[picatz]

Summary

• Add explicit -bodies=same-module only with -scope=selected and positive additional-package/parsed-syntax-byte limits.
• Validate the full exact-module dependency expansion from one load graph before SSA construction. Invalid metadata or exceeded budgets fail atomically, with no fallback or partial findings.
• Preserve original selected packages, exact roots, and source/sink occurrence identities. Default selected-body behavior and coverage output remain unchanged.
• Keep coverage diagnostics on stderr. Limits bound additional parsed inputs, not RSS, execution time or total SSA size; context cancellation cannot promptly interrupt SSA creation/build.

Validation

• Full Go1.26.8 and Go1.27.1 test suites; final wholeprogram/CLI sweeps on both versions.
• Complete root race suite plus callgraphutil, wholeprogram and CLI; build, vet, formatting, staticcheck and govulncheck.
• All 15 default evaluation snapshots unchanged: 8 TP / 5 FN / 0 FP. No default manifests, expectations or published baseline labels changed.
• Independent final-tree review approved without blockers; all seven hosted checks passed on the exact PR head.
• Fixtures cover selected ownership traps, constant/bound-query clean controls, module/workspace/replacement/nested boundaries, real overlay bytes, test variants, deterministic budgets, incomplete metadata, cancellation, imported initializers/unreachable exports, and text/JSON/SARIF coverage parity.

Separate controlled opt-in experiment

Same selected input patterns, target pin, analyzer, toolchain and warm caches; three serial alternating pairs per fixture:

• Minimal ./caller: 0 findings with selected bodies; 1 with exactly 1 added package / 110 syntax bytes. Root and match identities remain unchanged; clean transforms remain clean.
• Pinned Casdoor 051752340d21470db4020b9cf1b46fa50ae908a9, still only ./controllers ./object: 0 findings with selected bodies; 14 with exactly 7 added packages / 126,934 syntax bytes. All 543 root descriptors and the 2 original match-package identities remain unchanged. Exact limits succeed; either under-limit fails with empty stdout.
• The opt-in result includes the two existing annotated benchmark matches and 12 additional untriaged findings. Those 12 are not new benchmark labels, verified exploit claims or a measured precision improvement. No live target or model calls were used.
• Casdoor warm-cache medians: 7.538s → 7.880s elapsed and 1,166,632 → 1,190,084 KiB child peak RSS. These small local measurements are not general resource guarantees.

Base: merged #64 at 26f6e95db59e0ff9e9d178cef9eefdf6516b8a30.
Validated final tree: 293d6b99b542ef4d84ccf1ada4296c2b2c60970f.