fix(scoring): single-source fallbacks from DEFAULT_SCORING_CONSTANTS (Fixes #812)

[bohdansolovie]

Summary

Remove duplicated fallback literals scattered across preview.ts and derive every scoring constant lookup from DEFAULT_SCORING_CONSTANTS in model.ts.

Fixes #812

Problem

Every constant(constants, "KEY", <literal>) call in preview.ts duplicated a value already declared in DEFAULT_SCORING_CONSTANTS. When defaults changed (e.g. #807 MAX_CONTRIBUTION_BONUS 25→5), call-site literals could silently drift. Density-era constants (MIN_TOKEN_SCORE_FOR_BASE_SCORE, MAX_CODE_DENSITY_MULTIPLIER) were not even in the defaults map — only hardcoded at lookup sites.

Changes

• src/scoring/model.ts — add density-era constants to DEFAULT_SCORING_CONSTANTS; SCORING_CONSTANT_NAMES derives from keys only
• src/scoring/preview.ts — constant() reads fallbacks from DEFAULT_SCORING_CONSTANTS; remove all inline literal fallbacks (including feat(scoring): pull + model upstream constants not currently fetched #809 review-collateral and non-code cap constants)
• test/unit/scoring.test.ts — regression: empty-constants preview matches explicit-defaults preview; density branch retained; density constants no longer flagged as unmodeled drift

Scope boundary

Does not remove the density-model branch — current_density_model remains a supported activeModel in types, OpenAPI, and score-breakdown.ts.

API / OpenAPI / MCP contract

No schema changes. Preview math values unchanged when snapshot constants are present.

Note

Fresh PR replacing #1107 (auto-closed for merge conflicts). Rebased onto latest main (#1102 non-code cap, #1192 upstream SHA pinning, #1235 constants body validation).

Test plan

• npm run test:ci passes
• codecov/patch ≥ 97% on changed lines

Made with Cursor

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.03%. Comparing base (53ec209) to head (de4042f).
⚠️ Report is 3 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1240   +/-   ##
=======================================
  Coverage   95.03%   95.03%           
=======================================
  Files         177      177           
  Lines       19882    19883    +1     
  Branches     7163     7163           
=======================================
+ Hits        18894    18895    +1     
  Misses        395      395           
  Partials      593      593           

Files with missing lines	Coverage Δ
src/scoring/model.ts	98.11% <100.00%> (ø)
src/scoring/preview.ts	98.83% <100.00%> (+<0.01%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[JSONbored]

MERGE:

Code is sound:

• Faithful single-sourcing: all 25 removed inline literals exactly match their
  DEFAULT_SCORING_CONSTANTS values; no numeric behavior change; detectActiveModel unaffected
  (uses parsed upstream values, not the defaults-merged map).
• Good invariant test: empty-constants-vs-explicit-defaults equality (scoring.test.ts:1509);
  density gate both arms covered. codecov/patch + project green post-rebase.

Minor nit (non-blocking, coverage still passes): the rewritten constant() helper's
non-finite-value arm (preview.ts:1004) isn't directly asserted. Optional to add a test feeding
a NaN constant value, but not required — patch coverage is green.