code-auditor-mcp 5.0.2 → 5.3.3

package/dist/auditRunner.js

@@ -30,17 +30,18 @@ import { initializeOrmAdapters } from './analyzers/orm/index.js';
 import { syncStyleIndex } from './styles/styleIndexer.js';
 import { CodeIndexDB } from './codeIndexDB.js';
 import { notifyLegacyIndexLocation } from './legacyIndexNotice.js';
+import { gcStaleCacheDirsOnce } from './cacheGc.js';
 import { writeAuditToLedger, detectRunInput } from './ledger.js';
 // Pipeline imports (Spec 25 — pipeline replaces hand-rolled analyzer loop)
 import { runPipeline, makeVisitorStatus, getFilesProcessed, isVisitorStatus } from './pipeline.js';
 import { getRuleTimingSortedDesc } from './analyzers/ruleTiming.js';
 import { createFunctionIndexVisitor, createStylesCssVisitor, createStylesSourceVisitor, createStylesReducer, createInvariantsReducer, createSchemaCodeVisitor, } from './pipelineAdapters.js';
-import { computeSizeDistributions } from './reporting/sizeDistribution.js';
-import { splitRoutes, attributeRoutes, enabledMigratedRules } from './phase/routing.js';
 import { runPhaseModel } from './phase/phaseModel.js';
+import { resolveVendorSurfaces } from './analyzers/vendorSurfaces.js';
 import { resolvePhaseThresholds } from './phase/config.js';
 import { deriveCoverage, presentFormatsOf } from './phase/coverage.js';
 import { MIGRATED_RULES, RULE_ANALYZER } from './phase/rules/registry.js';
+import { computeReachabilityScores } from './phase/reachability.js';
 import { seedDryPairs, resolveBlockConfig } from './phase/rules/dry.js';
 import { checkUnresolvedReceiverImports, checkUnprovenQueryReceivers, checkUnresolvedQueries, checkUnparseableSql, dedupeCannotFireByReceiver } from './analyzers/universal/schema/codeAnalysis.js';
 import { readProjectManifest, computeManifestStaleness } from './analyzers/manifestStaleness.js';
@@ -171,8 +172,10 @@ async function resolveRunConfig(baseOptions, runOptions) {
         lintThresholds,
         presets: resolvedPresets,
     });
-    // Always merge built-in path profiles — corpus audits and projects without
-    // .codeauditor.json must still get the built-in scripts-and-tests profile.
+    // Always merge built-in path profiles (none ship today — the compiled-in
+    // "scripts-and-tests" gate exemption was removed). This stays as the seam
+    // that would apply any future built-in profile to corpus audits and to
+    // projects without a .codeauditor.json.
     mergedOptions.pathProfiles = mergePathProfiles(mergedOptions.pathProfiles, mergedOptions.builtin);
     return {
         mergedOptions,
@@ -200,7 +203,7 @@ async function discoverAuditFiles(mergedOptions, root, fileAccounting) {
         phase: 'discovery',
         message: `Discovering files... (scope: ${scopeResultType})`
     });
-    const { files, skippedExtensions } = await resolveDiscoveryScope(mergedOptions, scope, fileAccounting);
+    const { files, skippedExtensions, changedScopeNoBaseline } = await resolveDiscoveryScope(mergedOptions, scope, fileAccounting);
     throwIfAborted(mergedOptions.abortSignal);
     // Detect changed functions for non-all scopes
     let changedFunctions;
@@ -228,6 +231,7 @@ async function discoverAuditFiles(mergedOptions, root, fileAccounting) {
         scope,
         isScoped,
         scopeResultType,
+        changedScopeNoBaseline,
     };
 }
 /**
@@ -238,6 +242,11 @@ async function discoverAuditFiles(mergedOptions, root, fileAccounting) {
  */
 async function resolveDiscoveryScope(mergedOptions, scope, fileAccounting) {
     let files;
+    // True when a bare `changed` scope found no baseline in the index to diff
+    // against (an empty `functions` table). That is "the diff cannot be computed",
+    // not "nothing changed" — surfaced as a diagnostic so the run never reports a
+    // false clean. Explicit-files and all/other scopes leave this false.
+    let changedScopeNoBaseline = false;
     // Extensions present on disk that discovery skipped (Spec 43 R5 follow-up).
     // Populated only for the `all` scope — scoped runs are explicitly scoped by
     // the user, so "what wasn't analyzed" there is the scope itself, not the
@@ -269,12 +278,29 @@ async function resolveDiscoveryScope(mergedOptions, scope, fileAccounting) {
                 error: err instanceof Error ? err.message : String(err)
             });
         }
-        const modifiedFiles = mergedOptions.explicitFiles !== undefined
-            ? mergedOptions.explicitFiles
-            : (db ? await db.detectModifiedFiles(path.resolve(mergedOptions.projectRoot || process.cwd())) : []);
+        let modifiedFiles;
+        if (mergedOptions.explicitFiles !== undefined) {
+            modifiedFiles = mergedOptions.explicitFiles;
+        }
+        else if (db) {
+            // `undefined` here means *no baseline* (an empty `functions` table) — a
+            // different answer from `[]` ("baseline present, nothing modified"). The
+            // former is reported as an uncomputable diff, never as a clean run. The
+            // `db`-unavailable case (init threw, e.g. a future schema version) keeps
+            // its existing fail-open zero-file path and the later engine-error
+            // diagnostic.
+            const detected = await db.detectModifiedFiles(path.resolve(mergedOptions.projectRoot || process.cwd()));
+            if (detected === undefined)
+                changedScopeNoBaseline = true;
+            modifiedFiles = detected ?? [];
+        }
+        else {
+            modifiedFiles = [];
+        }
         files = [...new Set(modifiedFiles.map((f) => path.resolve(f)))].sort();
         logMcpInfo('discovery', 'changed scope resolved', {
-            fileCount: files.length
+            fileCount: files.length,
+            noBaseline: changedScopeNoBaseline
         });
     }
     else if (Array.isArray(scope)) {
@@ -290,7 +316,7 @@ async function resolveDiscoveryScope(mergedOptions, scope, fileAccounting) {
         files = discovered.files;
         skippedExtensions = discovered.skippedExtensions;
     }
-    return { files, skippedExtensions };
+    return { files, skippedExtensions, changedScopeNoBaseline };
 }
 /**
  * Detect changed functions for a scoped run via the code index (Spec 60.1).
@@ -527,8 +553,6 @@ function buildPipelineAdapters(analyzers) {
     const pipelineVisitors = [];
     const pipelineReducers = [];
     const pipelineDerivedReducers = [];
-    let reactBundle;
-    let solidBundle;
     // Always-on infrastructure: function-index visitor populates the
     // `functions` table so conventions + cross-domain reducers have data
     // even on a cold run with no prior index sync.
@@ -567,8 +591,6 @@ function buildPipelineAdapters(analyzers) {
         pipelineVisitors,
         pipelineReducers,
         pipelineDerivedReducers,
-        reactBundle,
-        solidBundle,
     };
 }
 /**
@@ -707,19 +729,20 @@ function buildPipelineConfig(inputs) {
     };
 }
 /**
- * Run the both-paths split (Spec 68 §11.1): strip migrated rules' legacy
- * emission and re-emit phase findings into the correct analyzer buckets.
- * Mutates `analyzerResults` and `pipelineAnalyzerConfig` (dry divergence).
+ * Run the phase model — the single analysis path (Spec 68 §15) — and re-emit its
+ * findings into the correct analyzer buckets. The legacy analyzer path is
+ * deleted; there is no route split to choose between. Mutates `analyzerResults`
+ * and `pipelineAnalyzerConfig` (dry divergence).
  */
-async function applyPhaseModelSplit(inputs) {
+async function runPhaseModelStage(inputs) {
     const { mergedOptions, root, files, isScoped, pipelineAnalyzerConfig, analyzerResults, pipelineIndexHandle } = inputs;
     let phaseFindings = [];
     let phaseIncompleteFacts = new Map();
-    let routeAttribution;
+    let phaseReachability;
     let receiverDiagnostics = [];
-    const { migrated } = splitRoutes();
-    routeAttribution = Object.fromEntries(attributeRoutes());
-    if (migrated.size > 0) {
+    let phaseCandidates = [];
+    let receiverResolutions = 0;
+    if (MIGRATED_RULES.length > 0) {
         // The `dry/diverging-clone` rule reads its knobs from `dry.divergence`.
         const topLevelDivergence = mergedOptions.divergence;
         if (topLevelDivergence && !pipelineAnalyzerConfig['dry']?.divergence) {
@@ -758,12 +781,17 @@ async function applyPhaseModelSplit(inputs) {
             tsconfigAliases: infraConfig.tsconfigAliases,
             packageEntryPoints: infraConfig.packageEntryPoints,
             indexHandle: pipelineIndexHandle,
-            enabledRules: enabledMigratedRules(),
+            enabledRules: new Set(MIGRATED_RULES.map((r) => r.id)),
             externalTables,
             workerCount: resolveWorkerCount(),
             sqlDialect: infraConfig.sqlDialect,
             sqlDialectReason: infraConfig.sqlDialectReason,
             declaredTypePackages: infraConfig.declaredTypePackages,
+            // Item B (reissued) — resolve each vendor's declaration from the tree under
+            // analysis (its own node_modules / workspace path) once per run. The
+            // loop-query / data-access producers read these resolved surfaces; nothing
+            // about a vendor's API is committed and nothing is fetched at analysis time.
+            vendorSurfaces: resolveVendorSurfaces(root),
             // Spec 70 2b — the diverging-clone write: seed `dry_pair_history` from the
             // phase `code-block` fact (replacing `createDryVisitor`/`persistDryPairs`).
             persistDryPairHistory: (facts) => {
@@ -774,6 +802,13 @@ async function applyPhaseModelSplit(inputs) {
         });
         phaseFindings = phaseResult.findings;
         phaseIncompleteFacts = phaseResult.incompleteFacts;
+        phaseCandidates = [...phaseResult.candidates];
+        receiverResolutions = phaseResult.receiverResolutions;
+        const reachabilityFact = phaseResult.facts.get('reachability');
+        const fileImports = phaseResult.facts.get('file-imports');
+        phaseReachability = reachabilityFact && fileImports
+            ? computeReachabilityScores(fileImports, reachabilityFact)
+            : undefined;
         // Spec 69 §10 + Part 2b — re-home the pre-pass's diagnostics (deleted from
         // `pipeline.ts`) on the phase result. Cannot-fire: re-derive per file from
         // `phaseResult.unprovenQueryReceivers` + `phaseResult.unresolvedImports`, keyed
@@ -781,12 +816,34 @@ async function applyPhaseModelSplit(inputs) {
         // receivers/imports never reached it). Manifest-stale: the ecosystem-list
         // self-check, unchanged from the deleted `buildPipelineResult` loop.
         receiverDiagnostics = await buildReceiverDiagnostics(phaseResult.unprovenQueryReceivers, phaseResult.unresolvedImports, phaseResult.unresolvedQuerySites, phaseResult.unparseableSql, root);
-        // Strip the migrated rules' legacy emission from every analyzer result.
-        let strippedCount = 0;
+        // Spec 68 §8 — `unreferenced-module`'s unproven modules: a module with no
+        // resolved importer while the graph carries a computed-specifier dynamic
+        // import. The rule withholds the dead-code finding for these; this surfaces
+        // the disposition (with its reason) as a coverage diagnostic instead.
+        for (const m of phaseResult.unprovenModules) {
+            receiverDiagnostics.push({
+                analyzerName: 'dependency-graph',
+                kind: 'unresolved-dynamic-import',
+                message: m.reason,
+                file: m.file,
+                line: m.line,
+            });
+        }
+        // §15 — a rule that could not run (fail-open, missing dependency) reported
+        // itself on the phase result's diagnostic channel. Merge those alongside the
+        // receiver-diagnostics the pre-pass re-derived, so the styles
+        // `undefined-class-disabled` diagnostic (re-homed from the deleted
+        // `initTailwindProbe`) reaches the same off-ladder surface.
+        receiverDiagnostics.push(...phaseResult.diagnostics);
+        // Strip the migrated rules' legacy emission from every analyzer result —
+        // the phase model is their single source of truth now (§15), and the legacy
+        // factories that keep running for their infra side-effect (styles reducer,
+        // schema-code visitor) still emit their migrated findings alongside. This is
+        // a direct projection of MIGRATED_RULES, not a route split: there is no
+        // "phase vs legacy" choice anymore, only discarding a stale duplicate.
+        const migratedRules = new Set(MIGRATED_RULES.map((r) => r.id));
         for (const result of Object.values(analyzerResults)) {
-            const before = result.violations.length;
-            result.violations = result.violations.filter((v) => !migrated.has(v.rule));
-            strippedCount += before - result.violations.length;
+            result.violations = result.violations.filter((v) => !migratedRules.has(v.rule));
         }
         // Re-emit phase findings as violations, bucketed by the rule's analyzer.
         const byAnalyzer = new Map();
@@ -836,13 +893,8 @@ async function applyPhaseModelSplit(inputs) {
                 analyzerResults[analyzer] = makeEmptyAnalyzerResult(analyzer, phaseFiles.length);
             }
         }
-        logMcpInfo('analysis', 'phase model (both paths)', {
-            migrated: migrated.size,
-            stripped: strippedCount,
-            reemitted: phaseFindings.length,
-        });
     }
-    return { phaseFindings, phaseIncompleteFacts, routeAttribution, receiverDiagnostics };
+    return { phaseFindings, phaseIncompleteFacts, phaseReachability, receiverDiagnostics, phaseCandidates, receiverResolutions };
 }
 /**
  * Spec 69 §10 + Part 2b — re-derive the pre-pass's coverage diagnostics from the
@@ -962,29 +1014,6 @@ export async function persistDryPairs(dryPairs, root) {
         // dry_pair_history persistence is advisory — non-fatal
     }
 }
-/**
- * Run the React analyzer's cross-component finalization (require-error-boundary
- * / raw-element checks), appending extra violations into the `react` result.
- */
-async function finalizeReact(reactBundle, analyzerResults, pipelineAnalyzerConfig) {
-    if (reactBundle) {
-        try {
-            const reactResult = analyzerResults['react'];
-            if (reactResult) {
-                // Pass the react namespace (not the whole namespaced config) so
-                // finalize reads `requireErrorBoundaries`/`rawElementCheck` at the
-                // same level the visitor's `context.config` does.
-                const extraViolations = await reactBundle.finalizeCrossComponent(pipelineAnalyzerConfig['react'] ?? {});
-                reactResult.violations.push(...extraViolations);
-            }
-        }
-        catch (err) {
-            logMcpInfo('analysis', 'react finalization failed (non-fatal)', {
-                error: err instanceof Error ? err.message : String(err)
-            });
-        }
-    }
-}
 /**
  * Build the pipeline, run it, and fold its outputs — plus the both-paths phase
  * split and derived coverage — into a single result bundle for `run`.
@@ -995,7 +1024,7 @@ async function runPipelineStage(inputs) {
     let indexFactsWritten = 0;
     let writeIndexFactsMs = 0;
     const { auditIndex, pipelineIndexHandle, indexSkipDiagnostic } = await initializeAuditIndex(root);
-    const { pipelineVisitors, pipelineReducers, pipelineDerivedReducers, reactBundle, solidBundle, } = buildPipelineAdapters(analyzers);
+    const { pipelineVisitors, pipelineReducers, pipelineDerivedReducers, } = buildPipelineAdapters(analyzers);
     // ── Safeguard warnings ────────────────────────────────────────────────
     if (auditIndex && analyzers.includes('cross-domain')) {
         const suCount = auditIndex.rawSql.count('schema_usage');
@@ -1011,6 +1040,9 @@ async function runPipelineStage(inputs) {
     // Outputs hoisted so derived coverage (after the split) can read them.
     let phaseFindings = [];
     let phaseIncompleteFacts = new Map();
+    let phaseReachability;
+    let phaseCandidates = [];
+    let receiverResolutions = 0;
     let pipelineCoverage;
     let pipelineTableCatalog;
     let pipelineStageTiming;
@@ -1023,7 +1055,6 @@ async function runPipelineStage(inputs) {
     let pipelineTestCoverage;
     let pipelineDeadClusters;
     let pipelineSizeDistributions;
-    let routeAttribution;
     let receiverDiagnostics = [];
     if (hasPipelineAnalyzers) {
         const pipelineAnalyzerConfig = buildPipelineAnalyzerConfig(analyzers, mergedOptions, root, files, corpusFiles, provenanceTiming);
@@ -1052,21 +1083,22 @@ async function runPipelineStage(inputs) {
                     status: ar.status?.status,
                 });
             }
-            await finalizeReact(reactBundle, analyzerResults, pipelineAnalyzerConfig);
-            const split = await applyPhaseModelSplit({
+            const split = await runPhaseModelStage({
                 mergedOptions, root, files, isScoped, pipelineAnalyzerConfig, analyzerResults, pipelineIndexHandle,
             });
             phaseFindings = split.phaseFindings;
             phaseIncompleteFacts = split.phaseIncompleteFacts;
-            routeAttribution = split.routeAttribution;
+            phaseReachability = split.phaseReachability;
             receiverDiagnostics = split.receiverDiagnostics;
+            phaseCandidates = split.phaseCandidates;
+            receiverResolutions = split.receiverResolutions;
             // Spec 68 §8 — derived coverage, computed AFTER the split so phaseFindings
             // holds the migrated rules' re-emitted findings.
             pipelineCoverage = deriveCoverage({
                 rules: MIGRATED_RULES,
                 findings: phaseFindings,
                 presentFormats: presentFormatsOf(files),
-                enabledRules: enabledMigratedRules(),
+                enabledRules: new Set(MIGRATED_RULES.map((r) => r.id)),
                 incompleteFacts: phaseIncompleteFacts,
                 groupOf: (ruleId) => RULE_ANALYZER.get(ruleId) ?? ruleId,
             });
@@ -1088,11 +1120,6 @@ async function runPipelineStage(inputs) {
             ];
             pipelineTestCoverage = pipelineResult.metadata?.testCoverage;
             pipelineDeadClusters = pipelineResult.metadata?.deadClusters;
-            // Spec 60 R2 — aggregate the SOLID analyzer's raw size readings.
-            if (solidBundle) {
-                const samples = await solidBundle.getSizeSamples();
-                pipelineSizeDistributions = computeSizeDistributions(samples);
-            }
         }
         catch (error) {
             if (error instanceof AuditAbortedError) {
@@ -1138,6 +1165,9 @@ async function runPipelineStage(inputs) {
         analyzerResults,
         phaseFindings,
         phaseIncompleteFacts,
+        phaseReachability,
+        phaseCandidates,
+        receiverResolutions,
         pipelineCoverage,
         pipelineTableCatalog,
         pipelineStageTiming,
@@ -1150,7 +1180,6 @@ async function runPipelineStage(inputs) {
         pipelineTestCoverage,
         pipelineDeadClusters,
         pipelineSizeDistributions,
-        routeAttribution,
         indexFactsWritten,
         writeIndexFactsMs,
     };
@@ -1254,75 +1283,40 @@ function stampAnalyzerFields(ordered) {
     }
 }
 /**
- * Spec 13 R2 — attach hotspot + reachability scores to every violation and
- * reorder within severity tiers (live code first, then higher hotspot, original
- * order as tiebreaker). Advisory — failure is non-fatal (no churn/hotspot data
- * is common on a first run).
+ * Spec 13 R2 — attach a reachability score to every violation and reorder within
+ * severity tiers (live code first: entry point → imported → dead), original
+ * order as tiebreaker. Derived from the phase `reachability` fact (reverse
+ * import adjacency + package entry points); no DB read. Advisory — a missing
+ * fact (a run where the phase model produced no reachability) leaves every
+ * finding at the neutral 0.5 and preserves original order.
  */
-async function applyHotspotScoring(ordered, root) {
-    try {
-        const indexDb = CodeIndexDB.getInstance(undefined, root);
-        await indexDb.initialize();
-        const hotspotRows = indexDb.rawDb
-            .prepare('SELECT target, type, score FROM hotspot_scores')
-            .all();
-        const hotspotByTarget = new Map();
-        const hotspotByFile = new Map();
-        for (const row of hotspotRows) {
-            hotspotByTarget.set(row.target, row.score);
-            if (row.type === 'file') {
-                hotspotByFile.set(row.target, row.score);
-            }
-        }
-        const reachabilityByFile = new Map();
-        const reachRows = indexDb.rawDb
-            .prepare("SELECT node_key, weight FROM graph_cache WHERE graph_type = 'reachability'")
-            .all();
-        for (const row of reachRows) {
-            reachabilityByFile.set(row.node_key, row.weight);
-        }
-        for (const analyzerName of Object.keys(ordered)) {
-            const result = ordered[analyzerName];
-            const violations = result.violations;
-            for (const v of violations) {
-                const funcName = v.symbol;
-                const file = v.file;
-                // Try function-level hotspot first: "filePath::symbol"
-                const funcTarget = funcName ? `${file}::${funcName}` : undefined;
-                v.hotspot = (funcTarget ? hotspotByTarget.get(funcTarget) : undefined)
-                    ?? hotspotByFile.get(file)
-                    ?? 0;
-                // Files with no cross-language entities (no reachability data) get a
-                // neutral 0.5 so we never demote a finding we know nothing about.
-                v.reachability = reachabilityByFile.get(file) ?? 0.5;
-            }
-            const severityOrder = {
-                critical: 0,
-                severe: 1,
-                high: 2,
-                info: 3,
-            };
-            const indexed = violations.map((v, i) => ({ v, i }));
-            indexed.sort((a, b) => {
-                const sevA = severityOrder[a.v.severity] ?? 99;
-                const sevB = severityOrder[b.v.severity] ?? 99;
-                if (sevA !== sevB)
-                    return sevA - sevB;
-                const reachA = a.v.reachability ?? 0.5;
-                const reachB = b.v.reachability ?? 0.5;
-                if (reachA !== reachB)
-                    return reachB - reachA;
-                const hsA = a.v.hotspot ?? 0;
-                const hsB = b.v.hotspot ?? 0;
-                if (hsA !== hsB)
-                    return hsB - hsA;
-                return a.i - b.i;
-            });
-            result.violations = indexed.map((x) => x.v);
+function applyReachabilityRanking(ordered, reachabilityByFile) {
+    const severityOrder = {
+        critical: 0,
+        severe: 1,
+        high: 2,
+        info: 3,
+    };
+    for (const result of Object.values(ordered)) {
+        const violations = result.violations;
+        for (const v of violations) {
+            // A file absent from the corpus graph gets a neutral 0.5 so we never
+            // demote a finding we know nothing about.
+            v.reachability = reachabilityByFile?.get(v.file) ?? 0.5;
         }
-    }
-    catch {
-        // Hotspot/reachability reordering is advisory — failure is non-fatal
+        const indexed = violations.map((v, i) => ({ v, i }));
+        indexed.sort((a, b) => {
+            const sevA = severityOrder[a.v.severity] ?? 99;
+            const sevB = severityOrder[b.v.severity] ?? 99;
+            if (sevA !== sevB)
+                return sevA - sevB;
+            const reachA = a.v.reachability ?? 0.5;
+            const reachB = b.v.reachability ?? 0.5;
+            if (reachA !== reachB)
+                return reachB - reachA;
+            return a.i - b.i;
+        });
+        result.violations = indexed.map((x) => x.v);
     }
 }
 /**
@@ -1369,18 +1363,54 @@ function classifyBaselineFindings(ordered, mergedOptions, files, isScoped) {
  * Spec 60 size/test/distribution reports), and hook-contract-clean violations.
  */
 function buildAuditResult(inputs) {
-    const { ordered, files, analyzers, mergedOptions, isScoped, scopeResultType, indexFactsWritten, writeIndexFactsMs, startTime, startCpu, provenanceTiming, blastRadius, zeroFilesDiagnostics, pipelineDiagnostics, rejected, lintConfigDiagnostics, configPath, baselineMetadata, pipelineCoverage, routeAttribution, pipelineTableCatalog, pipelineStageTiming, thresholdChanges, thresholdSources, pipelineSkippedFiles, pipelineUnparsedFiles, skippedExtensions, pipelineInputPresence, pipelineRuleTiming, pipelineFileAccounting, pipelineTestCoverage, pipelineDeadClusters, pipelineSizeDistributions, collectedFunctions, fileToFunctionsMap, } = inputs;
+    const { ordered, files, analyzers, mergedOptions, isScoped, scopeResultType, indexFactsWritten, writeIndexFactsMs, startTime, startCpu, provenanceTiming, blastRadius, changedScopeNoBaseline, zeroFilesDiagnostics, pipelineDiagnostics, rejected, lintConfigDiagnostics, configPath, baselineMetadata, pipelineCoverage, pipelineTableCatalog, pipelineStageTiming, thresholdChanges, thresholdSources, pipelineSkippedFiles, pipelineUnparsedFiles, skippedExtensions, pipelineInputPresence, pipelineRuleTiming, pipelineFileAccounting, pipelineTestCoverage, pipelineDeadClusters, pipelineSizeDistributions, collectedFunctions, fileToFunctionsMap, phaseCandidates, receiverResolutions, cacheGc, } = inputs;
     // Spec 69 §10 R4 — count query-shaped call sites whose DB receiver is
     // unproven, keyed by the analyzer that owns the receiver-resolution
     // instrument (`schema`). This is the site-level `cannot-fire` surface that
     // `summary.byAnalyzer[].unprovenSites` carries per analyzer.
     const unprovenSitesByAnalyzer = new Map();
+    // K9 — the same site-level `cannot-fire` surface, keyed by the *rule* each
+    // unproven site renders unreadable (from `details.affectedRules`) and the
+    // *cause* that produced it (`details.cause`). `byAnalyzer[].unprovenSites`
+    // answers "which analyzer produced these?"; this answers "which rule may have
+    // under-reported?" — the discriminant the raw 465-site total hid. One site
+    // affects every rule in its `affectedRules` list, so the per-rule `count` is
+    // the number of unproven sites that could have produced a finding under it.
+    const unprovenSitesByRule = new Map();
     for (const d of pipelineDiagnostics ?? []) {
         if (d.kind !== 'cannot-fire' || d.analyzerName !== 'schema')
             continue;
         unprovenSitesByAnalyzer.set(d.analyzerName, (unprovenSitesByAnalyzer.get(d.analyzerName) ?? 0) + 1);
+        const affectedRules = d.details?.affectedRules;
+        if (!Array.isArray(affectedRules))
+            continue;
+        const cause = typeof d.details?.cause === 'string' ? d.details.cause : 'unknown';
+        for (const rule of affectedRules) {
+            if (typeof rule !== 'string')
+                continue;
+            let entry = unprovenSitesByRule.get(rule);
+            if (!entry) {
+                entry = { count: 0, causes: new Map() };
+                unprovenSitesByRule.set(rule, entry);
+            }
+            entry.count++;
+            entry.causes.set(cause, (entry.causes.get(cause) ?? 0) + 1);
+        }
     }
-    const summary = generateSummary(ordered, files.length, unprovenSitesByAnalyzer);
+    // A bare `changed` scope that found no baseline to diff against (an empty
+    // `functions` table) is reported as an uncomputable diff, never as a clean
+    // run. The diagnostic names both possible causes: the index was never
+    // populated, or it was discarded (e.g. after corruption).
+    const noBaselineDiagnostics = changedScopeNoBaseline
+        ? [{
+                analyzerName: 'code-index',
+                kind: 'no-baseline',
+                message: 'Cannot determine what changed: the code index holds no baseline to diff against ' +
+                    '(no previously indexed files). No index has been built yet, or a prior index was ' +
+                    'discarded. Run a full audit to build the baseline, then re-run `changed`.',
+            }]
+        : [];
+    const summary = generateSummary(ordered, files.length, unprovenSitesByAnalyzer, unprovenSitesByRule);
     return {
         timestamp: new Date(),
         summary,
@@ -1389,6 +1419,7 @@ function buildAuditResult(inputs) {
         metadata: {
             auditDuration: Date.now() - startTime,
             auditCpuMs: cpuDurationMs(startCpu),
+            receiverResolutions,
             filesAnalyzed: files.length,
             ...(indexFactsWritten > 0 && { indexFactsWritten, writeIndexFactsMs }),
             analyzersRun: analyzers,
@@ -1397,8 +1428,9 @@ function buildAuditResult(inputs) {
             scope: scopeResultType,
             provenanceResolutionMs: provenanceTiming.totalMs,
             ...(blastRadius && { blastRadius }),
-            ...((zeroFilesDiagnostics.length > 0 || (pipelineDiagnostics?.length ?? 0) > 0 || rejected.length > 0 || lintConfigDiagnostics.length > 0) && {
+            ...((noBaselineDiagnostics.length > 0 || zeroFilesDiagnostics.length > 0 || (pipelineDiagnostics?.length ?? 0) > 0 || rejected.length > 0 || lintConfigDiagnostics.length > 0) && {
                 diagnostics: [
+                    ...noBaselineDiagnostics,
                     ...zeroFilesDiagnostics,
                     ...(pipelineDiagnostics ?? []),
                     ...lintConfigDiagnostics,
@@ -1413,7 +1445,6 @@ function buildAuditResult(inputs) {
             }),
             ...(baselineMetadata && { baseline: baselineMetadata }),
             ...(pipelineCoverage && { coverage: pipelineCoverage }),
-            ...(routeAttribution && { routeAttribution }),
             ...(pipelineTableCatalog && { tableCatalog: pipelineTableCatalog }),
             ...(pipelineStageTiming && { stageTiming: pipelineStageTiming }),
             ...(thresholdChanges.length > 0 && { thresholdChanges }),
@@ -1427,6 +1458,8 @@ function buildAuditResult(inputs) {
             ...(pipelineTestCoverage && { testCoverage: pipelineTestCoverage }),
             ...(pipelineDeadClusters && pipelineDeadClusters.length > 0 && { deadClusters: pipelineDeadClusters }),
             ...(pipelineSizeDistributions && pipelineSizeDistributions.length > 0 && { sizeDistributions: pipelineSizeDistributions }),
+            ...(phaseCandidates.length > 0 && { candidates: phaseCandidates }),
+            ...((cacheGc.removedCliVersions.length > 0 || cacheGc.removedProjects.length > 0) && { cacheGc }),
             ...(collectedFunctions.length > 0 && {
                 collectedFunctions,
                 fileToFunctionsMap: Object.fromEntries(fileToFunctionsMap)
@@ -1488,11 +1521,17 @@ export function createAuditRunner(options = {}) {
         // `node_modules/.cache/code-auditor`) left by a pre-move build — reported once,
         // never deleted (see legacyIndexNotice.ts).
         notifyLegacyIndexLocation(root);
+        // Bound the growth of the tool's own fallback cache: superseded pinned-CLI
+        // copies and abandoned project indexes. Process-scoped, never touches a user
+        // CODE_AUDITOR_DATA_DIR or the consuming repo (see cacheGc.ts). The result is
+        // captured (not fire-and-forget) so the audit output states what was collected
+        // — a silent delete of a 132 MB index is exactly the defect K10 forbids.
+        const cacheGc = gcStaleCacheDirsOnce();
         // Spec 44 — file accounting accumulator, owned by the run. Threaded through
         // discovery (full `all` scope) and the pipeline (stage 1/2) so every touched
         // file lands in exactly one terminal state and the balance can be asserted.
         const fileAccounting = new FileAccounting();
-        const { files, changedFunctions, skippedExtensions, blastRadius, corpusFiles, scope, isScoped, scopeResultType, } = await discoverAuditFiles(mergedOptions, root, fileAccounting);
+        const { files, changedFunctions, skippedExtensions, blastRadius, corpusFiles, scope, isScoped, scopeResultType, changedScopeNoBaseline, } = await discoverAuditFiles(mergedOptions, root, fileAccounting);
         const { collectedFunctions, fileToFunctionsMap } = await collectIndexedFunctions(mergedOptions, files);
         // Run analyzers
         // Spec 68 §15 — no selection model: the full pipeline always runs. `indexOnly`
@@ -1510,7 +1549,7 @@ export function createAuditRunner(options = {}) {
             mergedOptions, root, files, corpusFiles, isScoped, fileAccounting,
             styleConsumedFiles, styleContributingFiles, analyzers, provenanceTiming,
         });
-        const { analyzerResults, phaseFindings, phaseIncompleteFacts, pipelineCoverage, pipelineTableCatalog, pipelineStageTiming, pipelineSkippedFiles, pipelineUnparsedFiles, pipelineInputPresence, pipelineRuleTiming, pipelineFileAccounting, pipelineDiagnostics, pipelineTestCoverage, pipelineDeadClusters, pipelineSizeDistributions, routeAttribution, indexFactsWritten, writeIndexFactsMs, } = pipeline;
+        const { analyzerResults, phaseFindings, phaseIncompleteFacts, phaseReachability, phaseCandidates, receiverResolutions, pipelineCoverage, pipelineTableCatalog, pipelineStageTiming, pipelineSkippedFiles, pipelineUnparsedFiles, pipelineInputPresence, pipelineRuleTiming, pipelineFileAccounting, pipelineDiagnostics, pipelineTestCoverage, pipelineDeadClusters, pipelineSizeDistributions, indexFactsWritten, writeIndexFactsMs, } = pipeline;
         // ── Zero-files diagnostic ─────────────────────────────────────────────
         // Extracted to runZeroFilesDiagnostics() for testability. Runs against the
         // raw analyzerResults before truthiness filtering so the "no result" pass
@@ -1526,8 +1565,8 @@ export function createAuditRunner(options = {}) {
         // Normalize the analyzer field on every violation to its result key (the
         // single source of truth — see stampAnalyzerFields).
         stampAnalyzerFields(orderedAnalyzerResults);
-        // Spec 13 R2 — hotspot scoring & finding reordering (advisory).
-        await applyHotspotScoring(orderedAnalyzerResults, root);
+        // Spec 13 R2 — reachability scoring & finding reordering (advisory).
+        applyReachabilityRanking(orderedAnalyzerResults, phaseReachability);
         // Hook-contract guard: no violation may carry an empty file path, line 0, or
         // missing line. A sentinel violation with file:'' broke the Claude Code hook's
         // JSON consumer (Spec 15 regression); line:0 from CrossDomainAnalyzer broke it
@@ -1552,6 +1591,7 @@ export function createAuditRunner(options = {}) {
             startCpu,
             provenanceTiming,
             blastRadius,
+            changedScopeNoBaseline,
             zeroFilesDiagnostics,
             pipelineDiagnostics,
             rejected,
@@ -1559,7 +1599,6 @@ export function createAuditRunner(options = {}) {
             configPath,
             baselineMetadata,
             pipelineCoverage,
-            routeAttribution,
             pipelineTableCatalog,
             pipelineStageTiming,
             thresholdChanges,
@@ -1575,6 +1614,9 @@ export function createAuditRunner(options = {}) {
             pipelineSizeDistributions,
             collectedFunctions,
             fileToFunctionsMap,
+            phaseCandidates,
+            receiverResolutions,
+            cacheGc,
         });
         // Report completion
         reportProgress(mergedOptions, {
@@ -1753,8 +1795,9 @@ export async function resolveFilesScope(options, scopeFiles) {
  * @param analyzerResults per-analyzer results, keyed by analyzer name
  * @param filesAnalyzed total number of files processed this run
  * @param unprovenSitesByAnalyzer per-analyzer count of unproven (cannot-fire) sites
+ * @param unprovenSitesByRule per-rule count + cause of unproven (cannot-fire) sites (K9)
  */
-export function generateSummary(analyzerResults, filesAnalyzed, unprovenSitesByAnalyzer = new Map()) {
+export function generateSummary(analyzerResults, filesAnalyzed, unprovenSitesByAnalyzer = new Map(), unprovenSitesByRule = new Map()) {
     let totalViolations = 0;
     let criticalIssues = 0;
     let severe = 0;
@@ -1801,6 +1844,14 @@ export function generateSummary(analyzerResults, filesAnalyzed, unprovenSitesByA
     let unprovenSites = 0;
     for (const n of unprovenSitesByAnalyzer.values())
         unprovenSites += n;
+    // K9 — materialize the per-rule cannot-fire breakdown as a plain object so
+    // the summary carries it through the JSON/HTML/report surfaces. Keys are the
+    // affected rule ids; `count` is the number of unproven sites that could have
+    // produced a finding under that rule, and `causes` names the emission path.
+    const unprovenSitesByRuleOut = {};
+    for (const [rule, entry] of unprovenSitesByRule) {
+        unprovenSitesByRuleOut[rule] = { count: entry.count, causes: Object.fromEntries(entry.causes) };
+    }
     return {
         totalFiles: filesAnalyzed,
         totalViolations,
@@ -1811,6 +1862,7 @@ export function generateSummary(analyzerResults, filesAnalyzed, unprovenSitesByA
         byAnalyzer,
         topIssues,
         unprovenSites,
+        unprovenSitesByRule: unprovenSitesByRuleOut,
         heldOut
     };
 }