perf(scan): parse/read files once, parallelize sections, scope cache

[alxxjohn]

Summary

Cuts redundant work in the scan engine and fixes a latent clone-cache correctness bug. From a performance audit of the scan hot path.

• Walk/read/parse each file once per scan — new shared fileCorpus (runner/support/corpus.go) memoizes the per-target walk, file reads, and Go AST parses. quality and design now reuse one AST via support.ParseGoSource instead of re-parsing the same file. Taint/graph parsers keep their cheaper parse modes and are left untouched.
• Parallel sections — enabled sections run on a NumCPU-bounded worker pool with deterministic, position-indexed result ordering. ScanCache and ArtifactStore are now mutex-guarded and OnSectionComplete is serialized. Section-level (not file-level) parallelism was chosen deliberately: some evaluators mutate closure state and are only safe within a serial section.
• Per-section cache fingerprints — the per-file cache key is now scoped to the config family that actually affects a section's findings (cache version bumped 6→7). Editing an unrelated field (output format, target names, excludes) no longer invalidates the whole cache. Unknown section IDs fall back to an all-checks hash, so a new section can never silently serve stale entries.
• Clone detection O(C²) → bucketed — candidates are partitioned by (LeftDoc, RightDoc) so the overlap merge scans only that file-pair's bucket; document paths are slash-normalized once instead of per comparator call.
• Regex memoization — dynamically compiled TypeScript security regexes are cached in a sync.Map and reused across files.

Bug fixed

Clone detection built its document list via a closure side-effect and returned nil, but ScanTargetFiles skips the evaluator on a cache hit — so all quality.duplicate-code findings silently disappeared on any second scan with a warm cache (confirmed against the original code: cold=6 clones, warm=0). Fixed by routing clone doc-collection through VisitTargetFiles, which bypasses the findings cache.

Verification

• go build / go vet / gofmt clean; golangci-lint: 0 issues (CI gate).
• Full test suite passes with -race — no data races in the new concurrent path.
• Cold and warm scans are byte-identical (deterministic output).
• Interleaved benchmarks: ~1.2× faster on ~500 files, ~1.7× faster on ~1,400 files. Tradeoff: higher peak memory (~61 MB vs ~4 MB) from the retained corpus.
• Added one waiver for unbounded-goroutines-in-loop on the worker pool (true false positive — goroutines are semaphore-bounded) to keep the repo's own CI self-scan clean.

Notes

Also updated .claude/knowledge/architecture-boundaries.md with the pure-evaluator cache constraint, the new concurrency model, and the per-section fingerprint scheme.

🤖 Generated with Claude Code