diff --git a/src/builder/incremental.js b/src/builder/incremental.js
index 8081b42..d30c89d 100644
--- a/src/builder/incremental.js
+++ b/src/builder/incremental.js
@@ -25,7 +25,7 @@ import { BUILTIN_RECEIVERS, readFileSafe } from './helpers.js';
  * @param {Function} [options.diffSymbols] - Symbol diff function
  * @returns {Promise<object|null>} Update result or null on failure
  */
-export async function rebuildFile(db, rootDir, filePath, stmts, engineOpts, cache, options = {}) {
+export async function rebuildFile(_db, rootDir, filePath, stmts, engineOpts, cache, options = {}) {
   const { diffSymbols } = options;
   const relPath = normalizePath(path.relative(rootDir, filePath));
   const oldNodes = stmts.countNodes.get(relPath)?.c || 0;
diff --git a/src/graph/classifiers/risk.js b/src/graph/classifiers/risk.js
index f1aafe6..d427efb 100644
--- a/src/graph/classifiers/risk.js
+++ b/src/graph/classifiers/risk.js
@@ -2,6 +2,10 @@
  * Risk scoring — pure logic, no DB.
  */
 
+// Weights sum to 1.0. Complexity gets the highest weight because cognitive load
+// is the strongest predictor of defect density. Fan-in and churn are next as
+// they reflect coupling and volatility. Role adds architectural context, and MI
+// (maintainability index) is a weaker composite signal, so it gets the least.
 export const DEFAULT_WEIGHTS = {
   fanIn: 0.25,
   complexity: 0.3,
@@ -10,6 +14,10 @@ export const DEFAULT_WEIGHTS = {
   mi: 0.1,
 };
 
+// Role weights reflect structural importance: core modules are central to the
+// dependency graph, utilities are widely imported, entry points are API
+// surfaces. Adapters bridge subsystems but are replaceable. Leaves and dead
+// code have minimal downstream impact.
 export const ROLE_WEIGHTS = {
   core: 1.0,
   utility: 0.9,
diff --git a/src/graph/model.js b/src/graph/model.js
index 9f85b8f..733be68 100644
--- a/src/graph/model.js
+++ b/src/graph/model.js
@@ -101,6 +101,7 @@ export class CodeGraph {
     for (const [src, targets] of this._successors) {
       for (const [tgt, attrs] of targets) {
         if (!this._directed) {
+          // \0 is safe as separator — node IDs are file paths/symbols, never contain null bytes
           const key = src < tgt ? `${src}\0${tgt}` : `${tgt}\0${src}`;
           if (seen.has(key)) continue;
           seen.add(key);