fix(analyzer): stabilize TM1 window identity

[chrisknvidia]

Summary

• reconcile lexical and AST-owned TM1 findings across bounded and cross-window views
• derive stable fingerprints from the full normalized call while keeping public evidence bounded
• retain the true source-order prefix under output caps across ordinary, direct, bound, normalized, and reconstructed findings
• preserve restored source coordinates and remove private reconciliation evidence from reports

Review context

This is the focused TM1 window/identity follow-up split from #497.

Open stacked dependencies: #576 at fb86cf753c8e4a15cbaca12f39f106bc4a6cf8df and #577 at c3b0ff945013f2cc0eeaeb66515ba099d184478a. Neither dependency has merged. This branch incorporates those exact heads, plus current origin/main at d162d9b343e559be13df8ebba093df3bc9d58c90, through DCO-signed-off merge commits without rewriting the published branch.

The original focused TM1 review range remains:

git diff f2ae98f86b337ca7da07a653db8b6ce37795a8de..d856d88c289c5ef3389060ef69651c9981aae38f

That original range is 5 files (+3,264/-192). The current combined head also contains the dependency fixes and conflict resolutions needed to integrate main's paragraph-aware prose matching, plus DCO-signed-off follow-up 1404c29671c35e48e13f0da2c602d6cf16d4e5af so normalized and declared-marker projections retain the true source prefix under low caps.

Validation at current head

• focused TM1 identity, collision, cross-window, source-order, cap, declared-marker, reconstruction, inherited shell-order, filtering, and security matrix: 1,026 passed
• focused inherited fix(cli): make recursive scans fail closed #576/fix(analyzer): detect bound shell truthiness #577 regression cases: 12 passed
• full configured non-provider suite: 6,193 passed, 14 skipped, 39 deselected, 4 expected xfails
• affected non-live graph integrations: 18 passed
• OpenCode Node runner: 44 passed
• Ruff, formatting, diff checks, and targeted analyzer mypy passed
• installed-wheel JSON and Markdown CLI scans passed for direct, bound, normalized-only, declared-marker, syntax-error Python, and 256 KiB cross-window fixtures
• direct and bound forms produced the same stable fingerprint; colliding long calls retained distinct fingerprints while public matched text stayed at or below 200 characters
• forced low-cap installed-package checks retained the lexical and declared-marker source prefixes, reported partial/output_limit, restored source coordinates, and exposed no private _tm1_ evidence

No live LLM/provider call was run or required: this change is confined to the static analyzer path. The PR remains stacked on open #576/#577 and still requires current-head reviewer approval before merge.

[rng1995]

Reviewed exact draft head d856d88c289c5ef3389060ef69651c9981aae38f. I found no additional blocker in the focused TM1 identity range (f2ae98f..d856d88): 220 focused tests and 392 current-main merged-tree regressions pass, and lint/format/diff checks are clean.

I am requesting changes because the current combined tree still contains both confirmed dependency blockers from #576 and #577. On this exact head, a three-row ledger cap drops the second distinct fatal fact, and shell=enabled still evades TM1 when a later argument expression is effectful. The PR is also still draft and its own review contract requires #576/#577 to land, a rebase onto current main, fresh CI, and current-head review.

Please propagate the dependency fixes and rebase. If the focused range remains semantically unchanged and CI stays green, I found it otherwise suitable for approval.

[chrisknvidia]

@rng1995 The final #577 receiver-invalidation fix is included, the merge conflicts are resolved, and the cap/source-order findings remain fixed. PTAL.

[rng1995]

The focused #578 cap/source-order work looks correct and its prior #576/#577 reproductions now pass, but this stacked head contains the exact #577 receiver-invalidation blocker: an effectful argument after shell= may replace the trusted subprocess receiver, yet later proxy calls are still classified as subprocess and receive false-positive TM1 findings. Please update the stack after #577 clears trusted_names on this effectful path and add the regression. The current head is otherwise conflict-free and its affected/integration suites are clean.

[rng1995]

[SkillSpector Review]

Changes requested on exact head 1c03702961323bd8d322c89928480197282d1d0b for a confirmed remaining issue inherited from #577.

The earlier effectful-argument fix is present: direct subprocess calls now invalidate receiver trust after unsafe arguments, including expression, assignment, and annotated-assignment paths. However, an ordinary effectful function call can still replace the receiver without invalidating that trust; a later call through the replacement object is then reported as HIGH TM1. The inline comment provides the source-traced fixture and expected correction. Please propagate the #577 correction through this stack and cover this case.

Scope: I inspected the prior review history, current dependency fix, receiver-trust collector and both scan passes, its caller integration, tests for the direct-argument correction, and current checks. This is a focused blocking review, not approval or certification of the entire large combined stack. The remaining combined diff still needs complete current-head assessment after the dependency issue is addressed. Six hosted checks pass, but passing checks do not establish this untested receiver semantic.

No contributor-provided code or tests were executed locally.