From f265140935c5f0bc6010482cb938c98a3475cc76 Mon Sep 17 00:00:00 2001
From: pitboss <pitboss@local>
Date: Fri, 22 May 2026 06:19:02 -0500
Subject: [PATCH] [pitboss/grind] cleanup session-0020 (20260522T043516Z-29b8)

---
 docs/cli.md     | 20 ++++++++++++++++++++
 src/database.rs |  9 +++++----
 2 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/docs/cli.md b/docs/cli.md
index fb03c421..9cb27738 100644
--- a/docs/cli.md
+++ b/docs/cli.md
@@ -289,6 +289,26 @@ Pipe `dot` output through `dot -Tsvg` for a renderable graph, or use `--format s
 
 ---
 
+## `nyx serve`
+
+Start the local browser UI for browsing scan results.
+
+```
+nyx serve [PATH] [OPTIONS]
+```
+
+**PATH** defaults to `.` (current directory). The server binds to a loopback address only and refuses non-loopback hosts at startup.
+
+| Flag | Default | Description |
+|------|---------|-------------|
+| `-p, --port <PORT>` | *(from config)* | Port to bind to (overrides `[server].port`) |
+| `--host <HOST>` | *(from config)* | Host to bind to (overrides `[server].host`) |
+| `--no-browser` | off | Skip opening the browser automatically |
+
+See [serve.md](serve.md) for the UI tour, route map, and CSRF / host-header behaviour.
+
+---
+
 ## `nyx verify-feedback`
 
 Record a correction or confirmation against a dynamic-verifier verdict. Requires `--features dynamic`.
diff --git a/src/database.rs b/src/database.rs
index b056faf8..81c6e1ae 100644
--- a/src/database.rs
+++ b/src/database.rs
@@ -783,7 +783,9 @@ pub mod index {
         ///
         /// Short-circuits on mtime: if the stored mtime matches the
         /// filesystem mtime, the file is assumed unchanged (skip hash).
-        #[allow(dead_code)] // used in tests and by should_scan_with_hash callers may fall back
+        /// Production scans use `should_scan_with_hash`, which avoids the
+        /// redundant `digest_file` read; this variant exists for tests.
+        #[cfg(test)]
         pub fn should_scan(&self, path: &Path) -> NyxResult<bool> {
             let meta = fs::metadata(path)?;
             let mtime = meta.modified()?.duration_since(UNIX_EPOCH)?.as_secs() as i64;
@@ -2311,7 +2313,6 @@ pub mod index {
 
         /// Set the triage state for a single finding. Upserts the state and
         /// appends an audit log entry. Returns the previous state (or "open").
-        #[allow(dead_code)]
         pub fn set_triage_state(
             &self,
             fingerprint: &str,
@@ -2700,7 +2701,7 @@ pub mod index {
         // -------------------------------------------------------------------------
         // Helpers
         // -------------------------------------------------------------------------
-        #[allow(dead_code)] // used by should_scan() and tests
+        #[cfg(test)]
         fn digest_file(path: &Path) -> NyxResult<Vec<u8>> {
             let mut hasher = blake3::Hasher::new();
             let mut file = fs::File::open(path)?;
@@ -3204,7 +3205,7 @@ fn clear_drops_ssa_summaries_table() {
 // ── CalleeSsaBody persistence tests ──────────────────────────────────────
 
 /// Helper: build a minimal CalleeSsaBody for DB tests.
-#[allow(dead_code)] // used by tests below
+#[cfg(test)]
 fn make_test_callee_body(
     num_blocks: usize,
     param_count: usize,