rcf-lite 0.0.1 → 0.7.1

package/src/core/patterns/services.js

@@ -0,0 +1,358 @@
+// Third-party service seed pattern set - single source of truth for
+// service-dependency detection across the 0.7.0 verification-integrity
+// train.
+//
+// Consumed by:
+//   - `packages/rcf-lite/src/preflight/scanner.js` (Track A pre-flight service
+//     candidate scanner, verification-integrity-cluster-spec §4.3 / §8.3);
+//     the scanner walks PRD + TAD prose, calls `matchServiceSignals(text)`,
+//     and packages each hit into a `preFlightConfig.servicesInScope[]`
+//     candidate with per-match provenance (doc path, section anchor, the
+//     matched phrase and its category).
+//   - `packages/rcf-lite/src/verify/provision/index.js` (verify's provisioning
+//     heuristic, spec §5.3 / §8.4); verify's existing `SERVICE_PATTERNS`
+//     regex is superseded by this shared set so the "email channel" miss
+//     that motivated the whole cluster (d-2026-07-30-142 investigation)
+//     cannot recur from regex drift between packages.
+//
+// The pattern set is data, not a classifier: consumers own the "what field
+// the signal came from" packaging and any interactive-session grouping.
+// This module exposes the categorised keyword sets plus a convenience
+// matcher that returns per-hit provenance in document order.
+//
+// Match rules per spec §4.4:
+//   - Case-insensitive.
+//   - Word-boundary anchored on the leading side (the matcher wraps every
+//     pattern as `\b<pattern>`, mirroring the sibling ui-shapes / req-shapes
+//     idiom); stem-suffixed forms (`emails`, `webhooks`, `providers`) match
+//     by design.
+//   - Any single match triggers a service candidate. False positives are
+//     cheap (the interactive session dismisses them); false negatives are
+//     the failure mode this seed set exists to close (`email channel` was
+//     missed by the old regex — d-142 rec 2).
+//   - Categorisation is non-exclusive: the same phrase (`provider`, `api`)
+//     legitimately fires under multiple categories, and every hit is
+//     recorded independently so the scanner can present them as separate
+//     candidates for the operator to merge or dismiss.
+//
+// Interpretation of the spec's "× verbs" shorthand (`storageCdn`, `llmAi`,
+// `analyticsTelemetry`, `featureFlags`): where §4.4 writes "× verbs"
+// without enumerating a per-category verb list, the shared
+// `GENERIC_SERVICE_VERBS` set below is used — the union of every explicit
+// verb spelled out by the four categories that DO enumerate (email,
+// payment, sms/voice, auth, search). This is the sole interpretation call
+// in transcribing §4.4; every token, vendor and explicitly-enumerated verb
+// is ship-verbatim.
+
+/**
+ * @typedef {'emailDelivery'|'payment'|'smsVoice'|'auth'|'storageCdn'|'llmAi'|'analyticsTelemetry'|'featureFlags'|'search'} ServiceCategory
+ */
+
+/**
+ * @typedef {'token'|'verb'|'vendor'} ServiceSignalRole
+ */
+
+/**
+ * @typedef {object} ServiceSignalMatch
+ * @property {ServiceCategory} category
+ * @property {ServiceSignalRole} role
+ * @property {string} pattern        source pattern string that matched
+ * @property {string} match          exact substring the pattern captured
+ * @property {number} index          offset of the match inside `text`
+ */
+
+// Canonical category id list. Order is spec §4.4 document order so the
+// scanner's presentation to the operator stays stable across runs.
+export const SERVICE_CATEGORY_KEYS = Object.freeze([
+  'emailDelivery',
+  'payment',
+  'smsVoice',
+  'auth',
+  'storageCdn',
+  'llmAi',
+  'analyticsTelemetry',
+  'featureFlags',
+  'search',
+]);
+
+// Shared verb set used by every category whose spec §4.4 entry writes
+// "× verbs" without an explicit enumeration. Composed as the union of every
+// verb the spec DOES enumerate, in first-appearance document order.
+// Exported for tests and for consumers that want to reason about the
+// interpretation call directly.
+export const GENERIC_SERVICE_VERBS = Object.freeze([
+  'send',
+  'deliver',
+  'dispatch',
+  'notify',
+  'route',
+  'channel',
+  'provider',
+  'processor',
+  'gateway',
+  'api',
+]);
+
+/**
+ * The nine-category third-party-service seed set, transcribed verbatim from
+ * verification-integrity-cluster-spec §4.4. Each category exposes three
+ * frozen arrays:
+ *
+ *   - `tokens`  the generic terms that name the service concept.
+ *   - `verbs`   the actions that co-occur with tokens in service-mentioning
+ *               prose; equals `GENERIC_SERVICE_VERBS` for the four
+ *               categories whose spec entry writes "× verbs".
+ *   - `vendors` the explicit vendor names spec §4.4 lists separately (empty
+ *               for `emailDelivery`, whose §4.4 entry lists vendors inline
+ *               with tokens — this transcription preserves that spec shape
+ *               rather than re-sorting vendors out of the token list).
+ *
+ * Every array is `Object.freeze`d so downstream classifiers cannot mutate
+ * the shared source.
+ *
+ * @type {Readonly<Record<ServiceCategory, {tokens: readonly string[], verbs: readonly string[], vendors: readonly string[]}>>}
+ */
+export const SERVICE_SEED_PATTERNS_V1 = Object.freeze({
+  // Email delivery §4.4: `email|smtp|mailer|resend|sendgrid|mailgun|postmark|ses\b|mailtrap|sparkpost`
+  //   × `send|deliver|dispatch|notify|route|channel|provider`
+  // (Vendor names live inline in the token list per §4.4; `vendors` empty
+  // here preserves that spec transcription.)
+  emailDelivery: Object.freeze({
+    tokens: Object.freeze([
+      'email',
+      'smtp',
+      'mailer',
+      'resend',
+      'sendgrid',
+      'mailgun',
+      'postmark',
+      'ses\\b',
+      'mailtrap',
+      'sparkpost',
+    ]),
+    verbs: Object.freeze([
+      'send',
+      'deliver',
+      'dispatch',
+      'notify',
+      'route',
+      'channel',
+      'provider',
+    ]),
+    vendors: Object.freeze([]),
+  }),
+  // Payment §4.4: `payment|checkout|billing|invoice|charge|payout|refund`
+  //   × `provider|processor|gateway|api`;
+  //   explicit vendors `stripe|braintree|adyen|paypal|square`.
+  payment: Object.freeze({
+    tokens: Object.freeze([
+      'payment',
+      'checkout',
+      'billing',
+      'invoice',
+      'charge',
+      'payout',
+      'refund',
+    ]),
+    verbs: Object.freeze([
+      'provider',
+      'processor',
+      'gateway',
+      'api',
+    ]),
+    vendors: Object.freeze([
+      'stripe',
+      'braintree',
+      'adyen',
+      'paypal',
+      'square',
+    ]),
+  }),
+  // SMS/voice §4.4: `sms|voice|call|dial` × `provider|api`;
+  //   explicit vendors `twilio|vonage|messagebird`.
+  smsVoice: Object.freeze({
+    tokens: Object.freeze([
+      'sms',
+      'voice',
+      'call',
+      'dial',
+    ]),
+    verbs: Object.freeze([
+      'provider',
+      'api',
+    ]),
+    vendors: Object.freeze([
+      'twilio',
+      'vonage',
+      'messagebird',
+    ]),
+  }),
+  // Auth (identity provider) §4.4: `oauth|oidc|saml|sso|social login`
+  //   × `provider`;
+  //   explicit vendors `auth0|clerk|okta|firebase auth|cognito|supabase auth`.
+  auth: Object.freeze({
+    tokens: Object.freeze([
+      'oauth',
+      'oidc',
+      'saml',
+      'sso',
+      'social login',
+    ]),
+    verbs: Object.freeze([
+      'provider',
+    ]),
+    vendors: Object.freeze([
+      'auth0',
+      'clerk',
+      'okta',
+      'firebase auth',
+      'cognito',
+      'supabase auth',
+    ]),
+  }),
+  // Storage/CDN §4.4: `s3|r2|gcs|blob storage|cdn` × verbs;
+  //   explicit vendors `cloudflare r2|aws s3|gcs|azure blob`.
+  storageCdn: Object.freeze({
+    tokens: Object.freeze([
+      's3',
+      'r2',
+      'gcs',
+      'blob storage',
+      'cdn',
+    ]),
+    verbs: GENERIC_SERVICE_VERBS,
+    vendors: Object.freeze([
+      'cloudflare r2',
+      'aws s3',
+      'gcs',
+      'azure blob',
+    ]),
+  }),
+  // LLM/AI §4.4: `llm|inference|completion|embedding|model api` × verbs;
+  //   explicit vendors `anthropic|openai|gemini|mistral|cohere|replicate`.
+  llmAi: Object.freeze({
+    tokens: Object.freeze([
+      'llm',
+      'inference',
+      'completion',
+      'embedding',
+      'model api',
+    ]),
+    verbs: GENERIC_SERVICE_VERBS,
+    vendors: Object.freeze([
+      'anthropic',
+      'openai',
+      'gemini',
+      'mistral',
+      'cohere',
+      'replicate',
+    ]),
+  }),
+  // Analytics/telemetry §4.4: `analytics|telemetry|event tracking` × verbs;
+  //   explicit vendors `posthog|segment|mixpanel|amplitude|datadog`.
+  analyticsTelemetry: Object.freeze({
+    tokens: Object.freeze([
+      'analytics',
+      'telemetry',
+      'event tracking',
+    ]),
+    verbs: GENERIC_SERVICE_VERBS,
+    vendors: Object.freeze([
+      'posthog',
+      'segment',
+      'mixpanel',
+      'amplitude',
+      'datadog',
+    ]),
+  }),
+  // Feature flags §4.4: `feature flag|toggle` × verbs;
+  //   explicit vendors `launchdarkly|growthbook|flagsmith`.
+  featureFlags: Object.freeze({
+    tokens: Object.freeze([
+      'feature flag',
+      'toggle',
+    ]),
+    verbs: GENERIC_SERVICE_VERBS,
+    vendors: Object.freeze([
+      'launchdarkly',
+      'growthbook',
+      'flagsmith',
+    ]),
+  }),
+  // Search §4.4: `search|index` × `api|provider`;
+  //   explicit vendors `algolia|elasticsearch|typesense|meilisearch`.
+  search: Object.freeze({
+    tokens: Object.freeze([
+      'search',
+      'index',
+    ]),
+    verbs: Object.freeze([
+      'api',
+      'provider',
+    ]),
+    vendors: Object.freeze([
+      'algolia',
+      'elasticsearch',
+      'typesense',
+      'meilisearch',
+    ]),
+  }),
+});
+
+// Role iteration order for the matcher; consumers reading per-hit
+// provenance can rely on this being stable across releases.
+const ROLES = /** @type {const} */ (['tokens', 'verbs', 'vendors']);
+const ROLE_TO_SINGULAR = /** @type {const} */ ({
+  tokens: 'token',
+  verbs: 'verb',
+  vendors: 'vendor',
+});
+
+/**
+ * Scan `text` against `SERVICE_SEED_PATTERNS_V1` and return every match, in
+ * document order, tagged with the category and role (`token` / `verb` /
+ * `vendor`) that produced it. A single `text` may yield many hits — bare
+ * `provider` legitimately fires under email, payment, sms/voice, auth and
+ * search — and each hit is recorded separately so the scanner can present
+ * them as candidates for the operator to merge or dismiss (spec §4.5).
+ *
+ * @param {string} text
+ * @returns {ServiceSignalMatch[]}
+ */
+export function matchServiceSignals(text) {
+  if (typeof text !== 'string' || text.length === 0) return [];
+  /** @type {ServiceSignalMatch[]} */
+  const results = [];
+  for (const category of SERVICE_CATEGORY_KEYS) {
+    const bucket = SERVICE_SEED_PATTERNS_V1[category];
+    for (const roleKey of ROLES) {
+      const patterns = bucket[roleKey];
+      const role = ROLE_TO_SINGULAR[roleKey];
+      for (const pattern of patterns) {
+        // Leading `\b` prevents matching inside a longer word (e.g. `sms`
+        // inside `smsapi` would still be blocked by `\bsms`, but `smsapi`
+        // as a bare id has no leading word char anyway; the anchor blocks
+        // things like `damsms`). NO trailing `\b`, so stem-suffixed forms
+        // (`emails`, `providers`, `webhooks`, `deliveries`) still match.
+        // Spec §4.4 over-collects by design.
+        const re = new RegExp(`\\b${pattern}`, 'gi');
+        let m;
+        while ((m = re.exec(text)) !== null) {
+          results.push({
+            category,
+            role,
+            pattern,
+            match: m[0],
+            index: m.index,
+          });
+          if (m.index === re.lastIndex) re.lastIndex += 1; // zero-width safety
+        }
+      }
+    }
+  }
+  // Document-order stable sort (matches accumulate category-by-category,
+  // role-by-role, then pattern-by-pattern; this sort restores overall
+  // offset order so the scanner walks hits left-to-right through the doc).
+  results.sort((a, b) => a.index - b.index);
+  return results;
+}

package/src/core/patterns/ui-shapes.js

@@ -0,0 +1,166 @@
+// UI seed pattern set - single source of truth for UI-shape detection.
+//
+// Consumed by:
+//   - `packages/rcf-lite/src/ui-detection/classifier.js` (Track B UI-bearing FBS
+//     classifier, ui-design-gate-0.7.0-spec §4.3).
+//   - `packages/rcf-lite/src/core/patterns/req-shapes.js` (Track C+D REQ-shape
+//     classifier's `webUi` shape, elicitation-and-playbook-hardening-0.7.0
+//     spec §4.3, which requires this file as its single source of truth for
+//     the Web UI signal).
+//
+// The pattern set is data, not a classifier: consumers own the "what field
+// did the signal come from" packaging and the shape of the returned
+// `signals[]` array on the FBS / REQ `*Classification` block. This module
+// exposes the categorised keyword sets plus a convenience matcher.
+//
+// Match rules per spec §4.3:
+//   - Case-insensitive.
+//   - Word-boundary anchored so `nav` does not match inside `navigate` when
+//     the word-boundary hits (regex `\b` handles that).
+//   - Any single match triggers the classifier's `ui` verdict (match count
+//     is not a threshold; false positives are cheap, false negatives are the
+//     failure mode).
+//   - Sentences containing an excluded phrase from `UI_EXCLUDED_PHRASES`
+//     have their signals suppressed (avoids the API-endpoint / CLI /
+//     JSON-response false positive class); ambiguous cases favour `ui`.
+
+/**
+ * @typedef {'explicitUiNouns'|'htmlRenderVerbs'|'responseShapeSignals'|'authFlowSignals'|'accessibilitySignals'} UiSeedCategory
+ */
+
+/**
+ * @typedef {object} UiSignalMatch
+ * @property {UiSeedCategory} category
+ * @property {string} pattern      the source pattern string that matched
+ * @property {string} match        the exact substring the pattern captured
+ * @property {number} index        offset of the match inside `text`
+ */
+
+// Categorised keyword sets. Each entry is a regex source string (no flags,
+// no anchors); the matcher below wraps them with `\b<source>\b` and the
+// `gi` flags at scan time so consumers cannot accidentally use the raw
+// source without word boundaries.
+export const UI_SEED_PATTERNS_V1 = Object.freeze({
+  explicitUiNouns: Object.freeze([
+    'web ui', 'browser', 'page', 'dashboard', 'admin', 'screen', 'form',
+    'route', 'nav', 'navigation', 'layout', 'style', 'theme',
+    'dark mode', 'light mode',
+    'component', 'button', 'table', 'badge', 'header', 'footer',
+    'sidebar', 'modal', 'tooltip',
+  ]),
+  htmlRenderVerbs: Object.freeze([
+    'render(?:ed|s|ing)?',
+    'display(?:ed|s|ing)?',
+    'shows?',
+    'visible',
+    'see(?:s|ing)?',
+    'click(?:s|ed|ing)?',
+    'tap(?:s|ped|ping)?',
+  ]),
+  responseShapeSignals: Object.freeze([
+    'HTML',
+    'markup',
+    'template',
+    'view',
+    'serve.*page',
+    'content-type.*text/html',
+  ]),
+  authFlowSignals: Object.freeze([
+    'login form',
+    'sign(?:-|\\s)?in page',
+    'logout button',
+    'password reset page',
+    'magic(?:-|\\s)?link (?:page|landing)',
+  ]),
+  accessibilitySignals: Object.freeze([
+    'contrast',
+    'WCAG',
+    'screen reader',
+    'keyboard nav',
+    'focus ring',
+    'aria-',
+  ]),
+});
+
+// Sentences containing any of these phrases have their UI signals
+// suppressed. Guards against the API-endpoint / CLI / JSON-response false
+// positive class named in spec §4.3.
+export const UI_EXCLUDED_PHRASES = Object.freeze([
+  'API endpoint',
+  'CLI command',
+  'shell prompt',
+  'JSON response',
+]);
+
+// Split `text` into rough sentence-shaped chunks. Boundary is `.!?` plus a
+// line break; keeps the trailing terminator with the sentence so length /
+// index stays useful for downstream reporting. Deliberately unaware of
+// English abbreviations (`e.g.`, `i.e.`, `Dr.`); the excluded-phrase filter
+// is intended as a coarse noise gate, not a linguistic parser.
+function splitIntoSentences(text) {
+  if (typeof text !== 'string' || text.length === 0) return [];
+  const chunks = [];
+  const re = /[^.!?\n]+[.!?\n]?/g;
+  let match;
+  while ((match = re.exec(text)) !== null) {
+    const chunk = match[0];
+    const start = match.index;
+    const end = start + chunk.length;
+    const trimmed = chunk.trim();
+    if (trimmed.length > 0) chunks.push({ text: chunk, start, end });
+  }
+  return chunks;
+}
+
+function sentenceContainsExcluded(sentence) {
+  const lower = sentence.toLowerCase();
+  for (const phrase of UI_EXCLUDED_PHRASES) {
+    if (lower.includes(phrase.toLowerCase())) return true;
+  }
+  return false;
+}
+
+/**
+ * Scan `text` against `UI_SEED_PATTERNS_V1` and return every match, in
+ * document order, with the pattern that produced it. Sentences containing
+ * any `UI_EXCLUDED_PHRASES` phrase are skipped in full per spec §4.3.
+ *
+ * @param {string} text
+ * @returns {UiSignalMatch[]}
+ */
+export function matchUiSignals(text) {
+  if (typeof text !== 'string' || text.length === 0) return [];
+  /** @type {UiSignalMatch[]} */
+  const results = [];
+  const sentences = splitIntoSentences(text);
+  // Fall back to the whole text as a single "sentence" when the regex
+  // parse produced nothing (e.g. a text without terminators).
+  if (sentences.length === 0) sentences.push({ text, start: 0, end: text.length });
+  for (const sentence of sentences) {
+    if (sentenceContainsExcluded(sentence.text)) continue;
+    for (const category of Object.keys(UI_SEED_PATTERNS_V1)) {
+      for (const pattern of UI_SEED_PATTERNS_V1[category]) {
+        // Leading `\b` prevents matching inside a longer word (e.g. `nav`
+        // inside `navigate`); NO trailing `\b`, so stem-suffixed forms
+        // (`shows`, `dashboards`, `delivers`) still match. Spec §4.3
+        // over-collects by design; false-positive cost is one operator
+        // override, false-negative cost is a dated UI shipping unnoticed.
+        const re = new RegExp(`\\b${pattern}`, 'gi');
+        let m;
+        while ((m = re.exec(sentence.text)) !== null) {
+          results.push({
+            category,
+            pattern,
+            match: m[0],
+            index: sentence.start + m.index,
+          });
+          if (m.index === re.lastIndex) re.lastIndex += 1; // safety for zero-width
+        }
+      }
+    }
+  }
+  // Document-order stable sort (matches happen sentence-by-sentence, then
+  // pattern-by-pattern; sort restores overall offset order).
+  results.sort((a, b) => a.index - b.index);
+  return results;
+}

package/src/core/store/cn-resolve.js

@@ -0,0 +1,134 @@
+// Phase 10 (X2 CodeNode bridge): Code Node working-tree resolution.
+//
+// This is the STALENESS DETECTOR - X2's headline advantage over sidecar
+// approaches (S5/S6; testPointer was the same shape until tp-resolve.js
+// gave it its own working-tree check for the test axis, w-2026-07-28-005).
+// Every CN declares a `path` (file-level
+// "src/foo.js" or symbol-level "src/foo.js#symbol"). This module checks
+// each path against the CHECKED-OUT WORKING TREE and reports the CNs whose
+// target no longer resolves. A rename/move/deletion that a sidecar map
+// would silently carry as a dead pointer surfaces here as a `staleCode`
+// error at `rcf validate` time.
+//
+// Determinism (spec D6/D13 hold): file existence is `fs.stat`; symbol
+// presence is a fixed set of declaration-anchor regexes (function / class /
+// const|let|var / method-at-line-start / object-field). No LLM, no
+// semantic judgement, no parsing beyond regex. Fully reproducible given a
+// working tree.
+//
+// HONEST LIMITATION (documented in docs/ and the PoC report): the symbol
+// check proves a DECLARATION with that name exists - not that it still does
+// what the AC says. A symbol renamed is caught; a symbol whose body was
+// gutted but whose name survived is NOT caught (semantic drift is out of
+// reach for a deterministic check, out of scope per D13). File-level CNs
+// cannot detect intra-file symbol moves at all. A symbol moved to another
+// file while a same-file namesake declaration survives can false-clean
+// (the anchor scan has no lexical scope awareness).
+
+import { readFile, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+
+import { rcfError } from '../errors/index.js';
+
+/**
+ * Split a CN path into its file part and optional symbol part.
+ * @param {string} cnPath e.g. "src/store/validator.js#getAjv"
+ * @returns {{ file: string, symbol: string | null }}
+ */
+export function splitCnPath(cnPath) {
+  const hash = cnPath.indexOf('#');
+  if (hash < 0) return { file: cnPath, symbol: null };
+  return { file: cnPath.slice(0, hash), symbol: cnPath.slice(hash + 1) };
+}
+
+/**
+ * Build the deterministic declaration-anchor matchers for a symbol name.
+ * A symbol is considered PRESENT if any anchor matches the file text.
+ * @param {string} symbol
+ * @returns {RegExp[]}
+ */
+function anchorsFor(symbol) {
+  // Escape regex metacharacters in the symbol (identifiers won't normally
+  // carry any, but `$` is a legal JS identifier char and a regex metachar).
+  const s = symbol.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return [
+    new RegExp(`\\b(?:async\\s+)?function\\s*\\*?\\s+${s}\\b`), // function decl
+    new RegExp(`\\bclass\\s+${s}\\b`), // class decl
+    new RegExp(`\\b(?:const|let|var)\\s+${s}\\b`), // binding decl
+    new RegExp(`^\\s*(?:async\\s+)?(?:static\\s+)?(?:get\\s+|set\\s+)?${s}\\s*\\(`, 'm'), // method/def at line start
+    new RegExp(`^\\s*${s}\\s*[:=]`, 'm'), // object-literal / class-field form
+  ];
+}
+
+/**
+ * Check every Code Node in the tree against the working tree. Returns a
+ * list of structured `staleCode` errors (empty when all CN paths resolve).
+ * A per-file read cache avoids re-reading a file that multiple symbol-level
+ * CNs anchor into (spec D8).
+ *
+ * @param {object} args
+ * @param {string} args.projectRoot - absolute path to project root
+ * @param {object} args.tree - walker TreeModel (carries tree.codeNodes)
+ * @returns {Promise<import('../errors/index.js').RcfError[]>}
+ */
+export async function checkCodeNodeResolution({ projectRoot, tree }) {
+  /** @type {import('../errors/index.js').RcfError[]} */
+  const errors = [];
+  const fileCache = new Map();
+
+  const readFileCached = async (absFile) => {
+    if (fileCache.has(absFile)) return fileCache.get(absFile);
+    let text = null;
+    try {
+      text = await readFile(absFile, 'utf8');
+    } catch {
+      text = null;
+    }
+    fileCache.set(absFile, text);
+    return text;
+  };
+
+  for (const cn of tree.codeNodes ?? []) {
+    const cnPath = cn.path ?? '';
+    const relFile = `rcf/code-nodes/${(cn.cnId ?? '').toLowerCase()}.json`;
+    const { file, symbol } = splitCnPath(cnPath);
+    const absFile = join(projectRoot, file);
+
+    // 1. File existence.
+    let fileOk = false;
+    try {
+      const st = await stat(absFile);
+      fileOk = st.isFile();
+    } catch {
+      fileOk = false;
+    }
+    if (!fileOk) {
+      errors.push(rcfError({
+        kind: 'staleCode',
+        message: `CN ${cn.cnId} path is stale: file ${file} does not exist in the working tree`,
+        documentId: cn.cnId,
+        filePath: relFile,
+        field: 'path',
+        rule: 'fileResolves',
+      }));
+      continue; // no point checking the symbol in a missing file
+    }
+
+    // 2. Symbol presence (deterministic anchor scan).
+    if (symbol) {
+      const text = await readFileCached(absFile);
+      const present = text != null && anchorsFor(symbol).some((re) => re.test(text));
+      if (!present) {
+        errors.push(rcfError({
+          kind: 'staleCode',
+          message: `CN ${cn.cnId} path is stale: symbol '${symbol}' not found in ${file} (renamed, removed, or moved to another file)`,
+          documentId: cn.cnId,
+          filePath: relFile,
+          field: 'path',
+          rule: 'symbolResolves',
+        }));
+      }
+    }
+  }
+  return errors;
+}