Complete freshness dependencies and honest scan state (v0.6.0)

[Shakargy]

Why

v0.5.1 fixed results that were wrong. This fixes results that were stale while claiming to be current - the same failure wearing a timestamp.

All four problems were reproduced against v0.5.1 before being changed:

Reproduction	Before	After
Edit the test that justified a route association	FRESH	STALE, names the test
Delete an evidence file	FRESH (old files row still matched)	STALE, names the file
Add a new route to a set-level claim	FRESH	STALE (inventory changed)
Edit source, run dtc verify without rescanning	silent, fresh timestamp	explicit stale-scan warning

What changed

Dependencies are separate from displayed evidence. Verification was fingerprinting the bounded list shown to a user and treating it as the invalidation set. Results now record a complete dependency set - handler files, tests, guards, helpers - plus a fingerprint of the claim's surface, so adding a route invalidates a claim about "all routes" even though no recorded file changed. A result that recorded nothing is NEEDS_VERIFICATION, never assumed fresh. Unrelated edits still change nothing.

dtc verify reports which snapshot it used. A bounded, read-only comparison against the working tree, surfaced before any result, in JSON as evidence_snapshot, and in MCP as an explicit staleness_warning - agents can't see your files, so they must be told.

Request-based association restores usefulness legitimately. Tests that request the exact route path (supertest, FastAPI TestClient) now count, alongside imports. Method identity holds: requesting GET /users establishes nothing about POST /users. Name similarity is still only a suggestion.

Unresolved is not untested. Routes declared against an unresolved router mount prefix are reported as unresolved with the reason - that gap belongs to DevTime, not the repository. On the FastAPI template this correctly separates 10 unresolvable routes from 13 genuinely unassociated ones.

Migration

verifications gains inventory_fingerprint via an idempotent ALTER. Verified against a simulated pre-v0.6.0 database. Pre-existing rows keep NULL and get re-verified rather than assumed fresh. Decisions and scan history untouched. JSON stays schema_version: 2 (additive fields only).

Verification

• 173 tests (16 new), including every reproduction plus: empty dependency set, idempotent migration, stale CLI output, stale MCP disclosure, supertest and TestClient association, method separation, and cache.get("users") not being mistaken for an HTTP request.
• Real repos re-checked (Express, FastAPI template); build + twine clean.

Version 0.6.0. No tag, no publish - awaiting approval.