feat(core): schema v2 — instance nodes, evidence, confidence, query envelopes

[officialCodeWork]

Summary

TRACKER Step 0.1 — the schema rework everything else builds on. Fixes the v0.1 design flaw where the graph only had definition nodes, which makes per-call-site API attribution (failure mode C1, the headline case) structurally impossible.

Changes

• InstanceNode — a component as rendered at one call site (instance:<file>:<line>#<Name>), with staticProps captured. Parser emits one per project-component JSX usage, wired owner --renders--> instance --instance-of--> definition. parentInstanceId stays null until the Phase 2.1 cross-file instance tree.
• QueryResult envelope — no query API returns a bare value anymore (D2). Every answer is ranked candidates with Evidence[] + Confidence, or an honest ambiguous (with a generated disambiguation question) / declined (with a machine-readable reason).
  • matchComponentsByText: ties → ambiguous, no hits → declined("no-signal")
  • traceLineage: accepts definition or instance ids, walks through instances, declined("not-found"/"invalid-target") on bad targets
• EdgeCondition (flag/role/branch/response) and via on edges (B5/G5 foundations); GraphMeta stub for SHA tagging (0.3); graph version: 2.
• vitest wired into core + parser-react.

Acceptance criteria (from TRACKER 0.1)

• Unit tests for id construction + envelope invariants — 12 tests in core
• Parser emits instance nodes per project-component JSX usage — 6 tests in parser-react
• Demo-app scan shows UserCard: 1 definition + 1 instance (rendered by UserList)
• matchComponentsByText / traceLineage return QueryResult envelopes

Test plan

• pnpm build green (strict TS, all packages)
• pnpm test — 18/18 passing
• CLI verified end to end on the demo app (scan → find → trace; find now prints confidence + instance call sites)

Documentation

• TRACKER.md — 0.1 marked done, Status block advanced to 0.2

🤖 Generated with Claude Code