Prerelease cleanup (#46)

* feat: Add const_bound_vars tracking to prevent false positives in ownership checks

* feat: Introduce field interner and typed bounded vars for enhanced type tracking

* feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking

* feat: Centralize method name extraction with bare_method_name helper

* feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch

* feat: Enhance C++ taint tracking with additional container operations and inline method resolution

* feat: Introduce field-sensitive points-to analysis for enhanced resource tracking

* feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis

* test: Add comprehensive tests for JavaScript control flow constructs and lattice operations

* docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details

* test: Add comprehensive tests for lattice algebra laws and SSA edge cases

* feat: Add destructured session user handling and safe user ID access patterns

* feat: Implement row-population reverse-walk for enhanced authorization checks

* feat: Enhance authorization checks with local alias chain for self-actor types

* feat: Introduce ActiveRecord query safety checks and enhance snippet extraction

* feat: Implement chained method call inner-gate rebinding for SSRF prevention

* feat: Add observability and error modules, enhance debug functionality, and implement theme context

* feat: Remove Auth Analysis page and update navigation to redirect to Explorer

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity

* fix(ssa): ungate debug_assert_bfs_ordering for release-tests build

The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while
the unit test at the bottom of the file was gated only `#[cfg(test)]`.
Since `cfg(test)` is set in release builds with `--tests` but
`cfg(debug_assertions)` is not, `cargo build --release --tests` failed
with E0425. Removing the gate fixes the build; the body is `debug_assert!`
only, so the helper is free in release. Also drop the gate at the call
site to avoid a `dead_code` warning when the lib is built without
`--tests`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(closure-capture): flip JS/TS fixtures to required-finding

The JS and TS closure-capture fixtures pinned the old broken behaviour
via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now
correctly traces taint through the closure boundary (env source captured
by an arrow function, sunk via `child_process.exec` inside the body), so
the formerly-forbidden finding is a true positive.

Match the Python sibling's shape — `required_findings` with
`id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the
companion READMEs and the phase8_fragility_tests doc-comments from
"known gap" to "regression guard".

Verified:
- cargo test --release --test phase8_fragility_tests → 8/8 pass
- cargo test --release --lib bfs_assertion → pass
- corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis

* feat: Introduce health module and enhance health score computation with calibration tests

* feat: Add expectations configuration and cleanup .gitignore for log files

* feat: Implement theme selection and enhance settings panel for triage sync

* feat: Suppress false positives for strcpy calls with literal sources in AST

* feat: Update analyse_function_ssa to return body CFG for accurate analysis

* feat: Add bug report and feature request templates for improved issue tracking

* feat: removed dev scripts

* feat: update README.md for clarity and consistency in fixture descriptions

* feat: removed dev docs

* feat: clean up error handling and UI elements for improved user experience

* feat: adjust button sizes in HeaderBar for better UI consistency

* feat: enhance taint analysis with additional context for sanitizer and taint findings

* cargo fmt

* prettier

* refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts

* feat: add script to frame PNG screenshots with brand gradient

* feat: add fuzzing support with new targets and CI workflows

* refactor: streamline match expressions and improve formatting in CLI and output handling

* feat: enhance configuration display with detailed output options

* feat: stage demo configuration for improved CLI screenshot output

* feat: expose merge_configs function for user-configurable settings

* refactor: simplify code structure and improve readability in config handling

* refactor: improve descriptions for vulnerability patterns in various languages

* feat: update MIT License section with additional usage details and copyright information

* feat: update screenshots

* refactor: update build process and paths for frontend assets

* feat: add cross-file taint fuzzing target and supporting dictionary

* refactor: clean up formatting and comments in fuzz configuration and example files

* refactor: remove outdated comments and clean up CI configuration files

* chore: update changelog dates and improve formatting in documentation

* refactor: update Cargo.toml and CI configuration for improved packaging and build process

* refactor: enhance quote-stripping logic to prevent panics and add regression tests

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/state/engine.rs

@@ -253,6 +253,7 @@ mod tests {
             resource_pairs: rules::resource_pairs(Lang::C),
             interner: &interner,
             resource_method_summaries: &[],
+            ptr_proxy_hints: None,
         };
 
         let result = run_forward(&cfg, entry, &transfer, ProductState::initial());
@@ -323,6 +324,7 @@ mod tests {
             resource_pairs: rules::resource_pairs(Lang::C),
             interner: &interner,
             resource_method_summaries: &[],
+            ptr_proxy_hints: None,
         };
 
         let result = run_forward(&cfg, entry, &transfer, ProductState::initial());
@@ -508,4 +510,168 @@ mod tests {
         assert_eq!(wl.len(), 3);
         assert_eq!(in_wl.len(), 3);
     }
+
+    // ── CFG-shape robustness ─────────────────────────────────────────────
+    //
+    // The audit flagged that `run_forward` had only linear/diamond test
+    // shapes. These tests exercise edge cases that can trip up the
+    // worklist algorithm: nodes the entry can't reach, a CFG with only
+    // an entry node, irreducible flow with multiple paths into the
+    // same loop body, and a self-loop. Each must terminate without
+    // panicking and produce a sensible converged state.
+
+    /// A node disconnected from the entry must NOT receive any state
+    /// (it's unreachable). The engine processes only nodes reachable
+    /// from the worklist seed; a quiescent unreachable node should
+    /// stay absent from the result map.
+    #[test]
+    fn unreachable_nodes_get_no_state() {
+        use crate::state::domain::ProductState;
+
+        let mut cfg: Cfg = Graph::new();
+        let entry = cfg.add_node(make_node(StmtKind::Entry));
+        let reachable = cfg.add_node(make_node(StmtKind::Seq));
+        let exit = cfg.add_node(make_node(StmtKind::Exit));
+        // Unreachable island: no edge from entry leads here.
+        let orphan = cfg.add_node(make_node(StmtKind::Seq));
+        let orphan_exit = cfg.add_node(make_node(StmtKind::Exit));
+
+        cfg.add_edge(entry, reachable, EdgeKind::Seq);
+        cfg.add_edge(reachable, exit, EdgeKind::Seq);
+        cfg.add_edge(orphan, orphan_exit, EdgeKind::Seq);
+
+        let interner = SymbolInterner::from_cfg(&cfg);
+        let transfer = DefaultTransfer {
+            lang: Lang::C,
+            resource_pairs: rules::resource_pairs(Lang::C),
+            interner: &interner,
+            resource_method_summaries: &[],
+            ptr_proxy_hints: None,
+        };
+
+        let result = run_forward(&cfg, entry, &transfer, ProductState::initial());
+        assert!(result.converged);
+        assert!(
+            result.states.contains_key(&entry),
+            "entry must have a state"
+        );
+        assert!(
+            result.states.contains_key(&reachable),
+            "reachable node must have a state"
+        );
+        assert!(
+            !result.states.contains_key(&orphan),
+            "orphan island must NOT receive any state"
+        );
+        assert!(
+            !result.states.contains_key(&orphan_exit),
+            "orphan exit must NOT receive any state"
+        );
+    }
+
+    /// A single-node graph (entry only, no edges) is the minimal case.
+    /// The engine must terminate immediately, mark converged, and leave
+    /// the entry's initial state untouched.
+    #[test]
+    fn single_node_graph_terminates_immediately() {
+        use crate::state::domain::ProductState;
+
+        let mut cfg: Cfg = Graph::new();
+        let entry = cfg.add_node(make_node(StmtKind::Entry));
+
+        let interner = SymbolInterner::from_cfg(&cfg);
+        let transfer = DefaultTransfer {
+            lang: Lang::C,
+            resource_pairs: rules::resource_pairs(Lang::C),
+            interner: &interner,
+            resource_method_summaries: &[],
+            ptr_proxy_hints: None,
+        };
+
+        let result = run_forward(&cfg, entry, &transfer, ProductState::initial());
+        assert!(result.converged);
+        assert!(
+            result.states.contains_key(&entry),
+            "single-node graph still seeds the entry state"
+        );
+    }
+
+    /// Self-loop on a single node: `entry → A → A → … → exit`. The
+    /// worklist must not livelock — once A's state is stable, the
+    /// back-edge stops re-enqueueing it.
+    #[test]
+    fn self_loop_terminates() {
+        use crate::state::domain::ProductState;
+
+        let mut cfg: Cfg = Graph::new();
+        let entry = cfg.add_node(make_node(StmtKind::Entry));
+        let a = cfg.add_node(make_node(StmtKind::Seq));
+        let exit = cfg.add_node(make_node(StmtKind::Exit));
+
+        cfg.add_edge(entry, a, EdgeKind::Seq);
+        cfg.add_edge(a, a, EdgeKind::Back); // self-loop
+        cfg.add_edge(a, exit, EdgeKind::Seq);
+
+        let interner = SymbolInterner::from_cfg(&cfg);
+        let transfer = DefaultTransfer {
+            lang: Lang::C,
+            resource_pairs: rules::resource_pairs(Lang::C),
+            interner: &interner,
+            resource_method_summaries: &[],
+            ptr_proxy_hints: None,
+        };
+
+        let result = run_forward(&cfg, entry, &transfer, ProductState::initial());
+        assert!(result.converged, "self-loop must converge");
+        assert!(result.states.contains_key(&exit));
+    }
+
+    /// Irreducible CFG: two distinct paths from entry both enter the
+    /// same loop body, so the loop has multiple "entry points". This
+    /// is the classic shape that breaks structured-loop assumptions
+    /// (e.g., "every loop has a unique header"). The forward worklist
+    /// must still terminate.
+    ///
+    /// Shape:
+    ///     entry → a ─┐
+    ///                ├→ loop_body ─→ exit
+    ///     entry → b ─┘     ↑
+    ///                      └─ back-edge from loop_body to itself
+    #[test]
+    fn irreducible_cfg_terminates() {
+        use crate::state::domain::ProductState;
+
+        let mut cfg: Cfg = Graph::new();
+        let entry = cfg.add_node(make_node(StmtKind::Entry));
+        let a = cfg.add_node(make_node(StmtKind::Seq));
+        let b = cfg.add_node(make_node(StmtKind::Seq));
+        let loop_body = cfg.add_node(make_node(StmtKind::Loop));
+        let exit = cfg.add_node(make_node(StmtKind::Exit));
+
+        cfg.add_edge(entry, a, EdgeKind::Seq);
+        cfg.add_edge(entry, b, EdgeKind::Seq);
+        cfg.add_edge(a, loop_body, EdgeKind::Seq);
+        cfg.add_edge(b, loop_body, EdgeKind::Seq);
+        cfg.add_edge(loop_body, loop_body, EdgeKind::Back);
+        cfg.add_edge(loop_body, exit, EdgeKind::Seq);
+
+        let interner = SymbolInterner::from_cfg(&cfg);
+        let transfer = DefaultTransfer {
+            lang: Lang::C,
+            resource_pairs: rules::resource_pairs(Lang::C),
+            interner: &interner,
+            resource_method_summaries: &[],
+            ptr_proxy_hints: None,
+        };
+
+        let result = run_forward(&cfg, entry, &transfer, ProductState::initial());
+        assert!(
+            result.converged,
+            "irreducible CFG must still converge under run_forward"
+        );
+        // Every reachable node must have a state.
+        for n in [entry, a, b, loop_body, exit] {
+            assert!(result.states.contains_key(&n), "node {n:?} must be visited");
+        }
+    }
 }