✨ feat(flow): Graph.build — plan-time expansion of flow bodies

[roninjin10]

Summary

The analysis phase: Graph.build(flow, payload) turns a bodied flow into keyed plan input.

• Bodies evaluate against their real payload; step results are strict Planned placeholders — computation throws GraphBuildError with the node path (PR1's traps, now exercised end-to-end).
• Branch expands both arms as static topology with the digested predicate on the branch node's material — the plan shows the whole choice.
• Inline .call() splices a bodied callee's subgraph (capability intersection); body-less flow calls and activity calls are leaf drafts. Recursive .call() throws recursion_requires_boundary directing to .to()/.child().
• Effects/capabilities/placement read from the PR3 annotation keys into KeyMaterial + NodeEffects.
• Output drafts feed Plan.compile/Plan.append directly — round-trip test proves drafts → keyed Plan with correct dependsOn from Ref/Pending inputs, and that editing a map function's source re-keys exactly the downstream cone.

Two OPEN QUESTION (2026-08-11) markers (deliberate): default boundary mode for nodes without declared effects; nested-branch planned-subject binding.

Depends-on: #183

Verification

• npm run check clean for @smthrs/flow and @smthrs/plan; lint clean for both
• New Graph.test.ts (20) + extended Node.test.ts (15); full suites: flow 15 files / 141 tests, plan 6 files — both at the enforced 100% coverage (independently re-verified)

Decisions taken (were open questions — review these)

1. Default effects for a node that declares none: {reads: [], writes: [], boundaryMode: "expected"} (Graph.ts:200). Rationale: a node that declared nothing claims no path either way; "expected" means runtime deviation is surfaced, not fatal. The "hard" alternative would fail any run whose node touches an undeclared path — the right strictness only after authors actually declare effects routinely. Revisit when effect declarations are pervasive.
2. Nested branch subjects: innermost binding wins (Graph.ts:674). The arm subject is recorded under one Node.branchSubject name, so an arm nested in another branch's arm sees the inner subject — exactly lexical shadowing semantics from ordinary code. Per-branch subject names in the AST were deliberately not added; they buy disambiguation nobody has needed at the cost of AST surface.

[roninjin10]

---

Review round 1 complete (sol + fable, independent). Findings for this PR were fixed and folded into its commit; the full ledger (15 fixes, 6 resolved-as-designed) lives in the stack's review notes. All 14 branches rebased and re-verified: whole-repo check green, all package suites at 100% coverage, rebuilt tip byte-identical to the verified fix tree.

[roninjin10]

---

Swap pass complete — review loop closed. Both seats have now reviewed every PR. Swap findings (6: nested-catch subject scoping, foreign-flow wait tokens, two __proto__ cloner recurrences, drafts-field refusal, re-drive test + lineage-id doc) fixed and folded into owning PRs; tail rebuilt tree-identical; whole-repo check + all suites green at 100% coverage.