up

src/Scanner/StellaOps.Scanner.WebService/Contracts/EntryTraceResponse.cs

@@ -7,4 +7,5 @@ public sealed record EntryTraceResponse(
     string ImageDigest,
     DateTimeOffset GeneratedAt,
     EntryTraceGraph Graph,
-    IReadOnlyList<string> Ndjson);
+    IReadOnlyList<string> Ndjson,
+    EntryTracePlan? BestPlan = null);

src/Scanner/StellaOps.Scanner.WebService/Endpoints/ScanEndpoints.cs

@@ -424,12 +424,18 @@ internal static class ScanEndpoints
             }
         }
 
+        var bestPlan = result.Graph.Plans
+            .OrderByDescending(p => p.Confidence)
+            .ThenBy(p => p.TerminalPath, StringComparer.Ordinal)
+            .FirstOrDefault();
+
         var response = new EntryTraceResponse(
             result.ScanId,
             result.ImageDigest,
             result.GeneratedAtUtc,
             result.Graph,
-            result.Ndjson);
+            result.Ndjson,
+            bestPlan);
 
         return Json(response, StatusCodes.Status200OK);
     }