fix(enrichment): include changed-file usage in dead-export scan (#1509)

[tmimmanuel]

Summary

• Add new REES analyzer callerImpact to detect cross-file caller-impact for export-surface changes and dead new exports.
• Register analyzer in registry with runtime limits, docs and brief rendering.
• Add analyzer metadata and update UI analyzer catalog/docs.
• Add focused tests covering changed/removed/renamed/dead export scenarios and missing-context behavior.

Validation

• cd review-enrichment && npm run build
• cd review-enrichment && npm test -- --runInBand caller-impact.test.ts analyzer-registry.test.ts

Closes #1509

[loopover-orb]

Caution

🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥

🛑 Gittensory review result - reject/close recommended

_{Review updated: 2026-06-30 19:06:18 UTC}

10 files · 1 AI reviewer · 1 blocker · readiness 55/100 · CI green · dirty

🛑 Suggested Action - Reject/Close

• AI reviewers agree on a likely critical defect: review-enrichment/src/analyzers/caller-impact.ts:257 and review-enrichment/src/analyzers/caller-impact.ts:461 make GitHub search/content failures indistinguishable from a successful zero-hit search, so a transient 403/timeout can report a new export as dead even when unchanged files still reference it
• return an explicit unknown/failure state and suppress dead findings unless every searched path was verified. — Resolve the flagged defect, or override if the AI reviewers are mistaken, then re-run the gate.

Review summary
This PR wires a new caller-impact analyzer through registry metadata, rendering, docs, and focused tests, but the analyzer currently treats absence of evidence as evidence of no callers and can emit incorrect findings on reachable GitHub API failure paths. The core implementation also conflates exported declaration names with public export names and uses plain identifier presence as a caller signal, so the visible diff is not reliable enough to ship as an analyzer that feeds review context. The registration and metadata plumbing are coherent, but the source-tracing layer needs to fail closed and distinguish real import/call relationships from symbol text hits.

Blockers

• review-enrichment/src/analyzers/caller-impact.ts:257 and review-enrichment/src/analyzers/caller-impact.ts:461 make GitHub search/content failures indistinguishable from a successful zero-hit search, so a transient 403/timeout can report a new export as dead even when unchanged files still reference it; return an explicit unknown/failure state and suppress dead findings unless every searched path was verified.
• review-enrichment/src/analyzers/caller-impact.ts:123 parses `export default function Foo` and `export default class Foo` as a public export named `Foo`, but consumers import default exports under arbitrary local names, so changed or added default exports will be searched and reported under the wrong symbol; skip default declarations or model the exported surface as `default` with import-source-aware lookup.
• review-enrichment/src/analyzers/caller-impact.ts:313 treats any identifier-boundary text match as a live caller, including comments, local declarations, properties, or imports from unrelated modules, so common exported names will produce false caller-impact findings; verify the file imports/re-exports the changed module path before counting it as a caller.

Nits — 6 non-blocking

• nit: review-enrichment/src/analyzers/caller-impact.ts:391 includes `removedBySymbol.get(symbol)?.length === 0` while iterating `removedBySymbol`, which is redundant and makes the candidate filter harder to audit.
• nit: review-enrichment/src/analyzers/registry.ts:238 and review-enrichment/README.md:39 say dead exports have no callsites outside changed files, but the implementation intentionally counts same-PR and same-file references for dead detection; align the wording with the actual behavior or change the behavior.
• nit: review-enrichment/test/caller-impact.test.ts:103 has the assertion block indented two spaces deeper than the surrounding test body.
• Change `searchUsages`/`readFileContainsSymbol` to return a tri-state result and make `scanCallerImpact` report `dead` only when search succeeded and all candidate content fetches were checked.
• Add tests for named default exports and for a simulated GitHub search failure on a new export that has an unchanged caller.
• Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.

Why this is blocked

• review-enrichment/src/analyzers/caller-impact.ts:257 and review-enrichment/src/analyzers/caller-impact.ts:461 make GitHub search/content failures indistinguishable from a successful zero-hit search, so a transient 403/timeout can report a new export as dead even when unchanged files still reference it; return an explicit unknown/failure state and suppress dead findings unless every searched path was verified.

Signal	Result	Evidence
Code review	❌ 1 blocker	1 reviewer
Linked issue	✅ Linked	#1509
Related work	⚠️ 3 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (size label size:XL; 1 linked issue).
Validation posture	❌ 5/25	Preflight is holding this PR; address the blocker before review.
Contributor workload	✅ 10/10	Author activity: 51 registered-repo PR(s), 19 merged, 35 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	tmimmanuel; Gittensor profile; 51 PR(s), 35 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.

Review context

• Author: tmimmanuel
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 51 PR(s), 35 issue(s).
• Related work: Items reference the same linked issue feat(enrichment): Cross-file caller-impact / dead-symbol analyzer #1509. (issue #1509)
• Related work: Open PR work references issue feat(enrichment): Cross-file caller-impact / dead-symbol analyzer #1509. (issue #1509)
• Related work: Titles/paths share 5 meaningful terms. (issue #1509, PR #1882)

Contributor next steps

• Review top overlaps.
• Add a concise scope and risk note.
• Fix the blocker.
• Triage stale or unlinked PRs.
• Refresh registry data or choose a registered active repo.
• Check active issues and PRs before submitting.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[JSONbored]

Merge conflicts:

This branch has conflicts that must be resolved
Use the [web editor](https://github.com/JSONbored/gittensory/pull/1870/conflicts) or the command line to resolve conflicts before continuing.

.env.example