fix(analysis)!: scope call-graph caveats to their observed relationships

Return deduplicated execution caveats once and preserve provider-owned relationship diagnostics and completeness on graph nodes. Keep complete relationship reads exhaustive despite contextual caveats, including portable call-path reconstruction.

Preserve omitted diagnostic fields in historical Evidence and bind reported diagnostics into semantic identity. Revise graph workflow and Ghidra adapter profiles so old cached representations cannot replay under the new contracts.

Remove stale duplicate-lookup test claims and redundant fixture validation. Prune million-entry duplicate cases while retaining argument-stack and deep-chain regressions; bounded Flameox captures identified validation and canonical hashing costs.

Validation: static and architecture checks, generated docs, 364 focused tests before pruning, 21 call-path tests after pruning, public MCP schema validation and targeted profile tests. Real engine behavior was not locally exercised.

BREAKING CHANGE: get_call_graph normalized_result now contains { graph, limitations }; traversal-depth groups are under graph.

src/application/binary/AnalysisSnapshotCache.test.ts

@@ -14,6 +14,7 @@ import {
   createAnalysisSnapshotWorkflowEntry,
   parseAnalysisSnapshot,
   serializeAnalysisSnapshot,
+  snapshotEvidenceForQuery,
   snapshotBinding,
   snapshotTarget,
 } from "../../domain/analysisSnapshot.js";
@@ -30,6 +31,7 @@ import {
   SNAPSHOT_CACHE_ENTRY_CEILING,
   isSnapshotCacheable,
 } from "./AnalysisSnapshotCache.js";
+import { enhancedOutputSchemas } from "../../contracts/toolOutputSchemaGroups.js";
 
 it("exports independent nested query, workflow and Evidence payloads", () => {
   const cache = new AnalysisSnapshotCache();
@@ -505,7 +507,10 @@ describe("relationship coverage snapshot replay", () => {
     const cache = new AnalysisSnapshotCache();
     const operation = "procedure_callees" as const;
     const parameters = { procedure: "0x1000", document: "fixture" };
-    const coverage = { status: "complete" as const };
+    const coverage = {
+      status: "complete" as const,
+      diagnostics: ["The provider retained an unresolved call target."],
+    };
     const execution = createAnalysisExecution(
       ["0x2000"],
       ANALYSIS_SNAPSHOT_PROVIDER,
@@ -561,8 +566,8 @@ describe("relationship coverage snapshot replay", () => {
     const tamperedEntry = tampered.entries[0];
     if (tamperedEntry === undefined) throw new Error("snapshot entry missing");
     tamperedEntry.execution.relationship_coverage = {
-      status: "partial",
-      limitations: ["forged coverage"],
+      status: "complete",
+      diagnostics: ["forged coverage"],
     };
     expect(
       new AnalysisSnapshotCache().import(tampered, undefined, () => ok(0)).ok,
@@ -601,3 +606,58 @@ describe("relationship coverage snapshot replay", () => {
     });
   });
 });
+
+it("does not replay pre-envelope call graphs under the revised workflow profile", () => {
+  const cache = new AnalysisSnapshotCache();
+  const target = ANALYSIS_SNAPSHOT_TARGET;
+  const profile = ANALYSIS_SNAPSHOT_PROFILE;
+  const operation = "get_call_graph" as const;
+  const parameters = { address: "0x1000", direction: "forward" };
+  const oldProfile = workflowAnalysisProfile(profile);
+  const revisedProfile = workflowAnalysisProfile(profile, operation);
+  const oldResult = { "0": [] };
+  cache.recordWorkflow({
+    target,
+    profile,
+    operation,
+    parameters,
+    execution: {
+      ...createAnalysisExecution(oldResult, REA_WORKFLOW_PROVIDER, {
+        subject: target,
+        rawResult: oldResult,
+      }),
+      analysisProfile: oldProfile,
+    },
+  });
+  const evidence = createEvidence(target, REA_WORKFLOW_PROVIDER, {
+    operation,
+    confidence: "derived",
+    parameters,
+    result: oldResult,
+    rawResult: oldResult,
+    analysisProfile: oldProfile,
+  });
+  const exported = cache.export(
+    target,
+    profile,
+    createEvidenceBundle([evidence]),
+  );
+  if (!exported.ok) throw exported.error;
+  const snapshot = parseAnalysisSnapshot(exported.value);
+
+  expect(
+    snapshotEvidenceForQuery(snapshot, {
+      target,
+      bindingProfile: profile,
+      operation,
+      parameters,
+      provider: REA_WORKFLOW_PROVIDER,
+      evidenceProfile: revisedProfile,
+    }),
+  ).toBeUndefined();
+  expect(
+    enhancedOutputSchemas.get_call_graph?.safeParse({
+      normalized_result: oldResult,
+    }).success,
+  ).toBe(false);
+});