docs(changelog): document sub-project 1 Phases 1-4 (resolver SPI)

Captures the cross-cutting Confidence + source schema change, the
intelligence/resolver/ SPI surface, the Java backend
(javaparser-symbol-solver-core), DetectorContext.resolved() opt-in, and
the per-base confidence floor wired through Analyzer's emission path.
Detector migrations to consume ctx.resolved() are explicitly called out
as Phase 5 follow-up.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: aksOps

CHANGELOG.md

@@ -54,6 +54,36 @@ for that specific tag for the per-commit details.
   `Confidence` enum + `source` field on every `CodeNode` / `CodeEdge`,
   4–6 Java detectors migrated, 9 layers of aggressive testing). Implementation
   in flight on `feat/sub-project-1-resolver-spi-and-java-pilot`.
+- **Symbol-resolver SPI** (sub-project 1, Phases 1–4 of the resolver-and-Java-pilot
+  plan): the foundation for moving the graph from regex-class-of-correctness
+  to AST-and-symbol-resolution-class-of-correctness. New `Confidence` enum
+  (`LEXICAL`/`SYNTACTIC`/`RESOLVED` with stable `score()` mapping) plus a
+  `source` field land on every `CodeNode` and `CodeEdge`, round-trip through
+  Neo4j (bare `confidence`/`source` properties on nodes and `RELATES_TO`
+  relationships) and through the H2 analysis cache (`CACHE_VERSION` bumped
+  4 → 5 so existing v4 caches drop and rebuild on next open). Read paths are
+  non-throwing — legacy data without these fields reads back as
+  `LEXICAL`/null, never NPEs. New SPI under
+  `intelligence/resolver/`: `Resolved` interface + `EmptyResolved` singleton
+  sentinel, `SymbolResolver` per-language backend, `ResolutionException`,
+  `ResolverRegistry` (Spring `@Service` with deterministic alphabetical
+  bootstrap, case-insensitive lookup, per-resolver failure isolation). First
+  backend `JavaSymbolResolver` wraps `javaparser-symbol-solver-core` 3.28.0
+  (Apache-2.0, same release train as `javaparser-core`) with a
+  `JavaSourceRootDiscovery` that walks Maven/Gradle/plain layouts under a
+  project root (skipping `target/`, `build/`, `node_modules/`, `.git/`, etc.;
+  symlink-loop-safe via `NOFOLLOW_LINKS`). `DetectorContext` now carries an
+  `Optional<Resolved>` (`withResolved()` opt-in, `Optional.empty()` for every
+  detector that doesn't care — fully backward compatible). `Detector.defaultConfidence()`
+  declares the per-detector floor (`LEXICAL` for regex bases, `SYNTACTIC` for
+  AST/structured/JavaParser/JavaMessaging bases) and `DetectorEmissionDefaults.applyDefaults`
+  is wired into every `detector.detect()` call site in `Analyzer.java` —
+  emissions whose `source` is null get stamped at the orchestration boundary
+  (detectors that explicitly stamp survive untouched). 11 atomic commits
+  ship with ~290 new tests covering happy paths, legacy-data fallbacks,
+  malformed inputs, determinism, concurrency-safe construction, and singleton
+  invariants. Detector migrations to consume `ctx.resolved()` and the
+  resolver-bootstrap-into-Analyzer hook follow in sub-project 1 Phase 5.
 
 ### Changed