fix: address 14 analysis and governance review bugs (#48–#61)

[aoto-tech]

Boundary analysis could return success after dropping relevant declarations, loader origins, URL authorities, or resource candidates. Other review findings showed inconsistent ownership, coverage counts, Python resolution, and baseline adoption guidance.

This PR fixes the 14 reviewed cases and adds executable regressions. It remains a draft while the full PR CI, including changed-scope mutation testing and the platform matrix, completes on the latest head.

Issue	Change
#48	Remove exact @internal declaration spans so adjacent public signatures remain in the hash.
#49	Carry the actual createRequire origin through aliases and call/apply forms; unresolved origins fail closed.
#50	Resolve both URL input and base, retaining the destination authority.
#51	Treat more than 16 unique static alternatives as unresolved instead of silently dropping candidates.
#52	Remove unsound resource scan prefilters and cover the Fastify route method vocabulary.
#53	Analyze an explicit head commit in a detached temporary worktree; preserve the caller's checkout and dirt.
#54	Prefer Python packages over same-named modules, checked against Python's runtime.
#55	Report assigned or escaped require loaders as unsupported analysis.
#56	Use owned-path overlap semantics for cell-versus-path reservations.
#57	Apply bare-directory ownership to blast radius, including deleted paths and commit evidence.
#58	Apply governance exclusions to coverage inventory and preserve cell/line attribution.
#59	Document passing resource contracts as a prerequisite for baseline creation.
#60	Read standard-library names from the inspector's isolated Python runtime.
#61	Always compare declared Changed-Cells with actual changed ownership, including empty declarations.

Latest repair — 2026-09-08 JST

Commit ae7ff86e91104210d7dc9e897a60ad997a6c1005 integrates main at ede709489d4930339d7f8740e7f011e4708481a4 and addresses the remaining module-resolution mutation gaps.

• Remove redundant loader-binding recognition and the unused default-binding path without weakening unresolved-loader diagnostics.
• Exercise internal-declaration span removal through actual .ts, .mts, and .cts declaration emission; retain the existing declaration-file regression.
• Assert the complete assigned/escaped-loader diagnostics and the kind/typeOnly metadata of imports resolved from a different createRequire origin.
• Cover ordinary shadowed functions and properties, builtin loader forms, and invalid file URLs.
• Resolve the Python stdlib merge conflict by retaining isolated runtime discovery, which already includes main's tomllib and types additions. Main's regression tests are included and pass.

Verification at the latest repair commit

The isolated verification run checked out and tested the detached commit ae7ff86e91104210d7dc9e897a60ad997a6c1005 before it was fast-forwarded onto this PR. The temporary verification workflow and helper are not part of this PR's tree.

Check	Result
npm test, including build, on Ubuntu / Node 20 / Python 3.12	1,196 passed, 1 skipped, 0 failed. The skipped test requires Windows cmd.exe.
npm run lint	Passed.
npm run typecheck	Passed.
npm run cellfence:self-check	Passed against the unchanged signed baseline.
git diff --check and clean tracked working-tree verification	Passed.
Focused, non-incremental Stryker verification	115 killed, 0 timed out, 0 survived; 100.00%, with the existing break threshold of 100.

The focused mutation result covers requireOrigin, requireBindingForExpression, addUnsupportedRequireWarning, addRequireCallReference, and sourceTextWithoutInternalDeclarations. It is not a whole-module or repository-wide mutation score.

The full PR CI rerun was started on the updated PR head. Its changed-scope mutation result and complete OS/Node matrix were still pending when this verification note was written; the focused result above does not replace those checks.

Regression checks also exercise Node/Python runtime resolution, URL authority, the 16/17 candidate boundary, caller worktree preservation, claims, coverage exclusions, dependency ratchets, and empty Changed-Cells.

Public-surface compatibility

The import origin is internal analysis metadata, and the hashing helper is internal to the module. Keeping those implementation details out of the public declarations resolved the initial signature mismatch. The accepted signed baseline, signing key, verification policy, fixture outcomes, and mutation thresholds remain unchanged; baseline migration is not required by the current self-check.

Python 3.10+ supplies complete stdlib metadata; older runtimes without it recognize builtin modules conservatively. Resource candidate overflow and unsupported loader flow produce unresolved findings instead of a partial success.

Closes #48
Closes #49
Closes #50
Closes #51
Closes #52
Closes #53
Closes #54
Closes #55
Closes #56
Closes #57
Closes #58
Closes #59
Closes #60
Closes #61

[aoto-tech]

@pushnanashi2 Leaving this draft unmerged for now. It is behind main and not currently closeable: self-check, cross-platform smoke (windows-latest, node 22), and ci-counts failed on the latest run, and mutation evidence was still incomplete at review time. GitHub does not allow me to submit a Changes requested review on my own PR, so I am recording the blocker here instead.