Claude Deep Review raised 7 findings on the IncludeExtractor. #1/#2
(BLOCKERs) were fixed earlier. This commit closes the remaining five.
#3 HIGH case-sensitive FS -> provider contract-id collision
Document the deliberate case-folding trade-off on normalizeIncludePath
(matches C/C++ convention on Windows/macOS; collapses Foo.h & foo.h on
Linux). Add a unit test pinning the behavior.
#4 HIGH suffixResolve short-suffix match silently drops cross-repo include
When a local file ends with the same basename as an external include
(e.g. local internal/api.h vs. #include "ext/api.h"), suffixResolve
returned a bogus local hit and suppressed the cross-repo consumer.
Replace the suffixResolve lookup inside include-extractor with a
strict isLocalInclude() that only accepts full-path hits via
SuffixIndex.get / getInsensitive. Callers of suffixResolve elsewhere
are unaffected. Add 3 unit tests covering the regression.
#5 MEDIUM regex fallback matched #include inside /* ... */
Strip block comments before running the fallback regex scan.
Add a unit test.
#6 MEDIUM meta.source was hard-coded to 'tree_sitter'
Track the actual extraction path with an extractionSource local and
write it into meta.source so downstream audits can distinguish
tree-sitter parses from regex fallbacks. Add 2 unit tests.
#7 MEDIUM missing end-to-end coverage
Add test/integration/group/include-extractor-sync.test.ts with 3
cases exercising extractor -> syncGroup -> CrossLink (mocked
contracts, mixed-case/backslash normalization, real temp repos).
Tests: 21 unit + 3 integration, all green.
