@azure-id/orc 1.8.2 → 1.9.1

package/CHANGELOG.md

@@ -10,6 +10,305 @@ Format: `### v<version> — <title> _(<date>)_`.
 
 ---
 
+### v1.9.1 — the graph that was paid for and never asked _(2026-09-23)_
+
+**Still on the unscoped `orc` package?** Do this once first - your `orc upgrade`
+is the pre-v0.56.0 one and cannot install itself. Full detail in the CAUTION at
+the top of this file.
+
+- **Step 1 - release the command from the old package:** `npm uninstall -g orc`
+- **Step 2 - install the current package:** `npm i -g @azure-id/orc`
+- **Step 3 - re-apply it to your project:** `orc update`
+
+**Do not use `npm i -g -f`.** Full detail in v0.56.0 below.
+
+The code graph was maintained far more than it was consulted, and the part that
+WAS consulted cost more than the meter said. On one real Vue project the store
+was at generation 93 with 19 recorded reads, the panel said `0 hook updates`
+after the hook had run 35 of them, and 416 of 429 `.vue` files had no symbol at
+all. This release makes an answer smaller, makes the meter tell the truth, says
+when the map is thin and why, and teaches the parser to read the Vue Options API.
+
+The version number is a patch because that was the release owner's call. The
+release adds flags, one command and an engine change; every one is backward
+compatible.
+
+**What you have to do: nothing.** A store built by 1.9.0 reads `DRIFTED` once,
+and the next preflight (`orc graph status --heal`) re-reads every file
+automatically — measured at about 8 ms a file. Notes and function ids survive.
+No config key changed.
+
+**`--brief`: the answer a lane reads, without the rows it never prints.**
+
+- Every `orc graph … --json` read takes `--brief`. It keeps the card, the line,
+  the trace, every scalar and every count, drops the row arrays, and prints
+  compact JSON. Without `--brief`, `--json` is unchanged — the 1.9.0 answers
+  are frozen as goldens and compared key for key.
+- Measured on this repository (tokens):
+
+  | command | full | brief | card |
+  |---|---|---|---|
+  | `ctx <symbol>` | 2,773 | 734 | 600 |
+  | `ctx <file>` | 1,484 | 369 | 243 |
+  | `ctx --for-slice` (3 files) | 1,818 | 420 | 320 |
+  | `impact` (3 files) | 4,910 | 1,122 | 956 |
+  | `map` | 8,995 | 1,193 | 1,113 |
+  | `changes` | 5,228 | 934 | 681 |
+
+  −74 % to −87 %. Every payload call site now asks for it (46 of them).
+
+**The CLI computes the lines the lanes used to assemble.**
+
+- `orc graph changes` returns `totals`, the affected `tests[]`, a `tests_line`
+  and the `blast_line` `/orc-quick` prints. `--files=a,b` limits it to a set.
+- `orc graph impact --complexity [--risk=<class>[@<file:line>],…]` returns
+  `/orc-mini`'s complexity line, its numbers and the `facts{}` the planner
+  pastes — impact and co-change in ONE process instead of one call per file.
+  The four thresholds are named constants in `bin/graph-signals.js`.
+
+**The map says when it is thin, and why.**
+
+- `orc graph status` prints the density (`1.9 symbols/file`) and `THIN` when a
+  repository of 30+ files has under 3 symbols per file and 40 %+ of its files
+  empty. A 1.9.0 store gets the numbers once, under `--heal`, without a new
+  generation.
+- **`orc graph audit`** (new, never called by a lane): density by language, the
+  files the parser read as EMPTY, longest first, and the shape of each one's
+  first declaration — with the shapes that are a parser gap marked as such.
+- `orc graph map` ranks a file with no symbol below every file that has one. It
+  is a rank, never a filter.
+
+**The meter tells the truth.**
+
+- **Fixed: `hook updates` was always 0.** The hook updated the graph and counted
+  it in the run's counters file, but never wrote the ledger row `orc graph gain`
+  counts. It writes a `hook-update` row now, and that row pays nothing.
+- **Fixed: `paid` counted the card, not the answer.** The orchestrator receives
+  the whole `--json` answer, 4 to 8 times the card, and the meter called the card
+  EXACT. `paid.envelope` is everything beyond the card; the panel's paid row reads
+  `(cards · source · hints · envelope)`.
+- `never_called` lists the reads this project has never made. It is a fact and
+  it carries no advice.
+
+**The paid reads carry what they were paid for.**
+
+- **`ctx <symbol> --callers-source`** adds six lines around each confident call
+  site (at most 5 callers), charged to the same budget after everything else.
+  Never an `AMBIGUOUS` candidate, never the target's own file, and a caller file
+  that changed since the index says so on its head line. The recon agents use it
+  for a blast radius.
+- **`lsp_at`** on every symbol card — `{file, line, character}`, the character
+  1-based. When a card says `AMBIGUOUS (n)` or `maybe <n>` and an `LSP` tool is
+  available, the read ladder, the recon agents and every executor now ask the
+  language server there before any Grep. `null` when it cannot be exact.
+- **`wide reads`**: under `code_graph_hooks: on`, a subagent's whole-file read of
+  a file with 8+ symbols is COUNTED — no context, no trace line — and `orc graph
+  gain` prints the count. It is the number the decision to arm `on,read` by
+  default waits for. The default did not change.
+- Under `on,read`, the wide-file hint names the run's own names first.
+
+**The parser reads the Vue Options API (`graph@6`).**
+
+- `export default {…}`, `defineComponent({…})` and `Vue.extend({…})` are a
+  `class`; every function-valued member at depth 1 and in `methods`, `computed`,
+  `watch`, `getters`, `mutations`, `actions`, `filters` and `provide` is a
+  `method` named `<Owner>.<name>`. `mixins` and `extends` are its bases.
+- So `this.submit()` resolves LOCAL, a component reaches its mixin as
+  `inherited`, and `orc graph impact` on a mixin names every component that
+  mixes it in. The owner is the `name:` property, else the file name.
+- An exported constant (`export const`, `exports.X =`, a key of
+  `module.exports = {…}`) is a `const` symbol with no calls. A `require(…)`
+  value is a re-export and is never one. A `<script setup>` or Svelte component
+  is one `class` named from its file.
+- Both parsers name the same symbols: the heuristic one and the project's own
+  TypeScript, when it has one.
+- Measured on this repository: the only change against the graph@5 parser is
+  189 new constants and 34 new links to them; files with no symbol went 25 → 7.
+
+**Limits, with the numbers.**
+
+- **The live-session evaluation did not run for this release**, and no paid
+  evaluation round was made for `--callers-source` (identical runs flip about 9 %
+  of outcomes, so a small round would not show the effect). The deterministic
+  half is in the suite: 1,202 tests.
+- **The Vue gate is measured on the user's project, not here.** The plan's gate
+  is under 20 % empty `.vue` files and 4+ symbols per file after the upgrade;
+  run the density command again after `orc graph status --heal` to check it.
+- The THIN thresholds (30 files · 3 per file · 40 % empty) are provisional.
+- `/orc-mini`'s spine is 4 lines shorter, not the 8 the plan asked for; the
+  prose that moved was one long line per step.
+- The parser still does not read a `<template>`: `@click="submit"` is not a link.
+
+Verify: 40 skills · 51 agent files · 214 contracts.
+
+---
+
+### v1.9.0 — the lean lanes learn to look before they leap _(2026-09-21)_
+
+**Still on the unscoped `orc` package?** Do this once first - your `orc upgrade`
+is the pre-v0.56.0 one and cannot install itself. Full detail in the CAUTION at
+the top of this file.
+
+- **Step 1 - release the command from the old package:** `npm uninstall -g orc`
+- **Step 2 - install the current package:** `npm i -g @azure-id/orc`
+- **Step 3 - re-apply it to your project:** `orc update`
+
+**Do not use `npm i -g -f`.** Full detail in v0.56.0 below.
+
+`/orc-quick` and `/orc-mini` are the two lanes people reach for most, and both
+were working half blind. The code graph could tell them WHERE a symbol is, and
+was forbidden from telling them WHAT BREAKS. A bug fix was never shown failing
+before it was fixed. Read-only work was dispatched by model name, so nothing in
+ORC could see it. This release fixes those three things and trims what the two
+lanes cost to load.
+
+**Nothing you have to do.** No new config key. No new prerequisite. If the code
+graph is off, every new call says so in one line and the lanes work as before.
+
+**A bug is now shown RED before it is fixed.**
+
+- A request like *"the orders page returns 500, find it and fix it"* is sorted
+  as a **defect**, and the slice carries a `repro` field. The executor writes
+  the reproduction FIRST — a failing test in your own framework, or a command —
+  runs it, captures the red run, implements, and runs it again for the green.
+- Both runs are printed, and the trace carries `REPRO red :: <cmd> exit=1` and
+  `REPRO green :: <cmd> exit=0`. `/orc-retro` counts them apart from a TDD
+  cycle, because a reproduction is not a `tdd_spec`.
+- **A reproduction that cannot be written is `repro: none` with a reason**, and
+  the entry says *not reproduced* — repeated at the commit offer, so a fix
+  nobody has seen work is never quietly shipped as one. It is never faked.
+- A `done` return whose `before` run was green, or whose `after` run is still
+  red, is a malformed return and is treated as a failure.
+
+Why: without the red run, a fix is proven against your test suite — which was
+green before and is green after. With it, the fix is proven against the bug you
+reported. It costs one extra run of one command.
+
+**The two lanes may now ask what breaks.**
+
+- `/orc-quick` gained `orc graph map`, `changes` and `coverage`; `/orc-mini`
+  gained `map`, `impact`, `changes` and `cochange`. Until now both could ask
+  only `ctx`.
+- **Affected tests run first.** After a dispatch that wrote code, `orc graph
+  changes` names the tests that reach the change — a test that arrives through
+  a URL included — and those run before the suite. A runner that takes no file
+  list says so in one line and runs the suite.
+- **Every entry carries a blast-radius line:** `3 symbols touched · callers 7 in
+  4 files · tests reach 2 · risk high: <symbol> (exported, fan-in 4, no test
+  reaches it)`. A `risk` word never appears without its reason. Nothing indexed
+  means it says that instead of a number.
+- **A request that names no file** starts with `orc graph map --focus`, so
+  *"where is the retry logic?"* no longer begins with a guess at a filename.
+
+**`/orc-mini`'s complexity read now carries numbers.**
+
+It used to be a sentence of judgment. It is now one line with counts behind it,
+and four thresholds that each carry their reason:
+
+```
+complexity: recommend /orc — 6 files · callers 27 in 9 files · risk auth (src/routes/orders.js:12) · cochange src/auth.js x3 not in plan
+```
+
+Confident callers in 4 or more files outside the plan · 8 or more confident
+callers · any cited risk class · a file that history says is always touched
+alongside one of yours. `AMBIGUOUS` callers are counted and printed as
+`maybe <n>`; they never trip a threshold alone. **It is an offer, never a
+switch**, and continuing writes the NUMBERS into the decision log so a later
+`/orc-retro` can move a threshold instead of anyone arguing about it. With the
+graph off it says `(graph off)` and decides from the cited risk classes alone —
+it never invents a number.
+
+The mini planner is dispatched WITH those facts (`graph_facts`), so it grounds
+its own file list on them. A file that history says belongs in the change, and
+that the plan does not name, becomes an open question — never a file the planner
+adds in silence.
+
+**Read-only work is a real agent now.**
+
+- `/orc-quick`'s recon is a pinned pair — `orc-recon-sonnet-4-6-med` and
+  `orc-recon-opus-5-low` — with one return contract: a short answer (12 lines at
+  most), evidence with `file:line`, what it searched, what it did NOT find and
+  the queries that prove it, and `graph_used`.
+- They are **traced**. The hook writes `SPAWN` and `RETURN` for them, they show
+  up in `orc run inflight` while they run, and `/orc-retro` can count them. Each
+  is dispatched through the same gate as everything else — the gate still asks
+  every time.
+- A blast-radius answer keeps four kinds of caller APART — a direct caller, one
+  that reaches through a URL, one through an alias, one through a base class —
+  and when a list rests on the map alone it carries the sentence that says so:
+  *A card lists every caller that NAMES the symbol. A card's silence is not
+  proof of absence.*
+- **`other — name a model` stays** as the escape hatch, and it now names a MODEL
+  only. The Agent tool has no per-call effort knob, so the old "effort" option
+  was a setting that did not exist.
+
+**The gate can now recommend, and it still never chooses.**
+
+A menu line may carry an arrow marked `suggested` WITH its reason from the dig —
+8 or more callers, a visible risk class, or more than three files changing. It
+is a recommendation printed beside the option, never a pre-selection, and every
+menu still ends with `Your choice — nothing runs until you answer.`
+
+**Both lanes cost less to load.**
+
+- The two skill descriptions load into **every** session. `/orc-quick`'s went
+  619 to 326 characters and `/orc-mini`'s 493 to 294, with every trigger phrase
+  kept word for word and a test that holds them there. Across all 33 skills that
+  is 492 characters off what every session pays before it does anything.
+- The anti-slop rules card in a `/orc-quick` slice is now a **compact** form:
+  about 1,460 tokens instead of about 3,469, on every dispatch and re-sent every
+  executor turn. Every HARD rule keeps its id, its title and its instruction and
+  loses only the worked examples, the pack file is named beside it, and the JSON
+  says `compact: true` — a reader that cannot tell a short card from a stripped
+  one cannot trust either.
+- `/orc-quick`'s spine went 379 to 325 lines and gained a budget it never had;
+  `/orc-mini`'s went 268 to 280 against a pin raised 270 to 280 with its reason
+  written into the guard. What left both spines is stated once, in the file that
+  owns it.
+
+**Smaller things.**
+
+- `orc graph update --notes-pending` replaces two calls with one in both lanes.
+- One `orc graph gain` line at the close of a code-writing request, copied word
+  for word: what the map put in (recorded) and an estimate, always a range, of
+  what it kept out.
+- `/orc-mini` passes wiki **paths**, not page bodies, to its planner and its
+  executor — the orchestrator's own context is the surface that fills up first.
+- `wiki_used: none` and `graph_used: none` are recorded rather than dropped. Two
+  runs in a row of `wiki_used: none` on fresh pages prints one line suggesting
+  you check those pages' TL;DRs.
+- `/orc-quick`'s `gh` probe is lazy — it runs on the first PR request, not at
+  every preflight.
+- Each `/orc-quick` trace packet is built from a running record with the time
+  each event actually happened, instead of one timestamp for the whole packet.
+
+**What this release does NOT promise.** It does not lower your bill. ORC
+measured that in v1.8.2 and the answer has not changed: search results are a
+fraction of one percent of what a session adds to its context. The claim here is
+correctness, traceability and fewer round trips — a bug proven fixed, a dig that
+shows up in the trace, and the affected tests run before the suite.
+
+**Limits, with the numbers.**
+
+- **The live-session evaluation in `eval/` did not run for this release.** The
+  deterministic half is covered by the suite — the shipped trace hook is driven
+  with a real recon dispatch and asserted to emit `SPAWN` and the `PHASE-EDGE`,
+  the `repro` contract is asserted across all ten executor agents, and the
+  compact rules card is asserted to keep every HARD rule id. What is NOT
+  measured is the part that needs a person driving a lane: whether a defect run
+  shows red then green three times out of three, whether recon's recall on
+  URL-reached callers beats the graph-off run, and whether a request with no
+  filename finds its files in fewer reads than the v1.8.2 baseline. Those are
+  the gates in the plan, and they are unmet, not passed.
+- **`/orc-quick` still cannot call `orc graph impact`.** It has no planner and
+  no declared-file set before the gate, so the two planning reads stay out of
+  its catalogue. Its recon agent calls them instead.
+- The complexity thresholds (4 files · 8 callers · any risk · 3 co-commits) are
+  a starting point chosen with reasons, not measured ones. They are printed in
+  the `GATE complexity` trace line precisely so a retro can move them.
+
+---
+
 ### v1.8.2 — the map that finds what a grep cannot _(2026-09-21)_
 
 **Still on the unscoped `orc` package?** Do this once first - your `orc upgrade`

package/README-id.md

@@ -7,13 +7,13 @@
 *Terima permintaan → pahami → rencanakan → beri nilai → kerjakan paralel → periksa → uji → kirim.*
 
 ![npm](https://img.shields.io/npm/v/%40azure-id%2Forc?style=for-the-badge&color=cb3837&logo=npm)
-![Version](https://img.shields.io/badge/version-1.8.2-blue.svg?style=for-the-badge)
+![Version](https://img.shields.io/badge/version-1.9.1-blue.svg?style=for-the-badge)
 ![License](https://img.shields.io/badge/license-MIT-green.svg?style=for-the-badge)
 ![Node](https://img.shields.io/badge/node-%3E%3D18-brightgreen.svg?style=for-the-badge)
 ![Claude Code](https://img.shields.io/badge/Claude_Code-Skills-purple.svg?style=for-the-badge)
 ![Dependencies](https://img.shields.io/badge/dependencies-zero-lightgrey.svg?style=for-the-badge)
 
-**Versi terbaru: v1.8.2** · diperbarui 21-09-2026 · [daftar perubahan lengkap](CHANGELOG.md)
+**Versi terbaru: v1.9.1** · diperbarui 23-09-2026 · [daftar perubahan lengkap](CHANGELOG.md)
 
 **Ada di npm: [`@azure-id/orc`](https://www.npmjs.com/package/@azure-id/orc)** — `npm i -g @azure-id/orc`
 
@@ -272,9 +272,9 @@ pemakaian 5 jam, pemakaian mingguan, dan beberapa hal lain.
 |---|---|---|
 | **`/orc`** | Alur penuh: terima → rencana → gelombang paralel bernilai → periksa → uji → kirim. Rajin menyimpan titik simpan; bisa dilanjutkan di sesi baru. | [lihat](mock-run/orc.md) |
 | **`/orc-ultra`** | Sama, ditambah penasihat Opus 5 **xhigh** dan tiga gerbang penilaian. Analisis dalam, pola kode, tes, dan keamanan dipaksa menyala. Memang mahal. | [lihat](mock-run/orc-ultra.md) |
-| **`/orc-mini`** | Satu agen Sonnet 5, satu pemeriksaan build + tes, lalu kirim. Melewati review penuh dan pengujian. Bisa pindah ke alur penuh di tengah jalan kalau diminta. | [lihat](templates/skills/orc-mini/examples/mini-run-mock.md) |
+| **`/orc-mini`** | Satu agen Sonnet 5, satu pemeriksaan build + tes, lalu kirim. Melewati review penuh dan pengujian. Satu baris **pembacaan kompleksitas** berisi angka menawarkan lane penuh kalau perubahannya lebih luas dari satu area. Bisa pindah ke alur penuh di tengah jalan kalau diminta. | [lihat](templates/skills/orc-mini/examples/mini-run-mock.md) |
 | **`/orc-fast`** | Lane tercepat. Butuh wiki yang masih segar **dan** pola kode yang sudah tersimpan; kalau ada, ia melewati tahap analis dan perencana sepenuhnya. Kalau salah satu syarat tidak ada, ia mundur ke `/orc-mini` — obrolan tidak pernah berhenti. | [lihat](mock-run/orc-fast.md) |
-| **`/orc-quick`** | Minta apa saja: perbaikan kecil, pertanyaan, mencari bug, menaikkan versi dependensi, komentar PR. Lihat → tanya sekali → kerjakan. **Selalu bertanya agen mana yang mau dipakai**, dan tidak ada pengaturan yang bisa mengubah itu. | [lihat](mock-run/orc-quick.md) |
+| **`/orc-quick`** | Minta apa saja: perbaikan kecil, pertanyaan, mencari bug, menaikkan versi dependensi, komentar PR. Lihat → tanya sekali → kerjakan. **Selalu bertanya agen mana yang mau dipakai**, dan tidak ada pengaturan yang bisa mengubah itu. Satu **defect direproduksi merah dulu sebelum diperbaiki**. | [lihat](mock-run/orc-quick.md) |
 | **`/orc-diy`** | Lane racikan Anda sendiri, disusun di terminal dengan `orc diy` lalu dikompilasi. Kalau belum disetel atau sudah basi, ia menolak jalan dan menawarkan `/orc` biasa. | [lihat](mock-run/orc-diy.md) |
 
 ### Memikirkan apa yang mau dibuat
@@ -465,11 +465,37 @@ orc graph gain                        # apa yang dimasukkan peta, dan perkiraan
   membangunnya di preflight dan memperbaruinya setelah setiap perubahan. Lane
   lain tidak pernah memanggilnya. **Tidak ada yang berjalan dengan pewaktu dan
   tidak ada yang berjalan di latar belakang.**
+- **Setiap lane hanya boleh menanyakan pertanyaan yang disebut katalognya
+  sendiri** (`orc lane calls <lane>`), dan v1.9.0 melebarkan itu untuk dua lane
+  ramping. `/orc-quick` sekarang boleh menanyakan `map`, `changes` dan
+  `coverage`, jadi ia bisa menyebut apa yang tersentuh satu perubahan dan
+  menjalankan test yang terdampak lebih dulu; `/orc-mini` boleh menanyakan
+  `map`, `impact`, `changes` dan `cochange`, yang menjadi angka di balik baris
+  kompleksitasnya. Sebelum ini keduanya hanya boleh menanyakan di mana satu
+  simbol berada.
 - **Hook itu juga memberi pekerja titik acuan yang tadinya harus dicari sendiri**
   — untuk Grep, Glob, dan pencarian lewat shell (`grep`, `rg`, `git grep`,
   `findstr`) — dan semua yang diberikannya ditandai sebagai data repositori,
   bukan perintah. Matikan dengan `orc config set code_graph_hooks off`; petanya
   tetap bekerja.
+- **`--brief` adalah jawaban yang dibaca lane** (v1.9.1). Bersama `--json`, ia
+  menyimpan kartu, baris, trace dan setiap hitungan, lalu membuang larik baris
+  yang tidak pernah dicetak lane — 74 % sampai 87 % lebih kecil di repositori
+  ini. Setiap panggilan lane memakainya; tanpa itu, `--json` tidak berubah.
+- **Graf membaca Vue Options API** (v1.9.1, mesin `graph@6`). Komponen, mixin
+  dan modul Vuex menjadi class, setiap fungsi di dalamnya menjadi method, dan
+  `mixins` menjadi basisnya — jadi `this.submit()` adalah tautan, dan `impact`
+  pada satu mixin menyebut setiap komponen yang memakainya. Konstanta yang
+  diekspor dan komponen `<script setup>` juga diberi nama. Store dari versi
+  lama memperbarui dirinya sendiri satu kali, di preflight berikutnya.
+- **Graf memberi tahu kapan petanya tipis, dan kenapa.** `orc graph status`
+  mencetak jumlah simbol per berkas dan `THIN` jika sebagian besar berkas tidak
+  punya simbol. `orc graph audit` menulis berkas-berkas itu per bahasa, yang
+  terpanjang lebih dulu, dengan bentuk masing-masing.
+- **Kartu simbol bisa membawa baris milik pemanggilnya** (`--callers-source`:
+  enam baris di sekitar setiap titik panggil yang pasti) dan menyebut di mana
+  language server harus melihat (`lsp_at`) jika peta hanya bisa bilang
+  `AMBIGUOUS`.
 
 Kontraknya: `templates/skills/_shared/code-graph.md`. Hook-nya:
 `templates/hooks/README.md`.
@@ -760,56 +786,47 @@ Bacalah sebagai catatan putaran itu, bukan sebagai audit terkini:
 **Riwayat lengkap: [CHANGELOG.md](CHANGELOG.md)** — atau `orc changelog`, yang
 hanya mencetak yang lebih baru dari versi yang Anda punya.
 
-### v1.8.2 - peta yang menemukan apa yang tidak bisa ditemukan grep _(21-09-2026)_
-
-v1.8.0 merilis graf kode dengan satu lubang yang sudah diketahui: kartu hanya
-menulis pemanggil yang MENYEBUT nama simbolnya, jadi test yang sampai ke satu
-route lewat URL bukan pemanggil dan kartunya diam soal itu. **Sekarang URL
-adalah satu tautan** — begitu juga alias instance
-(`const svc = new OrderService(); svc.run()`), method warisan, dan nama yang
-di-re-export lewat barrel. Panggilan tanpa penerima tidak lagi diarahkan ke
-satu-satunya method di repositori yang namanya sama; tebakan itu adalah tautan
-karangan dan sudah dihapus. Di django, tautan yang pasti naik dari 65.379 ke
-72.955 dan tebakan `UNIQUE` turun dari 23.866 ke 6.442.
-
-**Lima bahasa baru** — Ruby, Rust, Kotlin, C / C++ dan blok `<script>` komponen
-Vue atau Svelte. **Parser pinjaman** jika proyek Anda sudah punya alatnya:
-`node_modules/typescript` milik Anda dan `go` di PATH bergabung dengan `ast`
-milik Python. ORC sendiri tetap tanpa dependency.
-
-**Lebih sedikit bolak-balik.** `ctx --source [N]` menambahkan baris target ke
-kartunya. `ctx --for-slice` hanya mencetak tampak luar satu berkas yang memang
-akan dibaca penuh oleh agent — 30–51% lebih kecil dari kartu yang digantikannya.
-`update --notes-pending` menjawab keduanya dalam satu panggilan. Hook sekarang
-juga menjawab pencarian lewat shell, dan `code_graph_hooks on,read` menyebut
-enam simbol paling banyak dijangkau di satu berkas besar supaya pembacaan
-berikutnya bisa meminta satu rentang saja.
-
-**`orc graph map`** memberi peringkat repositori sebelum Anda tahu nama
-berkasnya, di dalam satu batas token, dengan `--focus`. Peringkat adalah
-petunjuk tentang di mana harus melihat lebih dulu, bukan bukti. **Kartu satu
-simbol kira-kira dua kali lebih cepat** — cache resolusinya sekarang dipecah
-menjadi shard, jadi django turun dari 881 ke 480 ms, dan shard menjawab persis
-sama dengan indeks penuh atau menolak menjawab (577 kartu dibandingkan, 0
-berbeda).
-
-**`orc graph gain`** melaporkan apa yang dimasukkan peta — tercatat — dan
-perkiraan, selalu sebagai rentang, tentang apa yang ditahannya. Angka tunggal
-tidak pernah dicetak, dan penghematan yang tidak bisa dibuktikan tidak pernah
-diklaim.
-
-**`code_graph_ignore`** adalah kunci baru: glob tambahan yang tidak pernah
-diindeks graf.
-
-Dua gate di rilis ini tidak tercapai, dan CHANGELOG menyebutkannya lengkap
-dengan angkanya: parser pinjaman tetap dirilis atas keputusan pemelihara
-walaupun gate tingkat kepastian mengukur +1,0 / −0,3 / −0,3, dan `orc graph map`
-hanya dihubungkan ke perencanaan karena pengukuran ulang transkrip mendapat 0,39
-panggilan perencanaan yang bisa dijawab per run, terhadap gate tiga.
+### v1.9.1 - graf yang dibayar tetapi tidak pernah ditanya _(23-09-2026)_
+
+Graf kode lebih sering dirawat daripada ditanya, dan bagian yang ditanya lebih
+mahal daripada yang dicatat meterannya. Di satu proyek Vue nyata, 416 dari 429
+berkas `.vue` tidak punya simbol, dan panel menulis `0 hook updates` setelah 35.
+
+**Jawaban lebih kecil.** `--brief` menyimpan kartu, baris dan setiap hitungan,
+lalu membuang baris yang tidak pernah dicetak lane: 74 % sampai 87 % lebih
+kecil, dan setiap panggilan lane memakainya. CLI sekarang menghitung baris
+blast-radius `/orc-quick` dan baris kompleksitas `/orc-mini` dalam satu
+panggilan, bukan lane yang menghitung baris-barisnya.
+
+**Meterannya jujur.** Pembaruan oleh hook selalu tercatat 0, dan `paid`
+menghitung kartu padahal lane menerima 4 sampai 8 kali lebih banyak. Keduanya
+diperbaiki: baris `hook-update`, dan `paid.envelope` di samping kartu.
+Meterannya juga menulis pembacaan yang belum pernah dilakukan proyek ini.
+
+**Peta memberi tahu kapan ia tipis, dan kenapa** — `THIN` di `orc graph
+status`, dan `orc graph audit` baru yang menulis berkas kosong per bahasa,
+yang terpanjang lebih dulu.
+
+**Parser membaca Vue Options API** (mesin `graph@6`). Komponen, mixin dan modul
+Vuex menjadi class dengan method; `mixins` menjadi basisnya; konstanta yang
+diekspor dan komponen `<script setup>` diberi nama. Store 1.9.0 memperbarui
+dirinya sendiri satu kali, di preflight berikutnya. Tidak ada yang perlu
+dilakukan.
+
+**Pembacaan berbayar membawa isinya:** `ctx --callers-source` (enam baris di
+sekitar setiap titik panggil yang pasti), `lsp_at` untuk language server jika
+kartu menulis `AMBIGUOUS`, dan hitungan pembacaan berkas lebar yang tidak
+diberi petunjuk.
+
+**Tidak diukur di sini:** evaluasi sesi langsung tidak dijalankan, dan gerbang
+Vue (di bawah 20 % berkas `.vue` kosong) diukur di proyek Anda sendiri.
+CHANGELOG menyebut setiap batasnya.
 
 <details>
-<summary><strong>Rilis sebelumnya</strong> — 118 rilis, hanya judulnya. Teks lengkapnya (dalam bahasa Inggris) ada di <a href="CHANGELOG.md">CHANGELOG.md</a>.</summary>
+<summary><strong>Rilis sebelumnya</strong> — 120 rilis, hanya judulnya. Teks lengkapnya (dalam bahasa Inggris) ada di <a href="CHANGELOG.md">CHANGELOG.md</a>.</summary>
 
+- **v1.9.0** — the lean lanes learn to look before they leap · _2026-09-21_
+- **v1.8.2** — the map that finds what a grep cannot · _2026-09-21_
 - **v1.8.1** — the guard that only failed on Windows · _2026-09-16_
 - **v1.8.0** — the code graph: a map of the code that stays fresh · _2026-09-16_
 - **v1.7.1** — the rules card now reaches the agent · _2026-09-14_

package/README.md

@@ -7,14 +7,14 @@
 *Intake → analyze → plan → score → parallel subagents → review → verify → ship.*
 
 ![npm](https://img.shields.io/npm/v/%40azure-id%2Forc?style=for-the-badge&color=cb3837&logo=npm)
-![Version](https://img.shields.io/badge/version-1.8.2-blue.svg?style=for-the-badge)
+![Version](https://img.shields.io/badge/version-1.9.1-blue.svg?style=for-the-badge)
 ![License](https://img.shields.io/badge/license-MIT-green.svg?style=for-the-badge)
 ![Node](https://img.shields.io/badge/node-%3E%3D18-brightgreen.svg?style=for-the-badge)
 ![Claude Code](https://img.shields.io/badge/Claude_Code-Skills-purple.svg?style=for-the-badge)
 ![Dependencies](https://img.shields.io/badge/dependencies-zero-lightgrey.svg?style=for-the-badge)
 ![GitHub stars](https://img.shields.io/github/stars/azure-id/orc?style=for-the-badge&color=yellow)
 
-**Latest: v1.8.2** · updated 2026-09-21 · [full changelog](CHANGELOG.md)
+**Latest: v1.9.1** · updated 2026-09-23 · [full changelog](CHANGELOG.md)
 
 **On npm: [`@azure-id/orc`](https://www.npmjs.com/package/@azure-id/orc)** — `npm i -g @azure-id/orc`
 
@@ -251,9 +251,9 @@ ORC have terminal hook to see: Context Window %, 5 Hour usage %, Weekly usage %
 |---|---|---|
 | **`/orc`** | The full pipeline: intake → plan → scored parallel waves → review → verify → ship. Checkpoints eagerly; resumes in a fresh session. | [see it](mock-run/orc.md) |
 | **`/orc-ultra`** | The same, plus an Opus 5 **xhigh** advisor and three judgment gates. Deep analysis, patterns, tests and security forced on. Costly by design. | [see it](mock-run/orc-ultra.md) |
-| **`/orc-mini`** | One Sonnet 5 executor, a build + test smoke gate, ship. Skips full review and verify. Switches to the full flow mid-run on request. | [see it](templates/skills/orc-mini/examples/mini-run-mock.md) |
+| **`/orc-mini`** | One Sonnet 5 executor, a build + test smoke gate, ship. Skips full review and verify. A one-line **complexity read** with counts behind it offers the full lane when the change is wider than one area. Switches to the full flow mid-run on request. | [see it](templates/skills/orc-mini/examples/mini-run-mock.md) |
 | **`/orc-fast`** | The fastest lane. Needs a fresh wiki **and** a cached code pattern; then it skips the analyst and planner entirely. A missing prerequisite falls back to `/orc-mini` — the chat never stops. | [see it](mock-run/orc-fast.md) |
-| **`/orc-quick`** | Ask for anything: a fix, a question, a defect hunt, a dependency bump, PR comments. Look → ask once → do. **It always asks which agent to dispatch**, and no setting can change that. | [see it](mock-run/orc-quick.md) |
+| **`/orc-quick`** | Ask for anything: a fix, a question, a defect hunt, a dependency bump, PR comments. Look → ask once → do. **It always asks which agent to dispatch**, and no setting can change that. A defect is **reproduced red before it is fixed**. | [see it](mock-run/orc-quick.md) |
 | **`/orc-wait`** | Wall-clock pause without losing the run. You see the window is nearly full, type `/orc-wait 30`, and ORC hands the run back to disk, waits in detached hops that **cost zero tokens**, and picks up where it stopped. Three modes decide how much finishes first: `safe` · `soft` (forces the checkpoint) · `hard` (fastest, can lose an in-flight return). `/orc-wait block <reason>` tells it not to stop you at all. | — |
 | **`/orc-diy`** | Your own lane, composed in the terminal with `orc diy` and compiled. Unconfigured or stale → it refuses and offers plain `/orc`. | [see it](mock-run/orc-diy.md) |
 
@@ -435,10 +435,32 @@ orc graph gain                        # what the map put in, and an estimate of
   — `/orc`, `/orc-ultra`, `/orc-diy`, `/orc-mini`, `/orc-fast`, `/orc-quick` —
   still builds it at preflight and updates it after each change. Other lanes
   never call it. **Nothing runs on a timer and nothing runs in the background.**
+- **Each lane may ask only the questions its own catalogue names** (`orc lane
+  calls <lane>`), and v1.9.0 widened that for the two lean lanes. `/orc-quick`
+  can now ask `map`, `changes` and `coverage`, so it can say what a change
+  touches and run the affected tests first; `/orc-mini` can ask `map`, `impact`,
+  `changes` and `cochange`, which are the counts behind its complexity line.
+  Until now both could ask only where a symbol is.
 - **The hook also hands a worker the anchors it would otherwise search for** —
   for a Grep, a Glob and a shell search (`grep`, `rg`, `git grep`, `findstr`) —
   and everything it hands over is labelled repository data, never an instruction.
   Switch it off with `orc config set code_graph_hooks off`; the map still works.
+- **`--brief` is the answer a lane reads** (v1.9.1). With `--json` it keeps the
+  card, the line, the trace and every count, and drops the row arrays a lane
+  never prints — 74 % to 87 % smaller on this repository. Every lane call uses
+  it; without it, `--json` is unchanged.
+- **It reads the Vue Options API** (v1.9.1, engine `graph@6`). A component, a
+  mixin and a Vuex module are a class, each function inside them is a method,
+  and `mixins` are its bases — so `this.submit()` is a link, and `impact` on a
+  mixin names every component that uses it. Exported constants and
+  `<script setup>` components are named too. A store built by an older version
+  upgrades itself once, at the next preflight.
+- **It says when the map is thin, and why.** `orc graph status` prints the
+  symbols per file and `THIN` when most files hold none. `orc graph audit` lists
+  those files by language, longest first, with the shape of each one.
+- **A symbol card can carry its callers' own lines** (`--callers-source`: six
+  lines around each confident call site) and says where a language server
+  should look (`lsp_at`) when the map can only say `AMBIGUOUS`.
 
 The contract: `templates/skills/_shared/code-graph.md`. The hook:
 `templates/hooks/README.md`.
@@ -706,50 +728,43 @@ a current audit: [EVAL-REPORT.md](EVAL-REPORT.md).
 **Full history: [CHANGELOG.md](CHANGELOG.md)** — or `orc changelog`, which prints
 only what is newer than the version you have.
 
-### v1.8.2 — the map that finds what a grep cannot _(2026-09-21)_
-
-v1.8.0 shipped the code graph with a known hole: a card listed every caller that
-NAMES a symbol, so a test reaching a route by its URL was not a caller and the
-card was silent about it. **A URL is now an edge** — and so is an instance alias
-(`const svc = new OrderService(); svc.run()`), an inherited method and a name
-re-exported through a barrel. A bare call no longer resolves to the only method
-in the repository with that name; that guess was an invented edge and it is gone.
-On django, confident edges went 65,379 → 72,955 and `UNIQUE` guesses 23,866 →
-6,442.
-
-**Five more languages** — Ruby, Rust, Kotlin, C / C++ and the `<script>` block of
-a Vue or Svelte component. **Borrowed parsers** where your project already has
-the tool: your own `node_modules/typescript` and the `go` on PATH join Python's
-`ast`. ORC still has zero dependencies.
-
-**Fewer round trips.** `ctx --source [N]` adds the target's lines to the card.
-`ctx --for-slice` prints only the outside view of a file an agent is about to
-read in full, 30–51% smaller than the card it replaces. `update --notes-pending`
-answers both in one call. The hook now answers a shell search too, and
-`code_graph_hooks on,read` names a wide file's six most reached symbols so the
-next read can ask for a range.
-
-**`orc graph map`** ranks the repository before you know a file name, inside a
-budget, with `--focus`. Rank is a hint about where to look first, never proof.
-**A one-symbol card is about twice as fast** — the resolution cache is sharded,
-so django goes 881 → 480 ms, and the shards answer exactly what the full index
-answers or they decline (577 cards compared, 0 different).
-
-**`orc graph gain`** reports what the map put in — recorded — and an estimate,
-always a range, of what it kept out. It never prints one number and never claims
-a saving it cannot show.
-
-**`code_graph_ignore`** is a new key: extra globs the graph never indexes.
-
-Two gates in this release were missed and the CHANGELOG says so with the
-numbers: the borrowed parsers ship on the maintainer's call although the
-confident-rate gate measured +1.0 / −0.3 / −0.3, and `orc graph map` is wired to
-planning only because the replay measured 0.39 answerable planning calls per run
-against a gate of three.
+### v1.9.1 — the graph that was paid for and never asked _(2026-09-23)_
+
+The code graph was maintained far more than it was consulted, and the part that
+was consulted cost more than the meter said. On one real Vue project, 416 of
+429 `.vue` files had no symbol, and the panel said `0 hook updates` after 35.
+
+**Answers are smaller.** `--brief` keeps the card, the line and every count and
+drops the rows a lane never prints: 74 % to 87 % smaller, and every lane call
+uses it. The CLI now computes `/orc-quick`'s blast-radius line and
+`/orc-mini`'s complexity line in one call, instead of the lane counting rows.
+
+**The meter tells the truth.** Hook updates were always counted as 0, and
+`paid` counted the card while the lane received 4 to 8 times more. Both are
+fixed: a `hook-update` row, and `paid.envelope` beside the cards. The meter
+also lists the reads this project has never made.
+
+**The map says when it is thin, and why** — `THIN` on `orc graph status`, and
+a new `orc graph audit` that lists the empty files by language, longest first.
+
+**The parser reads the Vue Options API** (engine `graph@6`). A component, a
+mixin and a Vuex module are a class with methods; `mixins` are its bases;
+exported constants and `<script setup>` components are named. A 1.9.0 store
+upgrades itself once, at the next preflight. Nothing to do.
+
+**The paid reads carry what they were paid for:** `ctx --callers-source` (six
+lines around each confident call site), `lsp_at` for a language server when a
+card says `AMBIGUOUS`, and a count of the wide whole-file reads no hint named.
+
+**Not measured here:** the live-session evaluation did not run, and the Vue gate
+(under 20 % empty `.vue` files) is measured on your own project. The CHANGELOG
+names every limit.
 
 <details>
-<summary><strong>Earlier releases</strong> — 118 of them, titles only. Full text in <a href="CHANGELOG.md">CHANGELOG.md</a>.</summary>
+<summary><strong>Earlier releases</strong> — 120 of them, titles only. Full text in <a href="CHANGELOG.md">CHANGELOG.md</a>.</summary>
 
+- **v1.9.0** — the lean lanes learn to look before they leap · _2026-09-21_
+- **v1.8.2** — the map that finds what a grep cannot · _2026-09-21_
 - **v1.8.1** — the guard that only failed on Windows · _2026-09-16_
 - **v1.8.0** — the code graph: a map of the code that stays fresh · _2026-09-16_
 - **v1.7.1** — the rules card now reaches the agent · _2026-09-14_