@azure-id/orc 1.9.0 → 1.9.1

package/CHANGELOG.md

@@ -10,6 +10,139 @@ Format: `### v<version> — <title> _(<date>)_`.
 
 ---
 
+### v1.9.1 — the graph that was paid for and never asked _(2026-09-23)_
+
+**Still on the unscoped `orc` package?** Do this once first - your `orc upgrade`
+is the pre-v0.56.0 one and cannot install itself. Full detail in the CAUTION at
+the top of this file.
+
+- **Step 1 - release the command from the old package:** `npm uninstall -g orc`
+- **Step 2 - install the current package:** `npm i -g @azure-id/orc`
+- **Step 3 - re-apply it to your project:** `orc update`
+
+**Do not use `npm i -g -f`.** Full detail in v0.56.0 below.
+
+The code graph was maintained far more than it was consulted, and the part that
+WAS consulted cost more than the meter said. On one real Vue project the store
+was at generation 93 with 19 recorded reads, the panel said `0 hook updates`
+after the hook had run 35 of them, and 416 of 429 `.vue` files had no symbol at
+all. This release makes an answer smaller, makes the meter tell the truth, says
+when the map is thin and why, and teaches the parser to read the Vue Options API.
+
+The version number is a patch because that was the release owner's call. The
+release adds flags, one command and an engine change; every one is backward
+compatible.
+
+**What you have to do: nothing.** A store built by 1.9.0 reads `DRIFTED` once,
+and the next preflight (`orc graph status --heal`) re-reads every file
+automatically — measured at about 8 ms a file. Notes and function ids survive.
+No config key changed.
+
+**`--brief`: the answer a lane reads, without the rows it never prints.**
+
+- Every `orc graph … --json` read takes `--brief`. It keeps the card, the line,
+  the trace, every scalar and every count, drops the row arrays, and prints
+  compact JSON. Without `--brief`, `--json` is unchanged — the 1.9.0 answers
+  are frozen as goldens and compared key for key.
+- Measured on this repository (tokens):
+
+  | command | full | brief | card |
+  |---|---|---|---|
+  | `ctx <symbol>` | 2,773 | 734 | 600 |
+  | `ctx <file>` | 1,484 | 369 | 243 |
+  | `ctx --for-slice` (3 files) | 1,818 | 420 | 320 |
+  | `impact` (3 files) | 4,910 | 1,122 | 956 |
+  | `map` | 8,995 | 1,193 | 1,113 |
+  | `changes` | 5,228 | 934 | 681 |
+
+  −74 % to −87 %. Every payload call site now asks for it (46 of them).
+
+**The CLI computes the lines the lanes used to assemble.**
+
+- `orc graph changes` returns `totals`, the affected `tests[]`, a `tests_line`
+  and the `blast_line` `/orc-quick` prints. `--files=a,b` limits it to a set.
+- `orc graph impact --complexity [--risk=<class>[@<file:line>],…]` returns
+  `/orc-mini`'s complexity line, its numbers and the `facts{}` the planner
+  pastes — impact and co-change in ONE process instead of one call per file.
+  The four thresholds are named constants in `bin/graph-signals.js`.
+
+**The map says when it is thin, and why.**
+
+- `orc graph status` prints the density (`1.9 symbols/file`) and `THIN` when a
+  repository of 30+ files has under 3 symbols per file and 40 %+ of its files
+  empty. A 1.9.0 store gets the numbers once, under `--heal`, without a new
+  generation.
+- **`orc graph audit`** (new, never called by a lane): density by language, the
+  files the parser read as EMPTY, longest first, and the shape of each one's
+  first declaration — with the shapes that are a parser gap marked as such.
+- `orc graph map` ranks a file with no symbol below every file that has one. It
+  is a rank, never a filter.
+
+**The meter tells the truth.**
+
+- **Fixed: `hook updates` was always 0.** The hook updated the graph and counted
+  it in the run's counters file, but never wrote the ledger row `orc graph gain`
+  counts. It writes a `hook-update` row now, and that row pays nothing.
+- **Fixed: `paid` counted the card, not the answer.** The orchestrator receives
+  the whole `--json` answer, 4 to 8 times the card, and the meter called the card
+  EXACT. `paid.envelope` is everything beyond the card; the panel's paid row reads
+  `(cards · source · hints · envelope)`.
+- `never_called` lists the reads this project has never made. It is a fact and
+  it carries no advice.
+
+**The paid reads carry what they were paid for.**
+
+- **`ctx <symbol> --callers-source`** adds six lines around each confident call
+  site (at most 5 callers), charged to the same budget after everything else.
+  Never an `AMBIGUOUS` candidate, never the target's own file, and a caller file
+  that changed since the index says so on its head line. The recon agents use it
+  for a blast radius.
+- **`lsp_at`** on every symbol card — `{file, line, character}`, the character
+  1-based. When a card says `AMBIGUOUS (n)` or `maybe <n>` and an `LSP` tool is
+  available, the read ladder, the recon agents and every executor now ask the
+  language server there before any Grep. `null` when it cannot be exact.
+- **`wide reads`**: under `code_graph_hooks: on`, a subagent's whole-file read of
+  a file with 8+ symbols is COUNTED — no context, no trace line — and `orc graph
+  gain` prints the count. It is the number the decision to arm `on,read` by
+  default waits for. The default did not change.
+- Under `on,read`, the wide-file hint names the run's own names first.
+
+**The parser reads the Vue Options API (`graph@6`).**
+
+- `export default {…}`, `defineComponent({…})` and `Vue.extend({…})` are a
+  `class`; every function-valued member at depth 1 and in `methods`, `computed`,
+  `watch`, `getters`, `mutations`, `actions`, `filters` and `provide` is a
+  `method` named `<Owner>.<name>`. `mixins` and `extends` are its bases.
+- So `this.submit()` resolves LOCAL, a component reaches its mixin as
+  `inherited`, and `orc graph impact` on a mixin names every component that
+  mixes it in. The owner is the `name:` property, else the file name.
+- An exported constant (`export const`, `exports.X =`, a key of
+  `module.exports = {…}`) is a `const` symbol with no calls. A `require(…)`
+  value is a re-export and is never one. A `<script setup>` or Svelte component
+  is one `class` named from its file.
+- Both parsers name the same symbols: the heuristic one and the project's own
+  TypeScript, when it has one.
+- Measured on this repository: the only change against the graph@5 parser is
+  189 new constants and 34 new links to them; files with no symbol went 25 → 7.
+
+**Limits, with the numbers.**
+
+- **The live-session evaluation did not run for this release**, and no paid
+  evaluation round was made for `--callers-source` (identical runs flip about 9 %
+  of outcomes, so a small round would not show the effect). The deterministic
+  half is in the suite: 1,202 tests.
+- **The Vue gate is measured on the user's project, not here.** The plan's gate
+  is under 20 % empty `.vue` files and 4+ symbols per file after the upgrade;
+  run the density command again after `orc graph status --heal` to check it.
+- The THIN thresholds (30 files · 3 per file · 40 % empty) are provisional.
+- `/orc-mini`'s spine is 4 lines shorter, not the 8 the plan asked for; the
+  prose that moved was one long line per step.
+- The parser still does not read a `<template>`: `@click="submit"` is not a link.
+
+Verify: 40 skills · 51 agent files · 214 contracts.
+
+---
+
 ### v1.9.0 — the lean lanes learn to look before they leap _(2026-09-21)_
 
 **Still on the unscoped `orc` package?** Do this once first - your `orc upgrade`

package/README-id.md

@@ -7,13 +7,13 @@
 *Terima permintaan → pahami → rencanakan → beri nilai → kerjakan paralel → periksa → uji → kirim.*
 
 ![npm](https://img.shields.io/npm/v/%40azure-id%2Forc?style=for-the-badge&color=cb3837&logo=npm)
-![Version](https://img.shields.io/badge/version-1.9.0-blue.svg?style=for-the-badge)
+![Version](https://img.shields.io/badge/version-1.9.1-blue.svg?style=for-the-badge)
 ![License](https://img.shields.io/badge/license-MIT-green.svg?style=for-the-badge)
 ![Node](https://img.shields.io/badge/node-%3E%3D18-brightgreen.svg?style=for-the-badge)
 ![Claude Code](https://img.shields.io/badge/Claude_Code-Skills-purple.svg?style=for-the-badge)
 ![Dependencies](https://img.shields.io/badge/dependencies-zero-lightgrey.svg?style=for-the-badge)
 
-**Versi terbaru: v1.9.0** · diperbarui 21-09-2026 · [daftar perubahan lengkap](CHANGELOG.md)
+**Versi terbaru: v1.9.1** · diperbarui 23-09-2026 · [daftar perubahan lengkap](CHANGELOG.md)
 
 **Ada di npm: [`@azure-id/orc`](https://www.npmjs.com/package/@azure-id/orc)** — `npm i -g @azure-id/orc`
 
@@ -478,6 +478,24 @@ orc graph gain                        # apa yang dimasukkan peta, dan perkiraan
   `findstr`) — dan semua yang diberikannya ditandai sebagai data repositori,
   bukan perintah. Matikan dengan `orc config set code_graph_hooks off`; petanya
   tetap bekerja.
+- **`--brief` adalah jawaban yang dibaca lane** (v1.9.1). Bersama `--json`, ia
+  menyimpan kartu, baris, trace dan setiap hitungan, lalu membuang larik baris
+  yang tidak pernah dicetak lane — 74 % sampai 87 % lebih kecil di repositori
+  ini. Setiap panggilan lane memakainya; tanpa itu, `--json` tidak berubah.
+- **Graf membaca Vue Options API** (v1.9.1, mesin `graph@6`). Komponen, mixin
+  dan modul Vuex menjadi class, setiap fungsi di dalamnya menjadi method, dan
+  `mixins` menjadi basisnya — jadi `this.submit()` adalah tautan, dan `impact`
+  pada satu mixin menyebut setiap komponen yang memakainya. Konstanta yang
+  diekspor dan komponen `<script setup>` juga diberi nama. Store dari versi
+  lama memperbarui dirinya sendiri satu kali, di preflight berikutnya.
+- **Graf memberi tahu kapan petanya tipis, dan kenapa.** `orc graph status`
+  mencetak jumlah simbol per berkas dan `THIN` jika sebagian besar berkas tidak
+  punya simbol. `orc graph audit` menulis berkas-berkas itu per bahasa, yang
+  terpanjang lebih dulu, dengan bentuk masing-masing.
+- **Kartu simbol bisa membawa baris milik pemanggilnya** (`--callers-source`:
+  enam baris di sekitar setiap titik panggil yang pasti) dan menyebut di mana
+  language server harus melihat (`lsp_at`) jika peta hanya bisa bilang
+  `AMBIGUOUS`.
 
 Kontraknya: `templates/skills/_shared/code-graph.md`. Hook-nya:
 `templates/hooks/README.md`.
@@ -768,65 +786,46 @@ Bacalah sebagai catatan putaran itu, bukan sebagai audit terkini:
 **Riwayat lengkap: [CHANGELOG.md](CHANGELOG.md)** — atau `orc changelog`, yang
 hanya mencetak yang lebih baru dari versi yang Anda punya.
 
-### v1.9.0 - lane ramping belajar melihat dulu sebelum melompat _(21-09-2026)_
-
-`/orc-quick` dan `/orc-mini` adalah dua lane yang paling sering dipakai orang,
-dan keduanya bekerja setengah buta. Graf kode bisa memberi tahu mereka DI MANA
-satu simbol berada, dan dilarang memberi tahu APA YANG RUSAK. Perbaikan bug
-tidak pernah ditunjukkan gagal lebih dulu. Pekerjaan baca-saja dikirim lewat
-nama model, jadi tidak ada satu pun bagian ORC yang bisa melihatnya.
-
-**Sekarang bug ditunjukkan MERAH dulu sebelum diperbaiki.** Permintaan seperti
-*"halaman orders mengembalikan 500, cari dan perbaiki"* digolongkan sebagai
-**defect**, dan agen eksekutor menulis reproduksinya LEBIH DULU — satu test yang
-gagal dalam framework Anda sendiri, atau satu perintah — menjalankannya sampai
-merah, memperbaikinya, lalu menjalankannya lagi sampai hijau. Kedua jalannya
-dicetak dan keduanya masuk ke jejak. Reproduksi yang tidak bisa ditulis menjadi
-`repro: none` beserta alasannya, dan catatannya berbunyi **tidak tereproduksi** —
-diulang lagi saat penawaran commit. Itu tidak pernah dikarang. Tanpa jalan merah,
-perbaikan hanya terbukti terhadap test suite Anda, yang sudah hijau sebelum dan
-sesudahnya; dengan jalan merah, perbaikan terbukti terhadap bug yang Anda
-laporkan.
-
-**Kedua lane sekarang boleh bertanya apa yang rusak.** `/orc-quick` mendapat
-`map`, `changes` dan `coverage`; `/orc-mini` mendapat `map`, `impact`, `changes`
-dan `cochange`. **Test yang terdampak dijalankan lebih dulu** — termasuk test
-yang sampai ke perubahan lewat URL — dan setiap catatan membawa satu baris
-radius dampak, tempat kata `risk` tidak pernah muncul tanpa alasannya.
-Permintaan yang tidak menyebut satu berkas pun sekarang dimulai dengan
-`orc graph map --focus`, bukan dengan tebakan nama berkas.
-
-**Pembacaan kompleksitas `/orc-mini` membawa angka.** Dulu itu satu kalimat
-penilaian; sekarang satu baris berisi hitungan dan empat ambang yang
-masing-masing menyebut kenapa angkanya segitu: pemanggil di 4 berkas atau lebih
-di luar rencana, 8 pemanggil atau lebih, kelas risiko apa pun yang dikutip, atau
-satu berkas yang menurut riwayat selalu ikut tersentuh. Itu **tawaran, bukan
-perpindahan**, dan kalau Anda tetap lanjut, angkanya ditulis ke catatan
-keputusan supaya `/orc-retro` nanti bisa menggeser ambangnya.
-
-**Pekerjaan baca-saja sekarang agen sungguhan.** Recon adalah sepasang agen
-tetap — `orc-recon-sonnet-4-6-med` dan `orc-recon-opus-5-low` — dengan kontrak
-pengembalian, terlihat di jejak dan di `orc run inflight`. Pilihan
-`other — sebut satu model` tetap ada sebagai jalan keluar. Gerbangnya sekarang
-boleh mencetak `suggested` di samping satu baris BESERTA alasannya, dan ia tetap
-tidak pernah memilih: setiap menu berakhir dengan *pilihan Anda — tidak ada yang
-berjalan sampai Anda menjawab*.
-
-**Kedua lane lebih murah untuk dimuat.** Dua deskripsi yang dibayar setiap sesi
-turun dari 619 ke 326 dan dari 493 ke 294 karakter, dengan setiap frasa pemicu
-tetap utuh. Kartu aturan dalam potongan `/orc-quick` sekarang berbentuk ringkas —
-sekitar 1.460 token, bukan 3.469 — yang menjaga id, judul dan instruksi setiap
-aturan HARD, dan hanya melepas contoh-contohnya.
-
-**Rilis ini tidak menurunkan tagihan Anda**, dan tidak mengklaim begitu.
-Klaimnya adalah kebenaran, keterlacakan, dan lebih sedikit bolak-balik.
-**Evaluasi sesi langsung tidak dijalankan** — setengah bagian deterministiknya
-ada di test suite, tetapi tiga gate yang butuh orang menjalankan lane tidak
-tercapai, bukan lulus. CHANGELOG menyebutkan satu per satu.
+### v1.9.1 - graf yang dibayar tetapi tidak pernah ditanya _(23-09-2026)_
+
+Graf kode lebih sering dirawat daripada ditanya, dan bagian yang ditanya lebih
+mahal daripada yang dicatat meterannya. Di satu proyek Vue nyata, 416 dari 429
+berkas `.vue` tidak punya simbol, dan panel menulis `0 hook updates` setelah 35.
+
+**Jawaban lebih kecil.** `--brief` menyimpan kartu, baris dan setiap hitungan,
+lalu membuang baris yang tidak pernah dicetak lane: 74 % sampai 87 % lebih
+kecil, dan setiap panggilan lane memakainya. CLI sekarang menghitung baris
+blast-radius `/orc-quick` dan baris kompleksitas `/orc-mini` dalam satu
+panggilan, bukan lane yang menghitung baris-barisnya.
+
+**Meterannya jujur.** Pembaruan oleh hook selalu tercatat 0, dan `paid`
+menghitung kartu padahal lane menerima 4 sampai 8 kali lebih banyak. Keduanya
+diperbaiki: baris `hook-update`, dan `paid.envelope` di samping kartu.
+Meterannya juga menulis pembacaan yang belum pernah dilakukan proyek ini.
+
+**Peta memberi tahu kapan ia tipis, dan kenapa** — `THIN` di `orc graph
+status`, dan `orc graph audit` baru yang menulis berkas kosong per bahasa,
+yang terpanjang lebih dulu.
+
+**Parser membaca Vue Options API** (mesin `graph@6`). Komponen, mixin dan modul
+Vuex menjadi class dengan method; `mixins` menjadi basisnya; konstanta yang
+diekspor dan komponen `<script setup>` diberi nama. Store 1.9.0 memperbarui
+dirinya sendiri satu kali, di preflight berikutnya. Tidak ada yang perlu
+dilakukan.
+
+**Pembacaan berbayar membawa isinya:** `ctx --callers-source` (enam baris di
+sekitar setiap titik panggil yang pasti), `lsp_at` untuk language server jika
+kartu menulis `AMBIGUOUS`, dan hitungan pembacaan berkas lebar yang tidak
+diberi petunjuk.
+
+**Tidak diukur di sini:** evaluasi sesi langsung tidak dijalankan, dan gerbang
+Vue (di bawah 20 % berkas `.vue` kosong) diukur di proyek Anda sendiri.
+CHANGELOG menyebut setiap batasnya.
 
 <details>
-<summary><strong>Rilis sebelumnya</strong> — 119 rilis, hanya judulnya. Teks lengkapnya (dalam bahasa Inggris) ada di <a href="CHANGELOG.md">CHANGELOG.md</a>.</summary>
+<summary><strong>Rilis sebelumnya</strong> — 120 rilis, hanya judulnya. Teks lengkapnya (dalam bahasa Inggris) ada di <a href="CHANGELOG.md">CHANGELOG.md</a>.</summary>
 
+- **v1.9.0** — the lean lanes learn to look before they leap · _2026-09-21_
 - **v1.8.2** — the map that finds what a grep cannot · _2026-09-21_
 - **v1.8.1** — the guard that only failed on Windows · _2026-09-16_
 - **v1.8.0** — the code graph: a map of the code that stays fresh · _2026-09-16_

package/README.md

@@ -7,14 +7,14 @@
 *Intake → analyze → plan → score → parallel subagents → review → verify → ship.*
 
 ![npm](https://img.shields.io/npm/v/%40azure-id%2Forc?style=for-the-badge&color=cb3837&logo=npm)
-![Version](https://img.shields.io/badge/version-1.9.0-blue.svg?style=for-the-badge)
+![Version](https://img.shields.io/badge/version-1.9.1-blue.svg?style=for-the-badge)
 ![License](https://img.shields.io/badge/license-MIT-green.svg?style=for-the-badge)
 ![Node](https://img.shields.io/badge/node-%3E%3D18-brightgreen.svg?style=for-the-badge)
 ![Claude Code](https://img.shields.io/badge/Claude_Code-Skills-purple.svg?style=for-the-badge)
 ![Dependencies](https://img.shields.io/badge/dependencies-zero-lightgrey.svg?style=for-the-badge)
 ![GitHub stars](https://img.shields.io/github/stars/azure-id/orc?style=for-the-badge&color=yellow)
 
-**Latest: v1.9.0** · updated 2026-09-21 · [full changelog](CHANGELOG.md)
+**Latest: v1.9.1** · updated 2026-09-23 · [full changelog](CHANGELOG.md)
 
 **On npm: [`@azure-id/orc`](https://www.npmjs.com/package/@azure-id/orc)** — `npm i -g @azure-id/orc`
 
@@ -445,6 +445,22 @@ orc graph gain                        # what the map put in, and an estimate of
   for a Grep, a Glob and a shell search (`grep`, `rg`, `git grep`, `findstr`) —
   and everything it hands over is labelled repository data, never an instruction.
   Switch it off with `orc config set code_graph_hooks off`; the map still works.
+- **`--brief` is the answer a lane reads** (v1.9.1). With `--json` it keeps the
+  card, the line, the trace and every count, and drops the row arrays a lane
+  never prints — 74 % to 87 % smaller on this repository. Every lane call uses
+  it; without it, `--json` is unchanged.
+- **It reads the Vue Options API** (v1.9.1, engine `graph@6`). A component, a
+  mixin and a Vuex module are a class, each function inside them is a method,
+  and `mixins` are its bases — so `this.submit()` is a link, and `impact` on a
+  mixin names every component that uses it. Exported constants and
+  `<script setup>` components are named too. A store built by an older version
+  upgrades itself once, at the next preflight.
+- **It says when the map is thin, and why.** `orc graph status` prints the
+  symbols per file and `THIN` when most files hold none. `orc graph audit` lists
+  those files by language, longest first, with the shape of each one.
+- **A symbol card can carry its callers' own lines** (`--callers-source`: six
+  lines around each confident call site) and says where a language server
+  should look (`lsp_at`) when the map can only say `AMBIGUOUS`.
 
 The contract: `templates/skills/_shared/code-graph.md`. The hook:
 `templates/hooks/README.md`.
@@ -712,60 +728,42 @@ a current audit: [EVAL-REPORT.md](EVAL-REPORT.md).
 **Full history: [CHANGELOG.md](CHANGELOG.md)** — or `orc changelog`, which prints
 only what is newer than the version you have.
 
-### v1.9.0 — the lean lanes learn to look before they leap _(2026-09-21)_
-
-`/orc-quick` and `/orc-mini` are the two lanes people reach for most, and both
-were working half blind. The code graph could tell them WHERE a symbol is and
-was forbidden from telling them WHAT BREAKS. A bug fix was never shown failing
-before it was fixed. Read-only work was dispatched by model name, so nothing in
-ORC could see it.
-
-**A bug is now shown RED before it is fixed.** A request like *"the orders page
-returns 500, find it and fix it"* is sorted as a **defect**, and the executor
-writes the reproduction FIRST — a failing test in your own framework, or a
-command — runs it red, implements, and runs it green. Both runs are printed and
-both reach the trace. A reproduction that cannot be written is `repro: none`
-with its reason, and the entry says **not reproduced** — repeated at the commit
-offer. It is never faked. Without the red run a fix is proven against your test
-suite, which was green before and after; with it, the fix is proven against the
-bug you reported.
-
-**Both lanes may now ask what breaks.** `/orc-quick` gained `map`, `changes` and
-`coverage`; `/orc-mini` gained `map`, `impact`, `changes` and `cochange`. The
-**affected tests run first** — a test that reaches the change through a URL
-included — and every entry carries a blast-radius line where a `risk` word never
-appears without its reason. A request that names no file now starts with
-`orc graph map --focus` instead of a guess at a filename.
-
-**`/orc-mini`'s complexity read carries numbers.** It was a sentence of
-judgment; it is now one line with counts and four thresholds that each state why
-that number: callers in 4 or more files outside the plan, 8 or more callers, any
-cited risk class, or a file history says is always touched alongside yours. It
-is an **offer, never a switch**, and continuing writes the numbers into the
-decision log so a later `/orc-retro` can move a threshold.
-
-**Read-only work is a real agent.** Recon is a pinned pair —
-`orc-recon-sonnet-4-6-med` and `orc-recon-opus-5-low` — with a return contract,
-visible in the trace and in `orc run inflight`. `other — name a model` stays as
-the escape hatch. The gate may now print `suggested` beside one line WITH its
-reason, and it still never chooses: every menu ends with *your choice — nothing
-runs until you answer*.
-
-**Both lanes cost less to load.** The two descriptions, which every session
-pays for, went 619 → 326 and 493 → 294 characters with every trigger phrase
-kept. The rules card in a `/orc-quick` slice is now a compact form — about 1,460
-tokens instead of 3,469 — that keeps every HARD rule's id, title and instruction
-and loses only the worked examples.
-
-**It does not lower your bill**, and this release does not claim it does. The
-claim is correctness, traceability and fewer round trips. **The live-session
-evaluation did not run** — the deterministic half is in the test suite, but the
-three gates that need a person driving a lane are unmet, not passed. The
-CHANGELOG names each one.
+### v1.9.1 — the graph that was paid for and never asked _(2026-09-23)_
+
+The code graph was maintained far more than it was consulted, and the part that
+was consulted cost more than the meter said. On one real Vue project, 416 of
+429 `.vue` files had no symbol, and the panel said `0 hook updates` after 35.
+
+**Answers are smaller.** `--brief` keeps the card, the line and every count and
+drops the rows a lane never prints: 74 % to 87 % smaller, and every lane call
+uses it. The CLI now computes `/orc-quick`'s blast-radius line and
+`/orc-mini`'s complexity line in one call, instead of the lane counting rows.
+
+**The meter tells the truth.** Hook updates were always counted as 0, and
+`paid` counted the card while the lane received 4 to 8 times more. Both are
+fixed: a `hook-update` row, and `paid.envelope` beside the cards. The meter
+also lists the reads this project has never made.
+
+**The map says when it is thin, and why** — `THIN` on `orc graph status`, and
+a new `orc graph audit` that lists the empty files by language, longest first.
+
+**The parser reads the Vue Options API** (engine `graph@6`). A component, a
+mixin and a Vuex module are a class with methods; `mixins` are its bases;
+exported constants and `<script setup>` components are named. A 1.9.0 store
+upgrades itself once, at the next preflight. Nothing to do.
+
+**The paid reads carry what they were paid for:** `ctx --callers-source` (six
+lines around each confident call site), `lsp_at` for a language server when a
+card says `AMBIGUOUS`, and a count of the wide whole-file reads no hint named.
+
+**Not measured here:** the live-session evaluation did not run, and the Vue gate
+(under 20 % empty `.vue` files) is measured on your own project. The CHANGELOG
+names every limit.
 
 <details>
-<summary><strong>Earlier releases</strong> — 119 of them, titles only. Full text in <a href="CHANGELOG.md">CHANGELOG.md</a>.</summary>
+<summary><strong>Earlier releases</strong> — 120 of them, titles only. Full text in <a href="CHANGELOG.md">CHANGELOG.md</a>.</summary>
 
+- **v1.9.0** — the lean lanes learn to look before they leap · _2026-09-21_
 - **v1.8.2** — the map that finds what a grep cannot · _2026-09-21_
 - **v1.8.1** — the guard that only failed on Windows · _2026-09-16_
 - **v1.8.0** — the code graph: a map of the code that stays fresh · _2026-09-16_