fix(runner): make kill escalation actually reach SIGKILL

fix(nuclei): scale batch -c/-rl by distinct hosts (throughput regression)

Merge feat/nuclei-batching into master: one nuclei run per URL batch (P2-6)

feat(nuclei): batch URLs into one nuclei run per scan (P2-6)

docs: drop completed P0 section from TODO.md

docs(todo): sync backlog after 2026-08-15 pipeline diagnostics

Merge feat/worker-errors-table into master: skipped-host diagnostics out of findings (P2-1)

feat(errors): worker_error diagnostics move to their own table (P2-1)

Merge feat/content-tiered-grading into master: wordlist hits graded critical/high/medium, info hits endpoints-only

feat(content): tiered grading of wordlist hits — critical/high/medium findings, info hits are endpoints only

Merge feat/nuclei-fp-guardrails into master: no more phantom criticals from network templates + verified high/critical

feat(nuclei): result-quality guardrails — drop network-template FPs, verify critical/high

Merge feat/dead-scan-cleanup into master: timed-out scans no longer clog the pipeline

feat(consumer): drop queued jobs of terminal scans (dead-scan guard)

feat(finalizer): hard-timeout scan is fully cancelled, not just marked failed

Merge feat/scan-timeout-24h into master: scan hard timeout 12h -> 24h

feat(config): raise scan hard timeout from 12h to 24h

Merge feat/content-direct-findings into master: content hits are direct findings

feat(content): wordlist hit is itself a finding, no nuclei re-enqueue

Merge feat/ffuf-wordlist-fuzztxt into master: ffuf wordlist -> Bo0oM fuzz.txt

feat(ffuf): switch content-discovery wordlist to Bo0oM fuzz.txt

Merge feat/gau-passive-discovery into master: P1-3 passive URL discovery (gau) + live verification

feat(gau): P1-3 — passive URL discovery (gau) + live verification

Merge docs/todo-refresh into master

docs(todo): mark P1-2 done; refresh P2-4 arg-injection refs (+content_worker/ffuf)

Merge feat/content-discovery into master: P1-2 content discovery (ffuf)

feat(content): P1-2 — content discovery (ffuf) for hidden files & dirs

docs: rewrite TODO to focus on test coverage backlog

feat(coverage): P0 — worker_error filter, recon UA, nuclei observability

docs: add AGENT_GUIDE.md technical reference

Merge feat/assets-http-meta-filters into master: assets server/title/length columns + filters + status dropdown

feat(assets): show + filter httpx response meta (server, title, length)

Merge fix/findings-del-button-placement: del button next to filters

fix(findings): move del button next to the filter toolbar