gitnexus 1.6.11-rc.21 → 1.6.11-rc.23

package/README.md

@@ -244,6 +244,7 @@ gitnexus analyze --skip-agents-md  # Preserve custom AGENTS.md/CLAUDE.md gitnexu
 gitnexus analyze --skip-skills   # Skip installing standard .claude/skills/gitnexus-* skill files
 gitnexus analyze --skip-git      # Index folders that are not Git repositories
 gitnexus analyze --workers <n>   # Parse worker pool size (>=1; default: cores-1, capped at 16)
+gitnexus analyze --spring-actuator ./actuator  # Enrich with local Spring Boot Actuator JSON snapshots
 gitnexus analyze --verbose       # Log skipped files when parsers are unavailable
 gitnexus analyze --max-file-size 1024  # Skip files larger than N KB (default: 512, cap: 32768)
 gitnexus analyze --worker-timeout 60  # Increase worker idle timeout for slow parses
@@ -323,6 +324,8 @@ and root fields. Dynamic decorator names, anonymous operations, and ambiguous or
 anchors are deliberately omitted. Add common infrastructure fields such as `/health` to
 `matching.exclude_links_paths` to keep those GraphQL contracts visible without cross-linking them.
 
+`--spring-actuator` is explicitly opt-in. The path may be a JSON bundle keyed by `mappings`, `beans`, `conditions`, `configprops`, and/or `env`, or a directory containing endpoint-named JSON files. Runtime mappings and beans confirm matching static nodes; conditions and configuration property keys enrich existing evidence, with conservative runtime-only nodes added when no match exists. The configured input is excluded from source scanning; only normalized repository-relative exclusions are retained for future scans, never absolute paths. Env/configprops values, origins, condition messages, and source names are never persisted or printed. Enabled runs always rebuild because runtime snapshots are external to git freshness; omitting the option later rebuilds once to remove runtime evidence. Project config can set the same path with `springActuator` in `.gitnexusrc`.
+
 > **`gitnexus uninstall`** reverses `gitnexus setup` — it removes the GitNexus MCP entries, hooks, and skill directories it added to each detected editor. Skill directories are identified **by bundled gitnexus skill name** (e.g. `gitnexus-cli/`), so if you customized files inside an installed skill directory, back them up first. It is a dry-run preview by default and prints the exact paths it would remove; pass `--force` to apply. Per-repo indexes (`gitnexus clean --all`) and the global npm package (`npm uninstall -g gitnexus`) are left for you to remove.
 
 ## Remote Embeddings
@@ -431,7 +434,7 @@ Installed automatically by both `gitnexus analyze` (per-repo) and `gitnexus setu
   LadybugDB native binary ships as a prebuild against that floor, so on an older host it cannot
   load and reinstalling does not help — see
   [Linux: `GLIBC_2.34' not found`](#linux-glibc_234-not-found).
-- **Windows, for full-text search:** the Microsoft Visual C++ 2015-2022 Redistributable (x64) *and*
+- **Windows, for full-text search:** the Microsoft Visual C++ 2015-2022 Redistributable (x64) _and_
   OpenSSL 3 (`libssl-3-x64.dll`, `libcrypto-3-x64.dll`) resolvable on `PATH` — see
   [Windows: full-text search unavailable](#windows-full-text-search-unavailable).
 
@@ -708,17 +711,17 @@ For repositories with very large source files, `GITNEXUS_WORKER_SUB_BATCH_MAX_BY
 
 Four env vars expose the pool's resilience layers (respawn budget, cumulative-timeout cap, circuit breaker, startup handshake). Defaults are tuned for typical repos; bump them when an analyze legitimately needs more retries, or lower them to fail-fast on a known-bad shape.
 
-| Variable                                        | Default                 | Effect                                                                                                                                                                                                                                                    |
-| ----------------------------------------------- | ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `GITNEXUS_WORKER_MAX_RESPAWNS_PER_SLOT`         | `3`                     | Max replacement spawns per slot before the slot is dropped from the active rotation.                                                                                                                                                                      |
-| `GITNEXUS_WORKER_MAX_CUMULATIVE_TIMEOUT_MS`     | `5 × subBatchTimeoutMs` | Total retry wall-time budget per job before quarantining. Bounds exponentially-growing retry waits.                                                                                                                                                       |
-| `GITNEXUS_WORKER_CONSECUTIVE_FAILURE_THRESHOLD` | `max(3, poolSize)`      | Per-slot consecutive deaths before the pool's circuit breaker trips. After tripping, dispatches require a fresh pool.                                                                                                                                     |
-| `GITNEXUS_WORKER_SHUTDOWN_DRAIN_MS`             | `30000`                 | Max wait at pool shutdown for a retired worker still inside native code — terminated at its next JS-safe point instead of mid-native-call, which would abort the process (`Napi::Error`, #2432).                                                          |
-| `GITNEXUS_WORKER_READY_TIMEOUT_MS`              | `5000`                  | Startup budget for a parse worker to load its grammar bindings and report `{type:'ready'}`. Slots that miss it are treated as startup crashes. Raise it on a slow or heavily loaded host where a full pool cold-starting concurrently needs more than 5s. |
-| `GITNEXUS_MEMORY`                            | `off`                          | unset (autopilot on) | `off` declines GitNexus's memory autopilot: analyze will neither re-run itself with a RAM-aware heap cap nor abort the parse before V8 enters its ineffective-mark-compact death spiral. Use it when you want to drive memory manually; to simply pin a heap size, pass Node's own `--max-old-space-size`, which is already honoured as your decision. |
-| `GITNEXUS_WORKER_HEAP_MB`                       | `clamp(512, RAM/2/poolSize, 4096)` | Per-worker V8 old-generation heap cap (#2649). Bounds pool RSS on large repos; a worker exceeding it dies with a real heap error handled by quarantine/respawn.                                                                    |
-| `GITNEXUS_SERVER_ANALYZE_HEAP_MB`               | `min(8192, auto cap)`   | Heap for the web/MCP server's forked analyze worker (#2649). Defaults to the historical 8192 MB bounded by the machine/container's RAM-aware auto cap; set an absolute MB value to override.                                                              |
-| `GITNEXUS_CPP_CAPTURE_BUDGET_MS`                | `20000`                 | Per-file wall-clock budget for C++ capture extraction; on breach the file keeps partial captures with a warning (#2432). `0` expires immediately.                                                |
+| Variable                                        | Default                            | Effect                                                                                                                                                                                                                                                    |
+| ----------------------------------------------- | ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `GITNEXUS_WORKER_MAX_RESPAWNS_PER_SLOT`         | `3`                                | Max replacement spawns per slot before the slot is dropped from the active rotation.                                                                                                                                                                      |
+| `GITNEXUS_WORKER_MAX_CUMULATIVE_TIMEOUT_MS`     | `5 × subBatchTimeoutMs`            | Total retry wall-time budget per job before quarantining. Bounds exponentially-growing retry waits.                                                                                                                                                       |
+| `GITNEXUS_WORKER_CONSECUTIVE_FAILURE_THRESHOLD` | `max(3, poolSize)`                 | Per-slot consecutive deaths before the pool's circuit breaker trips. After tripping, dispatches require a fresh pool.                                                                                                                                     |
+| `GITNEXUS_WORKER_SHUTDOWN_DRAIN_MS`             | `30000`                            | Max wait at pool shutdown for a retired worker still inside native code — terminated at its next JS-safe point instead of mid-native-call, which would abort the process (`Napi::Error`, #2432).                                                          |
+| `GITNEXUS_WORKER_READY_TIMEOUT_MS`              | `5000`                             | Startup budget for a parse worker to load its grammar bindings and report `{type:'ready'}`. Slots that miss it are treated as startup crashes. Raise it on a slow or heavily loaded host where a full pool cold-starting concurrently needs more than 5s. |
+| `GITNEXUS_MEMORY`                               | `off`                              | unset (autopilot on)                                                                                                                                                                                                                                      | `off` declines GitNexus's memory autopilot: analyze will neither re-run itself with a RAM-aware heap cap nor abort the parse before V8 enters its ineffective-mark-compact death spiral. Use it when you want to drive memory manually; to simply pin a heap size, pass Node's own `--max-old-space-size`, which is already honoured as your decision. |
+| `GITNEXUS_WORKER_HEAP_MB`                       | `clamp(512, RAM/2/poolSize, 4096)` | Per-worker V8 old-generation heap cap (#2649). Bounds pool RSS on large repos; a worker exceeding it dies with a real heap error handled by quarantine/respawn.                                                                                           |
+| `GITNEXUS_SERVER_ANALYZE_HEAP_MB`               | `min(8192, auto cap)`              | Heap for the web/MCP server's forked analyze worker (#2649). Defaults to the historical 8192 MB bounded by the machine/container's RAM-aware auto cap; set an absolute MB value to override.                                                              |
+| `GITNEXUS_CPP_CAPTURE_BUDGET_MS`                | `20000`                            | Per-file wall-clock budget for C++ capture extraction; on breach the file keeps partial captures with a warning (#2432). `0` expires immediately.                                                                                                         |
 
 ### Graph cleanup tuning
 
@@ -732,8 +735,8 @@ Programmatic callers can pass `keepLocalValueSymbols: true` in `PipelineOptions`
 
 ### Scope-resolution property-key dispatch cap
 
-During scope resolution GitNexus synthesizes CALLS edges through *property-key
-dispatch* — call sites like `hooks.emitScopeCaptures()` where a property key is
+During scope resolution GitNexus synthesizes CALLS edges through _property-key
+dispatch_ — call sites like `hooks.emitScopeCaptures()` where a property key is
 registered by multiple definitions across the codebase. To keep this fan-in
 bounded, each property key is capped at **32 registrations**: a key registered
 by more than 32 distinct functions is skipped entirely (no CALLS are synthesized
@@ -741,8 +744,8 @@ through it), and the dropped key names are surfaced in the analyze log for
 operator visibility. The cap is calibrated at 2× this repo's own provider table
 (16 legitimate registrations, one per language provider).
 
-| Variable                                | Default | Effect                                                                                                                                                                                                                                                                                                                |
-| --------------------------------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Variable                                | Default | Effect                                                                                                                                                                                                                                                                                                                       |
+| --------------------------------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `GITNEXUS_MAX_PROPERTY_DISPATCH_FANOUT` | `32`    | Per-property-key registration cap in the property-dispatch scope-resolution pass. Set to a positive integer to raise it for repositories whose provider/hook tables exceed the default and lose CALLS coverage on a legitimate key; non-integer or `< 1` values fall back to `32`. Lowering it tightens the overflow budget. |
 
 ```bash
@@ -755,11 +758,11 @@ npx gitnexus analyze --force
 
 ### Scope-resolution dispatch-target cap
 
-During scope resolution GitNexus resolves calls that flow through *callable
-values* — function/method references bound to variables, passed as arguments,
+During scope resolution GitNexus resolves calls that flow through _callable
+values_ — function/method references bound to variables, passed as arguments,
 or stored in maps/tables. To keep that inclusion-based resolution finite, each
 callable site is capped at **32 dispatch targets**. When a site gathers more
-candidates than the cap it is treated as **overflowed** and *all* of its call
+candidates than the cap it is treated as **overflowed** and _all_ of its call
 edges are dropped — a cliff, not a tail, so a repository with a legitimately
 wide dispatch table (a single callable site resolving to 33+ targets) loses
 that site's whole call chain. In that case `analyze` logs
@@ -769,8 +772,8 @@ candidate count, and the cap (32).
 
 Raise the cap for such repositories:
 
-| Variable                              | Default | Effect                                                                                                                                                                                                                                                                                                              |
-| ------------------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Variable                              | Default | Effect                                                                                                                                                                                                                                                                                                               |
+| ------------------------------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `GITNEXUS_MAX_CALLABLE_VALUE_TARGETS` | `32`    | Per-callable-site dispatch-target cap in the callable-value-flow scope-resolution pass. Set to a positive integer to raise it for repositories whose wide dispatch tables overflow the default and lose a whole call chain; non-integer or `< 1` values fall back to `32`. Lowering it tightens the overflow budget. |
 
 ```bash

package/dist/_shared/graph/types.d.ts

@@ -48,6 +48,12 @@ export type NodeProperties = {
     responseKeys?: string[];
     errorKeys?: string[];
     middleware?: string[];
+    /** Route runtime evidence is authoritative only when this is exactly true. */
+    runtimeConfirmed?: boolean;
+    /** Provenance of runtime evidence; presence alone does not imply confirmation. */
+    runtimeSource?: string;
+    /** Runtime result such as runtime-confirmed or handler-conflict. */
+    runtimeStatus?: string;
     text?: string;
     /** BasicBlock: space-joined leaf callee names invoked in the block — the
      *  statement-precise inter-procedural reach substrate for impact mode. */

package/dist/_shared/graph/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/graph/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,OAAO,GACP,UAAU,GACV,QAAQ,GACR,UAAU,GACV,WAAW,GACX,MAAM,GACN,WAAW,GACX,QAAQ,GACR,MAAM,GACN,aAAa,GACb,WAAW,GACX,SAAS,GAET,QAAQ,GACR,OAAO,GACP,SAAS,GACT,OAAO,GACP,WAAW,GACX,OAAO,GACP,MAAM,GACN,WAAW,GACX,OAAO,GACP,QAAQ,GACR,UAAU,GACV,QAAQ,GACR,UAAU,GACV,YAAY,GACZ,aAAa,GACb,UAAU,GACV,SAAS,GACT,OAAO,GACP,MAAM,GAGN,YAAY,CAAC;AAEjB,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC;IACvC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAEjC,WAAW,CAAC,EAAE,iBAAiB,GAAG,iBAAiB,CAAC;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;4EACwE;IACxE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;8EAC0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GACxB,UAAU,GACV,OAAO,GACP,UAAU,GACV,kBAAkB,GAClB,mBAAmB,GACnB,SAAS,GACT,MAAM,GACN,SAAS,GACT,WAAW,GACX,YAAY,GACZ,SAAS,GACT,YAAY,GACZ,cAAc,GACd,UAAU,GACV,WAAW,GACX,iBAAiB,GACjB,eAAe,GACf,SAAS,GACT,cAAc,GACd,gBAAgB,GAChB,OAAO,GACP,SAAS;AACX;;;;;;;;;;;0EAW0E;GACxE,SAAS;AACX;;;;;qBAKqB;GACnB,gBAAgB;AAClB;;;;+BAI+B;GAC7B,UAAU;AACZ;;;;6EAI6E;GAC3E,YAAY;AACd;;;;;;qEAMqE;GACnE,qBAAqB;AACvB;;;;;;gEAMgE;GAC9D,aAAa;AAOf,6EAA6E;GAC3E,KAAK;AACP;;;;qCAIqC;GACnC,cAAc;AAChB,qDAAqD;GACnD,SAAS;AACX,6CAA6C;GAC3C,WAAW;AACb;8EAC8E;GAC5E,YAAY;AACd;;;;qEAIqE;GACnE,KAAK;AACP;;;;;;0EAM0E;GACxE,eAAe;AACjB;;;;;;;;;;;oCAWoC;GAClC,cAAc,CAAC;AAEnB,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,SAAS;QAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACxB,EAAE,CAAC;CACL"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/graph/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,OAAO,GACP,UAAU,GACV,QAAQ,GACR,UAAU,GACV,WAAW,GACX,MAAM,GACN,WAAW,GACX,QAAQ,GACR,MAAM,GACN,aAAa,GACb,WAAW,GACX,SAAS,GAET,QAAQ,GACR,OAAO,GACP,SAAS,GACT,OAAO,GACP,WAAW,GACX,OAAO,GACP,MAAM,GACN,WAAW,GACX,OAAO,GACP,QAAQ,GACR,UAAU,GACV,QAAQ,GACR,UAAU,GACV,YAAY,GACZ,aAAa,GACb,UAAU,GACV,SAAS,GACT,OAAO,GACP,MAAM,GAGN,YAAY,CAAC;AAEjB,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC;IACvC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAEjC,WAAW,CAAC,EAAE,iBAAiB,GAAG,iBAAiB,CAAC;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;4EACwE;IACxE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,8EAA8E;IAC9E,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;8EAC0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GACxB,UAAU,GACV,OAAO,GACP,UAAU,GACV,kBAAkB,GAClB,mBAAmB,GACnB,SAAS,GACT,MAAM,GACN,SAAS,GACT,WAAW,GACX,YAAY,GACZ,SAAS,GACT,YAAY,GACZ,cAAc,GACd,UAAU,GACV,WAAW,GACX,iBAAiB,GACjB,eAAe,GACf,SAAS,GACT,cAAc,GACd,gBAAgB,GAChB,OAAO,GACP,SAAS;AACX;;;;;;;;;;;0EAW0E;GACxE,SAAS;AACX;;;;;qBAKqB;GACnB,gBAAgB;AAClB;;;;+BAI+B;GAC7B,UAAU;AACZ;;;;6EAI6E;GAC3E,YAAY;AACd;;;;;;qEAMqE;GACnE,qBAAqB;AACvB;;;;;;gEAMgE;GAC9D,aAAa;AAOf,6EAA6E;GAC3E,KAAK;AACP;;;;qCAIqC;GACnC,cAAc;AAChB,qDAAqD;GACnD,SAAS;AACX,6CAA6C;GAC3C,WAAW;AACb;8EAC8E;GAC5E,YAAY;AACd;;;;qEAIqE;GACnE,KAAK;AACP;;;;;;0EAM0E;GACxE,eAAe;AACjB;;;;;;;;;;;oCAWoC;GAClC,cAAc,CAAC;AAEnB,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,SAAS;QAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACxB,EAAE,CAAC;CACL"}

package/dist/cli/ai-context.d.ts

@@ -30,6 +30,8 @@ export interface AIContextOptions {
      * "no PDG layer" note, so advertising it on a non-`--pdg` index is noise.
      */
     hasPdg?: boolean;
+    /** Whether this index includes opt-in Spring Actuator runtime evidence. */
+    hasSpringActuator?: boolean;
 }
 /**
  * Strip backticks from a branch name before it is embedded in a Markdown
@@ -62,6 +64,8 @@ export interface GitNexusContentOptions {
      *  line below — false (default) omits it, so a non-pdg index doesn't advertise
      *  a tool that only returns a "no PDG layer" note. */
     hasPdg?: boolean;
+    /** Whether Route nodes may carry Spring Actuator runtime evidence. */
+    hasSpringActuator?: boolean;
 }
 export declare function generateGitNexusContent(projectName: string, stats: RepoStats, opts?: GitNexusContentOptions): string;
 /**

package/dist/cli/ai-context.js

@@ -79,7 +79,7 @@ export function markdownSafeBranch(branch) {
     return branch.replace(/`/g, '');
 }
 export function generateGitNexusContent(projectName, stats, opts = {}) {
-    const { generatedSkills, groupNames, noStats, skipSkills, runnerPath = '.gitnexus/run.cjs', defaultBranch = 'main', hasPdg = false, } = opts;
+    const { generatedSkills, groupNames, noStats, skipSkills, runnerPath = '.gitnexus/run.cjs', defaultBranch = 'main', hasPdg = false, hasSpringActuator = false, } = opts;
     const generatedRows = generatedSkills && generatedSkills.length > 0
         ? generatedSkills
             .map((s) => 
@@ -146,7 +146,9 @@ This project is indexed by GitNexus as **${projectName}**${noStats ? '' : ` (${s
 - MUST warn on HIGH/CRITICAL \`risk\` pre-edit; never use \`riskSharedAxes\` to waive a HIGH/CRITICAL \`risk\` warning. Compare File/symbol: MCP File omits axes; Graph-RAG expands File.
 - **MUST treat \`risk: UNKNOWN\` as unresolved, not as low.** An empty caller set is not evidence the symbol is unused — it can also mean the callers are not resolvable by the index (plain-object property access, dynamic dispatch, cross-language calls). \`impact\` pairs \`UNKNOWN\` with a \`riskNote\` saying so. Confirm with a text search before treating the symbol as safe to change or delete; do not proceed on the strength of a zero.
 - Explore with \`query({search_query: "concept"})\` for process-grouped flows.
-- Use \`context({name: "symbolName"})\` for callers, callees, and flows.
+- Use \`context({name: "symbolName"})\` for callers, callees, and flows.${hasSpringActuator
+        ? '\n- Spring Actuator runtime evidence is enabled. A Route is authoritative only when `runtimeConfirmed === true`; `runtimeSource` is provenance and may also describe conflicts. Snapshot values are never persisted.'
+        : ''}
 - For security review, \`explain({target: "fileOrSymbol"})\` lists taint findings (source→sink flows; needs \`analyze --pdg\`).${hasPdg
         ? `\n- For control/data dependence, \`pdg_query({mode: "controls", target: "fileOrSymbol"})\` answers "under what condition does X run?" (CDG, incl. guard clauses) and \`pdg_query({mode: "flows", target, variable})\` traces "where does variable Y flow?" (REACHING_DEF). \`--pdg\` layer.`
         : ''}
@@ -414,6 +416,7 @@ export async function generateAIContextFiles(repoPath, storagePath, projectName,
         runnerPath,
         defaultBranch: options?.defaultBranch ?? 'main',
         hasPdg: options?.hasPdg ?? false,
+        hasSpringActuator: options?.hasSpringActuator ?? false,
     });
     const createdFiles = [];
     if (!options?.skipAgentsMd) {

package/dist/cli/analyze-config.js

@@ -86,6 +86,9 @@ const KEY_SPECS = {
     // built-in convention set, is otherwise invisible to route_map consumers.
     // Listing it here adds it to the cross-file consumer scan.
     fetchWrappers: { target: 'fetchWrappers', kind: 'string-array' },
+    // Explicit local Actuator snapshot input (#2418). The path itself is safe in
+    // project config; payload contents are never copied into the graph wholesale.
+    springActuator: { target: 'springActuator', kind: 'path' },
     // Auth token AND dims are intentionally CLI/env-only — no embeddingAuthToken
     // or embeddingDims key here:
     //   - the token keeps secrets out of a committed .gitnexusrc;
@@ -192,6 +195,17 @@ const normalizeValue = (kind, value, key) => {
                 throw new GitNexusRcError(`${source} must be a string branch name.`);
             }
             return validateBranchName(value, source);
+        case 'path': {
+            if (typeof value !== 'string') {
+                throw new GitNexusRcError(`${source} must be a file or directory path.`);
+            }
+            const trimmed = value.trim();
+            if (!trimmed) {
+                throw new GitNexusRcError(`${source} must not be empty.`);
+            }
+            assertNoHiddenChars(trimmed, source);
+            return trimmed;
+        }
         case 'string': {
             if (typeof value !== 'string') {
                 throw new GitNexusRcError(`${source} must be a string.`);

package/dist/cli/analyze-options.d.ts

@@ -124,6 +124,11 @@ export interface AnalyzeOptions {
      * outside the built-in convention still produces `route_map` consumers.
      */
     fetchWrappers?: string[];
+    /**
+     * Explicit local Spring Boot Actuator snapshot input (#2418). Accepts a JSON
+     * bundle or a directory containing endpoint JSON files. Disabled by default.
+     */
+    springActuator?: string;
     /** OpenAI-compatible embeddings base URL (incl. /v1). Overrides GITNEXUS_EMBEDDING_URL. */
     embeddingBaseUrl?: string;
     /** Embedding model name. Overrides GITNEXUS_EMBEDDING_MODEL. */

package/dist/cli/analyze.js

@@ -1112,6 +1112,7 @@ const analyzeCommandImpl = async (inputPath, cliOptions, runnerIdentityAtBootstr
             // Extra fetch-wrapper names from `.gitnexusrc` (#1589/#1852 residual);
             // forwarded to the routes phase consumer scan.
             fetchWrappers: options.fetchWrappers,
+            springActuatorPath: options.springActuator,
             // The CLI always process.exit()s after this returns (success path at the
             // end of analyzeCommandImpl, error/interrupt paths via process.exit too),
             // so the finalize close skips the native conn/db close — it can double-free
@@ -1250,6 +1251,7 @@ const analyzeCommandImpl = async (inputPath, cliOptions, runnerIdentityAtBootstr
                         // exercised on the `--skills` path by analyze-no-stats-bridge.test.ts.
                         noStats: options.stats === false,
                         hasPdg: options.pdg === true,
+                        hasSpringActuator: options.springActuator !== undefined,
                     });
                 }
             }

package/dist/cli/index.js

@@ -73,6 +73,8 @@ program
     .option('--wal-checkpoint-threshold <bytes>', 'LadybugDB WAL auto-checkpoint threshold in bytes during analyze ' +
     '(integer >= -1; default: 67108864 = 64 MiB; -1 keeps Ladybug stock ~16 MiB).')
     .option('--workers <n>', 'Parse worker pool size (>=1). Default: cores-1 capped at 16, auto-sized to the repo.')
+    .option('--spring-actuator <path>', 'Import local Spring Boot Actuator JSON snapshots (mappings, beans, conditions, ' +
+    'configprops, env). Explicit opt-in; disabled by default.')
     .option('--embedding-threads <n>', 'Limit local ONNX embedding CPU threads')
     .option('--embedding-batch-size <n>', 'Number of nodes per embedding batch')
     .option('--embedding-sub-batch-size <n>', 'Number of chunks per embedding model call')

package/dist/cli/watch.js

@@ -74,6 +74,7 @@ export async function resolveWatchOptions(repoPath, cli, baseline, reportIgnored
         ['--self-commit', cli.selfCommit],
         ['--index-only', cli.indexOnly],
         ['--skip-git', cli.skipGit],
+        ['--spring-actuator', cli.springActuator],
         ['walCheckpointThreshold', cli.walCheckpointThreshold],
         ['embeddingThreads', cli.embeddingThreads],
         ['embeddingBatchSize', cli.embeddingBatchSize],
@@ -94,6 +95,7 @@ export async function resolveWatchOptions(repoPath, cli, baseline, reportIgnored
         ['skipAgentsMd', config.skipAgentsMd !== undefined],
         ['skipSkills', config.skipSkills !== undefined],
         ['stats', config.stats !== undefined],
+        ['springActuator', config.springActuator],
         ['walCheckpointThreshold', config.walCheckpointThreshold],
         ['embeddingThreads', config.embeddingThreads],
         ['embeddingBatchSize', config.embeddingBatchSize],

package/dist/core/group/cross-impact.d.ts

@@ -62,6 +62,9 @@ export declare function validateGroupImpactParams(params: Record<string, unknown
     name: string;
     repoPath: string;
     target: string;
+    target_uid?: string;
+    file_path?: string;
+    kind?: string;
     direction: 'upstream' | 'downstream';
     maxDepth: number;
     crossDepth: number;

package/dist/core/group/cross-impact.js

@@ -103,13 +103,21 @@ export function clampTimeout(timeoutMs) {
 export function validateGroupImpactParams(params) {
     const name = String(params.name ?? '').trim();
     const repoPath = String(params.repo ?? '').trim();
-    const target = String(params.target ?? '').trim();
+    // Optional string, same helper shape as cross-trace's `str()`: empty/blank
+    // counts as absent so `target_uid: ''` degrades to the name lookup rather
+    // than a zero-ambiguity lookup of the empty uid. Parsed before the required
+    // check so UID-only callers (MCP impact schema requires `direction`, not
+    // `target`) are accepted.
+    const str = (v) => typeof v === 'string' && v.trim() !== '' ? v : undefined;
+    const targetName = String(params.target ?? '').trim();
+    const target_uidEarly = str(params.target_uid);
     if (!name)
         return { ok: false, error: 'name is required' };
     if (!repoPath)
         return { ok: false, error: 'repo is required (group repo path, e.g. app/backend)' };
-    if (!target)
-        return { ok: false, error: 'target is required' };
+    if (!targetName && !target_uidEarly)
+        return { ok: false, error: 'target or target_uid is required' };
+    const target = targetName || target_uidEarly;
     if (params.service !== undefined &&
         params.service !== null &&
         String(params.service).trim() === '') {
@@ -133,6 +141,9 @@ export function validateGroupImpactParams(params) {
         minConfidence = 1;
     const service = normalizeServicePrefix(params.service);
     const subgroup = typeof params.subgroup === 'string' ? params.subgroup : undefined;
+    const target_uid = target_uidEarly;
+    const file_path = str(params.file_path);
+    const kind = str(params.kind);
     // Clamp at the validate boundary so the downstream `deadline` (line
     // ~366) and `safeLocalImpact`'s `setTimeout` both see a single
     // bounded value. Without this, the outer deadline budgeted Phase-2
@@ -150,6 +161,9 @@ export function validateGroupImpactParams(params) {
         name,
         repoPath,
         target,
+        target_uid,
+        file_path,
+        kind,
         direction,
         maxDepth,
         crossDepth,
@@ -448,7 +462,7 @@ export async function runGroupImpact(deps, params) {
     const parsed = validateGroupImpactParams(params);
     if (parsed.ok === false)
         return { error: parsed.error };
-    const { name, repoPath, target, direction, maxDepth, crossDepth: _crossDepth, crossDepthWarning, relationTypes, includeTests, minConfidence, service: servicePrefix, subgroup, timeoutMs, } = parsed;
+    const { name, repoPath, target, target_uid, file_path, kind, direction, maxDepth, crossDepth: _crossDepth, crossDepthWarning, relationTypes, includeTests, minConfidence, service: servicePrefix, subgroup, timeoutMs, } = parsed;
     const groupDir = getGroupDir(deps.gitnexusDir, name);
     let config;
     try {
@@ -464,6 +478,14 @@ export async function runGroupImpact(deps, params) {
         return { error: resolved.error };
     const impactParams = {
         target,
+        // Selector params pass through to the member repo's impact (the port
+        // contract in service.ts documents them), so the single-repo tool's
+        // "re-call with target_uid to disambiguate" loop works unchanged in
+        // group mode. `undefined` keeps the call shape flat — same convention
+        // as the relationTypes line below.
+        target_uid,
+        file_path,
+        kind,
         direction,
         maxDepth,
         relationTypes: relationTypes && relationTypes.length > 0 ? relationTypes : undefined,

package/dist/core/group/extractors/http-patterns/java.js

@@ -2,7 +2,7 @@ import Java from 'tree-sitter-java';
 import { compilePatterns, runCompiledPatterns, unquoteLiteral, } from '../tree-sitter-scanner.js';
 import { springAnnotationHttpMethods, intersectSpringHttpMethods, isRouteMemberKey, findEnclosingClass, joinPath, } from '../../../ingestion/route-extractors/spring-shared.js';
 import { REST_TEMPLATE_TO_HTTP, WEB_CLIENT_SHORT_TO_HTTP, WEB_CLIENT_LONG_VERB_RE, EXCHANGE_ANNOTATION_TO_HTTP, parseRequestLine, pushPrefix, scanSpringInheritanceProject, OPENFEIGN_FRAMEWORK, HTTP_INTERFACE_FRAMEWORK, FEIGN_CONFIDENCE, REQUEST_LINE_CONFIDENCE, EXCHANGE_CONFIDENCE, } from './spring-consumer-shared.js';
-import { extractJavaModuleConstants, foldJavaOperands, isJavaConstantFile, parseJavaConstOperands, } from '../../../ingestion/route-extractors/java-const-resolver.js';
+import { expandJavaWildcardStaticImports, extractJavaModuleConstants, foldJavaOperands, isJavaConstantFile, parseJavaConstOperands, prepareJavaRouteConstants, } from '../../../ingestion/route-extractors/java-const-resolver.js';
 import { extractStaticPathExpression, inferOkHttpMethod, inferHttpClientMethod, okHttpUrlRootsAtBuilder, httpClientUriRootsAtNewBuilder, httpClientChainHasUriCall, } from './java-static-path.js';
 /**
  * Java HTTP plugin. Handles:
@@ -789,7 +789,10 @@ export const JAVA_HTTP_PLUGIN = {
                 if (!tree)
                     continue;
                 const mc = extractJavaModuleConstants(tree);
-                if (mc.literals.size > 0 || mc.exprs.size > 0 || mc.imports.size > 0) {
+                if (mc.literals.size > 0 ||
+                    mc.exprs.size > 0 ||
+                    mc.imports.size > 0 ||
+                    (mc.wildcardImports?.length ?? 0) > 0) {
                     constants.set(rel, mc);
                 }
             }
@@ -800,7 +803,14 @@ export const JAVA_HTTP_PLUGIN = {
                 continue;
             }
         }
-        return { constants };
+        // On-demand static imports (`import static a.b.C.*`) were recorded as
+        // pending class FQNs during extraction; materialize their bare-name
+        // bindings now that the whole map exists. A wildcard's target is itself
+        // a constants file, so it is necessarily a map entry — anything else
+        // degrades to the fold's skip floor. In-place: each entry is owned by
+        // this map, and every file is expanded exactly once.
+        const constantIndex = prepareJavaRouteConstants(constants);
+        return { constants, constantIndex };
     },
     scan(tree, repoContext, fileRel) {
         const out = [];
@@ -832,8 +842,12 @@ export const JAVA_HTTP_PLUGIN = {
                 return foldConstants;
             try {
                 const mc = extractJavaModuleConstants(tree);
-                if (mc.imports.size > 0) {
+                // A file carrying ONLY wildcard static imports has an empty import
+                // table pre-expansion — overlay it too, then materialize the promised
+                // bindings against the repo map before it becomes a fold target.
+                if (mc.imports.size > 0 || (mc.wildcardImports?.length ?? 0) > 0) {
                     const merged = new Map(javaCtx.constants);
+                    expandJavaWildcardStaticImports(mc, fileRel, merged, javaCtx.constantIndex);
                     merged.set(fileRel, mc);
                     foldConstants = merged;
                 }

package/dist/core/group/extractors/http-patterns/kotlin.js

@@ -1260,6 +1260,7 @@ function buildKotlinPlugin(language) {
                     if (mc.literals.size > 0 ||
                         mc.exprs.size > 0 ||
                         mc.imports.size > 0 ||
+                        (mc.wildcardImports?.length ?? 0) > 0 ||
                         unfoldableDeclarationsOf(mc).size > 0) {
                         // POSIX key (see `normalizeRel`); `readFile` above got the raw `rel`.
                         constants.set(normalizeRel(rel), mc);
@@ -1303,6 +1304,7 @@ function buildKotlinPlugin(language) {
                     if (mc.literals.size > 0 ||
                         mc.exprs.size > 0 ||
                         mc.imports.size > 0 ||
+                        (mc.wildcardImports?.length ?? 0) > 0 ||
                         unfoldableDeclarationsOf(mc).size > 0) {
                         foldIndex = overlayKotlinConstantIndex(kotlinCtx.index, fileKey, mc);
                     }

package/dist/core/group/normalization.d.ts

@@ -1,3 +1,40 @@
-import type { CrossLink, StoredContract } from './types.js';
+import type { CrossLink, CrossLinkEndpoint, StoredContract } from './types.js';
+/**
+ * True when a link endpoint carries no resolved graph symbol — empty
+ * `symbolUid` or a missing/empty `symbolRef`.
+ *
+ * Sync marks a cross-link `degraded: true` when this holds for the PROVIDER
+ * endpoint (`to`): the contract boundary is proven, but the empty uid can
+ * never match a Phase-1 impact symbol id, so cross-repo fan-out across the
+ * link silently yields nothing (the classic case is a provider whose handler
+ * failed to resolve, leaving `symbolName` degraded to the file name with one
+ * pseudo-symbol carrying every route in that file). Consumer-side (`from`)
+ * emptiness is deliberately NOT degraded — several extractors (topics, grpc)
+ * legitimately emit consumer contracts without a per-call symbol, and the
+ * anchor that matters for far-side fan-out is the provider's.
+ *
+ * Kept next to the endpoint merge logic because `dedupeCrossLinks` must
+ * re-derive the flag after a merge: `mergeEndpoints` backfills `symbolUid`
+ * from the losing twin, which can invalidate a flag carried in from the winner.
+ *
+ * NOT unresolved: a deterministic `manifest::<repo>::<contractId>` synthetic
+ * uid (see `manifestSymbolUid`). Manifest endpoints fall back to it precisely
+ * when the graph has no symbol for them — its empty `symbolRef.filePath` would
+ * otherwise trip the check below — yet cross-impact anchors those links by
+ * design (#2722: the crossing is preserved with `fanout_status:
+ * 'not_attempted'` instead of silently yielding cross=0). The prefix is the
+ * canonical discriminator — real indexer uids never start with `manifest::`
+ * — and `cross-impact.ts` branches on the same test. Encoding the exemption
+ * HERE (not at the sync marking call site) keeps marking and the post-merge
+ * re-derivation from drifting apart, and keeps the flag's meaning exactly what
+ * `types.ts` documents: "distinct from manifest::… synthetic UIDs".
+ */
+export declare function isUnresolvedEndpoint(endpoint: CrossLinkEndpoint): boolean;
+/**
+ * Derive `degraded` from the provider endpoint. Present (`true`) only when
+ * unresolved; deleted otherwise so contracts.json stays "carried only when
+ * meaningful" (`'degraded' in link === false` for anchored links).
+ */
+export declare function applyDegradedFlag(link: CrossLink): CrossLink;
 export declare function dedupeContracts(items: StoredContract[]): StoredContract[];
 export declare function dedupeCrossLinks(items: CrossLink[]): CrossLink[];

package/dist/core/group/normalization.js

@@ -83,6 +83,59 @@ function crossLinkKey(link) {
         endpointKey(link.to),
     ].join('\0');
 }
+/**
+ * True when a link endpoint carries no resolved graph symbol — empty
+ * `symbolUid` or a missing/empty `symbolRef`.
+ *
+ * Sync marks a cross-link `degraded: true` when this holds for the PROVIDER
+ * endpoint (`to`): the contract boundary is proven, but the empty uid can
+ * never match a Phase-1 impact symbol id, so cross-repo fan-out across the
+ * link silently yields nothing (the classic case is a provider whose handler
+ * failed to resolve, leaving `symbolName` degraded to the file name with one
+ * pseudo-symbol carrying every route in that file). Consumer-side (`from`)
+ * emptiness is deliberately NOT degraded — several extractors (topics, grpc)
+ * legitimately emit consumer contracts without a per-call symbol, and the
+ * anchor that matters for far-side fan-out is the provider's.
+ *
+ * Kept next to the endpoint merge logic because `dedupeCrossLinks` must
+ * re-derive the flag after a merge: `mergeEndpoints` backfills `symbolUid`
+ * from the losing twin, which can invalidate a flag carried in from the winner.
+ *
+ * NOT unresolved: a deterministic `manifest::<repo>::<contractId>` synthetic
+ * uid (see `manifestSymbolUid`). Manifest endpoints fall back to it precisely
+ * when the graph has no symbol for them — its empty `symbolRef.filePath` would
+ * otherwise trip the check below — yet cross-impact anchors those links by
+ * design (#2722: the crossing is preserved with `fanout_status:
+ * 'not_attempted'` instead of silently yielding cross=0). The prefix is the
+ * canonical discriminator — real indexer uids never start with `manifest::`
+ * — and `cross-impact.ts` branches on the same test. Encoding the exemption
+ * HERE (not at the sync marking call site) keeps marking and the post-merge
+ * re-derivation from drifting apart, and keeps the flag's meaning exactly what
+ * `types.ts` documents: "distinct from manifest::… synthetic UIDs".
+ */
+export function isUnresolvedEndpoint(endpoint) {
+    if (endpoint.symbolUid.startsWith('manifest::'))
+        return false;
+    return (!endpoint.symbolUid ||
+        !endpoint.symbolRef ||
+        !endpoint.symbolRef.filePath ||
+        !endpoint.symbolRef.name);
+}
+/**
+ * Derive `degraded` from the provider endpoint. Present (`true`) only when
+ * unresolved; deleted otherwise so contracts.json stays "carried only when
+ * meaningful" (`'degraded' in link === false` for anchored links).
+ */
+export function applyDegradedFlag(link) {
+    const next = { ...link };
+    if (isUnresolvedEndpoint(next.to)) {
+        next.degraded = true;
+    }
+    else {
+        delete next.degraded;
+    }
+    return next;
+}
 export function dedupeContracts(items) {
     const deduped = new Map();
     for (const contract of items) {
@@ -104,12 +157,15 @@ export function dedupeCrossLinks(items) {
         const keepIncoming = link.confidence > existing.confidence;
         const primary = keepIncoming ? link : existing;
         const secondary = keepIncoming ? existing : link;
-        deduped.set(key, {
+        const merged = {
             ...primary,
             confidence: Math.max(existing.confidence, link.confidence),
             from: mergeEndpoints(primary.from, secondary.from),
             to: mergeEndpoints(primary.to, secondary.to),
-        });
+        };
+        // Re-derive after mergeEndpoints: a richer twin can backfill `to.symbolUid`
+        // and must not leave a stale `degraded` flag on an now-anchored link.
+        deduped.set(key, applyDegradedFlag(merged));
     }
-    return [...deduped.values()];
+    return [...deduped.values()].map(applyDegradedFlag);
 }

package/dist/core/group/service.d.ts

@@ -15,6 +15,17 @@ export interface GroupToolPort {
     resolveRepo(repoParam?: string): Promise<GroupRepoHandle>;
     impact(repo: GroupRepoHandle, params: {
         target: string;
+        /**
+         * Target-selector params, same semantics as the single-repo `impact`
+         * tool: `target_uid` is the zero-ambiguity lookup (it wins over the
+         * name), `file_path`/`kind` narrow a name shared by several symbols
+         * (e.g. same-named Api/Impl/Controller layers). The port implementation
+         * consumes them directly; the Phase-1 caller in cross-impact.ts is
+         * responsible for threading them from the MCP `impact` args.
+         */
+        target_uid?: string;
+        file_path?: string;
+        kind?: string;
         direction: 'upstream' | 'downstream';
         maxDepth?: number;
         relationTypes?: string[];

package/dist/core/group/service.js

@@ -341,6 +341,14 @@ export class GroupService {
             // can otherwise see contract counts that disagree with this payload, with
             // nothing here explaining why the write was skipped.
             registryOutcome: result.registryOutcome,
+            // Data-quality signals surfaced from the sync run: links whose provider
+            // endpoint never resolved to a graph symbol, per-repo extraction
+            // failures with reasons, and operator warnings (e.g. bridge.lbug write
+            // failed after contracts.json was written). Always present so MCP
+            // consumers can branch on them without existence checks.
+            degradedLinks: result.degradedLinks,
+            failedRepos: result.failedRepos,
+            warnings: result.warnings,
         };
     }
     async groupContracts(params) {

package/dist/core/group/sync.d.ts

@@ -47,6 +47,27 @@ export interface SyncResult {
      * none of that repo's contracts are in `contracts`.
      */
     unreadableRepos: string[];
+    /**
+     * Cross-links whose provider endpoint has no resolved graph symbol
+     * (`degraded: true` on the link — see `isUnresolvedEndpoint`). The boundary
+     * is proven but cross-impact fan-out cannot anchor it; the usual remedy is
+     * re-analyzing the provider repo so its handlers resolve.
+     */
+    degradedLinks: number;
+    /**
+     * Repos whose per-repo extraction threw (init, an extractor, or the
+     * snapshot read). Each still lands in `unreadableRepos` (group path) —
+     * unchanged downstream semantics — but carries its failure reason here: the
+     * catch used to swallow the exception, leaving contracts already pushed by
+     * earlier extractors in this iteration as silent half-repo data. `repo` is
+     * that same group path (e.g. `app/backend`), not the registry display name.
+     */
+    failedRepos: Array<{
+        repo: string;
+        reason: string;
+    }>;
+    /** Operator-facing run warnings (e.g. bridge.lbug write failed after contracts.json was written). */
+    warnings: string[];
     repoSnapshots: Record<string, RepoSnapshot>;
     /**
      * Matching stages this run was asked to skip. Populated on EVERY outcome,