# TraceFlow Static Scanner First Patch

This is a limited static scanner patch, not a complete PHP parser.
It never executes application code or sources .env files.

## Included changes

- Supported local constant and variable path assignments.
- __DIR__, __FILE__, DIRECTORY_SEPARATOR, and dirname() expressions.
- Source line metadata and source-reference ordering.
- Visible unresolved expressions in tree output.
- Comment filtering and collision-free outside-root file identifiers.

## Validation performed

Python compilation and a focused PHP fixture passed. The fixture checks
comment exclusion, local constants, variable concatenation, source lines,
and unresolved expressions in tree output.

The full existing suite and real applications require local validation.

## Known limitations

This patch uses lightweight text parsing. It is not a PHP control-flow,
function-scope, or template-execution analyzer. Heredocs, complex escaped
strings, conditional assignments, and dynamic loaders need further work.

Values assigned inside functions are not a reliable global configuration.
Configured pageSetup entries are not automatically treated as includes.
Dynamic HTML asset expressions and helper-generated URLs remain unsupported.
External URLs are still omitted by the inherited scanner.
.env loading, explicit URL mappings, and full scope analysis are not added.

## Run

```bash
bash tests/run-tests.sh
bash run.static.sh defapp
```

Use the existing scan command for JSON or flat text output.
Report unresolved expressions and incorrect relationships with source lines.