…mits

The cquery timeout detection tested for a `timedOut` flag the registry spawn
never sets; on a timeout the child is killed and Node reports `killed: true`
with `signal: SIGTERM` (or SIGKILL). Drop the phantom `timedOut` branch and
update the test to assert the real kill shape.

A Bazel Maven extraction that under-reports dependencies must never be
presented downstream as a complete SBOM. This reworks the shared status
model so the CLI is honest about partial and unanalyzable runs:

- Add an `indeterminate` probe state. An unrecognized non-zero probe exit
  or a thrown probe is no longer swallowed as `not-defined` ("no Maven
  here"); it is propagated so the run is never reported complete.
- A workspace that fails to load is recorded as a load failure rather than
  silently skipped: a hard failure when nothing else was analyzable, a
  partial otherwise.
- Enrich the extraction result with a machine-readable completeness signal
  (a `complete` flag plus per-workspace / per-hub outcomes) and write a
  completeness summary alongside the manifests for downstream consumers.
  The partial SBOM is still emitted and the warning stays loud.
- Make both the explicit command and auto-manifest honest: exit non-zero
  only on hard failure, exit 0 on partial with a prominent warning and the
  completeness signal echoed.
- Gate synthetic hub manifests on committed lockfiles: when a committed
  maven_install.json / <hub>_maven_install.json already covers a hub, skip
  re-emitting it since the server already ingests committed lockfiles.
- Wire a --per-repo-timeout flag (and socket.json setting) with a 120s
  default for the explicit command, longer than the 60s auto-manifest
  default; drop the misleading comment claiming the default already existed.

Per-state diagnostics are logged under --verbose.

…lookup

Array.prototype.at requires the es2022 lib; the stricter typechecker flagged
it on the mock.calls tuple type. Use length-1 index access, which is lib-agnostic.

…ce root

The committed-lockfile gate walked the whole tree under a workspace root
and matched a maven_install.json at any depth. A nested workspace or test
fixture lockfile then wrongly marked the root @maven hub as already
covered, so its synthetic manifest was skipped and its distinct
coordinates were never emitted while the run could still report complete.

Scope the gate to depth-0: a committed lockfile only covers the workspace
it lives directly in, since each workspace is analyzed independently and
the server walker ingests every committed lockfile against its own
workspace. Also exclude the CLI's own synthetic output directories
(.socket-auto-manifest, bazel-manifests) by name so a stale prior-run
manifest can never be misread as a committed lockfile.

Mark Maven hub enumeration indeterminate when `bazel mod show_extension`
fails to execute (non-zero exit), distinct from a clean run that finds no
maven extension. A failed enumeration may have missed custom-named hubs,
so the run is reported known-incomplete (partial when other hubs
succeeded, hard failure when nothing is analyzable) instead of silently
falling back to conventional-name probes and reporting complete.

…f blanket-flagging

bazel mod show_extension for the maven extension exits non-zero on every
bzlmod repo that doesn't depend on rules_jvm_external, because its argument
resolution throws before any Starlark runs. Treating any non-zero exit as an
indeterminate enumeration wrongly flipped those legitimate no-Maven repos to
a hard failure, aborting the user's whole auto-manifest scan.

Classify the result by stderr shape via classifyShowExtensionResult:
- extension/module not in the dependency graph (arg-resolution error) is a
  legitimate not-defined, contributing no Maven (noEcosystem)
- a genuine MODULE.bazel evaluation/load failure, or a missing binary
  (normalized code -1), stays indeterminate so the run is never complete
- an unrecognized non-zero exit biases to not-defined; only positive
  eval-failure stderr escalates to indeterminate

Replace the old hard-fail test (whose mock was a legitimate no-Maven repo)
with a noEcosystem assertion, and add coverage for the not-in-graph and
genuine-eval-failure paths.

The not-in-graph classifier relied on the conservative default for Bazel's
actual phrasing ('No module with the apparent repo name X exists in the
dependency graph'). Add that verified wording explicitly and pin both the
real not-in-graph (exit 2 -> not-defined) and real unbound-name eval failure
(exit 2 -> indeterminate, eval-failure checked first) with tests.