dedup so the call-site signal
+    // wins over the import-level signal — mirroring the deleted
+    // `collectCannotFireDiagnostics` (which ran per TS-family file inside the
+    // schema-code visitor, so Go files never reached it).
+    const files = new Set();
+    for (const u of unprovenQueryReceivers)
+        if (!u.file.endsWith('.go'))
+            files.add(u.file);
+    for (const u of unresolvedImports)
+        if (!u.importer.endsWith('.go'))
+            files.add(u.importer);
+    for (const file of files) {
+        const perFile = [];
+        const unresolvedHere = unresolvedImports.filter((u) => path.resolve(u.importer) === path.resolve(file));
+        if (unresolvedHere.length > 0) {
+            perFile.push(...checkUnresolvedReceiverImports(unresolvedHere.map((u) => ({ source: u.source, names: [...u.names] })), file));
         }
-        if (enabledAnalyzers.includes('secrets'))
-            pipelineVisitors.push(createSecretsVisitor());
-        if (enabledAnalyzers.includes('security'))
-            pipelineVisitors.push(createSecurityVisitor());
-        if (enabledAnalyzers.includes('react')) {
-            reactBundle = createReactVisitor();
-            pipelineVisitors.push(reactBundle.visitor);
+        const unprovenHere = unprovenQueryReceivers.filter((u) => path.resolve(u.file) === path.resolve(file));
+        if (unprovenHere.length > 0) {
+            perFile.push(...checkUnprovenQueryReceivers(unprovenHere.map((u) => ({ receiver: u.receiver, method: u.method, line: u.line, reason: u.reason })), file));
         }
-        if (enabledAnalyzers.includes('documentation'))
-            pipelineVisitors.push(createDocumentationVisitor());
-        if (enabledAnalyzers.includes('styles'))
-            pipelineReducers.push(createStylesReducer());
-        if (enabledAnalyzers.includes('conventions'))
-            pipelineReducers.push(createConventionsReducer());
-        if (enabledAnalyzers.includes('invariants'))
-            pipelineReducers.push(createInvariantsReducer());
-        if (enabledAnalyzers.includes('cross-domain'))
-            pipelineDerivedReducers.push(createCrossDomainReducer());
-        if (enabledAnalyzers.includes('schema')) {
-            pipelineVisitors.push(createSchemaSqlVisitor());
-            pipelineVisitors.push(createSchemaCodeVisitor());
-            pipelineVisitors.push(createSchemaPrismaVisitor());
-            pipelineVisitors.push(createSchemaJsonVisitor());
-            pipelineReducers.push(createSchemaReducer());
+        diagnostics.push(...dedupeCannotFireByReceiver(perFile));
+    }
+    // Spec 70 1b — the `unresolved-query` diagnostics (re-admitted DB-calls whose
+    // SQL is held in an unresolvable identifier). Emitted separately from
+    // `cannot-fire`: a distinct kind, never receiver-deduped (the legacy
+    // `schema-code` visitor emitted them verbatim, per file, in visitor order).
+    const unresolvedByFile = new Map();
+    for (const site of unresolvedQuerySites) {
+        if (site.file.endsWith('.go'))
+            continue;
+        let list = unresolvedByFile.get(site.file);
+        if (!list) {
+            list = [];
+            unresolvedByFile.set(site.file, list);
         }
-        // Cross-language analyzers (SchemaValidator, APIContractAnalyzer,
-        // DependencyGraphBuilder) — three Stage-4 reducers fed by one shared
-        // entity-extraction visitor. The visitor is cheap (per-file) and runs
-        // whenever ANY cross-language analyzer is enabled; the corpus-wide reducers
-        // short-circuit on scoped/diff runs.
-        const crossLanguageEnabled = ['schema-validator', 'api-contract', 'dependency-graph']
-            .some((a) => enabledAnalyzers.includes(a));
-        if (crossLanguageEnabled) {
-            pipelineVisitors.push(createCrossLanguageEntityVisitor());
+        list.push(site);
+    }
+    for (const [file, sites] of unresolvedByFile) {
+        diagnostics.push(...checkUnresolvedQueries(sites.map((s) => ({ identifier: s.identifier, location: s.location })), file));
+    }
+    // Spec 70 R2 — the `unparseable` cannot-fire diagnostics. Emitted per file in
+    // fact order, mirroring the deleted legacy `schema-code` visitor, which ran
+    // `checkUnparseableSql` over every admitted tag/DB-call parse within the file.
+    const unparseableByFile = new Map();
+    for (const u of unparseableSql) {
+        if (u.file.endsWith('.go'))
+            continue;
+        let list = unparseableByFile.get(u.file);
+        if (!list) {
+            list = [];
+            unparseableByFile.set(u.file, list);
         }
-        if (enabledAnalyzers.includes('schema-validator'))
-            pipelineDerivedReducers.push(createSchemaValidatorReducer());
-        if (enabledAnalyzers.includes('api-contract'))
-            pipelineDerivedReducers.push(createAPIContractReducer());
-        if (enabledAnalyzers.includes('dependency-graph'))
-            pipelineDerivedReducers.push(createDependencyGraphReducer());
-        // ── 2. Safeguard warnings ────────────────────────────────────────────
-        if (auditIndex) {
-            if (enabledAnalyzers.includes('cross-domain')) {
-                const suCount = auditIndex.count('schema_usage');
-                if (suCount === 0) {
-                    console.warn('[code-audit] ⚠ cross-domain analyzer requires schema_usage data. '
-                        + 'This is populated during a full audit run by the schema analyzer. '
-                        + 'If this warning persists, run a full "code-audit audit --path ." first.');
+        list.push(u);
+    }
+    for (const [file, records] of unparseableByFile) {
+        diagnostics.push(...checkUnparseableSql(records, file));
+    }
+    // Part 2b — the manifest staleness self-check, unchanged from the deleted
+    // `buildPipelineResult` loop: our hardcoded ecosystem lists vs. the project's
+    // manifest, emitted as a diagnostic (never a verdict input).
+    const manifest = await readProjectManifest(projectRoot);
+    for (const stale of computeManifestStaleness(manifest)) {
+        diagnostics.push({
+            analyzerName: 'data-access',
+            kind: 'manifest-stale',
+            message: `our list names '${stale.package}', this project doesn't depend on it`,
+            file: stale.manifestPath,
+            line: 0,
+            details: { ecosystem: stale.ecosystem, package: stale.package },
+        });
+    }
+    return diagnostics;
+}
+/**
+ * Persist seeded DRY pairs into `dry_pair_history` (Spec 13 R5 Phase 1) so the
+ * migrated `dry/diverging-clone` rule can read them through the index handle.
+ * The pairs come from `seedDryPairs` over the phase `code-block` fact (Spec 70
+ * 2b — the writer moved off the legacy DRY visitor). Runs BEFORE the phase
+ * model's `clone-pair-history` read. Advisory — non-fatal on failure.
+ * @param dryPairs The seeded DRY pairs to persist into `dry_pair_history`.
+ * @param root The project root used to open the code-index database handle.
+ * @returns Resolves when the advisory write completes (never rejects).
+ */
+export async function persistDryPairs(dryPairs, root) {
+    try {
+        if (dryPairs.length > 0) {
+            const indexDb = CodeIndexDB.getInstance(undefined, root);
+            await indexDb.initialize();
+            const dryPersistRunId = randomUUID();
+            const insertStmt = indexDb.rawDb.prepare(`
+        INSERT OR IGNORE INTO dry_pair_history
+          (pair_fingerprint, file1, symbol1, line1, content_hash1,
+           file2, symbol2, line2, content_hash2, similarity, timestamp, run_id)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, datetime('now'), ?)
+      `);
+            const tx = indexDb.rawDb.transaction(() => {
+                for (const pair of dryPairs) {
+                    insertStmt.run(pair.pairFingerprint, pair.file1, pair.symbol1, pair.line1, pair.contentHash1, pair.file2, pair.symbol2, pair.line2, pair.contentHash2, pair.similarity, dryPersistRunId);
                 }
-            }
+            });
+            tx();
         }
-        // ── 3. Run pipeline ──────────────────────────────────────────────────
-        const hasPipelineAnalyzers = pipelineVisitors.length > 0
-            || pipelineReducers.length > 0
-            || pipelineDerivedReducers.length > 0;
-        if (hasPipelineAnalyzers) {
-            // Build per-analyzer namespaced config — no flat Object.assign merge.
-            // Each analyzer gets its own namespace; _infra holds shared infrastructure keys
-            // that every visitor/reducer receives alongside its own config.
-            const pipelineAnalyzerConfig = {};
-            for (const name of enabledAnalyzers) {
-                pipelineAnalyzerConfig[name] = { ...(mergedOptions.analyzerConfigs?.[name] ?? {}) };
-            }
-            // Spec 62 Amendment B — the missing-org-filter Stage-4 reducer reads the
-            // data-access config namespace (orgFilterTables/orgFilterColumns/schemas),
-            // so it inherits the data-access analyzer's config rather than a fresh
-            // empty namespace. `data-access-org-filter` is never in enabledAnalyzers
-            // (it is auto-registered), so this is the only place its config is set.
-            if (enabledAnalyzers.includes('data-access')) {
-                pipelineAnalyzerConfig['data-access-org-filter'] = { ...(pipelineAnalyzerConfig['data-access'] ?? {}) };
-            }
-            // Pass invariant rules from .codeauditor.json into the invariants pipeline config.
-            // The rules field lives at the top level of the loaded config (not under analyzerConfigs).
-            if (enabledAnalyzers.includes('invariants') && mergedOptions.rules) {
-                pipelineAnalyzerConfig['invariants'] = {
-                    ...(pipelineAnalyzerConfig['invariants'] ?? {}),
-                    rules: mergedOptions.rules,
-                };
+    }
+    catch {
+        // dry_pair_history persistence is advisory — non-fatal
+    }
+}
+/**
+ * Run the React analyzer's cross-component finalization (require-error-boundary
+ * / raw-element checks), appending extra violations into the `react` result.
+ */
+async function finalizeReact(reactBundle, analyzerResults, pipelineAnalyzerConfig) {
+    if (reactBundle) {
+        try {
+            const reactResult = analyzerResults['react'];
+            if (reactResult) {
+                // Pass the react namespace (not the whole namespaced config) so
+                // finalize reads `requireErrorBoundaries`/`rawElementCheck` at the
+                // same level the visitor's `context.config` does.
+                const extraViolations = await reactBundle.finalizeCrossComponent(pipelineAnalyzerConfig['react'] ?? {});
+                reactResult.violations.push(...extraViolations);
             }
-            // Cross-domain config lives at the top level (not analyzerConfigs)
-            if (enabledAnalyzers.includes('cross-domain') && mergedOptions.crossDomain) {
-                pipelineAnalyzerConfig['cross-domain'] = {
-                    ...(pipelineAnalyzerConfig['cross-domain'] ?? {}),
-                    ...mergedOptions.crossDomain,
-                };
+        }
+        catch (err) {
+            logMcpInfo('analysis', 'react finalization failed (non-fatal)', {
+                error: err instanceof Error ? err.message : String(err)
+            });
+        }
+    }
+}
+/**
+ * Build the pipeline, run it, and fold its outputs — plus the both-paths phase
+ * split and derived coverage — into a single result bundle for `run`.
+ */
+async function runPipelineStage(inputs) {
+    const { mergedOptions, root, files, corpusFiles, isScoped, fileAccounting, styleConsumedFiles, styleContributingFiles, analyzers, provenanceTiming, } = inputs;
+    const analyzerResults = {};
+    let indexFactsWritten = 0;
+    let writeIndexFactsMs = 0;
+    const { auditIndex, pipelineIndexHandle, indexSkipDiagnostic } = await initializeAuditIndex(root);
+    const { pipelineVisitors, pipelineReducers, pipelineDerivedReducers, reactBundle, solidBundle, } = buildPipelineAdapters(analyzers);
+    // ── Safeguard warnings ────────────────────────────────────────────────
+    if (auditIndex && analyzers.includes('cross-domain')) {
+        const suCount = auditIndex.rawSql.count('schema_usage');
+        if (suCount === 0) {
+            console.warn('[code-audit] ⚠ cross-domain analyzer requires schema_usage data. '
+                + 'This is populated during a full audit run by the schema analyzer. '
+                + 'If this warning persists, run a full "code-audit audit --path ." first.');
+        }
+    }
+    const hasPipelineAnalyzers = pipelineVisitors.length > 0
+        || pipelineReducers.length > 0
+        || pipelineDerivedReducers.length > 0;
+    // Outputs hoisted so derived coverage (after the split) can read them.
+    let phaseFindings = [];
+    let phaseIncompleteFacts = new Map();
+    let pipelineCoverage;
+    let pipelineTableCatalog;
+    let pipelineStageTiming;
+    let pipelineSkippedFiles;
+    let pipelineUnparsedFiles;
+    let pipelineInputPresence;
+    let pipelineRuleTiming;
+    let pipelineFileAccounting;
+    let pipelineDiagnostics;
+    let pipelineTestCoverage;
+    let pipelineDeadClusters;
+    let pipelineSizeDistributions;
+    let routeAttribution;
+    let receiverDiagnostics = [];
+    if (hasPipelineAnalyzers) {
+        const pipelineAnalyzerConfig = buildPipelineAnalyzerConfig(analyzers, mergedOptions, root, files, corpusFiles, provenanceTiming);
+        const pipelineConfig = buildPipelineConfig({
+            mergedOptions, root, files, isScoped, fileAccounting,
+            styleConsumedFiles, styleContributingFiles, analyzers,
+            auditIndex, pipelineAnalyzerConfig, pipelineVisitors, pipelineReducers,
+            pipelineDerivedReducers,
+        });
+        try {
+            logMcpInfo('analysis', 'running pipeline', { visitorCount: pipelineVisitors.length, reducerCount: pipelineReducers.length, derivedReducerCount: pipelineDerivedReducers.length, fileCount: files.length });
+            const pipelineResult = await runPipeline(pipelineConfig, pipelineIndexHandle);
+            // §6.3 — the parent is the only index writer; surface its count and
+            // wall-clock via stageTiming.
+            const stageWriteCount = pipelineResult.metadata.stageTiming?.['index-fact-write-count'];
+            const stageWriteMs = pipelineResult.metadata.stageTiming?.['index-fact-write'];
+            if (typeof stageWriteCount === 'number')
+                indexFactsWritten = stageWriteCount;
+            if (typeof stageWriteMs === 'number')
+                writeIndexFactsMs = stageWriteMs;
+            // Pull in pipeline results
+            for (const [name, ar] of Object.entries(pipelineResult.analyzerResults)) {
+                analyzerResults[name] = ar;
+                logMcpDebug('analysis', `pipeline: ${name} completed`, {
+                    violations: ar.violations?.length ?? 0,
+                    status: ar.status?.status,
+                });
             }
-            // Schema config: all table discovery flows through visitors and facts;
-            // the reducer builds the known-tables catalog solely from fact data.
-            if (enabledAnalyzers.includes('schema')) {
-                const scConfig = mergedOptions.analyzerConfigs?.schema ?? {};
-                const schemaConfig = {
-                    ...(pipelineAnalyzerConfig['schema'] ?? {}),
-                    sqlTagNames: scConfig.sqlTagNames ?? ['sql', 'db'],
-                    dbReceiverNames: scConfig.dbReceiverNames,
-                    dbCallMethods: scConfig.dbCallMethods,
-                    dbBindingNames: scConfig.dbBindingNames ?? ['env.DB'],
-                    fileGateGlobs: scConfig.fileGateGlobs,
-                    // Forward the per-function query ceiling + query-pattern/naming gates
-                    // so the configured value reaches checkQueryPatterns instead of being
-                    // dropped (which made the too-many-queries message print "undefined").
-                    maxQueriesPerFunction: scConfig.maxQueriesPerFunction,
-                    validateQueryPatterns: scConfig.validateQueryPatterns,
-                    checkNamingConventions: scConfig.checkNamingConventions,
-                    // Declarative ORM table-source registry (Spec 29 R2). Defaults to the
-                    // Drizzle builders in the visitor when unset; presets (drizzle, typeorm,
-                    // knex) supply their own, and it must not be dropped before the visitor.
-                    tableSources: scConfig.tableSources,
-                    // Provenance context knobs that the visitor reads via buildProvenanceContext.
-                    dbWrapperNames: scConfig.dbWrapperNames,
-                    detection: scConfig.detection,
-                    // External schema references — the pipeline reducer gates unknown-table
-                    // detection on these being non-empty (fail-open law: no external
-                    // authority means the rule cannot accuse).
-                    schemas: scConfig.schemas,
-                    knownTables: scConfig.knownTables,
-                };
-                pipelineAnalyzerConfig['schema'] = schemaConfig;
-                // Pipeline resolves config by visitor name (rawConfig[visitor.name]).
-                // The schema-* sub-visitors need the same namespace as the schema reducer.
-                for (const sub of ['schema-code', 'schema-sql', 'schema-prisma', 'schema-json']) {
-                    pipelineAnalyzerConfig[sub] = schemaConfig;
-                }
+            await finalizeReact(reactBundle, analyzerResults, pipelineAnalyzerConfig);
+            const split = await applyPhaseModelSplit({
+                mergedOptions, root, files, isScoped, pipelineAnalyzerConfig, analyzerResults, pipelineIndexHandle,
+            });
+            phaseFindings = split.phaseFindings;
+            phaseIncompleteFacts = split.phaseIncompleteFacts;
+            routeAttribution = split.routeAttribution;
+            receiverDiagnostics = split.receiverDiagnostics;
+            // Spec 68 §8 — derived coverage, computed AFTER the split so phaseFindings
+            // holds the migrated rules' re-emitted findings.
+            pipelineCoverage = deriveCoverage({
+                rules: MIGRATED_RULES,
+                findings: phaseFindings,
+                presentFormats: presentFormatsOf(files),
+                enabledRules: enabledMigratedRules(),
+                incompleteFacts: phaseIncompleteFacts,
+                groupOf: (ruleId) => RULE_ANALYZER.get(ruleId) ?? ruleId,
+            });
+            // Spec 29: extract table catalog from pipeline metadata for audit report
+            pipelineTableCatalog = pipelineResult.metadata?.tableCatalog;
+            pipelineStageTiming = pipelineResult.metadata?.stageTiming;
+            pipelineSkippedFiles = pipelineResult.metadata?.skippedFiles;
+            pipelineUnparsedFiles = pipelineResult.metadata?.unparsedFiles;
+            pipelineInputPresence = pipelineResult.metadata?.inputPresence;
+            // Spec 38 R2 — read the live accumulator rather than the `runPipeline`
+            // snapshot: the phase model's `analyzeAll` records its per-rule timing
+            // after `runPipeline` already snapshotted (empty) `ruleTiming`. The
+            // accumulator was reset at `runPipeline` entry, so this is legacy + phase.
+            pipelineRuleTiming = getRuleTimingSortedDesc();
+            pipelineFileAccounting = pipelineResult.metadata?.fileAccounting;
+            pipelineDiagnostics = [
+                ...(pipelineResult.metadata?.diagnostics ?? []),
+                ...receiverDiagnostics,
+            ];
+            pipelineTestCoverage = pipelineResult.metadata?.testCoverage;
+            pipelineDeadClusters = pipelineResult.metadata?.deadClusters;
+            // Spec 60 R2 — aggregate the SOLID analyzer's raw size readings.
+            if (solidBundle) {
+                const samples = await solidBundle.getSizeSamples();
+                pipelineSizeDistributions = computeSizeDistributions(samples);
             }
-            // Global/infrastructure settings passed to all pipeline stages
-            pipelineAnalyzerConfig['_infra'] = {
-                pathProfiles: mergedOptions.pathProfiles,
-                projectRoot: root,
-                _provenanceTiming: provenanceTiming,
-                files,
-                // Spec 60.1 Correction 1 — unfiltered discovery list, used as the
-                // classifier's corpus set (see the computation above for why `files`
-                // is too narrow).
-                corpusFiles,
-                // Spec 60.1 — virtual-module list (config, default ['.blitz']) and the
-                // project's tsconfig `paths` + `baseUrl` (alias classification *and*
-                // resolution). Threaded here so the function-index visitor and the
-                // reachability reducer read them once per run rather than re-reading
-                // tsconfig per file.
-                importVirtualModules: mergedOptions.importVirtualModules ?? DEFAULT_VIRTUAL_MODULES,
-                tsconfigAliases: readTsconfigAliases(root),
-                // Files reachable only through package.json (main/module/types/bin/exports
-                // + their sibling facades) are entry points, not dead modules — knex's
-                // `knex.mjs` / `knex.d.mts` beside `main: knex.js` were flagged
-                // `unreferenced-module` because no in-tree import reaches them.
-                packageEntryPoints: readPackageEntryPoints(root).entryPaths,
-            };
-            const pipelineConfig = {
-                projectRoot: root,
-                explicitFiles: files,
-                visitors: pipelineVisitors,
-                reducers: pipelineReducers,
-                derivedReducers: pipelineDerivedReducers,
-                config: pipelineAnalyzerConfig,
-                abortSignal: mergedOptions.abortSignal,
-                progressCallback: (progress) => {
-                    throwIfAborted(mergedOptions.abortSignal);
-                    reportProgress(mergedOptions, progress);
-                },
-                isScoped,
-                fileAccounting,
-                consumedFilePaths: styleConsumedFiles,
-                styleContributingFiles,
-                onStage2Complete: async (ctx) => {
-                    // Post-stage-2 setup: rebuild function_calls from the functions table
-                    // (populated by the function-index visitor), then mine conventions.
-                    if (auditIndex && enabledAnalyzers.includes('conventions')) {
-                        try {
-                            await auditIndex.updateDependencyGraph();
-                        }
-                        catch (err) {
-                            logMcpInfo('analysis', 'updateDependencyGraph failed (non-fatal)', {
-                                error: err instanceof Error ? err.message : String(err)
-                            });
-                        }
-                        try {
-                            // Convention mining reads source on demand via readFileSync
-                            // (mineImportForm/mineExportShape have an internal fallback).
-                            auditIndex.mineAllConventions(root);
-                        }
-                        catch (err) {
-                            logMcpInfo('analysis', 'convention mining failed (non-fatal)', {
-                                error: err instanceof Error ? err.message : String(err)
-                            });
-                        }
-                    }
-                },
-            };
-            try {
-                logMcpInfo('analysis', 'running pipeline', { visitorCount: pipelineVisitors.length, reducerCount: pipelineReducers.length, derivedReducerCount: pipelineDerivedReducers.length, fileCount: files.length });
-                const pipelineResult = await runPipeline(pipelineConfig, pipelineIndexHandle);
-                // Write index facts (schema_usage from schema visitor, etc.)
-                if (pipelineIndexHandle && pipelineResult.indexFacts && pipelineResult.indexFacts.length > 0) {
-                    writeIndexFactsToDb(pipelineIndexHandle, pipelineResult.indexFacts);
-                }
-                // Pull in pipeline results
-                for (const [name, ar] of Object.entries(pipelineResult.analyzerResults)) {
-                    analyzerResults[name] = ar;
-                    logMcpDebug('analysis', `pipeline: ${name} completed`, {
-                        violations: ar.violations?.length ?? 0,
-                        status: ar.status?.status,
-                    });
-                }
-                // ── Schema sub-visitors: keep separate rows for visibility ────
-                // Schema runs as 4 Stage 2 visitors + 1 Stage 3 reducer. Each visitor
-                // keeps its own violations and status row so the CLI displays per-visitor
-                // file/fact counts. Violations are NOT merged — the reducer only carries
-                // cross-file violations (unknown-table, JSON schema validation).
-                // Sub-visitors are added to orderedAnalyzerResults below (line ~650).
-                // ── React finalization (cross-component checks) ──────────────────
-                if (reactBundle) {
-                    try {
-                        const reactResult = analyzerResults['react'];
-                        if (reactResult) {
-                            // Pass the react namespace (not the whole namespaced config) so
-                            // finalize reads `requireErrorBoundaries`/`rawElementCheck` at the
-                            // same level the visitor's `context.config` does.
-                            const extraViolations = await reactBundle.finalizeCrossComponent(pipelineAnalyzerConfig['react'] ?? {});
-                            reactResult.violations.push(...extraViolations);
-                        }
-                    }
-                    catch (err) {
-                        logMcpInfo('analysis', 'react finalization failed (non-fatal)', {
-                            error: err instanceof Error ? err.message : String(err)
-                        });
-                    }
-                }
-                // Spec 27 — build per-rule coverage from final analyzer results
-                // (computed AFTER react finalization so cross-component checks are included).
-                // Spec 33 Item 14 — thread the pipeline's input-presence snapshot so
-                // zero-violation rules promote from `unassessed` to `clean`/`notApplicable`.
-                pipelineCoverage = buildCoverageReport(analyzerResults, pipelineConfig, pipelineResult.metadata?.inputPresence, new Map((pipelineResult.metadata?.ruleApplicability ?? []).map((a) => [
-                    a.ruleId,
-                    { applicable: a.applicable, reason: a.reason, kind: a.kind },
-                ])));
-                // Spec 29: extract table catalog from pipeline metadata for audit report
-                pipelineTableCatalog = pipelineResult.metadata?.tableCatalog;
-                pipelineStageTiming = pipelineResult.metadata?.stageTiming;
-                pipelineSkippedFiles = pipelineResult.metadata?.skippedFiles;
-                pipelineUnparsedFiles = pipelineResult.metadata?.unparsedFiles;
-                pipelineInputPresence = pipelineResult.metadata?.inputPresence;
-                pipelineRuleTiming = pipelineResult.metadata?.ruleTiming;
-                pipelineFileAccounting = pipelineResult.metadata?.fileAccounting;
-                pipelineDiagnostics = pipelineResult.metadata?.diagnostics;
-                pipelineTestCoverage = pipelineResult.metadata?.testCoverage;
-                pipelineDeadClusters = pipelineResult.metadata?.deadClusters;
-                // Spec 60 R2 — aggregate the SOLID analyzer's raw size readings into
-                // per-measure distributions (median/p95/max + tail annotation).
-                if (solidBundle) {
-                    const samples = await solidBundle.getSizeSamples();
-                    pipelineSizeDistributions = computeSizeDistributions(samples);
-                }
+        }
+        catch (error) {
+            if (error instanceof AuditAbortedError) {
+                throw error;
             }
-            catch (error) {
-                if (error instanceof AuditAbortedError || error instanceof AuditHandoffError) {
-                    throw error;
-                }
-                // Pipeline failure — populate error results for all pipeline analyzers.
-                // Exclude infrastructure visitors (function-index) that don't produce violations.
-                const pipelineAnalyzerNames = new Set([
-                    ...pipelineVisitors.map(v => v.name),
-                    ...pipelineReducers.map(r => r.name),
-                    ...pipelineDerivedReducers.map(r => r.name),
-                ]);
-                pipelineAnalyzerNames.delete('function-index');
-                for (const name of pipelineAnalyzerNames) {
-                    if (!analyzerResults[name]) {
-                        analyzerResults[name] = {
-                            violations: [],
-                            status: makeVisitorStatus(0),
-                            executionTime: 0,
-                            analyzerName: name,
-                            errors: [{ file: 'pipeline', error: error.message }],
-                        };
-                    }
+            // Pipeline failure — one error, reported once below. Populate a `notRun`
+            // placeholder (NOT `visitor-ran` with zero files) for each pipeline analyzer
+            // so the zero-files diagnostic does not fan this single failure out into N
+            // "matched zero source files" warnings. Exclude infrastructure visitors
+            // (function-index) that don't produce violations. The single `pipeline-error`
+            // diagnostic below is the one signal the CLI gates on for a non-zero exit.
+            const pipelineAnalyzerNames = new Set([
+                ...pipelineVisitors.map(v => v.name),
+                ...pipelineReducers.map(r => r.name),
+                ...pipelineDerivedReducers.map(r => r.name),
+            ]);
+            pipelineAnalyzerNames.delete('function-index');
+            for (const name of pipelineAnalyzerNames) {
+                if (!analyzerResults[name]) {
+                    analyzerResults[name] = {
+                        violations: [],
+                        executionTime: 0,
+                        analyzerName: name,
+                        status: { status: 'notRun', reason: `pipeline error: ${error.message}` },
+                    };
                 }
-                reportError(mergedOptions, error, 'pipeline');
             }
+            pipelineDiagnostics = [{
+                    analyzerName: 'pipeline',
+                    kind: 'pipeline-error',
+                    message: error.message,
+                }];
+            reportError(mergedOptions, error, 'pipeline');
         }
-        // ── Zero-files diagnostic ─────────────────────────────────────────────
-        // Extracted to runZeroFilesDiagnostics() for testability. Runs against the
-        // raw analyzerResults before truthiness filtering so the "no result" pass
-        // catches analyzers skipped by the registry, abort, or handoff exceptions.
-        const hasGoFiles = files.some((f) => f.endsWith('.go'));
-        const zeroFilesDiagnostics = runZeroFilesDiagnostics(enabledAnalyzers, analyzerResults, files.length, hasGoFiles);
-        for (const w of zeroFilesDiagnostics) {
-            console.warn(w.message);
+    }
+    // An unavailable index (e.g. a future schema version) is reported as a
+    // coverage diagnostic — never raised as a fatal — so the run still completes
+    // with the exit code it would otherwise have had.
+    if (indexSkipDiagnostic) {
+        pipelineDiagnostics = [...(pipelineDiagnostics ?? []), indexSkipDiagnostic];
+    }
+    return {
+        analyzerResults,
+        phaseFindings,
+        phaseIncompleteFacts,
+        pipelineCoverage,
+        pipelineTableCatalog,
+        pipelineStageTiming,
+        pipelineSkippedFiles,
+        pipelineUnparsedFiles,
+        pipelineInputPresence,
+        pipelineRuleTiming,
+        pipelineFileAccounting,
+        pipelineDiagnostics,
+        pipelineTestCoverage,
+        pipelineDeadClusters,
+        pipelineSizeDistributions,
+        routeAttribution,
+        indexFactsWritten,
+        writeIndexFactsMs,
+    };
+}
+/**
+ * Initialize the analyzer-facing CodeIndexDB and build the `IndexHandle` the
+ * pipeline reducers read through. Both are optional: a failed init degrades to
+ * `undefined` and the pipeline continues without index-backed facts. Hoisted out
+ * of `runPipelineStage` so its body stays under the `function-length` ceiling.
+ */
+async function initializeAuditIndex(root) {
+    let auditIndex;
+    let indexSkipDiagnostic;
+    try {
+        auditIndex = CodeIndexDB.getInstance(undefined, root);
+        await auditIndex.initialize();
+        logMcpInfo('analysis', 'code index initialized for analyzers', { isInitialized: auditIndex.isInitialized, dbPath: auditIndex.dbPath });
+    }
+    catch (err) {
+        // Fail-open (Spec 71 R7 shape): a failed init — including a *future* index
+        // schema version — must not crash the audit. Drop the half-built singleton
+        // (its concern modules are undefined after a failed createSchema) so every
+        // downstream `if (auditIndex)` guard reads "no index", and record the skip
+        // as a coverage diagnostic naming the cause so "indexed analysis skipped"
+        // is visible in the report, not raised as a fatal.
+        auditIndex = undefined;
+        const message = err instanceof Error ? err.message : String(err);
+        const context = err?.context;
+        indexSkipDiagnostic = {
+            analyzerName: 'code-index',
+            kind: 'engine-error',
+            message: `Indexed analysis skipped: ${message}`,
+            ...(context && typeof context.storedSchemaVersion === 'number' && typeof context.supportedSchemaVersion === 'number'
+                ? { details: { storedSchemaVersion: context.storedSchemaVersion, supportedSchemaVersion: context.supportedSchemaVersion } }
+                : {}),
+        };
+        logMcpInfo('analysis', 'failed to initialize code index for analyzers (continuing)', { error: message });
+    }
+    // Build IndexHandle for pipeline reducers
+    let pipelineIndexHandle;
+    if (auditIndex) {
+        pipelineIndexHandle = {
+            query: (sql, params) => auditIndex.rawSql.query(sql, params),
+            count: (table) => auditIndex.rawSql.count(table),
+            tableHasRows: (table) => auditIndex.rawSql.tableHasRows(table),
+            run: (sql, params) => auditIndex.rawDb.prepare(sql).run(...(params ?? [])),
+            exec: (sql) => auditIndex.rawDb.exec(sql),
+            getMeta: (key) => auditIndex.meta.getMeta(key),
+            getUntestedTopDecile: (td) => auditIndex.coverage.getUntestedTopDecile(td),
+            rawDb: auditIndex.rawDb,
+        };
+    }
+    return { auditIndex, pipelineIndexHandle, indexSkipDiagnostic };
+}
+/**
+ * Build the ordered analyzer-results map from the raw pipeline output: filter
+ * to truthy entries (so downstream consumers never see undefineds), and insert
+ * the schema sub-visitors and the auto-registered `data-access-org-filter`
+ * reducer in their display positions.
+ */
+function buildOrderedAnalyzerResults(analyzers, analyzerResults) {
+    const ordered = {};
+    for (const analyzerName of analyzers) {
+        if (analyzerResults[analyzerName]) {
+            ordered[analyzerName] = analyzerResults[analyzerName];
         }
-        // Build ordered results — filter to truthy entries so downstream consumers
-        // (DRY pair persistence, baseline, report generation) don't see undefineds.
-        const orderedAnalyzerResults = {};
-        for (const analyzerName of enabledAnalyzers) {
-            if (analyzerResults[analyzerName]) {
-                orderedAnalyzerResults[analyzerName] = analyzerResults[analyzerName];
-            }
-            // When schema is enabled, insert sub-visitor rows after the schema entry
-            // so the CLI table shows per-visitor file/fact counts.
-            if (analyzerName === 'schema') {
-                for (const subName of SCHEMA_SUB_VISITORS) {
-                    if (analyzerResults[subName]) {
-                        orderedAnalyzerResults[subName] = analyzerResults[subName];
-                    }
+        // When schema is enabled, insert sub-visitor rows after the schema entry
+        // so the CLI table shows per-visitor file/fact counts.
+        if (analyzerName === 'schema') {
+            for (const subName of SCHEMA_SUB_VISITORS) {
+                if (analyzerResults[subName]) {
+                    ordered[subName] = analyzerResults[subName];
                 }
             }
-            // Spec 62 Amendment B — `data-access-org-filter` is auto-registered (never
-            // in enabledAnalyzers), so surface its Stage-4 row right after data-access.
-            if (analyzerName === 'data-access' && analyzerResults['data-access-org-filter']) {
-                orderedAnalyzerResults['data-access-org-filter'] = analyzerResults['data-access-org-filter'];
-            }
         }
-        // ── Normalize the analyzer field on every violation to its result key ──
-        // Violations are emitted by analyzers that don't always stamp `analyzer`
-        // correctly: the react analyzer omits it entirely, and the schema sub-visitor
-        // helpers (createSchemaViolation) hardcode `analyzer: 'schema'` for every
-        // sub-visitor, collapsing schema-code/schema-sql/schema-prisma/schema-json
-        // into the parent 'schema'. Both surface in the baseline metadata as
-        // `unknown: 338` / an over-broad `schema` bucket. The result key IS the
-        // analyzer that emitted the finding, so stamp it here as the single source
-        // of truth — a no-op for every analyzer that already labels itself, and it
-        // also fixes any future analyzer that forgets. Runs before baseline
-        // classification (Spec 18) so fingerprints and analyzerCounts are correct.
-        // Spec 62 Amendment B — the `data-access-org-filter` reducer stamps its
-        // findings with `analyzer: 'data-access'` so the ledger group
-        // `data-access/missing-org-filter` stays stable across the Stage-2 → Stage-4
-        // move. The result key is otherwise the single source of truth (see above).
-        const analyzerFieldOverride = {
-            'data-access-org-filter': 'data-access',
-        };
-        for (const [resultName, result] of Object.entries(orderedAnalyzerResults)) {
-            const stampedAnalyzer = analyzerFieldOverride[resultName] ?? resultName;
-            for (const v of result.violations) {
-                v.analyzer = stampedAnalyzer;
-            }
+        // Spec 62 Amendment B — `data-access-org-filter` is auto-registered (never
+        // in analyzers), so surface its Stage-4 row right after data-access.
+        if (analyzerName === 'data-access' && analyzerResults['data-access-org-filter']) {
+            ordered['data-access-org-filter'] = analyzerResults['data-access-org-filter'];
         }
-        // ── Spec 13 R5 Phase 1: Persist seeded DRY pairs ──────────────────
-        // Store pairs from DRY analysis in dry_pair_history for divergence tracking.
-        // Pair identity is fingerprint-based (file + nodeType + line),
-        // NOT content-hash-based — so a diverging clone stays the same pair.
-        let dryPersistRunId = null;
-        try {
-            const dryPairs = dryBundle?.getDryPairs();
-            if (dryPairs && dryPairs.length > 0) {
-                const indexDb = CodeIndexDB.getInstance(undefined, root);
-                await indexDb.initialize();
-                dryPersistRunId = randomUUID();
-                const insertStmt = indexDb.rawDb.prepare(`
-          INSERT OR IGNORE INTO dry_pair_history
-            (pair_fingerprint, file1, symbol1, line1, content_hash1,
-             file2, symbol2, line2, content_hash2, similarity, timestamp, run_id)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, datetime('now'), ?)
-        `);
-                const tx = indexDb.rawDb.transaction(() => {
-                    for (const pair of dryPairs) {
-                        insertStmt.run(pair.pairFingerprint, pair.file1, pair.symbol1, pair.line1, pair.contentHash1, pair.file2, pair.symbol2, pair.line2, pair.contentHash2, pair.similarity, dryPersistRunId);
-                    }
-                });
-                tx();
+    }
+    return ordered;
+}
+/**
+ * Stamp the `analyzer` field on every violation to its result key. Violations
+ * are emitted by analyzers that don't always stamp `analyzer` correctly: the
+ * react analyzer omits it entirely, schema sub-visitor helpers hardcode
+ * `'schema'`, and the `data-access-org-filter` reducer deliberately labels
+ * itself `data-access` to keep the ledger group stable. The result key is the
+ * single source of truth.
+ */
+function stampAnalyzerFields(ordered) {
+    const overrides = {
+        'data-access-org-filter': 'data-access',
+    };
+    for (const [resultName, result] of Object.entries(ordered)) {
+        const stamped = overrides[resultName] ?? resultName;
+        for (const v of result.violations) {
+            v.analyzer = stamped;
+        }
+    }
+}
+/**
+ * Spec 13 R2 — attach hotspot + reachability scores to every violation and
+ * reorder within severity tiers (live code first, then higher hotspot, original
+ * order as tiebreaker). Advisory — failure is non-fatal (no churn/hotspot data
+ * is common on a first run).
+ */
+async function applyHotspotScoring(ordered, root) {
+    try {
+        const indexDb = CodeIndexDB.getInstance(undefined, root);
+        await indexDb.initialize();
+        const hotspotRows = indexDb.rawDb
+            .prepare('SELECT target, type, score FROM hotspot_scores')
+            .all();
+        const hotspotByTarget = new Map();
+        const hotspotByFile = new Map();
+        for (const row of hotspotRows) {
+            hotspotByTarget.set(row.target, row.score);
+            if (row.type === 'file') {
+                hotspotByFile.set(row.target, row.score);
             }
         }
-        catch {
-            // dry_pair_history persistence is advisory — non-fatal
+        const reachabilityByFile = new Map();
+        const reachRows = indexDb.rawDb
+            .prepare("SELECT node_key, weight FROM graph_cache WHERE graph_type = 'reachability'")
+            .all();
+        for (const row of reachRows) {
+            reachabilityByFile.set(row.node_key, row.weight);
         }
-        // ── Spec 13 R2 — Hotspot scoring & finding reordering ──────────────
-        // Attach hotspot scores to violations and reorder within severity tiers.
-        // Falls back gracefully when no churn/hotspot data exists.
-        //
-        // Reachability (live vs dead code) is a second ranking axis written by the
-        // dependency-graph reducer to graph_cache. Within a severity tier, dead
-        // code sinks below live code, so a finding in an unreferenced module drops
-        // while a finding on a framework entry point rises.
-        try {
-            const indexDb = CodeIndexDB.getInstance(undefined, root);
-            await indexDb.initialize();
-            // Build hotspot lookup: target -> score
-            const hotspotRows = indexDb.rawDb
-                .prepare('SELECT target, type, score FROM hotspot_scores')
-                .all();
-            const hotspotByTarget = new Map();
-            const hotspotByFile = new Map();
-            for (const row of hotspotRows) {
-                hotspotByTarget.set(row.target, row.score);
-                if (row.type === 'file') {
-                    hotspotByFile.set(row.target, row.score);
-                }
-            }
-            // Build reachability lookup: file -> score (0 dead, 0.5 imported, 1 entry)
-            const reachabilityByFile = new Map();
-            const reachRows = indexDb.rawDb
-                .prepare("SELECT node_key, weight FROM graph_cache WHERE graph_type = 'reachability'")
-                .all();
-            for (const row of reachRows) {
-                reachabilityByFile.set(row.node_key, row.weight);
-            }
-            // Attach hotspot + reachability to each violation and reorder within each analyzer
-            for (const analyzerName of Object.keys(orderedAnalyzerResults)) {
-                const result = orderedAnalyzerResults[analyzerName];
-                const violations = result.violations;
-                for (const v of violations) {
-                    const funcName = v.functionName;
-                    const file = v.file;
-                    // Try function-level hotspot first: "filePath::functionName"
-                    const funcTarget = funcName ? `${file}::${funcName}` : undefined;
-                    v.hotspot = (funcTarget ? hotspotByTarget.get(funcTarget) : undefined)
-                        ?? hotspotByFile.get(file)
-                        ?? 0;
-                    // Files with no cross-language entities (no reachability data) get a
-                    // neutral 0.5 so we never demote a finding we know nothing about.
-                    v.reachability = reachabilityByFile.get(file) ?? 0.5;
-                }
-                // Reorder within severity tiers: reachability descending, then hotspot
-                // descending, preserving original order as tiebreaker.
-                const severityOrder = {
-                    critical: 0,
-                    severe: 1,
-                    high: 2,
-                    info: 3,
-                };
-                const indexed = violations.map((v, i) => ({ v, i }));
-                indexed.sort((a, b) => {
-                    const sevA = severityOrder[a.v.severity] ?? 99;
-                    const sevB = severityOrder[b.v.severity] ?? 99;
-                    if (sevA !== sevB)
-                        return sevA - sevB;
-                    // Within same severity: live code first, dead code last
-                    const reachA = a.v.reachability ?? 0.5;
-                    const reachB = b.v.reachability ?? 0.5;
-                    if (reachA !== reachB)
-                        return reachB - reachA;
-                    // Then higher hotspot first
-                    const hsA = a.v.hotspot ?? 0;
-                    const hsB = b.v.hotspot ?? 0;
-                    if (hsA !== hsB)
-                        return hsB - hsA;
-                    // Tiebreaker: original order
-                    return a.i - b.i;
-                });
-                result.violations = indexed.map(x => x.v);
+        for (const analyzerName of Object.keys(ordered)) {
+            const result = ordered[analyzerName];
+            const violations = result.violations;
+            for (const v of violations) {
+                const funcName = v.symbol;
+                const file = v.file;
+                // Try function-level hotspot first: "filePath::symbol"
+                const funcTarget = funcName ? `${file}::${funcName}` : undefined;
+                v.hotspot = (funcTarget ? hotspotByTarget.get(funcTarget) : undefined)
+                    ?? hotspotByFile.get(file)
+                    ?? 0;
+                // Files with no cross-language entities (no reachability data) get a
+                // neutral 0.5 so we never demote a finding we know nothing about.
+                v.reachability = reachabilityByFile.get(file) ?? 0.5;
             }
+            const severityOrder = {
+                critical: 0,
+                severe: 1,
+                high: 2,
+                info: 3,
+            };
+            const indexed = violations.map((v, i) => ({ v, i }));
+            indexed.sort((a, b) => {
+                const sevA = severityOrder[a.v.severity] ?? 99;
+                const sevB = severityOrder[b.v.severity] ?? 99;
+                if (sevA !== sevB)
+                    return sevA - sevB;
+                const reachA = a.v.reachability ?? 0.5;
+                const reachB = b.v.reachability ?? 0.5;
+                if (reachA !== reachB)
+                    return reachB - reachA;
+                const hsA = a.v.hotspot ?? 0;
+                const hsB = b.v.hotspot ?? 0;
+                if (hsA !== hsB)
+                    return hsB - hsA;
+                return a.i - b.i;
+            });
+            result.violations = indexed.map((x) => x.v);
+        }
+    }
+    catch {
+        // Hotspot/reachability reordering is advisory — failure is non-fatal
+    }
+}
+/**
+ * Spec 18 R1 — classify the ordered findings against the committed baseline,
+ * tagging each violation new/known and computing the baseline metadata. Runs
+ * after the hook-contract guard so it classifies exactly the set that reaches
+ * the report.
+ */
+function classifyBaselineFindings(ordered, mergedOptions, files, isScoped) {
+    const projectRoot = path.resolve(mergedOptions.projectRoot || process.cwd());
+    const baseline = loadBaseline(projectRoot);
+    let baselineMetadata;
+    if (baseline) {
+        const allViolations = Object.values(ordered).flatMap((r) => r.violations);
+        // For scoped runs, limit "fixed" to in-scope files
+        const scopedFiles = isScoped ? files : undefined;
+        const classified = matchFindings(allViolations, baseline, scopedFiles);
+        // Tag violations with their baseline status
+        for (const v of classified.new) {
+            v.new = true;
+        }
+        for (const v of classified.known) {
+            v.new = false;
         }
-        catch {
-            // Hotspot/reachability reordering is advisory — failure is non-fatal
+        baselineMetadata = {
+            present: true,
+            hash: hashBaseline(baseline),
+            newCount: classified.new.length,
+            fixedCount: classified.fixed.length,
+            knownCount: classified.known.length,
+            previousKnownCount: baseline.metadata.totalFindings,
+        };
+        logMcpInfo('baseline', 'baseline classification complete', {
+            new: classified.new.length,
+            fixed: classified.fixed.length,
+            known: classified.known.length,
+        });
+    }
+    return { projectRoot, baselineMetadata };
+}
+/**
+ * Build the final `AuditResult` from the ordered findings and the pipeline
+ * bundle — summary, metadata assembly (coverage, baseline, diagnostics, the
+ * Spec 60 size/test/distribution reports), and hook-contract-clean violations.
+ */
+function buildAuditResult(inputs) {
+    const { ordered, files, analyzers, mergedOptions, isScoped, scopeResultType, indexFactsWritten, writeIndexFactsMs, startTime, startCpu, provenanceTiming, blastRadius, zeroFilesDiagnostics, pipelineDiagnostics, rejected, lintConfigDiagnostics, configPath, baselineMetadata, pipelineCoverage, routeAttribution, pipelineTableCatalog, pipelineStageTiming, thresholdChanges, thresholdSources, pipelineSkippedFiles, pipelineUnparsedFiles, skippedExtensions, pipelineInputPresence, pipelineRuleTiming, pipelineFileAccounting, pipelineTestCoverage, pipelineDeadClusters, pipelineSizeDistributions, collectedFunctions, fileToFunctionsMap, } = inputs;
+    // Spec 69 §10 R4 — count query-shaped call sites whose DB receiver is
+    // unproven, keyed by the analyzer that owns the receiver-resolution
+    // instrument (`schema`). This is the site-level `cannot-fire` surface that
+    // `summary.byAnalyzer[].unprovenSites` carries per analyzer.
+    const unprovenSitesByAnalyzer = new Map();
+    for (const d of pipelineDiagnostics ?? []) {
+        if (d.kind !== 'cannot-fire' || d.analyzerName !== 'schema')
+            continue;
+        unprovenSitesByAnalyzer.set(d.analyzerName, (unprovenSitesByAnalyzer.get(d.analyzerName) ?? 0) + 1);
+    }
+    const summary = generateSummary(ordered, files.length, unprovenSitesByAnalyzer);
+    return {
+        timestamp: new Date(),
+        summary,
+        analyzerResults: ordered,
+        recommendations: [],
+        metadata: {
+            auditDuration: Date.now() - startTime,
+            auditCpuMs: cpuDurationMs(startCpu),
+            filesAnalyzed: files.length,
+            ...(indexFactsWritten > 0 && { indexFactsWritten, writeIndexFactsMs }),
+            analyzersRun: analyzers,
+            ...(isScoped && { analyzedFiles: files }),
+            configUsed: mergedOptions,
+            scope: scopeResultType,
+            provenanceResolutionMs: provenanceTiming.totalMs,
+            ...(blastRadius && { blastRadius }),
+            ...((zeroFilesDiagnostics.length > 0 || (pipelineDiagnostics?.length ?? 0) > 0 || rejected.length > 0 || lintConfigDiagnostics.length > 0) && {
+                diagnostics: [
+                    ...zeroFilesDiagnostics,
+                    ...(pipelineDiagnostics ?? []),
+                    ...lintConfigDiagnostics,
+                    ...rejected.map((entry) => ({
+                        analyzerName: 'config',
+                        kind: 'config-key-rejected',
+                        message: `${entry.key}: ${entry.value} (${entry.reason})`,
+                        ...(configPath ? { file: configPath } : {}),
+                        details: { key: entry.key, value: entry.value, reason: entry.reason },
+                    })),
+                ],
+            }),
+            ...(baselineMetadata && { baseline: baselineMetadata }),
+            ...(pipelineCoverage && { coverage: pipelineCoverage }),
+            ...(routeAttribution && { routeAttribution }),
+            ...(pipelineTableCatalog && { tableCatalog: pipelineTableCatalog }),
+            ...(pipelineStageTiming && { stageTiming: pipelineStageTiming }),
+            ...(thresholdChanges.length > 0 && { thresholdChanges }),
+            ...(thresholdSources.length > 0 && { thresholdSources }),
+            ...(pipelineSkippedFiles && pipelineSkippedFiles.length > 0 && { skippedFiles: pipelineSkippedFiles }),
+            ...(pipelineUnparsedFiles && pipelineUnparsedFiles.length > 0 && { unparsedFiles: pipelineUnparsedFiles }),
+            ...(skippedExtensions && skippedExtensions.length > 0 && { skippedExtensions }),
+            ...(pipelineInputPresence && { inputPresence: pipelineInputPresence }),
+            ...(pipelineRuleTiming && { ruleTiming: pipelineRuleTiming }),
+            ...(pipelineFileAccounting && { fileAccounting: pipelineFileAccounting }),
+            ...(pipelineTestCoverage && { testCoverage: pipelineTestCoverage }),
+            ...(pipelineDeadClusters && pipelineDeadClusters.length > 0 && { deadClusters: pipelineDeadClusters }),
+            ...(pipelineSizeDistributions && pipelineSizeDistributions.length > 0 && { sizeDistributions: pipelineSizeDistributions }),
+            ...(collectedFunctions.length > 0 && {
+                collectedFunctions,
+                fileToFunctionsMap: Object.fromEntries(fileToFunctionsMap)
+            })
         }
-        // ── Spec 13 R5 Phase 2: Divergence tracking pass ──────────────────
-        // For every pair in dry_pair_history, compare the last 2 similarity
-        // measurements. If similarity has declined by ≥ divergenceThreshold
-        // for divergenceRuns consecutive runs, emit dry/diverging-clone.
-        //
-        // New rows are inserted by Phase 1 for pairs the DRY analyzer re-detects
-        // this run. Pairs that weren't re-detected don't get a new measurement
-        // this pass — full source re-read is deferred to the 20% case.
+    };
+}
+/**
+ * Spec 11 R1 — fire-and-forget write to the findings ledger. Non-fatal: the
+ * ledger is advisory, so a failed write never invalidates the audit result.
+ * Forked shard workers set `writeToLedger:false` (handled by the caller's
+ * guard here) so the parent run is the single writer.
+ */
+function fireLedgerWrite(inputs) {
+    if (inputs.mergedOptions.writeToLedger === false) {
+        return;
+    }
+    void (async () => {
         try {
-            const divergenceCfg = mergedOptions.analyzerConfigs?.dry?.divergence
-                ?? mergedOptions.divergence
-                ?? { divergenceThreshold: 0.05, divergenceRuns: 2, minPairSimilarity: 0.5 };
-            const threshold = divergenceCfg.divergenceThreshold ?? 0.05;
-            const requiredDeclines = divergenceCfg.divergenceRuns ?? 2;
-            if (threshold > 0) {
-                const indexDb = CodeIndexDB.getInstance(undefined, root);
-                await indexDb.initialize();
-                // Get all distinct pair fingerprints
-                const fingerprints = indexDb.rawDb
-                    .prepare('SELECT DISTINCT pair_fingerprint FROM dry_pair_history')
-                    .all();
-                if (fingerprints.length > 0) {
-                    const getRows = indexDb.rawDb.prepare(`
-            SELECT similarity, timestamp
-            FROM dry_pair_history
-            WHERE pair_fingerprint = ?
-            ORDER BY timestamp ASC
-          `);
-                    const divergingViolations = [];
-                    for (const { pair_fingerprint: fp } of fingerprints) {
-                        const rows = getRows.all(fp);
-                        if (rows.length < requiredDeclines + 1)
-                            continue;
-                        // Check last `requiredDeclines` consecutive pairs for decline
-                        let consecutiveDeclines = 0;
-                        for (let i = rows.length - requiredDeclines; i < rows.length; i++) {
-                            if (rows[i].similarity < rows[i - 1].similarity - threshold) {
-                                consecutiveDeclines++;
-                            }
-                        }
-                        if (consecutiveDeclines >= requiredDeclines) {
-                            // Get file/line info from the last row
-                            const lastRow = indexDb.rawDb.prepare(`
-                SELECT file1, file2, line1, line2 FROM dry_pair_history
-                WHERE pair_fingerprint = ?
-                ORDER BY timestamp DESC LIMIT 1
-              `).get(fp);
-                            if (lastRow) {
-                                const currentSim = rows[rows.length - 1].similarity;
-                                const prevSim = rows[rows.length - 2].similarity;
-                                const drop = Math.round((prevSim - currentSim) * 1000) / 1000;
-                                divergingViolations.push({
-                                    file: lastRow.file1,
-                                    line: lastRow.line1,
-                                    severity: 'severe',
-                                    message: `Clone pair has diverged: similarity dropped ${drop} (from ${prevSim.toFixed(3)} to ${currentSim.toFixed(3)}) across ${requiredDeclines} consecutive runs (pair: ${fp.slice(0, 12)}…). Review ${lastRow.file1}:${lastRow.line1} and ${lastRow.file2}:${lastRow.line2} for diverged logic.`,
-                                    analyzer: 'dry',
-                                    rule: 'dry/diverging-clone',
-                                });
-                            }
-                        }
-                    }
-                    if (divergingViolations.length > 0) {
-                        // Append to the dry analyzer result, or create one if none exists
-                        if (orderedAnalyzerResults['dry']) {
-                            orderedAnalyzerResults['dry'].violations.push(...divergingViolations);
-                        }
-                        else {
-                            orderedAnalyzerResults['dry'] = {
-                                violations: divergingViolations,
-                                status: makeVisitorStatus(0),
-                                executionTime: 0,
-                                analyzerName: 'dry',
-                            };
-                        }
-                    }
-                }
-            }
+            const indexDb = CodeIndexDB.getInstance(undefined, inputs.root);
+            await indexDb.initialize();
+            const violations = Object.values(inputs.ordered).flatMap((ar) => ar.violations);
+            const scopeStr = Array.isArray(inputs.scope) ? `files:${inputs.scope.length}` : (inputs.scope ?? 'all');
+            return writeAuditToLedger(indexDb.rawDb, detectRunInput(process.argv.slice(2).join(' '), inputs.options.surface ?? 'cli', scopeStr, inputs.root, TOOL_VERSION), violations, Date.now() - inputs.startTime, 0, // exit status TBD — updateLedgerRunStatus by CLI after return
+            { coverage: inputs.result.metadata.coverage });
         }
-        catch {
-            // Divergence tracking is advisory — non-fatal
+        catch (_err) {
+            // ledger write is non-fatal — audit result is still valid
+            return null;
         }
+    })();
+}
+/**
+ * Create an audit runner with the given options
+ *
+ * @param options - Audit runner options (project root, analyzer config, thresholds).
+ */
+export function createAuditRunner(options = {}) {
+    /**
+     * Load configuration from file
+     */
+    async function loadConfiguration(configPath) {
+        const { config } = await loadConfig({ configPath, projectRoot: path.dirname(configPath) });
+        return { ...options, ...config };
+    }
+    /**
+     * Run the audit
+     */
+    async function run(runOptions) {
+        const { mergedOptions, configPath, rejected, lintConfigDiagnostics, thresholdChanges, thresholdSources, } = await resolveRunConfig(options, runOptions);
+        const startTime = Date.now();
+        // CPU-time clock for the load-independent gate metric (Spec 38 R3 / Spec 43
+        // R2-R3): wall clock conflates a slow rule with a slow machine; CPU time
+        // isolates the rule cost. Captured alongside the wall clock so both stay in
+        // the same scope (everything from scope resolution through result creation).
+        const startCpu = process.cpuUsage();
+        const root = path.resolve(mergedOptions.projectRoot || process.cwd());
+        // One-time notice for a legacy in-repo index location (`.code-index` /
+        // `node_modules/.cache/code-auditor`) left by a pre-move build — reported once,
+        // never deleted (see legacyIndexNotice.ts).
+        notifyLegacyIndexLocation(root);
+        // Spec 44 — file accounting accumulator, owned by the run. Threaded through
+        // discovery (full `all` scope) and the pipeline (stage 1/2) so every touched
+        // file lands in exactly one terminal state and the balance can be asserted.
+        const fileAccounting = new FileAccounting();
+        const { files, changedFunctions, skippedExtensions, blastRadius, corpusFiles, scope, isScoped, scopeResultType, } = await discoverAuditFiles(mergedOptions, root, fileAccounting);
+        const { collectedFunctions, fileToFunctionsMap } = await collectIndexedFunctions(mergedOptions, files);
+        // Run analyzers
+        // Spec 68 §15 — no selection model: the full pipeline always runs. `indexOnly`
+        // skips analysis wholesale (the index-only harness); config cannot pick a subset.
+        const analyzers = mergedOptions.indexOnly ? [] : [...RUN_ANALYZERS];
+        logMcpInfo('analysis', 'enabled analyzers', {
+            names: analyzers,
+            fileCount: files.length,
+            scope: scopeResultType
+        });
+        // Spec 21: Shared timing accumulator for provenance resolution.
+        const provenanceTiming = { totalMs: 0 };
+        const { styleConsumedFiles, styleContributingFiles } = await syncStyles(analyzers, root, files, isScoped);
+        const pipeline = await runPipelineStage({
+            mergedOptions, root, files, corpusFiles, isScoped, fileAccounting,
+            styleConsumedFiles, styleContributingFiles, analyzers, provenanceTiming,
+        });
+        const { analyzerResults, phaseFindings, phaseIncompleteFacts, pipelineCoverage, pipelineTableCatalog, pipelineStageTiming, pipelineSkippedFiles, pipelineUnparsedFiles, pipelineInputPresence, pipelineRuleTiming, pipelineFileAccounting, pipelineDiagnostics, pipelineTestCoverage, pipelineDeadClusters, pipelineSizeDistributions, routeAttribution, indexFactsWritten, writeIndexFactsMs, } = pipeline;
+        // ── Zero-files diagnostic ─────────────────────────────────────────────
+        // Extracted to runZeroFilesDiagnostics() for testability. Runs against the
+        // raw analyzerResults before truthiness filtering so the "no result" pass
+        // catches analyzers skipped by the registry, abort, or handoff exceptions.
+        const hasGoFiles = files.some((f) => f.endsWith('.go'));
+        const zeroFilesDiagnostics = runZeroFilesDiagnostics(analyzers, analyzerResults, files.length, hasGoFiles);
+        for (const w of zeroFilesDiagnostics) {
+            console.warn(w.message);
+        }
+        // Build ordered results — filter to truthy entries so downstream consumers
+        // (DRY pair persistence, baseline, report generation) don't see undefineds.
+        const orderedAnalyzerResults = buildOrderedAnalyzerResults(analyzers, analyzerResults);
+        // Normalize the analyzer field on every violation to its result key (the
+        // single source of truth — see stampAnalyzerFields).
+        stampAnalyzerFields(orderedAnalyzerResults);
+        // Spec 13 R2 — hotspot scoring & finding reordering (advisory).
+        await applyHotspotScoring(orderedAnalyzerResults, root);
         // Hook-contract guard: no violation may carry an empty file path, line 0, or
         // missing line. A sentinel violation with file:'' broke the Claude Code hook's
-        // JSON consumer (Spec 15 regression). line:0 from CrossDomainAnalyzer broke it
-        // again (Spec 22 alarm #1). This guard is permanent — every analyzer code path
-        // must produce properly anchored violations.
-        //
-        // Runs BEFORE result construction so the CLI/MCP surfaces never see bad
-        // violations. Operates on the originals (via splice), not a copy.
+        // JSON consumer (Spec 15 regression); line:0 from CrossDomainAnalyzer broke it
+        // again (Spec 22 alarm #1). Permanent — every analyzer code path must produce
+        // properly anchored violations. Operates on the originals (via splice).
         for (const ar of Object.values(orderedAnalyzerResults)) {
             validateHookContract(ar.violations);
         }
-        // ── Baseline classification (Spec 18 R1) ────────────────────────────
-        // Runs AFTER validateHookContract (and after divergence tracking) so it
-        // classifies exactly the violation set that reaches the report. Previously
-        // this ran before the hook-contract guard spliced out malformed violations
-        // (empty file / line 0 / missing line), so newCount+knownCount over-counted
-        // by the number of spliced findings and no longer reconciled with
-        // summary.totalViolations.
-        const projectRoot = path.resolve(mergedOptions.projectRoot || process.cwd());
-        const baseline = loadBaseline(projectRoot);
-        let baselineMetadata;
-        if (baseline) {
-            const allViolations = Object.values(orderedAnalyzerResults).flatMap((r) => r.violations);
-            // For scoped runs, limit "fixed" to in-scope files
-            const scopedFiles = isScoped ? files : undefined;
-            const classified = matchFindings(allViolations, baseline, scopedFiles);
-            // Tag violations with their baseline status
-            for (const v of classified.new) {
-                v.new = true;
-            }
-            for (const v of classified.known) {
-                v.new = false;
-            }
-            baselineMetadata = {
-                present: true,
-                hash: hashBaseline(baseline),
-                newCount: classified.new.length,
-                fixedCount: classified.fixed.length,
-                knownCount: classified.known.length,
-                previousKnownCount: baseline.metadata.totalFindings,
-            };
-            logMcpInfo('baseline', 'baseline classification complete', {
-                new: classified.new.length,
-                fixed: classified.fixed.length,
-                known: classified.known.length,
-            });
-        }
-        // Generate summary
-        const summary = generateSummary(orderedAnalyzerResults, files.length);
-        // Create result
-        const result = {
-            timestamp: new Date(),
-            summary,
-            analyzerResults: orderedAnalyzerResults,
-            recommendations: [],
-            metadata: {
-                auditDuration: Date.now() - startTime,
-                filesAnalyzed: files.length,
-                analyzersRun: enabledAnalyzers,
-                ...(isScoped && { analyzedFiles: files }),
-                configUsed: mergedOptions,
-                scope: scopeResultType,
-                provenanceResolutionMs: provenanceTiming.totalMs,
-                ...(blastRadius && { blastRadius }),
-                ...((zeroFilesDiagnostics.length > 0 || (pipelineDiagnostics?.length ?? 0) > 0 || rejected.length > 0 || lintConfigDiagnostics.length > 0) && {
-                    diagnostics: [
-                        ...zeroFilesDiagnostics,
-                        ...(pipelineDiagnostics ?? []),
-                        ...lintConfigDiagnostics,
-                        ...rejected.map((entry) => ({
-                            analyzerName: 'config',
-                            kind: 'config-key-rejected',
-                            message: `${entry.key}: ${entry.value} (${entry.reason})`,
-                            ...(configPath ? { file: configPath } : {}),
-                            details: { key: entry.key, value: entry.value, reason: entry.reason },
-                        })),
-                    ],
-                }),
-                ...(baselineMetadata && { baseline: baselineMetadata }),
-                ...(pipelineCoverage && { coverage: pipelineCoverage }),
-                ...(pipelineTableCatalog && { tableCatalog: pipelineTableCatalog }),
-                ...(pipelineStageTiming && { stageTiming: pipelineStageTiming }),
-                ...(thresholdChanges.length > 0 && { thresholdChanges }),
-                ...(thresholdSources.length > 0 && { thresholdSources }),
-                ...(pipelineSkippedFiles && pipelineSkippedFiles.length > 0 && { skippedFiles: pipelineSkippedFiles }),
-                ...(pipelineUnparsedFiles && pipelineUnparsedFiles.length > 0 && { unparsedFiles: pipelineUnparsedFiles }),
-                ...(skippedExtensions && skippedExtensions.length > 0 && { skippedExtensions }),
-                ...(pipelineInputPresence && { inputPresence: pipelineInputPresence }),
-                ...(pipelineRuleTiming && { ruleTiming: pipelineRuleTiming }),
-                ...(pipelineFileAccounting && { fileAccounting: pipelineFileAccounting }),
-                ...(pipelineTestCoverage && { testCoverage: pipelineTestCoverage }),
-                ...(pipelineDeadClusters && pipelineDeadClusters.length > 0 && { deadClusters: pipelineDeadClusters }),
-                ...(pipelineSizeDistributions && pipelineSizeDistributions.length > 0 && { sizeDistributions: pipelineSizeDistributions }),
-                ...(collectedFunctions.length > 0 && {
-                    collectedFunctions,
-                    fileToFunctionsMap: Object.fromEntries(fileToFunctionsMap)
-                })
-            }
-        };
+        // Baseline classification (Spec 18 R1) — after the hook-contract guard so it
+        // classifies exactly the violation set that reaches the report.
+        const { projectRoot, baselineMetadata } = classifyBaselineFindings(orderedAnalyzerResults, mergedOptions, files, isScoped);
+        const result = buildAuditResult({
+            ordered: orderedAnalyzerResults,
+            files,
+            analyzers,
+            mergedOptions,
+            isScoped,
+            scopeResultType,
+            indexFactsWritten,
+            writeIndexFactsMs,
+            startTime,
+            startCpu,
+            provenanceTiming,
+            blastRadius,
+            zeroFilesDiagnostics,
+            pipelineDiagnostics,
+            rejected,
+            lintConfigDiagnostics,
+            configPath,
+            baselineMetadata,
+            pipelineCoverage,
+            routeAttribution,
+            pipelineTableCatalog,
+            pipelineStageTiming,
+            thresholdChanges,
+            thresholdSources,
+            pipelineSkippedFiles,
+            pipelineUnparsedFiles,
+            skippedExtensions,
+            pipelineInputPresence,
+            pipelineRuleTiming,
+            pipelineFileAccounting,
+            pipelineTestCoverage,
+            pipelineDeadClusters,
+            pipelineSizeDistributions,
+            collectedFunctions,
+            fileToFunctionsMap,
+        });
         // Report completion
         reportProgress(mergedOptions, {
             phase: 'reporting',
             message: 'Generating reports...'
         });
-        if (handoffRemaining.length > 0) {
-            throw new AuditHandoffError(`${handoffRemaining.length} file(s) deferred to the next worker chunk`, result, handoffRemaining);
-        }
         // Spec 57 — apply committed dismissals: mark matching findings dismissed
         // (they never gate) and record the dismissed count in the summary (never
         // subtracted from totalViolations).
         applyDismissals(result, projectRoot);
         // Spec 11 R1 — write to findings ledger (non-fatal: ledger is advisory).
-        // Forked shard workers set writeToLedger:false so the parent run is the
-        // single ledger writer (see AuditRunnerOptions.writeToLedger).
-        if (mergedOptions.writeToLedger !== false) {
-            void (async () => {
-                try {
-                    const indexDb = CodeIndexDB.getInstance(undefined, root);
-                    await indexDb.initialize();
-                    const violations = Object.values(orderedAnalyzerResults).flatMap(ar => ar.violations);
-                    const scopeStr = Array.isArray(scope) ? `files:${scope.length}` : (scope ?? 'all');
-                    return writeAuditToLedger(indexDb.rawDb, detectRunInput(process.argv.slice(2).join(' '), options.surface ?? 'cli', scopeStr, root, TOOL_VERSION), violations, Date.now() - startTime, 0, // exit status TBD — updateLedgerRunStatus by CLI after return
-                    { coverage: result.metadata.coverage });
-                }
-                catch (_err) {
-                    // ledger write is non-fatal — audit result is still valid
-                    return null;
-                }
-            })();
-        }
+        fireLedgerWrite({ mergedOptions, root, options, scope, ordered: orderedAnalyzerResults, result, startTime });
         return result;
     }
     /**
@@ -1219,9 +1692,18 @@ function resolveGitScopeFiles(options, ref) {
 /**
  * Resolve files scope: paths can be file paths or globs.
  * Absolute paths are used directly; relative paths are resolved
- * against the project root; globs use discoverFiles.
+ * against the project root; globs use discoverFiles. A direct path whose
+ * extension no analyzer claims (nor a raw/markup extension the pipeline reads
+ * directly) is dropped — see `getSourceExtensions` — so a prose edit never
+ * reaches the pipeline as a "dark analyzer" and trips the zero-files gate.
+ *
+ * @param options - The merged audit-runner options (`projectRoot`, `excludePaths`,
+ *   `fileExtensions`).
+ * @param scopeFiles - Candidate paths or globs to resolve into an absolute file
+ *   set.
+ * @returns The sorted set of absolute paths that are in audit scope.
  */
-async function resolveFilesScope(options, scopeFiles) {
+export async function resolveFilesScope(options, scopeFiles) {
     const rootDir = path.resolve(options.projectRoot || process.cwd());
     const result = new Set();
     for (const item of scopeFiles) {
@@ -1237,8 +1719,20 @@ async function resolveFilesScope(options, scopeFiles) {
                 result.add(m);
         }
         else {
-            // Direct file path — skip files that don't exist
+            // Direct file path — skip files that don't exist, and files no analyzer
+            // understands. A file whose extension is not claimed by the language
+            // registry (nor a raw/markup extension the pipeline reads directly) was
+            // never in scope: it must not enter `files` and trip the zero-files gate
+            // as a "dark analyzer", which would turn a prose edit into an exit-2 hook
+            // failure. The Spec 32 parse-failure gate is untouched — a claimed-but-
+            // unparseable file (a `.ts` that fails to parse) still reaches the
+            // pipeline and stays loud. The gate is the registry union (via
+            // `getSourceExtensions`), not a hand-maintained extension list, so a parser
+            // added to the registry is in scope here without a second edit.
             const resolved = path.isAbsolute(item) ? item : path.resolve(rootDir, item);
+            const ext = path.extname(resolved).toLowerCase();
+            if (!getSourceExtensions().has(ext))
+                continue;
             try {
                 await fs.stat(resolved);
                 result.add(resolved);
@@ -1251,27 +1745,21 @@ async function resolveFilesScope(options, scopeFiles) {
     return [...result].sort();
 }
 /**
- * Get list of enabled analyzers
- */
-function getEnabledAnalyzers(options, registry) {
-    // Explicit array (including empty = run no analyzers, e.g. index-only harness)
-    if (options.enabledAnalyzers !== undefined) {
-        // invariants auto-disables at runtime inside the pipeline reducer when no
-        // rules are configured — it stays in the list so coverage can report its
-        // rules as notApplicable (Spec 27 criterion 5).
-        return options.enabledAnalyzers;
-    }
-    const allAnalyzers = Object.keys(registry);
-    return allAnalyzers;
-}
-/**
- * Generate audit summary
+ * Generate audit summary.
+ *
+ * Exported for the Spec 69 §10 R4 pin: `summary.byAnalyzer[].unprovenSites`
+ * must carry the site-level cannot-fire count per analyzer.
+ *
+ * @param analyzerResults per-analyzer results, keyed by analyzer name
+ * @param filesAnalyzed total number of files processed this run
+ * @param unprovenSitesByAnalyzer per-analyzer count of unproven (cannot-fire) sites
  */
-function generateSummary(analyzerResults, filesAnalyzed) {
+export function generateSummary(analyzerResults, filesAnalyzed, unprovenSitesByAnalyzer = new Map()) {
     let totalViolations = 0;
     let criticalIssues = 0;
     let severe = 0;
     let high = 0;
+    let heldOut = 0;
     const violationsByCategory = {};
     const byAnalyzer = {};
     for (const [analyzer, result] of Object.entries(analyzerResults)) {
@@ -1279,6 +1767,8 @@ function generateSummary(analyzerResults, filesAnalyzed) {
         for (const violation of result.violations) {
             totalViolations++;
             analyzerViolations++;
+            if (violation.gateExcluded)
+                heldOut++;
             switch (violation.severity) {
                 case 'critical':
                     criticalIssues++;
@@ -1297,6 +1787,7 @@ function generateSummary(analyzerResults, filesAnalyzed) {
             violations: analyzerViolations,
             filesProcessed: getFilesProcessed(result.status),
             fatalErrors: result.errors ? result.errors.length : 0,
+            unprovenSites: unprovenSitesByAnalyzer.get(analyzer) ?? 0,
         };
     }
     // Compute top issues from violationsByCategory
@@ -1304,6 +1795,12 @@ function generateSummary(analyzerResults, filesAnalyzed) {
         .sort(([, a], [, b]) => b - a)
         .slice(0, 5)
         .map(([type, count]) => ({ type, count }));
+    // Spec 69 §10 R4 follow-up — the site-level cannot-fire total, summed across
+    // analyzers, so the headline can state findings + unproven sites + held-out
+    // readings together without re-deriving from per-analyzer buckets.
+    let unprovenSites = 0;
+    for (const n of unprovenSitesByAnalyzer.values())
+        unprovenSites += n;
     return {
         totalFiles: filesAnalyzed,
         totalViolations,
@@ -1312,7 +1809,9 @@ function generateSummary(analyzerResults, filesAnalyzed) {
         high,
         violationsByCategory,
         byAnalyzer,
-        topIssues
+        topIssues,
+        unprovenSites,
+        heldOut
     };
 }
 /**
@@ -1405,17 +1904,23 @@ function mergeLintUnderProject(lintFragment, projectConfig) {
  *
  * Pass 2: Every analyzer with a result entry but filesProcessed === 0 and no
  * errors fires a warning — the analyzer ran but matched zero source files.
+ *
+ * @param analyzers - Names of the enabled analyzers to check against the results.
+ * @param analyzerResults - Map of analyzer name to its audit result.
+ * @param totalFiles - Total files processed; a zero total suppresses the warning as expected.
+ * @param hasGoFiles - Whether the corpus contained `.go` files (false excuses a skipped `go` analyzer).
+ * @returns Diagnostic warnings for analyzers that produced no result or matched zero files.
  */
-export function runZeroFilesDiagnostics(enabledAnalyzers, analyzerResults, totalFiles, hasGoFiles) {
+export function runZeroFilesDiagnostics(analyzers, analyzerResults, totalFiles, hasGoFiles) {
     // When there were zero files to process, zero-files is expected, not a bug.
     if (totalFiles === 0)
         return [];
     const warnings = [];
     // Pass 1: enabled but absent from results
-    for (const analyzerName of enabledAnalyzers) {
+    for (const analyzerName of analyzers) {
         if (!analyzerResults[analyzerName]) {
-            // The `go` analyzer is a polyglot subprocess reached only via
-            // `runAuditDispatch` when `.go` files exist. On a TypeScript-only corpus
+            // The `go` analyzer is a polyglot subprocess that runs only when `.go`
+            // files exist. On a TypeScript-only corpus
             // it is legitimately notApplicable, not a dropped analyzer (defect #50) —
             // zero `.go` files means there was nothing for it to run on.
             if (analyzerName === 'go' && hasGoFiles === false)
@@ -1428,23 +1933,28 @@ export function runZeroFilesDiagnostics(enabledAnalyzers, analyzerResults, total
             });
         }
     }
-    // Pass 2: filesProcessed = 0 — a dark-analyzer failure regardless of errors.
-    // Visitors with declared extensions that matched zero files in the corpus are
-    // benign (converted to notRun by the pipeline), but a visitor that was dispatched
-    // files and still shows visitor-ran + 0 files is broken — whether it errored or
-    // silently returned.
+    // Pass 2: filesProcessed = 0 — a dark-analyzer failure. Visitors with declared
+    // extensions that matched zero files in the corpus are benign (converted to
+    // notRun by the pipeline), but a visitor that was dispatched files and still
+    // shows visitor-ran + 0 files is broken. When it errored, name the file(s) and
+    // error(s) — "check file extensions" is the wrong cause for a parse/visit error
+    // and would send the reader to look at configuration when a file failed.
     for (const [analyzerName, result] of Object.entries(analyzerResults)) {
         if (analyzerName === 'go' && hasGoFiles === false)
             continue;
         if (isVisitorStatus(result.status) && getFilesProcessed(result.status) === 0) {
-            const errCount = result.errors?.length ?? 0;
-            const errDetail = errCount > 0 ? ` (${errCount} file error(s))` : '';
+            const errs = result.errors;
+            const errDetail = errs && errs.length > 0
+                ? ` — ${errs.length} file error(s): ${errs.slice(0, 3).map((e) => `${e.file}: ${e.error}`).join('; ')}${errs.length > 3 ? ' …' : ''}`
+                : '';
             warnings.push({
                 analyzerName,
                 kind: 'zero-files',
-                message: `⚠️  ${analyzerName} analyzer: filesProcessed = 0${errDetail}. ` +
-                    `The analyzer ran but matched zero source files. Check file extensions, ` +
-                    `scanner configuration, and project structure.`,
+                message: errDetail
+                    ? `⚠️  ${analyzerName} analyzer: filesProcessed = 0${errDetail}.`
+                    : `⚠️  ${analyzerName} analyzer: filesProcessed = 0. ` +
+                        `The analyzer ran but matched zero source files. Check file extensions, ` +
+                        `scanner configuration, and project structure.`,
             });
         }
     }