feat(index): Sonar cognitive complexity column and recipes

Add symbols.cognitive_complexity in the same oxc walk as cyclomatic,
including class methods. Ship high-cognitive-complexity (min_score 15)
and extend high-complexity-untested SELECT. Schema v38; plan deleted.

Author: SutuSebastian

.changeset/cognitive-complexity.md

@@ -0,0 +1,5 @@
+---
+"@stainless-code/codemap": patch
+---
+
+Add SonarSource cognitive complexity on `symbols` (same function-shaped coverage as cyclomatic, including class methods). New recipe `high-cognitive-complexity`; `high-complexity-untested` rows include `cognitive_complexity`.

docs/architecture.md

@@ -137,7 +137,11 @@ React components (PascalCase + JSX return or hook usage). PascalCase functions t
 
 ### `symbols.complexity` / cyclomatic complexity / McCabe
 
-Per-function decision-point count (REAL column on `symbols`). Computed by the parser walker (`src/parser.ts`) per the McCabe formula: `1 + (decision points)`. Counted nodes: `if`, `while`, `do…while`, `for`, `for…in`, `for…of`, `case X:` (not `default:` — that's the fall-through arm, not a decision), `&&`, `||`, `??`, `?:`, `catch`. Function-shaped symbols only — non-functions (interfaces, types, enums, plain consts) and class methods get `complexity = NULL` (v1 limitation; class methods tracked under `high-complexity-untested.md`). Joins to `coverage` via `(file_path, name, line_start)` natural key for the bundled `high-complexity-untested` recipe (complexity ≥ 10 ⨯ coverage < 50%).
+Per-function decision-point count (REAL column on `symbols`). Computed by the parser walker per the McCabe formula: `1 + (decision points)`. Counted nodes: `if`, `while`, `do…while`, `for`, `for…in`, `for…of`, `case X:` (not `default:`), `&&`, `||`, `??`, `?:`, `catch`. Function-shaped symbols only (top-level `function`, named arrow/const, class methods); non-functions get `complexity = NULL`. Joins to `coverage` for `high-complexity-untested` (cyclomatic ≥ 10 ⨯ coverage < 50%). See also [`symbols.cognitive_complexity`](#symbolscognitive_complexity--cognitive-complexity).
+
+### `symbols.cognitive_complexity` / cognitive complexity
+
+SonarSource cognitive complexity (INTEGER on `symbols`) for the same function-shaped symbols as cyclomatic `complexity`. Penalizes nested control flow; same oxc walk as McCabe (`src/extractors/complexity.ts`). Recipes: `high-cognitive-complexity` (`min_score` default 15); `high-complexity-untested` includes the column while filtering on cyclomatic `complexity`.
 
 ### `source_fts` (FTS5 virtual table) / `--with-fts` / opt-in full-text
 

docs/glossary.md

@@ -147,5 +147,5 @@ Register golden scenario per [`docs/golden-queries.md`](../golden-queries.md); g
 ## Dependencies
 
 - Shipped: `symbols` extraction, `hashContent`, recipe loader
-- Independent of [churn-complexity-hotspots](./churn-complexity-hotspots.md), [cognitive-complexity](./cognitive-complexity.md)
+- Independent of [churn-complexity-hotspots](./churn-complexity-hotspots.md), [`symbols.cognitive_complexity`](../glossary.md#symbolscognitive_complexity--cognitive-complexity)
 - Supersedes motivation for suffix-array semantic dupes (stay deferred)

docs/plans/ast-hash-duplication.md

@@ -125,5 +125,5 @@ bun test scripts/query-golden-coverage-matrix.test.mjs   # after golden scenario
 ## Dependencies
 
 - Shipped: `symbols.complexity`, `coverage`, `dependencies`, `calls`, `references`, `test_suites`, `affected-tests` glob conventions
-- Synergy: [cognitive-complexity](./cognitive-complexity.md) (optional second axis in same recipe later); [coverage-deletion-confidence](./coverage-deletion-confidence.md) (opposite signal — dead + zero coverage)
+- Synergy: [`symbols.cognitive_complexity`](../glossary.md#symbolscognitive_complexity--cognitive-complexity) (optional second axis in same recipe later); [coverage-deletion-confidence](./coverage-deletion-confidence.md) (opposite signal — dead + zero coverage)
 - Weaker until: [c9-plugin-layer](./c9-plugin-layer.md) (framework test files may be misclassified)

docs/plans/cognitive-complexity.md

@@ -111,7 +111,6 @@ Predicate-as-API only — enrich row shape and audit deltas; no standalone pass/
 - [ ] **`history` table** (deferred — revisit-triggered) — temporal queries: "when did symbol X get `@deprecated`?", "coverage trend over last 50 commits", "files that became dead this week". `audit --base <ref>` covers the most-common temporal question (PR-scoped diff) without schema growth, so the table earns its place only when bigger questions emerge. Two shapes (per-commit snapshots ~N × DB size; append-only event log heavier CTE walks); both pay an N-reindexes backfill cost (~30s per reindex). **Revisit triggers:** two consumers ship `jq`-based "audit-runs-over-time" workflows, OR `query_baselines` evolution becomes a recurring agent need.
 - [ ] **`codemap audit` verdict + thresholds** (v1.x) — `verdict: "pass" | "warn" | "fail"` driven by an `audit.deltas[<key>].{added_max, action}` field on the config object (`.codemap/config.{ts,js,json}`). Triggers: two consumers ship `jq`-based threshold scripts with similar shapes, OR one consumer asks with a concrete config sketch. Until then, raw deltas + consumer-side `jq` is the CI exit-code idiom. **Likely accelerant:** the Marketplace Action (next item) shipping is the most plausible path to firing the trigger — once `- uses: stainless-code/codemap@v1` is the dominant CI path, real `jq` threshold scripts will surface.
 - [ ] **GitHub Marketplace Action — publish + listing finish** — core Action implementation is in-tree: root `action.yml`, `query --ci`, `audit --format sarif` / `--ci`, package-manager detection, dogfood smoke, and opt-in `pr-comment` summary renderer have shipped. Remaining work is the release/listing slice: `MARKETPLACE.md`, `v1.0.0` / floating `v1` tags, Marketplace setup, sacrificial-repo smoke, and making `action-smoke` blocking once the Action tag exists. Action version stream is independent of CLI version (`package.json` currently drives CLI/npm version; Action publishes at its own `v1.0.0`). Plan: [`plans/github-marketplace-action.md`](./plans/github-marketplace-action.md). Effort: S.
-- [ ] **Cognitive complexity column** — `symbols.cognitive_complexity` (SonarSource rules) alongside cyclomatic `complexity` in the same oxc walk; recipe `high-cognitive-complexity`. Improves refactor-priority JOINs with coverage/churn recipes. Plan: [`plans/cognitive-complexity.md`](./plans/cognitive-complexity.md). Effort: M.
 - [ ] **Churn × complexity hotspots** — `file_churn` table (git `log --numstat` over indexed paths, recency-weighted commits, optional trend) + bundled recipe **`churn-complexity-hotspots`** JOINing `symbols.complexity` for ranked refactor targets. Distinct from outcome alias `hotspots` → `fan-in`. Score is a recipe column, not a verdict ([Moat A](./roadmap.md#moats-load-bearing)). Plan: [`plans/churn-complexity-hotspots.md`](./plans/churn-complexity-hotspots.md). Effort: L–M.
 - [ ] **AST-hash duplication** — `symbols.body_hash` column (normalized AST hash via oxc, computed at parse time — Rust-native, fast) + bundled `duplicates` recipe joining on `body_hash` (`GROUP BY body_hash HAVING COUNT(*) > 1`). **Different shape from token-level suffix-array dupes** (catches structurally-identical functions, not copy-paste with renamed variables). Substrate addition — consumer writes the JOIN that decides "this is a problem"; no severity, no suppression-by-default. Plan: [`plans/ast-hash-duplication.md`](./plans/ast-hash-duplication.md). Effort: M.
 - [ ] **Falsifiable benchmark CI on named external fixtures** — structural-cost A/B (indexed queries vs `find` + `grep` + `Read`-loop discovery) on zod, fastify, vue-core, next.js. Numbers land in [`docs/benchmark.md`](./benchmark.md); headline figures surface in `MARKETPLACE.md` only after external runs land. Harness: [benchmark § Agent eval harness](./benchmark.md#agent-eval-harness) + external fixture extension; pair with **Agent eval: quality × tokens × wall** for scored completion metrics. **Partial:** manual [`.github/workflows/agent-eval-external.yml`](../.github/workflows/agent-eval-external.yml) for in-repo fixture paths (not zod/fastify/nightly). Effort: M. **Self-index regression guardrail shipped** (#96): `bun run check:perf-baseline` + weekly scheduled workflow (demoted from PR hard gate — GHA runner variance).

docs/plans/graph-estimated-crap.md

@@ -0,0 +1,12 @@
+[
+  {
+    "name": "labyrinth",
+    "kind": "function",
+    "file_path": "src/lib/complexity-fixture.ts",
+    "line_start": 22,
+    "line_end": 83,
+    "cognitive_complexity": 40,
+    "complexity": 19,
+    "nesting_depth": 5
+  }
+]

docs/roadmap.md

@@ -6,6 +6,7 @@
     "line_start": 22,
     "line_end": 83,
     "complexity": 19,
+    "cognitive_complexity": 40,
     "coverage_pct": 0
   }
 ]

fixtures/golden/minimal/high-cognitive-complexity.json

@@ -452,6 +452,11 @@
       "prompt": "Functions with nesting_depth >= 4, ranked by depth/complexity.",
       "recipe": "deeply-nested-functions"
     },
+    {
+      "id": "high-cognitive-complexity",
+      "prompt": "Functions with cognitive complexity >= default threshold (15).",
+      "recipe": "high-cognitive-complexity"
+    },
     {
       "id": "circular-imports",
       "prompt": "Files in import cycles (SCCs of size >= 2) via Tarjan.",