code-auditor-mcp 5.0.1 → 5.2.0

package/dist/auditRunner.js

@@ -23,9 +23,7 @@ import { isMcpDebugEnabled, logMcpDebug, logMcpInfo } from './mcpDiagnostics.js'
 import { loadBaseline, matchFindings, hashBaseline } from './baseline.js';
 import { applyDismissals } from './dismissals.js';
 import { computeImpact, LATENCY_BUDGET_MS } from './graph/blastRadius.js';
-import { readTsconfigAliases, readPackageEntryPoints, readDeclaredTypePackages, DEFAULT_VIRTUAL_MODULES } from './graph/importClassification.js';
-import { normalizeDialect } from './mcp-tools/discoveryQueries.js';
-import { detectDialect } from './languages/sql/dialectDetection.js';
+import { buildResolutionEnvironment } from './graph/resolutionEnvironment.js';
 // Import universal analyzers
 import { initializeLanguages } from './languages/index.js';
 import { initializeOrmAdapters } from './analyzers/orm/index.js';
@@ -37,12 +35,12 @@ import { writeAuditToLedger, detectRunInput } from './ledger.js';
 import { runPipeline, makeVisitorStatus, getFilesProcessed, isVisitorStatus } from './pipeline.js';
 import { getRuleTimingSortedDesc } from './analyzers/ruleTiming.js';
 import { createFunctionIndexVisitor, createStylesCssVisitor, createStylesSourceVisitor, createStylesReducer, createInvariantsReducer, createSchemaCodeVisitor, } from './pipelineAdapters.js';
-import { computeSizeDistributions } from './reporting/sizeDistribution.js';
-import { splitRoutes, attributeRoutes, enabledMigratedRules } from './phase/routing.js';
 import { runPhaseModel } from './phase/phaseModel.js';
+import { resolveVendorSurfaces } from './analyzers/vendorSurfaces.js';
 import { resolvePhaseThresholds } from './phase/config.js';
 import { deriveCoverage, presentFormatsOf } from './phase/coverage.js';
 import { MIGRATED_RULES, RULE_ANALYZER } from './phase/rules/registry.js';
+import { computeReachabilityScores } from './phase/reachability.js';
 import { seedDryPairs, resolveBlockConfig } from './phase/rules/dry.js';
 import { checkUnresolvedReceiverImports, checkUnprovenQueryReceivers, checkUnresolvedQueries, checkUnparseableSql, dedupeCannotFireByReceiver } from './analyzers/universal/schema/codeAnalysis.js';
 import { readProjectManifest, computeManifestStaleness } from './analyzers/manifestStaleness.js';
@@ -202,7 +200,7 @@ async function discoverAuditFiles(mergedOptions, root, fileAccounting) {
         phase: 'discovery',
         message: `Discovering files... (scope: ${scopeResultType})`
     });
-    const { files, skippedExtensions } = await resolveDiscoveryScope(mergedOptions, scope, fileAccounting);
+    const { files, skippedExtensions, changedScopeNoBaseline } = await resolveDiscoveryScope(mergedOptions, scope, fileAccounting);
     throwIfAborted(mergedOptions.abortSignal);
     // Detect changed functions for non-all scopes
     let changedFunctions;
@@ -230,6 +228,7 @@ async function discoverAuditFiles(mergedOptions, root, fileAccounting) {
         scope,
         isScoped,
         scopeResultType,
+        changedScopeNoBaseline,
     };
 }
 /**
@@ -240,6 +239,11 @@ async function discoverAuditFiles(mergedOptions, root, fileAccounting) {
  */
 async function resolveDiscoveryScope(mergedOptions, scope, fileAccounting) {
     let files;
+    // True when a bare `changed` scope found no baseline in the index to diff
+    // against (an empty `functions` table). That is "the diff cannot be computed",
+    // not "nothing changed" — surfaced as a diagnostic so the run never reports a
+    // false clean. Explicit-files and all/other scopes leave this false.
+    let changedScopeNoBaseline = false;
     // Extensions present on disk that discovery skipped (Spec 43 R5 follow-up).
     // Populated only for the `all` scope — scoped runs are explicitly scoped by
     // the user, so "what wasn't analyzed" there is the scope itself, not the
@@ -271,12 +275,29 @@ async function resolveDiscoveryScope(mergedOptions, scope, fileAccounting) {
                 error: err instanceof Error ? err.message : String(err)
             });
         }
-        const modifiedFiles = mergedOptions.explicitFiles !== undefined
-            ? mergedOptions.explicitFiles
-            : (db ? await db.detectModifiedFiles(path.resolve(mergedOptions.projectRoot || process.cwd())) : []);
+        let modifiedFiles;
+        if (mergedOptions.explicitFiles !== undefined) {
+            modifiedFiles = mergedOptions.explicitFiles;
+        }
+        else if (db) {
+            // `undefined` here means *no baseline* (an empty `functions` table) — a
+            // different answer from `[]` ("baseline present, nothing modified"). The
+            // former is reported as an uncomputable diff, never as a clean run. The
+            // `db`-unavailable case (init threw, e.g. a future schema version) keeps
+            // its existing fail-open zero-file path and the later engine-error
+            // diagnostic.
+            const detected = await db.detectModifiedFiles(path.resolve(mergedOptions.projectRoot || process.cwd()));
+            if (detected === undefined)
+                changedScopeNoBaseline = true;
+            modifiedFiles = detected ?? [];
+        }
+        else {
+            modifiedFiles = [];
+        }
         files = [...new Set(modifiedFiles.map((f) => path.resolve(f)))].sort();
         logMcpInfo('discovery', 'changed scope resolved', {
-            fileCount: files.length
+            fileCount: files.length,
+            noBaseline: changedScopeNoBaseline
         });
     }
     else if (Array.isArray(scope)) {
@@ -292,7 +313,7 @@ async function resolveDiscoveryScope(mergedOptions, scope, fileAccounting) {
         files = discovered.files;
         skippedExtensions = discovered.skippedExtensions;
     }
-    return { files, skippedExtensions };
+    return { files, skippedExtensions, changedScopeNoBaseline };
 }
 /**
  * Detect changed functions for a scoped run via the code index (Spec 60.1).
@@ -529,8 +550,6 @@ function buildPipelineAdapters(analyzers) {
     const pipelineVisitors = [];
     const pipelineReducers = [];
     const pipelineDerivedReducers = [];
-    let reactBundle;
-    let solidBundle;
     // Always-on infrastructure: function-index visitor populates the
     // `functions` table so conventions + cross-domain reducers have data
     // even on a cold run with no prior index sync.
@@ -569,8 +588,6 @@ function buildPipelineAdapters(analyzers) {
         pipelineVisitors,
         pipelineReducers,
         pipelineDerivedReducers,
-        reactBundle,
-        solidBundle,
     };
 }
 /**
@@ -589,16 +606,12 @@ function buildPipelineAnalyzerConfig(analyzers, mergedOptions, root, files, corp
     // better-sqlite3/D1 → sqlite, mysql2 → mysql). A null dialect means the SQL
     // facts `cannot-fire` — and `sqlDialectReason` names *why* (undetermined or
     // ambiguous) so the abstention is visible rather than silent.
-    const detection = mergedOptions.databaseType
-        ? (() => {
-            const explicit = normalizeDialect(mergedOptions.databaseType);
-            return explicit
-                ? { dialect: explicit, reason: null }
-                : { dialect: null, reason: `dialect undetermined (unsupported databaseType '${mergedOptions.databaseType}')` };
-        })()
-        : detectDialect(root);
-    const sqlDialect = detection.dialect;
-    const sqlDialectReason = detection.reason;
+    const resolution = buildResolutionEnvironment(root, {
+        databaseType: mergedOptions.databaseType,
+        importVirtualModules: mergedOptions.importVirtualModules,
+    });
+    const sqlDialect = resolution.sqlDialect;
+    const sqlDialectReason = resolution.sqlDialectReason;
     // Spec 62 Amendment B — the missing-org-filter Stage-4 reducer reads the
     // data-access config namespace, so it inherits the data-access analyzer's
     // config rather than a fresh empty namespace.
@@ -662,10 +675,10 @@ function buildPipelineAnalyzerConfig(analyzers, mergedOptions, root, files, corp
         _provenanceTiming: provenanceTiming,
         files,
         corpusFiles,
-        importVirtualModules: mergedOptions.importVirtualModules ?? DEFAULT_VIRTUAL_MODULES,
-        tsconfigAliases: readTsconfigAliases(root),
-        packageEntryPoints: readPackageEntryPoints(root).entryPaths,
-        declaredTypePackages: readDeclaredTypePackages(root),
+        importVirtualModules: resolution.importVirtualModules,
+        tsconfigAliases: resolution.tsconfigAliases,
+        packageEntryPoints: resolution.packageEntryPoints,
+        declaredTypePackages: resolution.declaredTypePackages,
         // Spec 70 R1 — surfaced under `_infra` so `runPipeline` can hand the named
         // dialect to the phase model's data-access producer without reading the
         // data-access namespace.
@@ -713,19 +726,18 @@ function buildPipelineConfig(inputs) {
     };
 }
 /**
- * Run the both-paths split (Spec 68 §11.1): strip migrated rules' legacy
- * emission and re-emit phase findings into the correct analyzer buckets.
- * Mutates `analyzerResults` and `pipelineAnalyzerConfig` (dry divergence).
+ * Run the phase model — the single analysis path (Spec 68 §15) — and re-emit its
+ * findings into the correct analyzer buckets. The legacy analyzer path is
+ * deleted; there is no route split to choose between. Mutates `analyzerResults`
+ * and `pipelineAnalyzerConfig` (dry divergence).
  */
-async function applyPhaseModelSplit(inputs) {
+async function runPhaseModelStage(inputs) {
     const { mergedOptions, root, files, isScoped, pipelineAnalyzerConfig, analyzerResults, pipelineIndexHandle } = inputs;
     let phaseFindings = [];
     let phaseIncompleteFacts = new Map();
-    let routeAttribution;
+    let phaseReachability;
     let receiverDiagnostics = [];
-    const { migrated } = splitRoutes();
-    routeAttribution = Object.fromEntries(attributeRoutes());
-    if (migrated.size > 0) {
+    if (MIGRATED_RULES.length > 0) {
         // The `dry/diverging-clone` rule reads its knobs from `dry.divergence`.
         const topLevelDivergence = mergedOptions.divergence;
         if (topLevelDivergence && !pipelineAnalyzerConfig['dry']?.divergence) {
@@ -764,12 +776,17 @@ async function applyPhaseModelSplit(inputs) {
             tsconfigAliases: infraConfig.tsconfigAliases,
             packageEntryPoints: infraConfig.packageEntryPoints,
             indexHandle: pipelineIndexHandle,
-            enabledRules: enabledMigratedRules(),
+            enabledRules: new Set(MIGRATED_RULES.map((r) => r.id)),
             externalTables,
             workerCount: resolveWorkerCount(),
             sqlDialect: infraConfig.sqlDialect,
             sqlDialectReason: infraConfig.sqlDialectReason,
             declaredTypePackages: infraConfig.declaredTypePackages,
+            // Item B (reissued) — resolve each vendor's declaration from the tree under
+            // analysis (its own node_modules / workspace path) once per run. The
+            // loop-query / data-access producers read these resolved surfaces; nothing
+            // about a vendor's API is committed and nothing is fetched at analysis time.
+            vendorSurfaces: resolveVendorSurfaces(root),
             // Spec 70 2b — the diverging-clone write: seed `dry_pair_history` from the
             // phase `code-block` fact (replacing `createDryVisitor`/`persistDryPairs`).
             persistDryPairHistory: (facts) => {
@@ -780,6 +797,11 @@ async function applyPhaseModelSplit(inputs) {
         });
         phaseFindings = phaseResult.findings;
         phaseIncompleteFacts = phaseResult.incompleteFacts;
+        const reachabilityFact = phaseResult.facts.get('reachability');
+        const fileImports = phaseResult.facts.get('file-imports');
+        phaseReachability = reachabilityFact && fileImports
+            ? computeReachabilityScores(fileImports, reachabilityFact)
+            : undefined;
         // Spec 69 §10 + Part 2b — re-home the pre-pass's diagnostics (deleted from
         // `pipeline.ts`) on the phase result. Cannot-fire: re-derive per file from
         // `phaseResult.unprovenQueryReceivers` + `phaseResult.unresolvedImports`, keyed
@@ -787,12 +809,34 @@ async function applyPhaseModelSplit(inputs) {
         // receivers/imports never reached it). Manifest-stale: the ecosystem-list
         // self-check, unchanged from the deleted `buildPipelineResult` loop.
         receiverDiagnostics = await buildReceiverDiagnostics(phaseResult.unprovenQueryReceivers, phaseResult.unresolvedImports, phaseResult.unresolvedQuerySites, phaseResult.unparseableSql, root);
-        // Strip the migrated rules' legacy emission from every analyzer result.
-        let strippedCount = 0;
+        // Spec 68 §8 — `unreferenced-module`'s unproven modules: a module with no
+        // resolved importer while the graph carries a computed-specifier dynamic
+        // import. The rule withholds the dead-code finding for these; this surfaces
+        // the disposition (with its reason) as a coverage diagnostic instead.
+        for (const m of phaseResult.unprovenModules) {
+            receiverDiagnostics.push({
+                analyzerName: 'dependency-graph',
+                kind: 'unresolved-dynamic-import',
+                message: m.reason,
+                file: m.file,
+                line: m.line,
+            });
+        }
+        // §15 — a rule that could not run (fail-open, missing dependency) reported
+        // itself on the phase result's diagnostic channel. Merge those alongside the
+        // receiver-diagnostics the pre-pass re-derived, so the styles
+        // `undefined-class-disabled` diagnostic (re-homed from the deleted
+        // `initTailwindProbe`) reaches the same off-ladder surface.
+        receiverDiagnostics.push(...phaseResult.diagnostics);
+        // Strip the migrated rules' legacy emission from every analyzer result —
+        // the phase model is their single source of truth now (§15), and the legacy
+        // factories that keep running for their infra side-effect (styles reducer,
+        // schema-code visitor) still emit their migrated findings alongside. This is
+        // a direct projection of MIGRATED_RULES, not a route split: there is no
+        // "phase vs legacy" choice anymore, only discarding a stale duplicate.
+        const migratedRules = new Set(MIGRATED_RULES.map((r) => r.id));
         for (const result of Object.values(analyzerResults)) {
-            const before = result.violations.length;
-            result.violations = result.violations.filter((v) => !migrated.has(v.rule));
-            strippedCount += before - result.violations.length;
+            result.violations = result.violations.filter((v) => !migratedRules.has(v.rule));
         }
         // Re-emit phase findings as violations, bucketed by the rule's analyzer.
         const byAnalyzer = new Map();
@@ -842,13 +886,8 @@ async function applyPhaseModelSplit(inputs) {
                 analyzerResults[analyzer] = makeEmptyAnalyzerResult(analyzer, phaseFiles.length);
             }
         }
-        logMcpInfo('analysis', 'phase model (both paths)', {
-            migrated: migrated.size,
-            stripped: strippedCount,
-            reemitted: phaseFindings.length,
-        });
     }
-    return { phaseFindings, phaseIncompleteFacts, routeAttribution, receiverDiagnostics };
+    return { phaseFindings, phaseIncompleteFacts, phaseReachability, receiverDiagnostics };
 }
 /**
  * Spec 69 §10 + Part 2b — re-derive the pre-pass's coverage diagnostics from the
@@ -968,29 +1007,6 @@ export async function persistDryPairs(dryPairs, root) {
         // dry_pair_history persistence is advisory — non-fatal
     }
 }
-/**
- * Run the React analyzer's cross-component finalization (require-error-boundary
- * / raw-element checks), appending extra violations into the `react` result.
- */
-async function finalizeReact(reactBundle, analyzerResults, pipelineAnalyzerConfig) {
-    if (reactBundle) {
-        try {
-            const reactResult = analyzerResults['react'];
-            if (reactResult) {
-                // Pass the react namespace (not the whole namespaced config) so
-                // finalize reads `requireErrorBoundaries`/`rawElementCheck` at the
-                // same level the visitor's `context.config` does.
-                const extraViolations = await reactBundle.finalizeCrossComponent(pipelineAnalyzerConfig['react'] ?? {});
-                reactResult.violations.push(...extraViolations);
-            }
-        }
-        catch (err) {
-            logMcpInfo('analysis', 'react finalization failed (non-fatal)', {
-                error: err instanceof Error ? err.message : String(err)
-            });
-        }
-    }
-}
 /**
  * Build the pipeline, run it, and fold its outputs — plus the both-paths phase
  * split and derived coverage — into a single result bundle for `run`.
@@ -1001,7 +1017,7 @@ async function runPipelineStage(inputs) {
     let indexFactsWritten = 0;
     let writeIndexFactsMs = 0;
     const { auditIndex, pipelineIndexHandle, indexSkipDiagnostic } = await initializeAuditIndex(root);
-    const { pipelineVisitors, pipelineReducers, pipelineDerivedReducers, reactBundle, solidBundle, } = buildPipelineAdapters(analyzers);
+    const { pipelineVisitors, pipelineReducers, pipelineDerivedReducers, } = buildPipelineAdapters(analyzers);
     // ── Safeguard warnings ────────────────────────────────────────────────
     if (auditIndex && analyzers.includes('cross-domain')) {
         const suCount = auditIndex.rawSql.count('schema_usage');
@@ -1017,6 +1033,7 @@ async function runPipelineStage(inputs) {
     // Outputs hoisted so derived coverage (after the split) can read them.
     let phaseFindings = [];
     let phaseIncompleteFacts = new Map();
+    let phaseReachability;
     let pipelineCoverage;
     let pipelineTableCatalog;
     let pipelineStageTiming;
@@ -1029,7 +1046,6 @@ async function runPipelineStage(inputs) {
     let pipelineTestCoverage;
     let pipelineDeadClusters;
     let pipelineSizeDistributions;
-    let routeAttribution;
     let receiverDiagnostics = [];
     if (hasPipelineAnalyzers) {
         const pipelineAnalyzerConfig = buildPipelineAnalyzerConfig(analyzers, mergedOptions, root, files, corpusFiles, provenanceTiming);
@@ -1058,13 +1074,12 @@ async function runPipelineStage(inputs) {
                     status: ar.status?.status,
                 });
             }
-            await finalizeReact(reactBundle, analyzerResults, pipelineAnalyzerConfig);
-            const split = await applyPhaseModelSplit({
+            const split = await runPhaseModelStage({
                 mergedOptions, root, files, isScoped, pipelineAnalyzerConfig, analyzerResults, pipelineIndexHandle,
             });
             phaseFindings = split.phaseFindings;
             phaseIncompleteFacts = split.phaseIncompleteFacts;
-            routeAttribution = split.routeAttribution;
+            phaseReachability = split.phaseReachability;
             receiverDiagnostics = split.receiverDiagnostics;
             // Spec 68 §8 — derived coverage, computed AFTER the split so phaseFindings
             // holds the migrated rules' re-emitted findings.
@@ -1072,7 +1087,7 @@ async function runPipelineStage(inputs) {
                 rules: MIGRATED_RULES,
                 findings: phaseFindings,
                 presentFormats: presentFormatsOf(files),
-                enabledRules: enabledMigratedRules(),
+                enabledRules: new Set(MIGRATED_RULES.map((r) => r.id)),
                 incompleteFacts: phaseIncompleteFacts,
                 groupOf: (ruleId) => RULE_ANALYZER.get(ruleId) ?? ruleId,
             });
@@ -1094,11 +1109,6 @@ async function runPipelineStage(inputs) {
             ];
             pipelineTestCoverage = pipelineResult.metadata?.testCoverage;
             pipelineDeadClusters = pipelineResult.metadata?.deadClusters;
-            // Spec 60 R2 — aggregate the SOLID analyzer's raw size readings.
-            if (solidBundle) {
-                const samples = await solidBundle.getSizeSamples();
-                pipelineSizeDistributions = computeSizeDistributions(samples);
-            }
         }
         catch (error) {
             if (error instanceof AuditAbortedError) {
@@ -1144,6 +1154,7 @@ async function runPipelineStage(inputs) {
         analyzerResults,
         phaseFindings,
         phaseIncompleteFacts,
+        phaseReachability,
         pipelineCoverage,
         pipelineTableCatalog,
         pipelineStageTiming,
@@ -1156,7 +1167,6 @@ async function runPipelineStage(inputs) {
         pipelineTestCoverage,
         pipelineDeadClusters,
         pipelineSizeDistributions,
-        routeAttribution,
         indexFactsWritten,
         writeIndexFactsMs,
     };
@@ -1260,75 +1270,40 @@ function stampAnalyzerFields(ordered) {
     }
 }
 /**
- * Spec 13 R2 — attach hotspot + reachability scores to every violation and
- * reorder within severity tiers (live code first, then higher hotspot, original
- * order as tiebreaker). Advisory — failure is non-fatal (no churn/hotspot data
- * is common on a first run).
+ * Spec 13 R2 — attach a reachability score to every violation and reorder within
+ * severity tiers (live code first: entry point → imported → dead), original
+ * order as tiebreaker. Derived from the phase `reachability` fact (reverse
+ * import adjacency + package entry points); no DB read. Advisory — a missing
+ * fact (a run where the phase model produced no reachability) leaves every
+ * finding at the neutral 0.5 and preserves original order.
  */
-async function applyHotspotScoring(ordered, root) {
-    try {
-        const indexDb = CodeIndexDB.getInstance(undefined, root);
-        await indexDb.initialize();
-        const hotspotRows = indexDb.rawDb
-            .prepare('SELECT target, type, score FROM hotspot_scores')
-            .all();
-        const hotspotByTarget = new Map();
-        const hotspotByFile = new Map();
-        for (const row of hotspotRows) {
-            hotspotByTarget.set(row.target, row.score);
-            if (row.type === 'file') {
-                hotspotByFile.set(row.target, row.score);
-            }
-        }
-        const reachabilityByFile = new Map();
-        const reachRows = indexDb.rawDb
-            .prepare("SELECT node_key, weight FROM graph_cache WHERE graph_type = 'reachability'")
-            .all();
-        for (const row of reachRows) {
-            reachabilityByFile.set(row.node_key, row.weight);
-        }
-        for (const analyzerName of Object.keys(ordered)) {
-            const result = ordered[analyzerName];
-            const violations = result.violations;
-            for (const v of violations) {
-                const funcName = v.symbol;
-                const file = v.file;
-                // Try function-level hotspot first: "filePath::symbol"
-                const funcTarget = funcName ? `${file}::${funcName}` : undefined;
-                v.hotspot = (funcTarget ? hotspotByTarget.get(funcTarget) : undefined)
-                    ?? hotspotByFile.get(file)
-                    ?? 0;
-                // Files with no cross-language entities (no reachability data) get a
-                // neutral 0.5 so we never demote a finding we know nothing about.
-                v.reachability = reachabilityByFile.get(file) ?? 0.5;
-            }
-            const severityOrder = {
-                critical: 0,
-                severe: 1,
-                high: 2,
-                info: 3,
-            };
-            const indexed = violations.map((v, i) => ({ v, i }));
-            indexed.sort((a, b) => {
-                const sevA = severityOrder[a.v.severity] ?? 99;
-                const sevB = severityOrder[b.v.severity] ?? 99;
-                if (sevA !== sevB)
-                    return sevA - sevB;
-                const reachA = a.v.reachability ?? 0.5;
-                const reachB = b.v.reachability ?? 0.5;
-                if (reachA !== reachB)
-                    return reachB - reachA;
-                const hsA = a.v.hotspot ?? 0;
-                const hsB = b.v.hotspot ?? 0;
-                if (hsA !== hsB)
-                    return hsB - hsA;
-                return a.i - b.i;
-            });
-            result.violations = indexed.map((x) => x.v);
+function applyReachabilityRanking(ordered, reachabilityByFile) {
+    const severityOrder = {
+        critical: 0,
+        severe: 1,
+        high: 2,
+        info: 3,
+    };
+    for (const result of Object.values(ordered)) {
+        const violations = result.violations;
+        for (const v of violations) {
+            // A file absent from the corpus graph gets a neutral 0.5 so we never
+            // demote a finding we know nothing about.
+            v.reachability = reachabilityByFile?.get(v.file) ?? 0.5;
         }
-    }
-    catch {
-        // Hotspot/reachability reordering is advisory — failure is non-fatal
+        const indexed = violations.map((v, i) => ({ v, i }));
+        indexed.sort((a, b) => {
+            const sevA = severityOrder[a.v.severity] ?? 99;
+            const sevB = severityOrder[b.v.severity] ?? 99;
+            if (sevA !== sevB)
+                return sevA - sevB;
+            const reachA = a.v.reachability ?? 0.5;
+            const reachB = b.v.reachability ?? 0.5;
+            if (reachA !== reachB)
+                return reachB - reachA;
+            return a.i - b.i;
+        });
+        result.violations = indexed.map((x) => x.v);
     }
 }
 /**
@@ -1375,7 +1350,7 @@ function classifyBaselineFindings(ordered, mergedOptions, files, isScoped) {
  * Spec 60 size/test/distribution reports), and hook-contract-clean violations.
  */
 function buildAuditResult(inputs) {
-    const { ordered, files, analyzers, mergedOptions, isScoped, scopeResultType, indexFactsWritten, writeIndexFactsMs, startTime, startCpu, provenanceTiming, blastRadius, zeroFilesDiagnostics, pipelineDiagnostics, rejected, lintConfigDiagnostics, configPath, baselineMetadata, pipelineCoverage, routeAttribution, pipelineTableCatalog, pipelineStageTiming, thresholdChanges, thresholdSources, pipelineSkippedFiles, pipelineUnparsedFiles, skippedExtensions, pipelineInputPresence, pipelineRuleTiming, pipelineFileAccounting, pipelineTestCoverage, pipelineDeadClusters, pipelineSizeDistributions, collectedFunctions, fileToFunctionsMap, } = inputs;
+    const { ordered, files, analyzers, mergedOptions, isScoped, scopeResultType, indexFactsWritten, writeIndexFactsMs, startTime, startCpu, provenanceTiming, blastRadius, changedScopeNoBaseline, zeroFilesDiagnostics, pipelineDiagnostics, rejected, lintConfigDiagnostics, configPath, baselineMetadata, pipelineCoverage, pipelineTableCatalog, pipelineStageTiming, thresholdChanges, thresholdSources, pipelineSkippedFiles, pipelineUnparsedFiles, skippedExtensions, pipelineInputPresence, pipelineRuleTiming, pipelineFileAccounting, pipelineTestCoverage, pipelineDeadClusters, pipelineSizeDistributions, collectedFunctions, fileToFunctionsMap, } = inputs;
     // Spec 69 §10 R4 — count query-shaped call sites whose DB receiver is
     // unproven, keyed by the analyzer that owns the receiver-resolution
     // instrument (`schema`). This is the site-level `cannot-fire` surface that
@@ -1386,6 +1361,19 @@ function buildAuditResult(inputs) {
             continue;
         unprovenSitesByAnalyzer.set(d.analyzerName, (unprovenSitesByAnalyzer.get(d.analyzerName) ?? 0) + 1);
     }
+    // A bare `changed` scope that found no baseline to diff against (an empty
+    // `functions` table) is reported as an uncomputable diff, never as a clean
+    // run. The diagnostic names both possible causes: the index was never
+    // populated, or it was discarded (e.g. after corruption).
+    const noBaselineDiagnostics = changedScopeNoBaseline
+        ? [{
+                analyzerName: 'code-index',
+                kind: 'no-baseline',
+                message: 'Cannot determine what changed: the code index holds no baseline to diff against ' +
+                    '(no previously indexed files). No index has been built yet, or a prior index was ' +
+                    'discarded. Run a full audit to build the baseline, then re-run `changed`.',
+            }]
+        : [];
     const summary = generateSummary(ordered, files.length, unprovenSitesByAnalyzer);
     return {
         timestamp: new Date(),
@@ -1403,8 +1391,9 @@ function buildAuditResult(inputs) {
             scope: scopeResultType,
             provenanceResolutionMs: provenanceTiming.totalMs,
             ...(blastRadius && { blastRadius }),
-            ...((zeroFilesDiagnostics.length > 0 || (pipelineDiagnostics?.length ?? 0) > 0 || rejected.length > 0 || lintConfigDiagnostics.length > 0) && {
+            ...((noBaselineDiagnostics.length > 0 || zeroFilesDiagnostics.length > 0 || (pipelineDiagnostics?.length ?? 0) > 0 || rejected.length > 0 || lintConfigDiagnostics.length > 0) && {
                 diagnostics: [
+                    ...noBaselineDiagnostics,
                     ...zeroFilesDiagnostics,
                     ...(pipelineDiagnostics ?? []),
                     ...lintConfigDiagnostics,
@@ -1419,7 +1408,6 @@ function buildAuditResult(inputs) {
             }),
             ...(baselineMetadata && { baseline: baselineMetadata }),
             ...(pipelineCoverage && { coverage: pipelineCoverage }),
-            ...(routeAttribution && { routeAttribution }),
             ...(pipelineTableCatalog && { tableCatalog: pipelineTableCatalog }),
             ...(pipelineStageTiming && { stageTiming: pipelineStageTiming }),
             ...(thresholdChanges.length > 0 && { thresholdChanges }),
@@ -1498,7 +1486,7 @@ export function createAuditRunner(options = {}) {
         // discovery (full `all` scope) and the pipeline (stage 1/2) so every touched
         // file lands in exactly one terminal state and the balance can be asserted.
         const fileAccounting = new FileAccounting();
-        const { files, changedFunctions, skippedExtensions, blastRadius, corpusFiles, scope, isScoped, scopeResultType, } = await discoverAuditFiles(mergedOptions, root, fileAccounting);
+        const { files, changedFunctions, skippedExtensions, blastRadius, corpusFiles, scope, isScoped, scopeResultType, changedScopeNoBaseline, } = await discoverAuditFiles(mergedOptions, root, fileAccounting);
         const { collectedFunctions, fileToFunctionsMap } = await collectIndexedFunctions(mergedOptions, files);
         // Run analyzers
         // Spec 68 §15 — no selection model: the full pipeline always runs. `indexOnly`
@@ -1516,7 +1504,7 @@ export function createAuditRunner(options = {}) {
             mergedOptions, root, files, corpusFiles, isScoped, fileAccounting,
             styleConsumedFiles, styleContributingFiles, analyzers, provenanceTiming,
         });
-        const { analyzerResults, phaseFindings, phaseIncompleteFacts, pipelineCoverage, pipelineTableCatalog, pipelineStageTiming, pipelineSkippedFiles, pipelineUnparsedFiles, pipelineInputPresence, pipelineRuleTiming, pipelineFileAccounting, pipelineDiagnostics, pipelineTestCoverage, pipelineDeadClusters, pipelineSizeDistributions, routeAttribution, indexFactsWritten, writeIndexFactsMs, } = pipeline;
+        const { analyzerResults, phaseFindings, phaseIncompleteFacts, phaseReachability, pipelineCoverage, pipelineTableCatalog, pipelineStageTiming, pipelineSkippedFiles, pipelineUnparsedFiles, pipelineInputPresence, pipelineRuleTiming, pipelineFileAccounting, pipelineDiagnostics, pipelineTestCoverage, pipelineDeadClusters, pipelineSizeDistributions, indexFactsWritten, writeIndexFactsMs, } = pipeline;
         // ── Zero-files diagnostic ─────────────────────────────────────────────
         // Extracted to runZeroFilesDiagnostics() for testability. Runs against the
         // raw analyzerResults before truthiness filtering so the "no result" pass
@@ -1532,8 +1520,8 @@ export function createAuditRunner(options = {}) {
         // Normalize the analyzer field on every violation to its result key (the
         // single source of truth — see stampAnalyzerFields).
         stampAnalyzerFields(orderedAnalyzerResults);
-        // Spec 13 R2 — hotspot scoring & finding reordering (advisory).
-        await applyHotspotScoring(orderedAnalyzerResults, root);
+        // Spec 13 R2 — reachability scoring & finding reordering (advisory).
+        applyReachabilityRanking(orderedAnalyzerResults, phaseReachability);
         // Hook-contract guard: no violation may carry an empty file path, line 0, or
         // missing line. A sentinel violation with file:'' broke the Claude Code hook's
         // JSON consumer (Spec 15 regression); line:0 from CrossDomainAnalyzer broke it
@@ -1558,6 +1546,7 @@ export function createAuditRunner(options = {}) {
             startCpu,
             provenanceTiming,
             blastRadius,
+            changedScopeNoBaseline,
             zeroFilesDiagnostics,
             pipelineDiagnostics,
             rejected,
@@ -1565,7 +1554,6 @@ export function createAuditRunner(options = {}) {
             configPath,
             baselineMetadata,
             pipelineCoverage,
-            routeAttribution,
             pipelineTableCatalog,
             pipelineStageTiming,
             thresholdChanges,
@@ -1765,6 +1753,7 @@ export function generateSummary(analyzerResults, filesAnalyzed, unprovenSitesByA
     let criticalIssues = 0;
     let severe = 0;
     let high = 0;
+    let heldOut = 0;
     const violationsByCategory = {};
     const byAnalyzer = {};
     for (const [analyzer, result] of Object.entries(analyzerResults)) {
@@ -1772,6 +1761,8 @@ export function generateSummary(analyzerResults, filesAnalyzed, unprovenSitesByA
         for (const violation of result.violations) {
             totalViolations++;
             analyzerViolations++;
+            if (violation.gateExcluded)
+                heldOut++;
             switch (violation.severity) {
                 case 'critical':
                     criticalIssues++;
@@ -1798,6 +1789,12 @@ export function generateSummary(analyzerResults, filesAnalyzed, unprovenSitesByA
         .sort(([, a], [, b]) => b - a)
         .slice(0, 5)
         .map(([type, count]) => ({ type, count }));
+    // Spec 69 §10 R4 follow-up — the site-level cannot-fire total, summed across
+    // analyzers, so the headline can state findings + unproven sites + held-out
+    // readings together without re-deriving from per-analyzer buckets.
+    let unprovenSites = 0;
+    for (const n of unprovenSitesByAnalyzer.values())
+        unprovenSites += n;
     return {
         totalFiles: filesAnalyzed,
         totalViolations,
@@ -1806,7 +1803,9 @@ export function generateSummary(analyzerResults, filesAnalyzed, unprovenSitesByA
         high,
         violationsByCategory,
         byAnalyzer,
-        topIssues
+        topIssues,
+        unprovenSites,
+        heldOut
     };
 }
 /**