Coverage scanning

`scanExpressCandidates(rootDir, options?)`

Walks TypeScript sources under rootDir and collects Express route/middleware candidates.

Field	Description
`getAllTsFilesOptions`	Skip-dir overrides for discovery.
`compilerOptions`	Extra TS options merged over parsed `tsconfig.json`.
`files`	When set, restrict the program to these files only.
`ownedRoots`	Keep only handlers whose declaration file lives under these roots (drops third-party middleware noise).

Extends ScanExpressCandidatesOptions with:

Field	Description
`maxNodes`	Safety bound to limit recursion depth during reachability analysis.

Field	Description
`scanRoots`	Required array of directories to scan.
`registrySnapshot`	Required `Record<string, RegistryEntry>` at analysis time.
`getAllTsFilesOptions`	Optional discovery tweaks.
`compilerOptions`	Optional TS overrides.
`maxServiceNodes`	Optional cap on work during service reachability.

Section	Contents
`summary`	Counts `{ total, wrapped, left }` for `middleware`, `controllers`, and `services`.
`left`	Arrays of `CandidateRef` still needing instrumentation for each bucket.
`meta`	`scanRoots`, `filesScanned`, `generatedAt`, `protocolVersion`, `unresolvedHandlers`, `nodesVisited`.

Embedded WebSocket clients can request a report with the COVERAGE_REQUEST message — see wire docs in the SDK repo.