@neat.is/core 0.9.2-dev.20260822 → 0.9.3-dev.20260823

package/dist/cli.cjs

@@ -61,8 +61,8 @@ function mountBearerAuth(app, opts) {
   ]);
   const publicRead = opts.publicRead === true;
   app.addHook("preHandler", (req, reply, done) => {
-    const path92 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
-    if (exactUnauthPaths.has(path92) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path92)) {
+    const path93 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
+    if (exactUnauthPaths.has(path93) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path93)) {
       done();
       return;
     }
@@ -415,8 +415,8 @@ function websocketChannelPathOf(attrs) {
     const v = attrs[key];
     if (typeof v === "string" && v.length > 0) {
       const q = v.indexOf("?");
-      const path92 = q === -1 ? v : v.slice(0, q);
-      if (path92.length > 0) return path92;
+      const path93 = q === -1 ? v : v.slice(0, q);
+      if (path93.length > 0) return path93;
     }
   }
   return void 0;
@@ -799,13 +799,13 @@ __export(cli_exports, {
   runMonitorVerb: () => runMonitorVerb,
   runQueryVerb: () => runQueryVerb,
   runSkill: () => runSkill,
-  usage: () => usage4
+  usage: () => usage5
 });
 module.exports = __toCommonJS(cli_exports);
 init_cjs_shims();
-var import_node_path91 = __toESM(require("path"), 1);
+var import_node_path92 = __toESM(require("path"), 1);
 var import_node_os8 = __toESM(require("os"), 1);
-var import_node_fs55 = require("fs");
+var import_node_fs56 = require("fs");
 
 // src/banner.ts
 init_cjs_shims();
@@ -1373,19 +1373,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path92, edges) {
-    if (path92.length > best.path.length) {
-      best = { path: [...path92], edges: [...edges] };
+  function step(node, path93, edges) {
+    if (path93.length > best.path.length) {
+      best = { path: [...path93], edges: [...edges] };
     }
-    if (path92.length - 1 >= maxDepth) return;
+    if (path93.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path92.push(srcId);
+      path93.push(srcId);
       edges.push(edge);
-      step(srcId, path92, edges);
-      path92.pop();
+      step(srcId, path93, edges);
+      path93.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -1400,7 +1400,7 @@ function databaseRootCauseShape(graph, origin, walk10) {
   for (const id of walk10.path) {
     const owner = resolveOwningService(graph, id);
     if (!owner) continue;
-    const { id: serviceId15, svc } = owner;
+    const { id: serviceId16, svc } = owner;
     const deps = svc.dependencies ?? {};
     for (const pair of candidatePairs) {
       const declared = deps[pair.driver];
@@ -1413,7 +1413,7 @@ function databaseRootCauseShape(graph, origin, walk10) {
       );
       if (!result.compatible) {
         return {
-          rootCauseNode: serviceId15,
+          rootCauseNode: serviceId16,
           rootCauseReason: result.reason ?? "incompatible driver",
           ...result.minDriverVersion ? {
             fixRecommendation: `Upgrade ${svc.name} ${pair.driver} driver to >= ${result.minDriverVersion}`
@@ -1428,7 +1428,7 @@ function serviceRootCauseShape(graph, _origin, walk10) {
   for (const id of walk10.path) {
     const owner = resolveOwningService(graph, id);
     if (!owner) continue;
-    const { id: serviceId15, svc } = owner;
+    const { id: serviceId16, svc } = owner;
     const deps = svc.dependencies ?? {};
     const serviceNodeEngine = svc.nodeEngine;
     for (const constraint of nodeEngineConstraints()) {
@@ -1437,7 +1437,7 @@ function serviceRootCauseShape(graph, _origin, walk10) {
       const result = checkNodeEngineConstraint(constraint, declared, serviceNodeEngine);
       if (!result.compatible && result.reason) {
         return {
-          rootCauseNode: serviceId15,
+          rootCauseNode: serviceId16,
           rootCauseReason: result.reason,
           ...result.requiredNodeVersion ? {
             fixRecommendation: `Bump ${svc.name}'s engines.node to >= ${result.requiredNodeVersion}`
@@ -1452,7 +1452,7 @@ function serviceRootCauseShape(graph, _origin, walk10) {
       const result = checkPackageConflict(conflict, declared, requiredDeclared);
       if (!result.compatible && result.reason) {
         return {
-          rootCauseNode: serviceId15,
+          rootCauseNode: serviceId16,
           rootCauseReason: result.reason,
           fixRecommendation: `Upgrade ${svc.name}'s ${conflict.requires.name} to >= ${conflict.requires.minVersion}`
         };
@@ -1557,9 +1557,9 @@ function rootCauseFromIncidents(nodeId, incidents, errorEvent) {
 function isFailingCallEdge(e) {
   return e.type === import_types.EdgeType.CALLS && (e.signal?.errorCount ?? 0) > 0;
 }
-function callSourcesForService(graph, serviceId15) {
-  const ids = [serviceId15];
-  for (const edgeId of graph.outboundEdges(serviceId15)) {
+function callSourcesForService(graph, serviceId16) {
+  const ids = [serviceId16];
+  for (const edgeId of graph.outboundEdges(serviceId16)) {
     const e = graph.getEdgeAttributes(edgeId);
     if (e.type !== import_types.EdgeType.CONTAINS) continue;
     const tgt = graph.getNodeAttributes(e.target);
@@ -1583,9 +1583,9 @@ function failingCallDominates(e, id, curEdge, curId) {
   }
   return id < curId;
 }
-function dominantFailingCall(graph, serviceId15, visited) {
+function dominantFailingCall(graph, serviceId16, visited) {
   let best = null;
-  for (const src of callSourcesForService(graph, serviceId15)) {
+  for (const src of callSourcesForService(graph, serviceId16)) {
     for (const edgeId of graph.outboundEdges(src)) {
       const e = graph.getEdgeAttributes(edgeId);
       if (!isFailingCallEdge(e)) continue;
@@ -1600,20 +1600,20 @@ function dominantFailingCall(graph, serviceId15, visited) {
   return best;
 }
 function followFailingCallChain(graph, originServiceId, maxDepth) {
-  const path92 = [originServiceId];
+  const path93 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantFailingCall(graph, current, visited);
     if (!hop) break;
-    path92.push(hop.nextService);
+    path93.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path92, edges, culprit: current };
+  return { path: path93, edges, culprit: current };
 }
 function isStaleCallEdge(e) {
   return e.type === import_types.EdgeType.CALLS && e.provenance === import_types.Provenance.STALE;
@@ -1624,9 +1624,9 @@ function staleCallDominates(e, id, curEdge, curId) {
   if (ev !== cv) return ev > cv;
   return id < curId;
 }
-function dominantStaleCall(graph, serviceId15, visited) {
+function dominantStaleCall(graph, serviceId16, visited) {
   const bestByCallee = /* @__PURE__ */ new Map();
-  for (const src of callSourcesForService(graph, serviceId15)) {
+  for (const src of callSourcesForService(graph, serviceId16)) {
     for (const edgeId of graph.outboundEdges(src)) {
       const e = graph.getEdgeAttributes(edgeId);
       if (e.type !== import_types.EdgeType.CALLS) continue;
@@ -1649,26 +1649,26 @@ function dominantStaleCall(graph, serviceId15, visited) {
   return best;
 }
 function followStaleCallChain(graph, originServiceId, maxDepth) {
-  const path92 = [originServiceId];
+  const path93 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantStaleCall(graph, current, visited);
     if (!hop) break;
-    path92.push(hop.nextService);
+    path93.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path92, edges, culprit: current };
+  return { path: path93, edges, culprit: current };
 }
 function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
   if (!chain) return null;
   const culprit = chain.culprit;
-  const path92 = [...chain.path];
+  const path93 = [...chain.path];
   const edgeProvenances = chain.edges.map((e) => e.provenance);
   const baseConfidence = confidenceFromMix(chain.edges);
   const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
@@ -1676,14 +1676,14 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   if (loc) {
     let rootCauseNode = culprit;
     if (loc.fileNode) {
-      path92.push(loc.fileNode);
+      path93.push(loc.fileNode);
       edgeProvenances.push(import_types.Provenance.OBSERVED);
       rootCauseNode = loc.fileNode;
     }
     return import_types.RootCauseResultSchema.parse({
       rootCauseNode,
       rootCauseReason: loc.rootCauseReason,
-      traversalPath: path92,
+      traversalPath: path93,
       edgeProvenances,
       confidence,
       ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
@@ -1695,7 +1695,7 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   return import_types.RootCauseResultSchema.parse({
     rootCauseNode: culprit,
     rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
-    traversalPath: path92,
+    traversalPath: path93,
     edgeProvenances,
     confidence,
     fixRecommendation: `Inspect ${culpritName}'s failing handler`
@@ -2158,10 +2158,10 @@ function enrichWithNavigation(graph, errorNodeId, tagged, incidents, now) {
     traversalPath = staleChain.path;
     edgeProvenances = staleChain.edges.map((e) => e.provenance);
   } else if (top.node !== seedNode) {
-    const path92 = findPath(graph, errorNodeId, top.node, "up", ROOT_CAUSE_MAX_DEPTH);
-    if (path92) {
-      traversalPath = path92.nodes;
-      edgeProvenances = path92.edges.map((e) => e.provenance);
+    const path93 = findPath(graph, errorNodeId, top.node, "up", ROOT_CAUSE_MAX_DEPTH);
+    if (path93) {
+      traversalPath = path93.nodes;
+      edgeProvenances = path93.edges.map((e) => e.provenance);
     } else {
       traversalPath = [errorNodeId, top.node];
       edgeProvenances = [top.provenance ?? import_types.Provenance.OBSERVED];
@@ -3609,8 +3609,8 @@ function chiRoutesFromSource(source, parser) {
   chiWalk(tree.rootNode, "", out);
   return out;
 }
-function stripChiRegex(path92) {
-  return path92.replace(/\{([^{}:]+):[^{}]*\}/g, "{$1}");
+function stripChiRegex(path93) {
+  return path93.replace(/\{([^{}:]+):[^{}]*\}/g, "{$1}");
 }
 function chiWalk(node, prefix, out) {
   for (let i = 0; i < node.namedChildCount; i++) {
@@ -4282,9 +4282,9 @@ function rubyRocketRoute(args) {
     if (!pair || pair.type !== "pair") continue;
     const k = pair.childForFieldName("key");
     if (k?.type !== "string") continue;
-    const path92 = rubyLiteral(k);
-    if (path92 === null) continue;
-    return { path: path92, target: rubyLiteral(pair.childForFieldName("value")) };
+    const path93 = rubyLiteral(k);
+    if (path93 === null) continue;
+    return { path: path93, target: rubyLiteral(pair.childForFieldName("value")) };
   }
   return null;
 }
@@ -4837,11 +4837,11 @@ function actixAttributeRoute(attrItem, out) {
   if (!nameNode) return;
   const macro = nameNode.type === "identifier" ? nameNode.text : nameNode.type === "scoped_identifier" ? nameNode.childForFieldName("name")?.text ?? null : null;
   if (!macro) return;
-  const tokens = attr.childForFieldName("arguments");
-  if (!tokens || tokens.type !== "token_tree") return;
+  const tokens2 = attr.childForFieldName("arguments");
+  if (!tokens2 || tokens2.type !== "token_tree") return;
   const strings = [];
-  for (let i = 0; i < tokens.namedChildCount; i++) {
-    const s = rustStringContent(tokens.namedChild(i));
+  for (let i = 0; i < tokens2.namedChildCount; i++) {
+    const s = rustStringContent(tokens2.namedChild(i));
     if (s !== null) strings.push(s);
   }
   const pathStr = strings[0];
@@ -6735,29 +6735,29 @@ function promoteFrontierNodes(graph, opts = {}) {
     toPromote.push({ frontierId: id, serviceId: target });
   });
   let promoted = 0;
-  for (const { frontierId: frontierId2, serviceId: serviceId15 } of toPromote) {
+  for (const { frontierId: frontierId2, serviceId: serviceId16 } of toPromote) {
     if (opts.policies && opts.policies.length > 0 && opts.policyCtx) {
       const gate = canPromoteFrontier(graph, frontierId2, opts.policies, opts.policyCtx);
       if (!gate.allowed) {
         continue;
       }
     }
-    rewireFrontierEdges(graph, frontierId2, serviceId15);
+    rewireFrontierEdges(graph, frontierId2, serviceId16);
     graph.dropNode(frontierId2);
     promoted++;
   }
   return promoted;
 }
-function rewireFrontierEdges(graph, frontierId2, serviceId15) {
+function rewireFrontierEdges(graph, frontierId2, serviceId16) {
   const inbound = [...graph.inboundEdges(frontierId2)];
   const outbound = [...graph.outboundEdges(frontierId2)];
   for (const edgeId of inbound) {
     const edge = graph.getEdgeAttributes(edgeId);
-    rebuildEdge(graph, edge, edge.source, serviceId15, edgeId);
+    rebuildEdge(graph, edge, edge.source, serviceId16, edgeId);
   }
   for (const edgeId of outbound) {
     const edge = graph.getEdgeAttributes(edgeId);
-    rebuildEdge(graph, edge, serviceId15, edge.target, edgeId);
+    rebuildEdge(graph, edge, serviceId16, edge.target, edgeId);
   }
 }
 function rebuildEdge(graph, edge, newSource, newTarget, oldEdgeId) {
@@ -7872,9 +7872,9 @@ var K8S_KINDS_WITH_HOSTNAMES = /* @__PURE__ */ new Set([
   "StatefulSet",
   "DaemonSet"
 ]);
-function addAliases(graph, serviceId15, candidates) {
-  if (!graph.hasNode(serviceId15)) return;
-  const node = graph.getNodeAttributes(serviceId15);
+function addAliases(graph, serviceId16, candidates) {
+  if (!graph.hasNode(serviceId16)) return;
+  const node = graph.getNodeAttributes(serviceId16);
   if (node.type !== import_types19.NodeType.ServiceNode) return;
   const set = new Set(node.aliases ?? []);
   for (const c of candidates) {
@@ -7884,7 +7884,7 @@ function addAliases(graph, serviceId15, candidates) {
   }
   if (set.size === 0) return;
   const updated = { ...node, aliases: [...set].sort() };
-  graph.replaceNodeAttributes(serviceId15, updated);
+  graph.replaceNodeAttributes(serviceId16, updated);
 }
 function indexServicesByName(services) {
   const map = /* @__PURE__ */ new Map();
@@ -7904,9 +7904,9 @@ async function collectComposeAliases(graph, scanPath, serviceIndex) {
     }
   }
   if (!composePath) return;
-  let compose;
+  let compose2;
   try {
-    compose = await readYaml(composePath);
+    compose2 = await readYaml(composePath);
   } catch (err) {
     recordExtractionError(
       "aliases compose",
@@ -7915,14 +7915,14 @@ async function collectComposeAliases(graph, scanPath, serviceIndex) {
     );
     return;
   }
-  if (!compose?.services) return;
-  for (const [composeName, svc] of Object.entries(compose.services)) {
-    const serviceId15 = serviceIndex.get(composeName);
-    if (!serviceId15) continue;
+  if (!compose2?.services) return;
+  for (const [composeName, svc] of Object.entries(compose2.services)) {
+    const serviceId16 = serviceIndex.get(composeName);
+    if (!serviceId16) continue;
     const aliases = /* @__PURE__ */ new Set([composeName]);
     if (svc.container_name) aliases.add(svc.container_name);
     if (svc.hostname) aliases.add(svc.hostname);
-    addAliases(graph, serviceId15, aliases);
+    addAliases(graph, serviceId16, aliases);
   }
 }
 var LABEL_KEYS = /* @__PURE__ */ new Set([
@@ -9912,12 +9912,12 @@ async function resolveConfigs(literals, keys, serviceDir, looksLike, parse12) {
     const value = await interpolateEnvRefs(raw, serviceDir);
     if (!looksLike(value)) continue;
     const parsed = parse12(value);
-    if (parsed) out.push(parsed);
+    if (parsed) out.push({ ...parsed, hostSource: "config" });
   }
   for (const lit of literals) {
     if (!looksLike(lit)) continue;
     const parsed = parse12(lit);
-    if (parsed) out.push(parsed);
+    if (parsed) out.push({ ...parsed, hostSource: "literal" });
   }
   return out;
 }
@@ -10186,7 +10186,10 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
         type: import_types23.EdgeType.CONNECTS_TO,
         provenance: import_types23.Provenance.EXTRACTED,
         confidence: (0, import_types23.confidenceForExtracted)("structural"),
-        evidence: { file: evidenceFile }
+        // Carry how the host was recovered (ADR-213) so the divergence ranker
+        // can tell a real declared store from a hardcoded fault-injection /
+        // flag-gated probe. Only set when the parser distinguished the two.
+        evidence: config.hostSource ? { file: evidenceFile, hostSource: config.hostSource } : { file: evidenceFile }
       };
       if (!graph.hasEdge(edge.id)) {
         graph.addEdgeWithKey(edge.id, edge.source, edge.target, edge);
@@ -14475,9 +14478,9 @@ async function addComposeInfra(graph, scanPath, services) {
     }
   }
   if (!composePath) return { nodesAdded, edgesAdded };
-  let compose;
+  let compose2;
   try {
-    compose = await readYaml(composePath);
+    compose2 = await readYaml(composePath);
   } catch (err) {
     recordExtractionError(
       "infra docker-compose",
@@ -14486,10 +14489,10 @@ async function addComposeInfra(graph, scanPath, services) {
     );
     return { nodesAdded, edgesAdded };
   }
-  if (!compose?.services) return { nodesAdded, edgesAdded };
+  if (!compose2?.services) return { nodesAdded, edgesAdded };
   const evidenceFile = import_node_path58.default.relative(scanPath, composePath).split(import_node_path58.default.sep).join("/");
   const composeNameToNodeId = /* @__PURE__ */ new Map();
-  for (const [composeName, svc] of Object.entries(compose.services)) {
+  for (const [composeName, svc] of Object.entries(compose2.services)) {
     const matchedServiceId = serviceNameToServiceNode(composeName, services);
     if (matchedServiceId) {
       composeNameToNodeId.set(composeName, matchedServiceId);
@@ -14503,7 +14506,7 @@ async function addComposeInfra(graph, scanPath, services) {
     }
     composeNameToNodeId.set(composeName, node.id);
   }
-  for (const [composeName, svc] of Object.entries(compose.services)) {
+  for (const [composeName, svc] of Object.entries(compose2.services)) {
     const sourceId = composeNameToNodeId.get(composeName);
     if (!sourceId) continue;
     for (const dep of dependsOnList(svc.depends_on)) {
@@ -15224,7 +15227,7 @@ async function addSupabaseProjects(graph, services, scanPath) {
 
 // src/extract/infra/index.ts
 async function addInfra(graph, scanPath, services) {
-  const compose = await addComposeInfra(graph, scanPath, services);
+  const compose2 = await addComposeInfra(graph, scanPath, services);
   const dockerfile = await addDockerfileRuntimes(graph, services, scanPath);
   const terraform = await addTerraformResources(graph, scanPath);
   const k8s = await addK8sResources(graph, scanPath);
@@ -15233,8 +15236,8 @@ async function addInfra(graph, scanPath, services) {
   const railway = await addRailwayServices(graph, services, scanPath);
   const supabase = await addSupabaseProjects(graph, services, scanPath);
   return {
-    nodesAdded: compose.nodesAdded + dockerfile.nodesAdded + terraform.nodesAdded + k8s.nodesAdded + cloudflare.nodesAdded + vercel.nodesAdded + railway.nodesAdded + supabase.nodesAdded,
-    edgesAdded: compose.edgesAdded + dockerfile.edgesAdded + terraform.edgesAdded + k8s.edgesAdded + cloudflare.edgesAdded + vercel.edgesAdded + railway.edgesAdded + supabase.edgesAdded
+    nodesAdded: compose2.nodesAdded + dockerfile.nodesAdded + terraform.nodesAdded + k8s.nodesAdded + cloudflare.nodesAdded + vercel.nodesAdded + railway.nodesAdded + supabase.nodesAdded,
+    edgesAdded: compose2.edgesAdded + dockerfile.edgesAdded + terraform.edgesAdded + k8s.edgesAdded + cloudflare.edgesAdded + vercel.edgesAdded + railway.edgesAdded + supabase.edgesAdded
   };
 }
 
@@ -15981,6 +15984,53 @@ function detectColumnDrift(node) {
 function involvesNode(d, nodeId) {
   return d.source === nodeId || d.target === nodeId;
 }
+function datastoreEverObserved(graph, nodeId) {
+  if (!graph.hasNode(nodeId)) return false;
+  const n = graph.getNodeAttributes(nodeId);
+  if (n.type === import_types57.NodeType.DatabaseNode) {
+    const via = n.discoveredVia;
+    if (via === "otel" || via === "merged") return true;
+  }
+  for (const edgeId of graph.inboundEdges(nodeId)) {
+    const e = graph.getEdgeAttributes(edgeId);
+    if (e.provenance === import_types57.Provenance.OBSERVED || e.provenance === import_types57.Provenance.STALE) return true;
+  }
+  return false;
+}
+function serviceHasObservedSameEngineStore(graph, buckets2, serviceId16, engine, excludeTarget) {
+  for (const bucket of buckets2.values()) {
+    if (bucket.type !== import_types57.EdgeType.CONNECTS_TO) continue;
+    if (bucket.source !== serviceId16) continue;
+    if (bucket.target === excludeTarget) continue;
+    if (!graph.hasNode(bucket.target)) continue;
+    const target = graph.getNodeAttributes(bucket.target);
+    if (target.type !== import_types57.NodeType.DatabaseNode) continue;
+    if (target.engine !== engine) continue;
+    if (bucket.observed || datastoreEverObserved(graph, bucket.target)) return true;
+  }
+  return false;
+}
+var DEAD_CODE_PROBE_CONFIDENCE = 0.1;
+function dampenDeadCodeProbes(graph, buckets2, all) {
+  return all.map((d) => {
+    if (d.type !== "missing-observed") return d;
+    if (!d.extracted || d.edgeType !== import_types57.EdgeType.CONNECTS_TO) return d;
+    if (!graph.hasNode(d.target)) return d;
+    const target = graph.getNodeAttributes(d.target);
+    if (target.type !== import_types57.NodeType.DatabaseNode) return d;
+    if (d.extracted.evidence?.hostSource !== "literal") return d;
+    if (datastoreEverObserved(graph, d.target)) return d;
+    const engine = target.engine;
+    if (!serviceHasObservedSameEngineStore(graph, buckets2, d.source, engine, d.target)) return d;
+    const host = target.host ?? target.name;
+    return {
+      ...d,
+      confidence: Math.min(d.confidence, DEAD_CODE_PROBE_CONFIDENCE),
+      reason: `${d.source} declares a ${engine} connection to a hardcoded-literal host (${host}) that production has never observed, while it does observe another ${engine} store \u2014 this reads as a flag-gated or dead-code declaration (e.g. a fault-injection probe), not a real declared-vs-observed gap.`,
+      recommendation: "Confirm this is an intentional dead alternate \u2014 a fault-injection probe or a flag-gated branch. If it is meant to run in production, check the feature flag or conditional that gates it; if not, it can be ignored or removed."
+    };
+  });
+}
 function suppressHostMismatchHalves(all) {
   const observedHalf = /* @__PURE__ */ new Set();
   const declaredHalf = /* @__PURE__ */ new Set();
@@ -16017,7 +16067,8 @@ function computeDivergences(graph, opts = {}) {
     }
   });
   const reconciled = suppressHostMismatchHalves(all);
-  let filtered = reconciled;
+  const dampened = dampenDeadCodeProbes(graph, buckets2, reconciled);
+  let filtered = dampened;
   if (opts.type) {
     const allowed = opts.type;
     filtered = filtered.filter((d) => allowed.has(d.type));
@@ -16343,7 +16394,7 @@ var import_chokidar = __toESM(require("chokidar"), 1);
 init_cjs_shims();
 var import_fastify2 = __toESM(require("fastify"), 1);
 var import_cors = __toESM(require("@fastify/cors"), 1);
-var import_types93 = require("@neat.is/types");
+var import_types94 = require("@neat.is/types");
 
 // src/extend/index.ts
 init_cjs_shims();
@@ -16733,6 +16784,639 @@ function queryLogEntries(opts) {
   return merged;
 }
 
+// src/ask.ts
+init_cjs_shims();
+var import_types60 = require("@neat.is/types");
+var DEFAULT_MAX_NODES = 3;
+var MAX_FACTS_PER_SECTION = 6;
+var INTENT_RULES = [
+  {
+    intent: "root-cause",
+    test: /\b(why|root[\s-]?cause|failing|fail(?:s|ed)?|breaking|broke(?:n)?|crash(?:ing|ed)?|throw(?:ing|s)?|culprit|5\d\d)\b/
+  },
+  {
+    intent: "blast-radius",
+    test: /\b(blast|break[\s-]?if|breaks[\s-]?if|impact|downstream|dependents?|redeploy|who\s+(?:uses|calls|depends)|what\s+depends\s+on|affect(?:s|ed)?)\b/
+  },
+  {
+    intent: "divergence",
+    test: /\b(diverg\w*|weird|mismatch|drift|out\s+of\s+sync|inconsistent|disagree\w*|declared\s+vs|anything\s+wrong)\b/
+  },
+  {
+    intent: "incidents",
+    test: /\b(incidents?|recent\s+(?:errors?|failures?)|error\s+history|failure\s+history)\b/
+  },
+  {
+    intent: "observed",
+    test: /\b(at\s+runtime|in\s+prod(?:uction)?|actually\s+call\w*|really\s+call\w*|observed|runtime\s+traffic)\b/
+  },
+  {
+    intent: "dependencies",
+    test: /\b(depend\w*|calls?|uses?|imports?|relies\s+on|needs?)\b/
+  }
+];
+function classifyIntent(question) {
+  const q = question.toLowerCase();
+  for (const rule of INTENT_RULES) {
+    if (rule.test.test(q)) return rule.intent;
+  }
+  return "overview";
+}
+var STOPWORDS = /* @__PURE__ */ new Set([
+  "the",
+  "a",
+  "an",
+  "is",
+  "are",
+  "was",
+  "were",
+  "be",
+  "been",
+  "being",
+  "of",
+  "to",
+  "in",
+  "on",
+  "at",
+  "by",
+  "for",
+  "with",
+  "and",
+  "or",
+  "but",
+  "if",
+  "as",
+  "this",
+  "that",
+  "these",
+  "those",
+  "it",
+  "its",
+  "do",
+  "does",
+  "did",
+  "has",
+  "have",
+  "had",
+  "what",
+  "which",
+  "who",
+  "whom",
+  "how",
+  "when",
+  "where",
+  "my",
+  "me",
+  "i",
+  "we",
+  "you",
+  "they",
+  "them",
+  "from",
+  "into",
+  "about",
+  "would",
+  "will",
+  "can",
+  "could",
+  "should",
+  "anything",
+  "everything",
+  "something",
+  "all",
+  "any",
+  "some",
+  "no",
+  "not",
+  "so",
+  "up",
+  "out",
+  "over",
+  "get",
+  "got",
+  "show",
+  "tell",
+  "explain",
+  "find",
+  "give",
+  "happen",
+  "happens",
+  "happening",
+  "here",
+  "there",
+  "system",
+  "code",
+  "service",
+  "node",
+  "graph"
+]);
+var INTENT_WORDS = /* @__PURE__ */ new Set([
+  "why",
+  "root",
+  "cause",
+  "failing",
+  "fail",
+  "fails",
+  "failed",
+  "breaking",
+  "broke",
+  "broken",
+  "crash",
+  "crashing",
+  "crashed",
+  "throw",
+  "throwing",
+  "throws",
+  "culprit",
+  "blast",
+  "radius",
+  "break",
+  "breaks",
+  "impact",
+  "downstream",
+  "dependent",
+  "dependents",
+  "redeploy",
+  "affect",
+  "affects",
+  "affected",
+  "diverge",
+  "divergence",
+  "divergences",
+  "weird",
+  "mismatch",
+  "drift",
+  "inconsistent",
+  "disagree",
+  "declared",
+  "observed",
+  "incident",
+  "incidents",
+  "recent",
+  "errors",
+  "error",
+  "failures",
+  "failure",
+  "history",
+  "runtime",
+  "production",
+  "prod",
+  "traffic",
+  "actually",
+  "really",
+  "depend",
+  "depends",
+  "dependency",
+  "dependencies",
+  "call",
+  "calls",
+  "use",
+  "uses",
+  "using",
+  "import",
+  "imports",
+  "relies",
+  "rely",
+  "needs",
+  "need",
+  "sync"
+]);
+function tokens(input) {
+  const spaced = input.replace(/([a-z0-9])([A-Z])/g, "$1 $2");
+  return (spaced.toLowerCase().match(/[a-z0-9]+/g) ?? []).filter((t) => t.length >= 2);
+}
+function queryTokens(question) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const t of tokens(question)) {
+    if (STOPWORDS.has(t) || INTENT_WORDS.has(t)) continue;
+    if (seen.has(t)) continue;
+    seen.add(t);
+    out.push(t);
+  }
+  return out;
+}
+function nodeName(node) {
+  return node.name ?? node.id;
+}
+function idBody(id) {
+  const colon = id.indexOf(":");
+  return colon >= 0 ? id.slice(colon + 1) : id;
+}
+var EMBED_MIN_SCORE = 0.35;
+async function resolveEntities(graph, question, searchIndex, maxNodes) {
+  const qTokens = queryTokens(question);
+  const normalized = question.toLowerCase();
+  const best = /* @__PURE__ */ new Map();
+  const consider = (cand) => {
+    const cur = best.get(cand.nodeId);
+    if (!cur || cand.score > cur.score) best.set(cand.nodeId, cand);
+  };
+  graph.forEachNode((id, attrs) => {
+    const node = attrs;
+    if (node.type === import_types60.NodeType.FrontierNode) return;
+    const name = nodeName(node);
+    const body = idBody(id);
+    const labelTokens = /* @__PURE__ */ new Set([...tokens(body), ...tokens(name)]);
+    if (labelTokens.size === 0) return;
+    let matched = 0;
+    for (const t of qTokens) if (labelTokens.has(t)) matched += 1;
+    const named = body.length >= 2 && normalized.includes(body.toLowerCase()) || name.length >= 2 && normalized.includes(name.toLowerCase());
+    if (matched === 0 && !named) return;
+    const coverage = qTokens.length > 0 ? matched / qTokens.length : 0;
+    const via = named ? "id" : matched > 0 && tokens(name).some((t) => qTokens.includes(t)) ? "label" : "token";
+    const score = named ? Math.max(0.9, coverage) : Math.min(0.85, 0.3 + 0.7 * coverage);
+    consider({ nodeId: id, label: name, via, score: Math.min(1, score) });
+  });
+  if (searchIndex) {
+    try {
+      const res = await searchIndex.search(question, 10);
+      if (res.provider !== "substring") {
+        for (const m of res.matches) {
+          if (m.node.type === import_types60.NodeType.FrontierNode) continue;
+          const already = best.get(m.node.id);
+          if (!already && m.score < EMBED_MIN_SCORE) continue;
+          consider({
+            nodeId: m.node.id,
+            label: nodeName(m.node),
+            via: "embedding",
+            score: Math.max(0, Math.min(1, m.score))
+          });
+        }
+      }
+    } catch {
+    }
+  }
+  const viaRank = { id: 3, label: 2, token: 1, embedding: 0 };
+  return [...best.values()].sort(
+    (a, b) => b.score - a.score || viaRank[b.via] - viaRank[a.via] || a.nodeId.localeCompare(b.nodeId)
+  ).slice(0, maxNodes).map((s) => ({ nodeId: s.nodeId, label: s.label, via: s.via, score: Number(s.score.toFixed(3)) }));
+}
+function incidentsForNode(nodeId, incidents) {
+  if (!incidents || incidents.length === 0) return [];
+  const svc = nodeId.replace(/^service:/, "");
+  return incidents.filter((e) => e.affectedNode === nodeId || e.service === svc);
+}
+function edgeSignalNote(e) {
+  const bits = [];
+  if (e.signal) {
+    bits.push(`${e.signal.spanCount} spans`);
+    if (e.signal.errorCount > 0) bits.push(`${e.signal.errorCount} errors`);
+    if (e.signal.latencyMs?.p95 !== void 0) bits.push(`p95 ${Math.round(e.signal.latencyMs.p95)}ms`);
+  } else if (e.callCount !== void 0) {
+    bits.push(`${e.callCount} calls`);
+  }
+  return bits.length ? ` (${bits.join(", ")})` : "";
+}
+function buildRootCauseSection(graph, node, incidents, now) {
+  const result = getRootCause(graph, node, void 0, incidents, { now });
+  if (!result) return null;
+  const lastProv = result.edgeProvenances[result.edgeProvenances.length - 1] ?? import_types60.Provenance.OBSERVED;
+  const facts = [
+    {
+      text: `Root cause: ${result.rootCauseNode} \u2014 ${result.rootCauseReason}`,
+      provenance: lastProv,
+      confidence: result.confidence
+    }
+  ];
+  const candidates = result.candidates ?? [];
+  for (const c of candidates.slice(0, 3)) {
+    facts.push({
+      text: `Candidate ${c.node} \u2014 ${c.classification}: ${c.reason}`,
+      ...c.provenance ? { provenance: c.provenance } : {},
+      confidence: c.confidence
+    });
+  }
+  if (result.traversalPath.length > 1) {
+    facts.push({ text: `Traversal: ${result.traversalPath.join(" \u2190 ")}` });
+  }
+  if (result.fixRecommendation) {
+    facts.push({ text: `Recommended fix: ${result.fixRecommendation}` });
+  }
+  return { heading: "Root cause (navigation)", facts: facts.slice(0, MAX_FACTS_PER_SECTION) };
+}
+function buildDependenciesSection(graph, node) {
+  const result = getTransitiveDependencies(graph, node, 2);
+  if (result.total === 0) return null;
+  const facts = result.dependencies.slice(0, MAX_FACTS_PER_SECTION).map((d) => ({
+    text: `${d.nodeId} \u2014 ${d.edgeType} (distance ${d.distance})`,
+    // Per-fact provenance: the transitive walk mixes EXTRACTED and OBSERVED
+    // edges, so the tag is on the fact, not asserted for the whole section.
+    provenance: d.provenance
+  }));
+  return { heading: "Dependencies", facts };
+}
+function buildObservedSection(graph, node) {
+  const result = getObservedDependencies(graph, node);
+  const facts = [];
+  for (const e of result.dependencies.slice(0, MAX_FACTS_PER_SECTION)) {
+    const via = e.source !== node ? ` via ${e.source}` : "";
+    facts.push({
+      text: `calls ${e.target}${via}${edgeSignalNote(e)}`,
+      provenance: e.provenance,
+      confidence: confidenceForEdge(e)
+    });
+  }
+  if (facts.length === 0) {
+    if (result.observed && result.inboundObservedCount > 0) {
+      facts.push({
+        text: `no outbound runtime calls, but OTel observed ${result.inboundObservedCount} inbound call path${result.inboundObservedCount === 1 ? "" : "s"} \u2014 a pure receiver`,
+        provenance: import_types60.Provenance.OBSERVED
+      });
+    } else {
+      return null;
+    }
+  }
+  return { heading: "Runtime dependencies (OBSERVED)", facts };
+}
+function buildBlastSection(graph, node) {
+  const result = getBlastRadius(graph, node);
+  if (result.totalAffected === 0) return null;
+  const facts = result.affectedNodes.slice(0, MAX_FACTS_PER_SECTION).map((n) => ({
+    text: `${n.nodeId} (distance ${n.distance})`,
+    provenance: n.edgeProvenance,
+    confidence: n.confidence
+  }));
+  return {
+    heading: `Blast radius \u2014 ${result.totalAffected} dependent${result.totalAffected === 1 ? "" : "s"}`,
+    facts
+  };
+}
+function buildIncidentsSection(node, incidents) {
+  const relevant = incidentsForNode(node, incidents);
+  if (relevant.length === 0) return null;
+  const ordered = [...relevant].sort((a, b) => b.timestamp.localeCompare(a.timestamp)).slice(0, 4);
+  const facts = ordered.map((ev) => ({
+    text: `${ev.timestamp} \u2014 ${ev.service}: ${ev.errorMessage}`,
+    // ErrorEvents are observation records — OBSERVED by definition.
+    provenance: import_types60.Provenance.OBSERVED
+  }));
+  return { heading: `Recent incidents (OBSERVED) \u2014 ${relevant.length} recorded`, facts };
+}
+function divergenceLine(d) {
+  if ((d.type === "missing-observed" || d.type === "missing-extracted") && d.column) {
+    return `[${d.type}] ${d.table ?? d.source} column ${d.column} \u2014 ${d.reason}`;
+  }
+  return `[${d.type}] ${d.source} \u2192 ${d.target} \u2014 ${d.reason}`;
+}
+function buildDivergenceSection(graph, node) {
+  const result = computeDivergences(graph, { node });
+  if (result.totalAffected === 0) return null;
+  const facts = result.divergences.slice(0, MAX_FACTS_PER_SECTION).map((d) => ({
+    text: divergenceLine(d),
+    confidence: d.confidence
+    // A divergence is composite by construction (EXTRACTED vs OBSERVED), so it
+    // carries no single provenance — the fact leaves it unset.
+  }));
+  return {
+    heading: `Divergences (EXTRACTED vs OBSERVED) \u2014 ${result.totalAffected}`,
+    facts
+  };
+}
+function buildGlobalDivergenceSection(graph) {
+  const result = computeDivergences(graph);
+  if (result.totalAffected === 0) {
+    return {
+      heading: "Divergences (EXTRACTED vs OBSERVED)",
+      facts: [{ text: "None \u2014 declared code and observed runtime agree across the graph." }]
+    };
+  }
+  const facts = result.divergences.slice(0, MAX_FACTS_PER_SECTION).map((d) => ({
+    text: divergenceLine(d),
+    confidence: d.confidence
+    // Composite by construction (EXTRACTED vs OBSERVED), so no single provenance.
+  }));
+  return {
+    heading: `Divergences (EXTRACTED vs OBSERVED) \u2014 ${result.totalAffected}`,
+    facts
+  };
+}
+function buildGlobalIncidentsSection(incidents) {
+  if (!incidents || incidents.length === 0) {
+    return {
+      heading: "Incidents across the system",
+      facts: [{ text: "None recorded \u2014 the OBSERVED incident store is empty." }]
+    };
+  }
+  const byKey = /* @__PURE__ */ new Map();
+  for (const ev of incidents) {
+    const key = ev.affectedNode || (0, import_types60.serviceId)(ev.service);
+    const cur = byKey.get(key);
+    if (!cur) {
+      byKey.set(key, { key, count: 1, latest: ev.timestamp, sampleMsg: ev.errorMessage });
+    } else {
+      cur.count += 1;
+      if (ev.timestamp > cur.latest) {
+        cur.latest = ev.timestamp;
+        cur.sampleMsg = ev.errorMessage;
+      }
+    }
+  }
+  const rows = [...byKey.values()].sort((a, b) => b.count - a.count || b.latest.localeCompare(a.latest) || a.key.localeCompare(b.key)).slice(0, MAX_FACTS_PER_SECTION);
+  const facts = rows.map((r) => ({
+    text: `${r.key} \u2014 ${r.count} incident${r.count === 1 ? "" : "s"}, latest ${r.latest}: ${r.sampleMsg}`,
+    provenance: import_types60.Provenance.OBSERVED
+  }));
+  return {
+    heading: `Incidents across the system \u2014 ${incidents.length} recorded`,
+    facts
+  };
+}
+function buildOverviewSections(graph, incidents) {
+  const nodeByType = /* @__PURE__ */ new Map();
+  const services = [];
+  graph.forEachNode((_id, attrs) => {
+    const node = attrs;
+    nodeByType.set(node.type, (nodeByType.get(node.type) ?? 0) + 1);
+    if (node.type === import_types60.NodeType.ServiceNode) services.push(node.id);
+  });
+  const edgeByProv = /* @__PURE__ */ new Map();
+  graph.forEachEdge((_id, attrs) => {
+    const p = attrs.provenance;
+    edgeByProv.set(p, (edgeByProv.get(p) ?? 0) + 1);
+  });
+  const sections = [];
+  const count = (t) => nodeByType.get(t) ?? 0;
+  const shapeFacts = [
+    { text: `${graph.order} nodes, ${graph.size} edges` },
+    {
+      text: `${count(import_types60.NodeType.ServiceNode)} services, ${count(import_types60.NodeType.FileNode)} files, ${count(import_types60.NodeType.SymbolNode)} symbols, ${count(import_types60.NodeType.DatabaseNode)} databases`
+    }
+  ];
+  for (const p of [import_types60.Provenance.EXTRACTED, import_types60.Provenance.OBSERVED, import_types60.Provenance.INFERRED, import_types60.Provenance.STALE]) {
+    const n = edgeByProv.get(p) ?? 0;
+    if (n > 0) shapeFacts.push({ text: `${n} ${p} edge${n === 1 ? "" : "s"}`, provenance: p });
+  }
+  sections.push({ heading: "System shape", facts: shapeFacts });
+  const depCounts = services.map((s) => ({ s, n: getTransitiveDependencies(graph, s, 1).total })).filter((r) => r.n > 0).sort((a, b) => b.n - a.n || a.s.localeCompare(b.s)).slice(0, MAX_FACTS_PER_SECTION);
+  if (depCounts.length > 0) {
+    sections.push({
+      heading: "Busiest services (by direct dependencies)",
+      facts: depCounts.map((r) => ({
+        text: `${r.s} \u2014 ${r.n} direct dependenc${r.n === 1 ? "y" : "ies"}`
+      }))
+    });
+  }
+  if (incidents && incidents.length > 0) {
+    const incCount = /* @__PURE__ */ new Map();
+    for (const ev of incidents) {
+      const key = ev.affectedNode || (0, import_types60.serviceId)(ev.service);
+      incCount.set(key, (incCount.get(key) ?? 0) + 1);
+    }
+    const top = [...incCount.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).slice(0, MAX_FACTS_PER_SECTION);
+    sections.push({
+      heading: `Nodes with incidents \u2014 ${incidents.length} recorded`,
+      facts: top.map(([k, n]) => ({
+        text: `${k} \u2014 ${n} incident${n === 1 ? "" : "s"}`,
+        provenance: import_types60.Provenance.OBSERVED
+      }))
+    });
+  }
+  const div = computeDivergences(graph);
+  sections.push({
+    heading: "Divergences",
+    facts: [
+      {
+        text: div.totalAffected === 0 ? "None \u2014 declared code and observed runtime agree across the graph." : `${div.totalAffected} divergence${div.totalAffected === 1 ? "" : "s"} between declared code and observed runtime \u2014 ask "are there any divergences?" for the list.`
+      }
+    ]
+  });
+  return sections;
+}
+function buildGlobalSections(intent, graph, incidents) {
+  switch (intent) {
+    case "divergence":
+      return [buildGlobalDivergenceSection(graph)];
+    case "incidents":
+      return [buildGlobalIncidentsSection(incidents)];
+    case "overview":
+      return buildOverviewSections(graph, incidents);
+    default:
+      return null;
+  }
+}
+var SECTION_ORDER = {
+  "root-cause": ["root-cause", "incidents", "blast", "observed", "divergence"],
+  "blast-radius": ["blast", "dependencies", "observed", "incidents"],
+  dependencies: ["dependencies", "observed", "blast"],
+  observed: ["observed", "dependencies", "incidents"],
+  incidents: ["incidents", "root-cause", "observed"],
+  divergence: ["divergence", "observed", "dependencies", "incidents"],
+  overview: ["dependencies", "observed", "blast", "incidents", "divergence"]
+};
+function buildSection(kind, graph, node, incidents, now) {
+  switch (kind) {
+    case "root-cause":
+      return buildRootCauseSection(graph, node, incidents, now);
+    case "dependencies":
+      return buildDependenciesSection(graph, node);
+    case "observed":
+      return buildObservedSection(graph, node);
+    case "blast":
+      return buildBlastSection(graph, node);
+    case "incidents":
+      return buildIncidentsSection(node, incidents);
+    case "divergence":
+      return buildDivergenceSection(graph, node);
+  }
+}
+function summarizeGlobal(intent, sections) {
+  const lead = sections[0];
+  switch (intent) {
+    case "divergence": {
+      const none = lead?.facts[0]?.text.startsWith("None") ?? true;
+      return none ? "No divergences across the graph \u2014 declared code and observed runtime agree." : `${lead.heading} across the graph, highest-confidence first below.`;
+    }
+    case "incidents": {
+      const none = lead?.facts[0]?.text.startsWith("None") ?? true;
+      return none ? "No incidents recorded across the system \u2014 the OBSERVED incident store is empty." : `${lead.heading}, aggregated by node below.`;
+    }
+    case "overview":
+    default:
+      return `System overview across the whole graph: ${sections.length} view${sections.length === 1 ? "" : "s"} below \u2014 shape (nodes/edges by provenance), busiest services, incidents, and divergences.`;
+  }
+}
+function summarize(question, intent, matched, primary, sections, scope) {
+  if (scope === "global") {
+    return summarizeGlobal(intent, sections);
+  }
+  if (!primary) {
+    return `Nothing in "${question}" resolved to a node in the graph. Name a service, file, route, or table \u2014 e.g. \`ask "what does <service> depend on?"\`. For a graph-wide look, ask for an overview, divergences, or incidents.`;
+  }
+  const lead = sections[0];
+  const others = matched.slice(1);
+  const alsoNote = others.length ? ` Also matched: ${others.map((m) => m.nodeId).join(", ")}.` : "";
+  let core;
+  switch (intent) {
+    case "root-cause": {
+      const rc = sections.find((s) => s.heading === "Root cause (navigation)");
+      if (rc) {
+        core = rc.facts[0]?.text ?? "";
+      } else if (lead) {
+        core = `No root cause surfaced for ${primary} \u2014 it may be healthy, or the failure isn't recorded. Nearest context: ${lead.heading.toLowerCase()}.`;
+      } else {
+        core = `No root cause surfaced for ${primary} \u2014 it may be healthy.`;
+      }
+      break;
+    }
+    case "blast-radius":
+      core = lead ? `${lead.heading} of ${primary}.` : `${primary} has no dependents \u2014 nothing else would break if it failed.`;
+      break;
+    case "dependencies":
+      core = lead ? `${primary}: ${lead.heading.toLowerCase()} listed below.` : `${primary} has no declared dependencies in the graph.`;
+      break;
+    case "observed":
+      core = lead ? `${primary} at runtime: ${lead.facts.length} OBSERVED fact${lead.facts.length === 1 ? "" : "s"}.` : `No runtime traffic OBSERVED for ${primary}.`;
+      break;
+    case "incidents":
+      core = lead ? `${primary}: ${lead.heading.toLowerCase()}.` : `No incidents recorded against ${primary}.`;
+      break;
+    case "divergence":
+      core = lead ? `${lead.heading} involving ${primary}.` : `No divergences involve ${primary} \u2014 declared and observed agree here.`;
+      break;
+    default:
+      core = `${primary}: ${sections.length} view${sections.length === 1 ? "" : "s"} of its fused local context below.`;
+  }
+  return `${core}${alsoNote}`;
+}
+async function askGraph(graph, question, opts = {}) {
+  const now = opts.now ?? Date.now();
+  const maxNodes = opts.maxNodes ?? DEFAULT_MAX_NODES;
+  const intent = classifyIntent(question);
+  const matched = await resolveEntities(graph, question, opts.searchIndex, maxNodes);
+  const primary = matched[0]?.nodeId;
+  const sections = [];
+  let scope;
+  if (primary) {
+    scope = "node";
+    for (const kind of SECTION_ORDER[intent]) {
+      const s = buildSection(kind, graph, primary, opts.incidents, now);
+      if (s && s.facts.length > 0) sections.push(s);
+    }
+  } else {
+    const global = buildGlobalSections(intent, graph, opts.incidents);
+    if (global) {
+      scope = "global";
+      for (const s of global) if (s.facts.length > 0) sections.push(s);
+    }
+  }
+  const answer = summarize(question, intent, matched, primary, sections, scope);
+  const provSet = /* @__PURE__ */ new Set();
+  for (const s of sections) for (const f of s.facts) if (f.provenance) provSet.add(f.provenance);
+  const confidence = sections[0]?.facts[0]?.confidence;
+  return import_types60.AskResultSchema.parse({
+    question,
+    intent,
+    matched,
+    ...primary ? { primaryNode: primary } : {},
+    ...scope ? { scope } : {},
+    sections,
+    answer,
+    ...confidence !== void 0 ? { confidence } : {},
+    provenance: [...provSet]
+  });
+}
+
 // src/diff.ts
 init_cjs_shims();
 var import_node_fs38 = require("fs");
@@ -16867,7 +17551,7 @@ init_cjs_shims();
 var import_node_fs39 = require("fs");
 var import_node_os3 = __toESM(require("os"), 1);
 var import_node_path74 = __toESM(require("path"), 1);
-var import_types60 = require("@neat.is/types");
+var import_types61 = require("@neat.is/types");
 var LOCK_TIMEOUT_MS = 5e3;
 var LOCK_RETRY_MS = 50;
 function neatHome() {
@@ -17121,10 +17805,10 @@ async function readRegistry() {
     throw err;
   }
   const parsed = JSON.parse(raw);
-  return import_types60.RegistryFileSchema.parse(parsed);
+  return import_types61.RegistryFileSchema.parse(parsed);
 }
 async function writeRegistry(reg) {
-  const validated = import_types60.RegistryFileSchema.parse(reg);
+  const validated = import_types61.RegistryFileSchema.parse(reg);
   await writeAtomically(registryPath(), JSON.stringify(validated, null, 2) + "\n");
 }
 var ProjectNameCollisionError = class extends Error {
@@ -17637,15 +18321,15 @@ function getConnectorStatus(id, now = Date.now(), thresholdMs = CONNECTOR_STALE_
 
 // src/connectors/index.ts
 init_cjs_shims();
-var import_types61 = require("@neat.is/types");
+var import_types62 = require("@neat.is/types");
 var NO_ENV = "unknown";
 function staticCallSiteFor(graph, serviceName, targetNodeId) {
   if (!graph.hasNode(targetNodeId)) return void 0;
   const sites = [];
   for (const edgeId of graph.inboundEdges(targetNodeId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.provenance !== import_types61.Provenance.EXTRACTED) continue;
-    const parsed = (0, import_types61.parseFileId)(edge.source);
+    if (edge.provenance !== import_types62.Provenance.EXTRACTED) continue;
+    const parsed = (0, import_types62.parseFileId)(edge.source);
     if (!parsed || parsed.service !== serviceName || !edge.evidence) continue;
     const site = { relPath: edge.evidence.file };
     if (edge.evidence.line !== void 0) site.line = edge.evidence.line;
@@ -17656,7 +18340,7 @@ function staticCallSiteFor(graph, serviceName, targetNodeId) {
 function routeCallSiteFor(graph, targetNodeId) {
   if (!graph.hasNode(targetNodeId)) return void 0;
   const attrs = graph.getNodeAttributes(targetNodeId);
-  if (attrs.type !== import_types61.NodeType.RouteNode || !attrs.path) return void 0;
+  if (attrs.type !== import_types62.NodeType.RouteNode || !attrs.path) return void 0;
   const site = { relPath: attrs.path };
   if (attrs.line !== void 0) site.line = attrs.line;
   return site;
@@ -18154,10 +18838,10 @@ var SUPABASE_RPC_TARGET_KIND = "supabase-rpc";
 // src/connectors/supabase/map.ts
 var REST_RPC_PATH_RE = /^\/rest\/v1\/rpc\/([^/?]+)/;
 var REST_TABLE_PATH_RE = /^\/rest\/v1\/([^/?]+)/;
-function targetFromRestPath(path92) {
-  const rpcMatch = REST_RPC_PATH_RE.exec(path92);
+function targetFromRestPath(path93) {
+  const rpcMatch = REST_RPC_PATH_RE.exec(path93);
   if (rpcMatch) return { targetKind: SUPABASE_RPC_TARGET_KIND, name: rpcMatch[1] };
-  const tableMatch = REST_TABLE_PATH_RE.exec(path92);
+  const tableMatch = REST_TABLE_PATH_RE.exec(path93);
   if (tableMatch) return { targetKind: SUPABASE_TABLE_TARGET_KIND, name: tableMatch[1] };
   return null;
 }
@@ -18268,23 +18952,23 @@ async function fetchPgStatStatements(connectionString, limit = DEFAULT_STATEMENT
 
 // src/connectors/supabase/resolve.ts
 init_cjs_shims();
-var import_types63 = require("@neat.is/types");
+var import_types64 = require("@neat.is/types");
 function createSupabaseResolveTarget(graph, config) {
   return (signal, _ctx) => {
     if (signal.targetKind !== SUPABASE_TABLE_TARGET_KIND && signal.targetKind !== SUPABASE_RPC_TARGET_KIND) {
       return null;
     }
-    const subResourceId = (0, import_types63.infraId)(signal.targetKind, `${config.nodeRef}/${signal.targetName}`);
+    const subResourceId = (0, import_types64.infraId)(signal.targetKind, `${config.nodeRef}/${signal.targetName}`);
     if (graph.hasNode(subResourceId)) {
-      return { targetNodeId: subResourceId, serviceName: config.serviceName, edgeType: import_types63.EdgeType.CALLS };
+      return { targetNodeId: subResourceId, serviceName: config.serviceName, edgeType: import_types64.EdgeType.CALLS };
     }
-    const bareResourceId = (0, import_types63.infraId)(signal.targetKind, signal.targetName);
+    const bareResourceId = (0, import_types64.infraId)(signal.targetKind, signal.targetName);
     if (graph.hasNode(bareResourceId)) {
-      return { targetNodeId: bareResourceId, serviceName: config.serviceName, edgeType: import_types63.EdgeType.CALLS };
+      return { targetNodeId: bareResourceId, serviceName: config.serviceName, edgeType: import_types64.EdgeType.CALLS };
     }
-    const projectLevelId = (0, import_types63.infraId)("supabase", config.nodeRef);
+    const projectLevelId = (0, import_types64.infraId)("supabase", config.nodeRef);
     if (graph.hasNode(projectLevelId)) {
-      return { targetNodeId: projectLevelId, serviceName: config.serviceName, edgeType: import_types63.EdgeType.CALLS };
+      return { targetNodeId: projectLevelId, serviceName: config.serviceName, edgeType: import_types64.EdgeType.CALLS };
     }
     return null;
   };
@@ -18377,7 +19061,7 @@ function createSupabaseConnector(graph, config, deps = {}) {
 
 // src/connectors/railway/index.ts
 init_cjs_shims();
-var import_types67 = require("@neat.is/types");
+var import_types68 = require("@neat.is/types");
 
 // src/connectors/railway/client.ts
 init_cjs_shims();
@@ -18528,7 +19212,7 @@ function buildRailwayRouteIndex(graph, serviceName) {
   const out = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types67.NodeType.RouteNode) return;
+    if (node.type !== import_types68.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     out.push({
@@ -18632,12 +19316,12 @@ function createRailwayResolveTarget(config) {
     const serviceName = config.serviceNameById[config.serviceId];
     if (!serviceName) return null;
     if (signal.targetKind === ROUTE_TARGET_KIND) {
-      return { targetNodeId: signal.targetName, serviceName, edgeType: import_types67.EdgeType.CALLS };
+      return { targetNodeId: signal.targetName, serviceName, edgeType: import_types68.EdgeType.CALLS };
     }
     if (signal.targetKind === PEER_SERVICE_TARGET_KIND) {
       const peerName = config.serviceNameById[signal.targetName];
       if (!peerName) return null;
-      return { targetNodeId: (0, import_types67.serviceId)(peerName), serviceName, edgeType: import_types67.EdgeType.CONNECTS_TO };
+      return { targetNodeId: (0, import_types68.serviceId)(peerName), serviceName, edgeType: import_types68.EdgeType.CONNECTS_TO };
     }
     return null;
   };
@@ -18761,9 +19445,9 @@ function parseFirebaseTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path92 = rest.slice(secondSep + 1);
-  if (!resourceName || !method || !path92) return null;
-  return { resourceName, method, path: path92 };
+  const path93 = rest.slice(secondSep + 1);
+  if (!resourceName || !method || !path93) return null;
+  return { resourceName, method, path: path93 };
 }
 function resourceNameFor(type, labels) {
   if (!labels) return null;
@@ -18801,14 +19485,14 @@ function mapLogEntryToSignal(entry2) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path92 = pathFromRequestUrl(req.requestUrl);
-  if (path92 === null) return null;
+  const path93 = pathFromRequestUrl(req.requestUrl);
+  if (path93 === null) return null;
   const timestamp = entry2.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD2;
   return {
     targetKind: resourceType,
-    targetName: packFirebaseTargetName({ resourceName, method, path: path92 }),
+    targetName: packFirebaseTargetName({ resourceName, method, path: path93 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -18825,7 +19509,7 @@ function mapLogEntriesToSignals(entries) {
 
 // src/connectors/firebase/resolve.ts
 init_cjs_shims();
-var import_types68 = require("@neat.is/types");
+var import_types69 = require("@neat.is/types");
 function neatServiceNameFor(resourceType, resourceName, serviceMap) {
   switch (resourceType) {
     case "cloud_function":
@@ -18840,7 +19524,7 @@ function routeEntriesFor(graph, serviceName) {
   const entries = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types68.NodeType.RouteNode) return;
+    if (node.type !== import_types69.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     entries.push({
@@ -18872,7 +19556,7 @@ function createFirebaseResolveTarget(graph, serviceMap) {
     return {
       targetNodeId: match.routeNodeId,
       serviceName,
-      edgeType: import_types68.EdgeType.CALLS
+      edgeType: import_types69.EdgeType.CALLS
     };
   };
 }
@@ -18899,7 +19583,7 @@ init_cjs_shims();
 
 // src/connectors/cloudflare/connector.ts
 init_cjs_shims();
-var import_types70 = require("@neat.is/types");
+var import_types71 = require("@neat.is/types");
 
 // src/connectors/cloudflare/client.ts
 init_cjs_shims();
@@ -19015,7 +19699,7 @@ function mapEventToSignal(event) {
   if (Number.isNaN(observedAt.getTime())) return null;
   const statusCode = metadata?.statusCode;
   const isError = typeof statusCode === "number" && statusCode >= ERROR_STATUS_THRESHOLD3;
-  const path92 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
+  const path93 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
   return {
     targetKind: CLOUDFLARE_TARGET_KIND,
     targetName: scriptName,
@@ -19023,7 +19707,7 @@ function mapEventToSignal(event) {
     errorCount: isError ? 1 : 0,
     lastObservedIso: observedAt.toISOString(),
     method,
-    ...path92 ? { path: path92 } : {},
+    ...path93 ? { path: path93 } : {},
     ...typeof statusCode === "number" ? { statusCode } : {},
     ...typeof metadata?.duration === "number" ? { duration: metadata.duration } : {}
   };
@@ -19063,19 +19747,19 @@ function findTaggedWorkerFileNode(graph, workerName) {
   graph.forEachNode((id, attrs) => {
     if (found) return;
     const a = attrs;
-    if (a.type === import_types70.NodeType.FileNode && a.platform === "cloudflare" && a.platformName === workerName) {
+    if (a.type === import_types71.NodeType.FileNode && a.platform === "cloudflare" && a.platformName === workerName) {
       found = id;
     }
   });
   return found;
 }
-function findMatchingRouteNode(graph, serviceName, method, path92) {
-  const normalizedPath = normalizePathTemplate(path92);
+function findMatchingRouteNode(graph, serviceName, method, path93) {
+  const normalizedPath = normalizePathTemplate(path93);
   let found = null;
   graph.forEachNode((id, attrs) => {
     if (found) return;
     const a = attrs;
-    if (a.type !== import_types70.NodeType.RouteNode || a.service !== serviceName) return;
+    if (a.type !== import_types71.NodeType.RouteNode || a.service !== serviceName) return;
     if (!a.pathTemplate || normalizePathTemplate(a.pathTemplate) !== normalizedPath) return;
     const routeMethod = (a.method ?? "").toUpperCase();
     if (routeMethod !== "ALL" && routeMethod !== method) return;
@@ -19087,18 +19771,18 @@ function createCloudflareResolveTarget(config, graph) {
   return (signal) => {
     if (signal.targetKind !== CLOUDFLARE_TARGET_KIND) return null;
     const scriptName = signal.targetName;
-    const { method, path: path92 } = signal;
+    const { method, path: path93 } = signal;
     const resolveRouteGrain = (serviceName, wholeFileId) => {
-      if (!method || !path92) return wholeFileId;
-      return findMatchingRouteNode(graph, serviceName, method, path92) ?? wholeFileId;
+      if (!method || !path93) return wholeFileId;
+      return findMatchingRouteNode(graph, serviceName, method, path93) ?? wholeFileId;
     };
     const mapping = config.workers?.[scriptName];
     if (mapping) {
-      const wholeFileId = (0, import_types70.fileId)(mapping.service, mapping.entryFile);
+      const wholeFileId = (0, import_types71.fileId)(mapping.service, mapping.entryFile);
       return {
         targetNodeId: resolveRouteGrain(mapping.service, wholeFileId),
         serviceName: mapping.service,
-        edgeType: import_types70.EdgeType.CALLS
+        edgeType: import_types71.EdgeType.CALLS
       };
     }
     const taggedFileId = findTaggedWorkerFileNode(graph, scriptName);
@@ -19107,13 +19791,13 @@ function createCloudflareResolveTarget(config, graph) {
       return {
         targetNodeId: resolveRouteGrain(fileNode.service, taggedFileId),
         serviceName: fileNode.service,
-        edgeType: import_types70.EdgeType.CALLS
+        edgeType: import_types71.EdgeType.CALLS
       };
     }
     return {
-      targetNodeId: (0, import_types70.infraId)("cloudflare-worker", scriptName),
+      targetNodeId: (0, import_types71.infraId)("cloudflare-worker", scriptName),
       serviceName: scriptName,
-      edgeType: import_types70.EdgeType.CALLS,
+      edgeType: import_types71.EdgeType.CALLS,
       ensureInfraNode: { kind: "cloudflare-worker", name: scriptName, provider: "cloudflare" }
     };
   };
@@ -19309,14 +19993,14 @@ function diffNeonStatementsToSignals(rows, previous, observedAtIso) {
 
 // src/connectors/neon/resolve.ts
 init_cjs_shims();
-var import_types74 = require("@neat.is/types");
+var import_types75 = require("@neat.is/types");
 function createNeonResolveTarget(config) {
   return (signal) => {
     if (signal.targetKind !== NEON_SQL_TABLE_TARGET_KIND || !signal.targetName) return null;
     return {
-      targetNodeId: (0, import_types74.infraId)("sql-table", signal.targetName),
+      targetNodeId: (0, import_types75.infraId)("sql-table", signal.targetName),
       serviceName: config.serviceName,
-      edgeType: import_types74.EdgeType.CALLS,
+      edgeType: import_types75.EdgeType.CALLS,
       ensureInfraNode: { kind: "sql-table", name: signal.targetName, provider: "neon" }
     };
   };
@@ -19442,9 +20126,9 @@ function parseCloudRunTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP2);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path92 = rest.slice(secondSep + 1);
-  if (!serviceName || !method || !path92) return null;
-  return { serviceName, method, path: path92 };
+  const path93 = rest.slice(secondSep + 1);
+  if (!serviceName || !method || !path93) return null;
+  return { serviceName, method, path: path93 };
 }
 
 // src/connectors/cloud-run/map.ts
@@ -19473,14 +20157,14 @@ function mapLogEntryToSignal2(entry2) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path92 = pathFromRequestUrl2(req.requestUrl);
-  if (path92 === null) return null;
+  const path93 = pathFromRequestUrl2(req.requestUrl);
+  if (path93 === null) return null;
   const timestamp = entry2.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD4;
   return {
     targetKind: CLOUD_RUN_TARGET_KIND,
-    targetName: packCloudRunTargetName({ serviceName, method, path: path92 }),
+    targetName: packCloudRunTargetName({ serviceName, method, path: path93 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -19497,14 +20181,14 @@ function mapLogEntriesToSignals2(entries) {
 
 // src/connectors/cloud-run/resolve.ts
 init_cjs_shims();
-var import_types78 = require("@neat.is/types");
+var import_types79 = require("@neat.is/types");
 var CLOUD_RUN_SERVICE_INFRA_KIND = "cloud-run-service";
 function findMatchingRouteNode2(graph, serviceName, method, normalizedPath) {
   let found = null;
   graph.forEachNode((_id, attrs) => {
     if (found) return;
     const node = attrs;
-    if (node.type !== import_types78.NodeType.RouteNode) return;
+    if (node.type !== import_types79.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName || !route.pathTemplate) return;
     if (normalizePathTemplate(route.pathTemplate) !== normalizedPath) return;
@@ -19519,23 +20203,23 @@ function createCloudRunResolveTarget(graph, config) {
     if (signal.targetKind !== CLOUD_RUN_TARGET_KIND) return null;
     const identity = parseCloudRunTargetName(signal.targetName);
     if (!identity) return null;
-    const { serviceName: gcpServiceName, method, path: path92 } = identity;
+    const { serviceName: gcpServiceName, method, path: path93 } = identity;
     const mappedService = config.serviceMap?.[gcpServiceName];
     if (mappedService) {
       const routeNodeId = findMatchingRouteNode2(
         graph,
         mappedService,
         method,
-        normalizePathTemplate(path92)
+        normalizePathTemplate(path93)
       );
       if (routeNodeId) {
-        return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types78.EdgeType.CALLS };
+        return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types79.EdgeType.CALLS };
       }
     }
     return {
-      targetNodeId: (0, import_types78.infraId)(CLOUD_RUN_SERVICE_INFRA_KIND, gcpServiceName),
+      targetNodeId: (0, import_types79.infraId)(CLOUD_RUN_SERVICE_INFRA_KIND, gcpServiceName),
       serviceName: mappedService ?? gcpServiceName,
-      edgeType: import_types78.EdgeType.CALLS,
+      edgeType: import_types79.EdgeType.CALLS,
       ensureInfraNode: {
         kind: CLOUD_RUN_SERVICE_INFRA_KIND,
         name: gcpServiceName,
@@ -19576,7 +20260,7 @@ function createCloudRunConnector(graph, config = {}) {
 
 // src/connectors/render/index.ts
 init_cjs_shims();
-var import_types81 = require("@neat.is/types");
+var import_types82 = require("@neat.is/types");
 
 // src/connectors/render/types.ts
 init_cjs_shims();
@@ -19654,7 +20338,7 @@ function buildRenderRouteIndex(graph, serviceName) {
   const out = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types81.NodeType.RouteNode) return;
+    if (node.type !== import_types82.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     out.push({
@@ -19739,7 +20423,7 @@ function mapRenderRequestLogsToSignals(entries, routeIndex) {
 function createRenderResolveTarget(config) {
   return (signal) => {
     if (signal.targetKind === ROUTE_TARGET_KIND2) {
-      return { targetNodeId: signal.targetName, serviceName: config.serviceName, edgeType: import_types81.EdgeType.CALLS };
+      return { targetNodeId: signal.targetName, serviceName: config.serviceName, edgeType: import_types82.EdgeType.CALLS };
     }
     return null;
   };
@@ -19877,21 +20561,21 @@ function mapInsightsToSignals(rows, observedAtIso) {
 
 // src/connectors/planetscale/resolve.ts
 init_cjs_shims();
-var import_types85 = require("@neat.is/types");
+var import_types86 = require("@neat.is/types");
 var PLANETSCALE_DATABASE_KIND = "planetscale-database";
 function createPlanetscaleResolveTarget(graph, config) {
   const databaseName = `${config.organization}/${config.database}`;
   return (signal, _ctx) => {
     if (signal.targetKind !== PLANETSCALE_SQL_TABLE_TARGET_KIND || !signal.targetName) return null;
-    const tableId = (0, import_types85.infraId)("sql-table", signal.targetName);
+    const tableId = (0, import_types86.infraId)("sql-table", signal.targetName);
     if (graph.hasNode(tableId)) {
-      return { targetNodeId: tableId, serviceName: config.serviceName, edgeType: import_types85.EdgeType.CALLS };
+      return { targetNodeId: tableId, serviceName: config.serviceName, edgeType: import_types86.EdgeType.CALLS };
     }
-    const providerId = (0, import_types85.infraId)(PLANETSCALE_DATABASE_KIND, databaseName);
+    const providerId = (0, import_types86.infraId)(PLANETSCALE_DATABASE_KIND, databaseName);
     return {
       targetNodeId: providerId,
       serviceName: config.serviceName,
-      edgeType: import_types85.EdgeType.CALLS,
+      edgeType: import_types86.EdgeType.CALLS,
       ensureInfraNode: { kind: PLANETSCALE_DATABASE_KIND, name: databaseName, provider: "planetscale" }
     };
   };
@@ -20156,7 +20840,7 @@ function mapBuildsToSignals(builds, serviceName) {
 
 // src/connectors/eas/resolve.ts
 init_cjs_shims();
-var import_types90 = require("@neat.is/types");
+var import_types91 = require("@neat.is/types");
 var NO_ENV2 = "unknown";
 var EAS_JSON_PHASES = /* @__PURE__ */ new Set(["READ_EAS_JSON"]);
 var APP_CONFIG_PHASES = /* @__PURE__ */ new Set([
@@ -20172,8 +20856,8 @@ function configBasenamesForPhase(phase) {
 function configNodeService(graph, configNodeId) {
   for (const edgeId of graph.inboundEdges(configNodeId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== import_types90.EdgeType.CONFIGURED_BY) continue;
-    const parsed = (0, import_types90.parseFileId)(edge.source);
+    if (edge.type !== import_types91.EdgeType.CONFIGURED_BY) continue;
+    const parsed = (0, import_types91.parseFileId)(edge.source);
     if (parsed) return parsed.service;
   }
   return null;
@@ -20184,7 +20868,7 @@ function findConfigNode(graph, basenames, serviceName) {
   graph.forEachNode((id, attrs) => {
     if (scoped) return;
     const node = attrs;
-    if (node.type !== import_types90.NodeType.ConfigNode) return;
+    if (node.type !== import_types91.NodeType.ConfigNode) return;
     if (typeof node.name !== "string" || !basenames.includes(node.name)) return;
     if (anyMatch === null) anyMatch = id;
     if (configNodeService(graph, id) === serviceName) scoped = id;
@@ -20201,13 +20885,13 @@ function createEasResolveTarget(graph) {
     if (basenames.length > 0) {
       const configNodeId = findConfigNode(graph, basenames, serviceName);
       if (configNodeId) {
-        return { targetNodeId: configNodeId, serviceName, edgeType: import_types90.EdgeType.CALLS };
+        return { targetNodeId: configNodeId, serviceName, edgeType: import_types91.EdgeType.CALLS };
       }
     }
     return {
       targetNodeId: resolveFusedServiceId(graph, serviceName, NO_ENV2),
       serviceName,
-      edgeType: import_types90.EdgeType.CALLS
+      edgeType: import_types91.EdgeType.CALLS
     };
   };
 }
@@ -21011,11 +21695,11 @@ function registerRoutes(scope, ctx) {
       const candidates = req.query.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
       const parsed = [];
       for (const c of candidates) {
-        const r = import_types93.DivergenceTypeSchema.safeParse(c);
+        const r = import_types94.DivergenceTypeSchema.safeParse(c);
         if (!r.success) {
           return reply.code(400).send({
             error: `unknown divergence type "${c}"`,
-            allowed: import_types93.DivergenceTypeSchema.options
+            allowed: import_types94.DivergenceTypeSchema.options
           });
         }
         parsed.push(r.data);
@@ -21257,6 +21941,18 @@ function registerRoutes(scope, ctx) {
       matches: matches.slice(0, safeLimit)
     };
   });
+  scope.get("/graph/ask", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+    if (!proj) return;
+    const question = (req.query.q ?? "").trim();
+    if (!question) return reply.code(400).send({ error: "query parameter `q` is required" });
+    const epath = errorsPathFor(proj);
+    const incidents = epath ? await readErrorEvents(epath) : [];
+    return askGraph(proj.graph, question, {
+      ...proj.searchIndex ? { searchIndex: proj.searchIndex } : {},
+      incidents
+    });
+  });
   scope.get(
     "/graph/diff",
     async (req, reply) => {
@@ -21357,7 +22053,7 @@ function registerRoutes(scope, ctx) {
     const log = new PolicyViolationsLog(proj.paths.policyViolationsPath);
     let violations = await log.readAll();
     if (req.query.severity) {
-      const sev = import_types93.PolicySeveritySchema.safeParse(req.query.severity);
+      const sev = import_types94.PolicySeveritySchema.safeParse(req.query.severity);
       if (!sev.success) {
         return reply.code(400).send({
           error: "invalid severity",
@@ -21396,7 +22092,7 @@ function registerRoutes(scope, ctx) {
   scope.post("/policies/check", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
-    const parsed = import_types93.PoliciesCheckBodySchema.safeParse(req.body ?? {});
+    const parsed = import_types94.PoliciesCheckBodySchema.safeParse(req.body ?? {});
     if (!parsed.success) {
       return reply.code(400).send({
         error: "invalid /policies/check body",
@@ -21729,7 +22425,7 @@ var import_node_fs41 = require("fs");
 var import_node_path76 = __toESM(require("path"), 1);
 
 // src/daemon.ts
-var import_types94 = require("@neat.is/types");
+var import_types95 = require("@neat.is/types");
 function daemonJsonPath(scanPath) {
   return import_node_path77.default.join(scanPath, "neat-out", "daemon.json");
 }
@@ -23655,8 +24351,8 @@ function scriptHasShellChain(script) {
 function entryFromScript(script) {
   if (!script) return void 0;
   if (scriptHasShellChain(script)) return void 0;
-  const tokens = script.split(/\s+/).filter((t) => t.length > 0);
-  for (const token of tokens) {
+  const tokens2 = script.split(/\s+/).filter((t) => t.length > 0);
+  for (const token of tokens2) {
     const lower = token.toLowerCase();
     if (SCRIPT_LAUNCHERS.has(lower)) continue;
     const cleaned = token.startsWith("./") ? token.slice(2) : token;
@@ -25681,7 +26377,7 @@ async function extractAndPersist(opts) {
 }
 async function applyInstallersOver(services, project, options = {}) {
   const resolveManager = options.resolveManager ?? detectPackageManager;
-  const runInstall = options.runInstall ?? runPackageManagerInstall;
+  const runInstall2 = options.runInstall ?? runPackageManagerInstall;
   let instrumented = 0;
   let already = 0;
   let libOnly = 0;
@@ -25804,7 +26500,7 @@ async function applyInstallersOver(services, project, options = {}) {
   const packageManagerInstalls = [];
   for (const cmd of installPlans.values()) {
     console.log(`running \`${cmd.pm} ${cmd.args.join(" ")}\` in ${cmd.cwd}`);
-    const result = await runInstall(cmd);
+    const result = await runInstall2(cmd);
     packageManagerInstalls.push(result);
     if (result.exitCode !== 0) {
       console.error(
@@ -26783,6 +27479,9 @@ function claudeSettingsPath() {
 function installedHookPath() {
   return import_node_path87.default.join(neatHome3(), "hooks", HOOK_FILENAME);
 }
+function gateFlagPath() {
+  return import_node_path87.default.join(neatHome3(), "hooks", "gate-enabled");
+}
 function isNeatSearchEntry(entry2) {
   return (entry2.hooks ?? []).some(
     (h) => typeof h.command === "string" && h.command.includes(HOOK_FILENAME)
@@ -26845,13 +27544,30 @@ async function runHooks(opts) {
     };
     await import_node_fs52.promises.mkdir(import_node_path87.default.dirname(settingsFile), { recursive: true });
     await import_node_fs52.promises.writeFile(settingsFile, JSON.stringify(merged, null, 2) + "\n", "utf8");
-    console.log(`neat hooks: installed the search-nudge hook`);
+    const flag = gateFlagPath();
+    if (opts.gate) {
+      await import_node_fs52.promises.mkdir(import_node_path87.default.dirname(flag), { recursive: true });
+      await import_node_fs52.promises.writeFile(flag, "1\n", "utf8");
+    } else {
+      await import_node_fs52.promises.rm(flag, { force: true });
+    }
+    const mode = opts.gate ? "GATE (deny search until you ask the graph)" : "nudge (search still runs)";
+    console.log(`neat hooks: installed the search hook in ${opts.gate ? "gate" : "nudge"} mode`);
     console.log(`  script:   ${scriptPath}`);
     console.log(`  settings: ${settingsFile} (PreToolUse \u2192 ${HOOK_MATCHER})`);
     console.log(`  guidance: ${guidePath}`);
+    console.log(`  mode:     ${mode}`);
     console.log("");
-    console.log("restart Claude Code to load the hook. On a Grep/Glob or a Bash grep,");
-    console.log("your agent will now be nudged to query NEAT first.");
+    if (opts.gate) {
+      console.log("restart Claude Code to load the hook. A Grep/Glob or Bash grep is now DENIED");
+      console.log('until you run `neat ask "<question>"` (or the ask MCP tool) once this session;');
+      console.log("after that, search is allowed as a fallback. Set NEAT_SEARCH_GATE=0 to fall");
+      console.log("back to nudge-only without re-running.");
+    } else {
+      console.log("restart Claude Code to load the hook. On a Grep/Glob or a Bash grep,");
+      console.log("your agent will now be nudged to query NEAT first (the search still runs).");
+      console.log("Re-run with --gate to hard-force the graph-first orientation.");
+    }
     console.log("");
     console.log("The hook is Claude-Code-specific. For agents on other harnesses, paste");
     console.log(`the guidance above into your project instructions (CLAUDE.md / AGENTS.md).`);
@@ -26863,28 +27579,36 @@ async function runHooks(opts) {
 function usage() {
   console.log("neat hooks \u2014 wire NEAT into your agent so it queries the graph before grepping");
   console.log("");
-  console.log("  --apply          install the Claude Code search-nudge hook and write the");
+  console.log("  --apply          install the Claude Code search hook and write the");
   console.log("                   graph-first guidance to ~/.neat/, merging into");
   console.log("                   ~/.claude/settings.json without touching your other hooks");
+  console.log("  --gate           with --apply, enable hard-gate mode: DENY Grep/Glob/grep-Bash");
+  console.log("                   until `neat ask` has run this session (default is nudge-only).");
+  console.log("                   Toggle off at run time with NEAT_SEARCH_GATE=0.");
   console.log("  --print-hook     print the hook script to stdout");
   console.log("  --print-guide    print the agent-agnostic graph-first guidance to stdout");
   console.log("  --print-settings print the settings.json PreToolUse block --apply would add");
   console.log("");
-  console.log("The hook is a gentle, non-blocking nudge \u2014 searches still run. It is");
-  console.log("Claude-Code-specific; other harnesses get the same steer from the guidance.");
+  console.log("By default the hook is a gentle, non-blocking nudge \u2014 searches still run.");
+  console.log("--gate turns it into a hard forcing mechanism. It is Claude-Code-specific;");
+  console.log("other harnesses get the same steer from the graph-first guidance.");
 }
 async function runHooksCommand(args) {
   const opts = {
     apply: false,
     printHook: false,
     printGuide: false,
-    printSettings: false
+    printSettings: false,
+    gate: false
   };
   for (const arg of args) {
     switch (arg) {
       case "--apply":
         opts.apply = true;
         break;
+      case "--gate":
+        opts.gate = true;
+        break;
       case "--print-hook":
         opts.printHook = true;
         break;
@@ -26913,11 +27637,151 @@ async function runHooksCommand(args) {
   }
 }
 
-// src/codex-cli.ts
+// src/claude-cli.ts
 init_cjs_shims();
 var import_node_path88 = __toESM(require("path"), 1);
-var import_node_os6 = __toESM(require("os"), 1);
 var import_node_fs53 = require("fs");
+var NEAT_SECTION_HEADING = "## neat";
+var NEAT_DIRECTIVE_BODY = `This project has NEAT wired in: a live, fused semantic graph of the system \u2014
+code and runtime behaviour (OpenTelemetry) in one model, every fact tagged with
+its provenance (EXTRACTED / OBSERVED / INFERRED / STALE) and a confidence.
+
+For ANY question about this system's behaviour, dependencies, failures, root
+cause, or blast radius, call \`neat ask\` FIRST \u2014 before Read, Grep, Glob, or Bash:
+
+    neat ask "why is checkout failing?"
+    neat ask "what breaks if I change the orders table?"
+    neat ask "what does the payments service depend on at runtime?"
+
+\`ask\` resolves your question to graph nodes and routes it to the right traversal
+\u2014 root cause, dependencies, observed runtime calls, incidents, divergences,
+blast radius \u2014 and returns one compact, provenance-tagged answer. The same door
+is the \`ask\` MCP tool (\`mcp__neat__ask\`) when NEAT's MCP server is wired in.
+
+The graph is live and fused: it is faster and more accurate than scanning files,
+and it can tell you what the system actually does at runtime, not only what the
+source declares. Fall back to Read/Grep only when the graph does not have what
+you need \u2014 comments, string literals, config minutiae. Ask the graph first,
+then scan.
+
+If \`neat ask\` errors, the daemon may not be running (\`neat list\`) \u2014 start it
+with \`neat <path>\`, then re-ask.`;
+function neatSection() {
+  return `${NEAT_SECTION_HEADING}
+
+${NEAT_DIRECTIVE_BODY}
+`;
+}
+function claudeMdPath() {
+  const override = process.env.NEAT_CLAUDE_MD;
+  if (override && override.length > 0) return import_node_path88.default.resolve(override);
+  return import_node_path88.default.join(process.cwd(), "CLAUDE.md");
+}
+function splitAroundSection(raw) {
+  const lines = raw.split("\n");
+  const startIdx = lines.findIndex((l) => l.replace(/\s+$/, "") === NEAT_SECTION_HEADING);
+  if (startIdx === -1) {
+    return { before: raw.replace(/\n*$/, ""), after: "", found: false };
+  }
+  let endIdx = lines.length;
+  for (let i = startIdx + 1; i < lines.length; i++) {
+    if (/^#{1,2}\s+/.test(lines[i] ?? "")) {
+      endIdx = i;
+      break;
+    }
+  }
+  const before = lines.slice(0, startIdx).join("\n").replace(/\n*$/, "");
+  const after = lines.slice(endIdx).join("\n").replace(/^\n*/, "");
+  return { before, after, found: true };
+}
+function compose(before, after) {
+  const parts = [];
+  if (before.length > 0) parts.push(before);
+  parts.push(neatSection().replace(/\n+$/, ""));
+  if (after.length > 0) parts.push(after);
+  return parts.join("\n\n").replace(/\n*$/, "") + "\n";
+}
+async function readIfExists2(file) {
+  try {
+    return await import_node_fs53.promises.readFile(file, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+}
+async function runInstall() {
+  const file = claudeMdPath();
+  const raw = await readIfExists2(file) ?? "";
+  const { before, after, found } = splitAroundSection(raw);
+  const next = compose(before, after);
+  await import_node_fs53.promises.mkdir(import_node_path88.default.dirname(file), { recursive: true });
+  await import_node_fs53.promises.writeFile(file, next, "utf8");
+  const verb = raw.length === 0 ? "created" : found ? "refreshed" : "added";
+  console.log(`neat claude: ${verb} the \`${NEAT_SECTION_HEADING}\` section in ${file}`);
+  console.log("Your agent will now reach for `neat ask` before Read/Grep/Bash. Restart the");
+  console.log("session (or reload CLAUDE.md) to pick it up.");
+  return { exitCode: 0 };
+}
+async function runUninstall() {
+  const file = claudeMdPath();
+  const raw = await readIfExists2(file);
+  if (raw === null) {
+    console.log(`neat claude: no CLAUDE.md at ${file} \u2014 nothing to remove.`);
+    return { exitCode: 0 };
+  }
+  const { before, after, found } = splitAroundSection(raw);
+  if (!found) {
+    console.log(`neat claude: no \`${NEAT_SECTION_HEADING}\` section in ${file} \u2014 nothing to remove.`);
+    return { exitCode: 0 };
+  }
+  const remaining = [before, after].filter((s) => s.length > 0).join("\n\n");
+  const next = remaining.length > 0 ? remaining.replace(/\n*$/, "") + "\n" : "";
+  await import_node_fs53.promises.writeFile(file, next, "utf8");
+  console.log(`neat claude: removed the \`${NEAT_SECTION_HEADING}\` section from ${file}.`);
+  return { exitCode: 0 };
+}
+function usage2() {
+  console.log("neat claude \u2014 make the query-first directive always-on in Claude Code");
+  console.log("");
+  console.log("  install     write (or refresh) a `## neat` section in ./CLAUDE.md so your");
+  console.log("              agent reaches for `neat ask` before Read/Grep/Bash");
+  console.log("  uninstall   remove the `## neat` section from ./CLAUDE.md");
+  console.log("  print       print the directive block to stdout (for a manual paste)");
+  console.log("");
+  console.log("Idempotent: re-running install replaces its own section, never duplicates it.");
+  console.log("Target file overridable via NEAT_CLAUDE_MD.");
+}
+async function runClaudeCommand(args) {
+  const sub = args[0];
+  if (sub === "-h" || sub === "--help" || sub === void 0) {
+    usage2();
+    return sub === void 0 ? 2 : 0;
+  }
+  try {
+    switch (sub) {
+      case "install":
+        return (await runInstall()).exitCode;
+      case "uninstall":
+        return (await runUninstall()).exitCode;
+      case "print":
+        process.stdout.write(neatSection());
+        return 0;
+      default:
+        console.error(`neat claude: unknown subcommand "${sub}"`);
+        usage2();
+        return 2;
+    }
+  } catch (err) {
+    console.error(`neat claude: ${err.message}`);
+    return 1;
+  }
+}
+
+// src/codex-cli.ts
+init_cjs_shims();
+var import_node_path89 = __toESM(require("path"), 1);
+var import_node_os6 = __toESM(require("os"), 1);
+var import_node_fs54 = require("fs");
 var import_node_util = require("util");
 var import_smol_toml6 = require("smol-toml");
 var CODEX_MCP_SERVER = {
@@ -26935,14 +27799,14 @@ var NEAT_GRAPH_FIRST_START = "<!-- neat:graph-first -->";
 var NEAT_GRAPH_FIRST_END = "<!-- /neat:graph-first -->";
 function codexConfigPath() {
   const override = process.env.NEAT_CODEX_CONFIG;
-  if (override && override.length > 0) return import_node_path88.default.resolve(override);
+  if (override && override.length > 0) return import_node_path89.default.resolve(override);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? import_node_os6.default.homedir();
-  return import_node_path88.default.join(home, ".codex", "config.toml");
+  return import_node_path89.default.join(home, ".codex", "config.toml");
 }
 function agentsFilePath() {
   const override = process.env.NEAT_CODEX_AGENTS;
-  if (override && override.length > 0) return import_node_path88.default.resolve(override);
-  return import_node_path88.default.join(process.cwd(), "AGENTS.md");
+  if (override && override.length > 0) return import_node_path89.default.resolve(override);
+  return import_node_path89.default.join(process.cwd(), "AGENTS.md");
 }
 function isTableHeader(line) {
   return /^\s*\[\[?[^\]]+\]\]?\s*$/.test(line);
@@ -27076,7 +27940,7 @@ async function runCodex(opts) {
   const agentsPath = agentsFilePath();
   let configRaw = "";
   try {
-    configRaw = await import_node_fs53.promises.readFile(configPath, "utf8");
+    configRaw = await import_node_fs54.promises.readFile(configPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       console.error(`neat codex: failed to read ${configPath} \u2014 ${err.message}`);
@@ -27085,7 +27949,7 @@ async function runCodex(opts) {
   }
   let agentsRaw = "";
   try {
-    agentsRaw = await import_node_fs53.promises.readFile(agentsPath, "utf8");
+    agentsRaw = await import_node_fs54.promises.readFile(agentsPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       console.error(`neat codex: failed to read ${agentsPath} \u2014 ${err.message}`);
@@ -27125,15 +27989,15 @@ async function runCodex(opts) {
     return { exitCode: 0 };
   }
   if (config.changed) {
-    await import_node_fs53.promises.mkdir(import_node_path88.default.dirname(configPath), { recursive: true });
-    await import_node_fs53.promises.writeFile(configPath, config.text, "utf8");
+    await import_node_fs54.promises.mkdir(import_node_path89.default.dirname(configPath), { recursive: true });
+    await import_node_fs54.promises.writeFile(configPath, config.text, "utf8");
     console.log(`neat codex: wrote [mcp_servers.neat] to ${configPath}`);
   } else {
     console.log(`neat codex: ${configPath} already has NEAT's MCP server`);
   }
   if (agents.changed) {
-    await import_node_fs53.promises.mkdir(import_node_path88.default.dirname(agentsPath), { recursive: true });
-    await import_node_fs53.promises.writeFile(agentsPath, agents.text, "utf8");
+    await import_node_fs54.promises.mkdir(import_node_path89.default.dirname(agentsPath), { recursive: true });
+    await import_node_fs54.promises.writeFile(agentsPath, agents.text, "utf8");
     console.log(`neat codex: wrote the graph-first block to ${agentsPath}`);
   } else {
     console.log(`neat codex: ${agentsPath} already has the graph-first block`);
@@ -27143,7 +28007,7 @@ async function runCodex(opts) {
   console.log("points the server at the local daemon \u2014 edit it for a non-default one.");
   return { exitCode: 0 };
 }
-function usage2() {
+function usage3() {
   console.log("neat codex \u2014 install NEAT into the OpenAI Codex CLI (MCP server + AGENTS.md)");
   console.log("");
   console.log("  (no flag)        plan: print what would change, write nothing");
@@ -27171,11 +28035,11 @@ async function runCodexCommand(args) {
         break;
       case "-h":
       case "--help":
-        usage2();
+        usage3();
         return 0;
       default:
         console.error(`neat codex: unknown flag "${arg}"`);
-        usage2();
+        usage3();
         return 2;
     }
   }
@@ -27190,9 +28054,9 @@ async function runCodexCommand(args) {
 
 // src/editors-cli.ts
 init_cjs_shims();
-var import_node_path89 = __toESM(require("path"), 1);
+var import_node_path90 = __toESM(require("path"), 1);
 var import_node_os7 = __toESM(require("os"), 1);
-var import_node_fs54 = require("fs");
+var import_node_fs55 = require("fs");
 var import_node_util2 = require("util");
 var jsonc = __toESM(require("jsonc-parser"), 1);
 var NEAT_MCP_SERVER = {
@@ -27216,17 +28080,17 @@ function homeDir() {
 }
 function xdgConfigDir() {
   const xdg = process.env.XDG_CONFIG_HOME;
-  return xdg && xdg.length > 0 ? import_node_path89.default.resolve(xdg) : import_node_path89.default.join(homeDir(), ".config");
+  return xdg && xdg.length > 0 ? import_node_path90.default.resolve(xdg) : import_node_path90.default.join(homeDir(), ".config");
 }
 function envOverride(name) {
   const v = process.env[name];
-  return v && v.length > 0 ? import_node_path89.default.resolve(v) : void 0;
+  return v && v.length > 0 ? import_node_path90.default.resolve(v) : void 0;
 }
 var CURSOR_CLIENT = {
   id: "cursor",
   label: "Cursor",
   docsUrl: "https://docs.cursor.com/context/mcp",
-  mcpConfigPath: () => envOverride("NEAT_CURSOR_CONFIG") ?? import_node_path89.default.join(homeDir(), ".cursor", "mcp.json"),
+  mcpConfigPath: () => envOverride("NEAT_CURSOR_CONFIG") ?? import_node_path90.default.join(homeDir(), ".cursor", "mcp.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   // Cursor still reads a single `.cursorrules` at the project root (the modern
@@ -27238,7 +28102,7 @@ var DEVIN_CLIENT = {
   id: "devin",
   label: "Devin Desktop (Cascade)",
   docsUrl: "https://docs.devin.ai/desktop/cascade/mcp",
-  mcpConfigPath: () => envOverride("NEAT_DEVIN_CONFIG") ?? import_node_path89.default.join(homeDir(), ".codeium", "windsurf", "mcp_config.json"),
+  mcpConfigPath: () => envOverride("NEAT_DEVIN_CONFIG") ?? import_node_path90.default.join(homeDir(), ".codeium", "windsurf", "mcp_config.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   rulesFileName: ".windsurfrules"
@@ -27247,7 +28111,7 @@ var GEMINI_CLIENT = {
   id: "gemini",
   label: "Gemini CLI",
   docsUrl: "https://github.com/google-gemini/gemini-cli/blob/main/docs/tools/mcp-server.md",
-  mcpConfigPath: () => envOverride("NEAT_GEMINI_CONFIG") ?? import_node_path89.default.join(homeDir(), ".gemini", "settings.json"),
+  mcpConfigPath: () => envOverride("NEAT_GEMINI_CONFIG") ?? import_node_path90.default.join(homeDir(), ".gemini", "settings.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   rulesFileName: "GEMINI.md"
@@ -27256,7 +28120,7 @@ var QWEN_CLIENT = {
   id: "qwen",
   label: "Qwen Code",
   docsUrl: "https://qwenlm.github.io/qwen-code-docs/en/users/features/mcp/",
-  mcpConfigPath: () => envOverride("NEAT_QWEN_CONFIG") ?? import_node_path89.default.join(homeDir(), ".qwen", "settings.json"),
+  mcpConfigPath: () => envOverride("NEAT_QWEN_CONFIG") ?? import_node_path90.default.join(homeDir(), ".qwen", "settings.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   rulesFileName: "QWEN.md"
@@ -27265,7 +28129,7 @@ var AMAZONQ_CLIENT = {
   id: "amazonq",
   label: "Amazon Q Developer CLI",
   docsUrl: "https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/command-line-mcp-configuration.html",
-  mcpConfigPath: () => envOverride("NEAT_AMAZONQ_CONFIG") ?? import_node_path89.default.join(homeDir(), ".aws", "amazonq", "mcp.json"),
+  mcpConfigPath: () => envOverride("NEAT_AMAZONQ_CONFIG") ?? import_node_path90.default.join(homeDir(), ".aws", "amazonq", "mcp.json"),
   mcpContainerKey: "mcpServers",
   format: "json"
 };
@@ -27273,7 +28137,7 @@ var ROOCODE_CLIENT = {
   id: "roocode",
   label: "Roo Code",
   docsUrl: "https://roocodeinc.github.io/Roo-Code/features/mcp/using-mcp-in-roo",
-  mcpConfigPath: () => envOverride("NEAT_ROOCODE_CONFIG") ?? import_node_path89.default.join(process.cwd(), ".roo", "mcp.json"),
+  mcpConfigPath: () => envOverride("NEAT_ROOCODE_CONFIG") ?? import_node_path90.default.join(process.cwd(), ".roo", "mcp.json"),
   mcpContainerKey: "mcpServers",
   format: "json"
 };
@@ -27286,9 +28150,9 @@ var ZED_CLIENT = {
     if (override) return override;
     if (process.platform === "win32") {
       const appData = process.env.APPDATA;
-      if (appData && appData.length > 0) return import_node_path89.default.join(appData, "Zed", "settings.json");
+      if (appData && appData.length > 0) return import_node_path90.default.join(appData, "Zed", "settings.json");
     }
-    return import_node_path89.default.join(homeDir(), ".config", "zed", "settings.json");
+    return import_node_path90.default.join(homeDir(), ".config", "zed", "settings.json");
   },
   mcpContainerKey: "context_servers",
   format: "jsonc",
@@ -27298,7 +28162,7 @@ var OPENCODE_CLIENT = {
   id: "opencode",
   label: "OpenCode",
   docsUrl: "https://opencode.ai/docs/mcp-servers/",
-  mcpConfigPath: () => envOverride("NEAT_OPENCODE_CONFIG") ?? import_node_path89.default.join(xdgConfigDir(), "opencode", "opencode.json"),
+  mcpConfigPath: () => envOverride("NEAT_OPENCODE_CONFIG") ?? import_node_path90.default.join(xdgConfigDir(), "opencode", "opencode.json"),
   mcpContainerKey: "mcp",
   format: "json",
   serverEntry: NEAT_OPENCODE_SERVER,
@@ -27308,7 +28172,7 @@ var CRUSH_CLIENT = {
   id: "crush",
   label: "Crush",
   docsUrl: "https://charmbracelet-crush.mintlify.app/configuration/mcp",
-  mcpConfigPath: () => envOverride("NEAT_CRUSH_CONFIG") ?? import_node_path89.default.join(xdgConfigDir(), "crush", "crush.json"),
+  mcpConfigPath: () => envOverride("NEAT_CRUSH_CONFIG") ?? import_node_path90.default.join(xdgConfigDir(), "crush", "crush.json"),
   mcpContainerKey: "mcp",
   format: "json",
   serverEntry: NEAT_CRUSH_SERVER,
@@ -27371,7 +28235,7 @@ async function planMcp(client, mcpPath) {
   const serverEntry = client.serverEntry ?? NEAT_MCP_SERVER;
   let raw = "";
   try {
-    raw = await import_node_fs54.promises.readFile(mcpPath, "utf8");
+    raw = await import_node_fs55.promises.readFile(mcpPath, "utf8");
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT") {
@@ -27413,7 +28277,7 @@ async function runEditorInstall(client, opts) {
   const mcpPath = client.mcpConfigPath();
   const serverEntry = client.serverEntry ?? NEAT_MCP_SERVER;
   const hasRules = typeof client.rulesFileName === "string";
-  const rulesPath = hasRules ? import_node_path89.default.join(opts.projectDir, client.rulesFileName) : "";
+  const rulesPath = hasRules ? import_node_path90.default.join(opts.projectDir, client.rulesFileName) : "";
   const mcp = await planMcp(client, mcpPath);
   if (mcp === null) return { exitCode: 1 };
   let existingRules = "";
@@ -27422,7 +28286,7 @@ async function runEditorInstall(client, opts) {
   let block = "";
   if (hasRules) {
     try {
-      existingRules = await import_node_fs54.promises.readFile(rulesPath, "utf8");
+      existingRules = await import_node_fs55.promises.readFile(rulesPath, "utf8");
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(`neat ${client.id}: failed to read ${rulesPath} \u2014 ${err.message}`);
@@ -27456,11 +28320,11 @@ async function runEditorInstall(client, opts) {
     );
     return { exitCode: 0 };
   }
-  await import_node_fs54.promises.mkdir(import_node_path89.default.dirname(mcpPath), { recursive: true });
-  await import_node_fs54.promises.writeFile(mcpPath, mcp.text, "utf8");
+  await import_node_fs55.promises.mkdir(import_node_path90.default.dirname(mcpPath), { recursive: true });
+  await import_node_fs55.promises.writeFile(mcpPath, mcp.text, "utf8");
   if (hasRules) {
-    await import_node_fs54.promises.mkdir(import_node_path89.default.dirname(rulesPath), { recursive: true });
-    await import_node_fs54.promises.writeFile(rulesPath, newRules, "utf8");
+    await import_node_fs55.promises.mkdir(import_node_path90.default.dirname(rulesPath), { recursive: true });
+    await import_node_fs55.promises.writeFile(rulesPath, newRules, "utf8");
   }
   console.log(`neat ${client.id}: wired NEAT into ${client.label}`);
   console.log(`  MCP server: ${mcpPath} (${client.mcpContainerKey}.neat \u2192 npx -y @neat.is/mcp)`);
@@ -27473,7 +28337,7 @@ async function runEditorInstall(client, opts) {
 function indent(text) {
   return text.split("\n").map((line) => line.length > 0 ? `    ${line}` : line).join("\n");
 }
-function usage3(client) {
+function usage4(client) {
   const hasRules = typeof client.rulesFileName === "string";
   console.log(
     hasRules ? `neat ${client.id} \u2014 install NEAT's MCP server + graph-first guidance into ${client.label}` : `neat ${client.id} \u2014 install NEAT's MCP server into ${client.label}`
@@ -27504,11 +28368,11 @@ async function runEditorCommand(clientId, args, projectDir = process.cwd()) {
         break;
       case "-h":
       case "--help":
-        usage3(client);
+        usage4(client);
         return 0;
       default:
         console.error(`neat ${client.id}: unknown flag "${arg}"`);
-        usage3(client);
+        usage4(client);
         return 2;
     }
   }
@@ -27523,11 +28387,11 @@ async function runEditorCommand(clientId, args, projectDir = process.cwd()) {
 
 // src/monitor.ts
 init_cjs_shims();
-var import_types96 = require("@neat.is/types");
+var import_types97 = require("@neat.is/types");
 
 // src/cli-client.ts
 init_cjs_shims();
-var import_types95 = require("@neat.is/types");
+var import_types96 = require("@neat.is/types");
 var HttpError = class extends Error {
   constructor(status2, message, responseBody = "") {
     super(message);
@@ -27552,10 +28416,10 @@ function createHttpClient(baseUrl, bearerToken) {
   const root = baseUrl.replace(/\/$/, "");
   const authHeader = bearerToken && bearerToken.length > 0 ? { authorization: `Bearer ${bearerToken}` } : {};
   return {
-    async get(path92) {
+    async get(path93) {
       let res;
       try {
-        res = await fetch(`${root}${path92}`, {
+        res = await fetch(`${root}${path93}`, {
           headers: { ...authHeader }
         });
       } catch (err) {
@@ -27567,16 +28431,16 @@ function createHttpClient(baseUrl, bearerToken) {
         const body = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on GET ${path92}: ${body}`,
+          `${res.status} ${res.statusText} on GET ${path93}: ${body}`,
           body
         );
       }
       return await res.json();
     },
-    async post(path92, body) {
+    async post(path93, body) {
       let res;
       try {
-        res = await fetch(`${root}${path92}`, {
+        res = await fetch(`${root}${path93}`, {
           method: "POST",
           headers: { "content-type": "application/json", ...authHeader },
           body: JSON.stringify(body)
@@ -27590,7 +28454,7 @@ function createHttpClient(baseUrl, bearerToken) {
         const text = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on POST ${path92}: ${text}`,
+          `${res.status} ${res.statusText} on POST ${path93}: ${text}`,
           text
         );
       }
@@ -27604,12 +28468,12 @@ function projectPath(project, suffix) {
 }
 async function runRootCause(client, input) {
   const qs = input.errorId ? `?errorId=${encodeURIComponent(input.errorId)}` : "";
-  const path92 = projectPath(
+  const path93 = projectPath(
     input.project,
     `/graph/root-cause/${encodeURIComponent(input.errorNode)}${qs}`
   );
   try {
-    const result = await client.get(path92);
+    const result = await client.get(path93);
     const arrowPath = result.traversalPath.join(" \u2190 ");
     const provenances = result.edgeProvenances.length ? result.edgeProvenances.join(", ") : "(direct, no edges traversed)";
     const summary = `Root cause for ${input.errorNode} is ${result.rootCauseNode}. ` + result.rootCauseReason + (result.fixRecommendation ? ` Recommended fix: ${result.fixRecommendation}.` : "");
@@ -27635,12 +28499,12 @@ async function runRootCause(client, input) {
 }
 async function runBlastRadius(client, input) {
   const qs = input.depth !== void 0 ? `?depth=${input.depth}` : "";
-  const path92 = projectPath(
+  const path93 = projectPath(
     input.project,
     `/graph/blast-radius/${encodeURIComponent(input.nodeId)}${qs}`
   );
   try {
-    const result = await client.get(path92);
+    const result = await client.get(path93);
     if (result.totalAffected === 0) {
       return {
         summary: `${result.origin} has no dependents. Nothing else would break if it failed.`
@@ -27669,17 +28533,17 @@ async function runBlastRadius(client, input) {
   }
 }
 function formatBlastEntry(n) {
-  const tag = n.edgeProvenance === import_types95.Provenance.STALE ? " [STALE \u2014 last seen too long ago]" : "";
+  const tag = n.edgeProvenance === import_types96.Provenance.STALE ? " [STALE \u2014 last seen too long ago]" : "";
   return `  \u2022 ${n.nodeId} (distance ${n.distance}, ${n.edgeProvenance})${tag}`;
 }
 async function runDependencies(client, input) {
   const depth = input.depth ?? 3;
-  const path92 = projectPath(
+  const path93 = projectPath(
     input.project,
     `/graph/dependencies/${encodeURIComponent(input.nodeId)}?depth=${depth}`
   );
   try {
-    const result = await client.get(path92);
+    const result = await client.get(path93);
     if (result.total === 0) {
       return {
         summary: depth === 1 ? `${input.nodeId} has no direct dependencies in the graph.` : `${input.nodeId} has no dependencies (BFS to depth ${depth}).`
@@ -27726,7 +28590,7 @@ async function runObservedDependencies(client, input) {
       if (result.observed) {
         return {
           summary: `${input.nodeId} makes no outbound runtime calls, but OTel has observed it receiving traffic on ${result.inboundObservedCount} inbound call path${result.inboundObservedCount === 1 ? "" : "s"} \u2014 it's a pure receiver.`,
-          provenance: import_types95.Provenance.OBSERVED
+          provenance: import_types96.Provenance.OBSERVED
         };
       }
       const note = result.hasExtractedOutbound ? " Static (EXTRACTED) dependencies exist but no runtime traffic has been seen \u2014 is OTel running?" : "";
@@ -27736,7 +28600,7 @@ async function runObservedDependencies(client, input) {
     return {
       summary: `${input.nodeId} has ${result.dependencies.length} runtime dependenc${result.dependencies.length === 1 ? "y" : "ies"} confirmed by OTel.`,
       block: blockLines.join("\n"),
-      provenance: import_types95.Provenance.OBSERVED
+      provenance: import_types96.Provenance.OBSERVED
     };
   } catch (err) {
     if (err instanceof HttpError && err.status === 404) {
@@ -27771,9 +28635,9 @@ function formatDuration(ms) {
   return `${Math.round(h / 24)}d`;
 }
 async function runIncidents(client, input) {
-  const path92 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
+  const path93 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
   try {
-    const body = await client.get(path92);
+    const body = await client.get(path93);
     const events = body.events;
     if (events.length === 0) {
       return {
@@ -27790,7 +28654,7 @@ async function runIncidents(client, input) {
     return {
       summary: `${target} has ${body.total} recorded incident${body.total === 1 ? "" : "s"}; showing the ${ordered.length} most recent.`,
       block: blockLines.join("\n"),
-      provenance: import_types95.Provenance.OBSERVED
+      provenance: import_types96.Provenance.OBSERVED
     };
   } catch (err) {
     if (err instanceof HttpError && err.status === 404) {
@@ -27899,7 +28763,7 @@ async function runStaleEdges(client, input) {
   return {
     summary: `${events.length} stale-edge transition${events.length === 1 ? "" : "s"} recorded${input.edgeType ? ` for ${input.edgeType}` : ""}.`,
     block: blockLines.join("\n"),
-    provenance: import_types95.Provenance.STALE
+    provenance: import_types96.Provenance.STALE
   };
 }
 async function runPolicies(client, input) {
@@ -28014,6 +28878,33 @@ async function runDivergences(client, input) {
     provenance: "composite (EXTRACTED + OBSERVED)"
   };
 }
+async function runAsk(client, input) {
+  const result = await client.get(
+    projectPath(input.project, `/graph/ask?q=${encodeURIComponent(input.question)}`)
+  );
+  const blockLines = [];
+  if (result.matched.length > 0) {
+    blockLines.push(
+      `Matched: ${result.matched.map((m) => `${m.nodeId} [${m.via} ${m.score.toFixed(2)}]`).join(", ")}`
+    );
+    blockLines.push(`Intent: ${result.intent}`);
+  } else if (result.scope === "global") {
+    blockLines.push(`Graph-wide answer (${result.intent}) \u2014 no entity named.`);
+  }
+  for (const section of result.sections) {
+    blockLines.push("", section.heading + ":");
+    for (const fact of section.facts) {
+      const tag = fact.provenance ? ` [${fact.provenance}${fact.confidence !== void 0 ? ` ${fact.confidence.toFixed(2)}` : ""}]` : fact.confidence !== void 0 ? ` [confidence ${fact.confidence.toFixed(2)}]` : "";
+      blockLines.push(`  \u2022 ${fact.text}${tag}`);
+    }
+  }
+  return {
+    summary: result.answer,
+    block: blockLines.join("\n").trim(),
+    ...result.confidence !== void 0 ? { confidence: result.confidence } : {},
+    ...result.provenance.length > 0 ? { provenance: result.provenance } : {}
+  };
+}
 function formatFooter(confidence, provenance) {
   const c = confidence === void 0 ? "n/a" : confidence.toFixed(2);
   const p = provenance === void 0 ? "n/a" : Array.isArray(provenance) ? [...new Set(provenance)].join(", ") : provenance;
@@ -28058,10 +28949,10 @@ async function pushSnapshotToRemote(input) {
 
 // src/monitor.ts
 var OBSERVED_DEP_EDGE_TYPES = /* @__PURE__ */ new Set([
-  import_types96.EdgeType.CALLS,
-  import_types96.EdgeType.CONNECTS_TO,
-  import_types96.EdgeType.PUBLISHES_TO,
-  import_types96.EdgeType.CONSUMES_FROM
+  import_types97.EdgeType.CALLS,
+  import_types97.EdgeType.CONNECTS_TO,
+  import_types97.EdgeType.PUBLISHES_TO,
+  import_types97.EdgeType.CONSUMES_FROM
 ]);
 function divergenceKey(d) {
   const column = "column" in d && d.column ? d.column : "";
@@ -28106,7 +28997,7 @@ function formatDivergenceLine2(d) {
   }
 }
 function formatStaleLine(edgeId) {
-  const parsed = (0, import_types96.parseEdgeId)(edgeId);
+  const parsed = (0, import_types97.parseEdgeId)(edgeId);
   if (parsed) {
     return `\u22EF stale  ${parsed.source} \u2192 ${parsed.target}  (observed edge went quiet)`;
   }
@@ -28119,7 +29010,7 @@ function divergenceJson(d) {
   return JSON.stringify({ kind: "divergence", ...d });
 }
 function staleJson(edgeId) {
-  const parsed = (0, import_types96.parseEdgeId)(edgeId);
+  const parsed = (0, import_types97.parseEdgeId)(edgeId);
   return JSON.stringify({
     kind: "stale",
     edgeId,
@@ -28189,7 +29080,7 @@ var MonitorEmitter = class {
   // ignores non-OBSERVED edges and non-dependency edge types (structural
   // ownership), so only real runtime dependencies reach stdout.
   emitObservedEdge(edge) {
-    if (edge.provenance !== import_types96.Provenance.OBSERVED) return false;
+    if (edge.provenance !== import_types97.Provenance.OBSERVED) return false;
     if (!OBSERVED_DEP_EDGE_TYPES.has(edge.type)) return false;
     const key = `edge|${edge.id}`;
     if (this.seen.has(key)) return false;
@@ -28347,7 +29238,7 @@ async function runMonitor(opts) {
       case "edge-added": {
         const payload = safeParse(frame.data);
         const edge = payload?.edge;
-        if (edge && edge.provenance === import_types96.Provenance.OBSERVED) {
+        if (edge && edge.provenance === import_types97.Provenance.OBSERVED) {
           emitter.emitObservedEdge(edge);
           divergences.schedule();
         }
@@ -28427,7 +29318,7 @@ function sleep(ms, signal) {
 
 // src/cli-verbs.ts
 init_cjs_shims();
-var import_node_path90 = __toESM(require("path"), 1);
+var import_node_path91 = __toESM(require("path"), 1);
 async function resolveProjectEntry(opts) {
   const entries = await listProjects();
   if (opts.project) {
@@ -28437,7 +29328,7 @@ async function resolveProjectEntry(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const resolvedCwd = await normalizeProjectPath(cwd);
   for (const entry2 of entries) {
-    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${import_node_path90.default.sep}`)) {
+    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${import_node_path91.default.sep}`)) {
       return entry2;
     }
   }
@@ -28590,7 +29481,7 @@ async function runSync(opts) {
 }
 
 // src/cli.ts
-var import_types97 = require("@neat.is/types");
+var import_types98 = require("@neat.is/types");
 function isNpxInvocation() {
   if (process.env.npm_command === "exec") return true;
   const execpath = process.env.npm_execpath ?? "";
@@ -28602,7 +29493,7 @@ function isNpxInvocation() {
 function commandPrefix() {
   return isNpxInvocation() ? "npx neat.is" : "neat";
 }
-function usage4() {
+function usage5() {
   const neat = commandPrefix();
   console.log("Installed via npx? Prefix commands with `npx neat.is`, or install once: `npm i -g neat.is`.");
   console.log("");
@@ -28650,13 +29541,21 @@ function usage4() {
   console.log("                   --print-config   print the JSON snippet to stdout");
   console.log("                   --apply          merge mcpServers.neat into ~/.claude.json");
   console.log("  hooks          Wire NEAT into your agent so it queries the graph before");
-  console.log("                 grepping. Installs a gentle Claude Code search-nudge hook and");
-  console.log("                 writes agent-agnostic graph-first guidance for other harnesses.");
+  console.log("                 grepping. Installs a Claude Code search hook (nudge by default,");
+  console.log("                 or a hard gate) and agent-agnostic graph-first guidance.");
   console.log("                 Flags:");
   console.log("                   --apply          install the hook + guidance");
+  console.log("                   --gate           with --apply: DENY search until `neat ask`");
+  console.log("                                    has run this session (default: nudge-only)");
   console.log("                   --print-hook     print the hook script");
   console.log("                   --print-guide    print the graph-first guidance");
   console.log("                   --print-settings print the settings.json block --apply adds");
+  console.log("  claude         Write the query-first directive into ./CLAUDE.md as a `## neat`");
+  console.log("                 section so an agent reaches for `neat ask` before Read/Grep/Bash.");
+  console.log("                 Subcommands:");
+  console.log("                   install     write (or refresh) the `## neat` section");
+  console.log("                   uninstall   remove the `## neat` section");
+  console.log("                   print       print the directive block to stdout");
   console.log("  codex          Install NEAT into the OpenAI Codex CLI: add [mcp_servers.neat]");
   console.log("                 to ~/.codex/config.toml and the graph-first block to ./AGENTS.md.");
   console.log("                 Plan by default; --apply to write.");
@@ -28733,6 +29632,10 @@ function usage4() {
   console.log("                 run time; the config file is written owner-only (0600).");
   console.log("");
   console.log("query commands (mirror the MCP tools, ADR-050):");
+  console.log("  ask <question>                   Plain-language door: resolves the question to");
+  console.log("                                   nodes and routes it to the right traversal, with");
+  console.log("                                   a compact provenance-tagged answer. Reach here first.");
+  console.log(`                                   example: ${neat} ask "why is checkout failing?"`);
   console.log("  root-cause <node-id>             Walk inbound edges to find what broke first.");
   console.log(`                                   example: ${neat} root-cause service:<name>`);
   console.log("  blast-radius <node-id>           BFS inbound \u2014 the dependents that break if this dies.");
@@ -28952,7 +29855,7 @@ async function buildPatchSections(services, project) {
 }
 async function runInit(opts) {
   const written = [];
-  const stat = await import_node_fs55.promises.stat(opts.scanPath).catch(() => null);
+  const stat = await import_node_fs56.promises.stat(opts.scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) {
     console.error(`neat init: ${opts.scanPath} is not a directory`);
     return { exitCode: 2, writtenFiles: written };
@@ -28961,13 +29864,13 @@ async function runInit(opts) {
   printDiscoveryReport(opts, services);
   const sections = opts.noInstall ? [] : await buildPatchSections(services, opts.project);
   const patch = renderPatch(sections);
-  const patchPath = import_node_path91.default.join(opts.scanPath, "neat.patch");
+  const patchPath = import_node_path92.default.join(opts.scanPath, "neat.patch");
   if (opts.dryRun) {
-    await import_node_fs55.promises.writeFile(patchPath, patch, "utf8");
+    await import_node_fs56.promises.writeFile(patchPath, patch, "utf8");
     written.push(patchPath);
     console.log(`dry-run: patch written to ${patchPath}`);
-    const gitignorePath = import_node_path91.default.join(opts.scanPath, ".gitignore");
-    const gitignoreExists = await import_node_fs55.promises.stat(gitignorePath).then(() => true).catch(() => false);
+    const gitignorePath = import_node_path92.default.join(opts.scanPath, ".gitignore");
+    const gitignoreExists = await import_node_fs56.promises.stat(gitignorePath).then(() => true).catch(() => false);
     const verb = gitignoreExists ? "append" : "create";
     console.log(`dry-run: would ${verb} ${gitignorePath} (add neat-out/)`);
     console.log("rerun without --dry-run to register and snapshot.");
@@ -28978,9 +29881,9 @@ async function runInit(opts) {
   const graph = getGraph(graphKey);
   const projectPaths = pathsForProject(
     graphKey,
-    import_node_path91.default.join(opts.scanPath, "neat-out")
+    import_node_path92.default.join(opts.scanPath, "neat-out")
   );
-  const errorsPath = import_node_path91.default.join(import_node_path91.default.dirname(opts.outPath), import_node_path91.default.basename(projectPaths.errorsPath));
+  const errorsPath = import_node_path92.default.join(import_node_path92.default.dirname(opts.outPath), import_node_path92.default.basename(projectPaths.errorsPath));
   const result = await extractFromDirectory(graph, opts.scanPath, { errorsPath });
   await saveGraphToDisk(graph, opts.outPath);
   written.push(opts.outPath);
@@ -29059,7 +29962,7 @@ async function runInit(opts) {
         console.log("Run `npm install` (or your language equivalent) to refresh lockfiles.");
       }
     } else {
-      await import_node_fs55.promises.writeFile(patchPath, patch, "utf8");
+      await import_node_fs56.promises.writeFile(patchPath, patch, "utf8");
       written.push(patchPath);
     }
   }
@@ -29099,9 +30002,9 @@ var CLAUDE_SKILL_CONFIG = {
 };
 function claudeConfigPath() {
   const override = process.env.NEAT_CLAUDE_CONFIG;
-  if (override && override.length > 0) return import_node_path91.default.resolve(override);
+  if (override && override.length > 0) return import_node_path92.default.resolve(override);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return import_node_path91.default.join(home, ".claude.json");
+  return import_node_path92.default.join(home, ".claude.json");
 }
 async function runSkill(opts) {
   const snippet2 = JSON.stringify(CLAUDE_SKILL_CONFIG, null, 2) + "\n";
@@ -29113,7 +30016,7 @@ async function runSkill(opts) {
     const target = claudeConfigPath();
     let existing = {};
     try {
-      existing = JSON.parse(await import_node_fs55.promises.readFile(target, "utf8"));
+      existing = JSON.parse(await import_node_fs56.promises.readFile(target, "utf8"));
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(`neat skill: failed to read ${target} \u2014 ${err.message}`);
@@ -29125,8 +30028,8 @@ async function runSkill(opts) {
       ...existing,
       mcpServers: { ...mcp, neat: CLAUDE_SKILL_CONFIG.mcpServers.neat }
     };
-    await import_node_fs55.promises.mkdir(import_node_path91.default.dirname(target), { recursive: true });
-    await import_node_fs55.promises.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    await import_node_fs56.promises.mkdir(import_node_path92.default.dirname(target), { recursive: true });
+    await import_node_fs56.promises.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
     console.log(`neat skill: wrote mcpServers.neat to ${target}`);
     console.log("restart Claude Code to pick up the new MCP server.");
     console.log("");
@@ -29153,7 +30056,7 @@ async function main() {
   const argv = process.argv.slice(2);
   const cmd0 = argv[0];
   if (cmd0 === "-h" || cmd0 === "--help") {
-    usage4();
+    usage5();
     process.exit(0);
   }
   if (cmd0 === "--version" || cmd0 === "-v" || cmd0 === "version") {
@@ -29175,6 +30078,11 @@ async function main() {
     if (code !== 0) process.exit(code);
     return;
   }
+  if (cmd0 === "claude") {
+    const code = await runClaudeCommand(argv.slice(1));
+    if (code !== 0) process.exit(code);
+    return;
+  }
   const EDITOR_VERBS = [
     "cursor",
     "devin",
@@ -29205,19 +30113,19 @@ async function main() {
     const target = positional[0];
     if (!target) {
       console.error("neat init: missing <path>");
-      usage4();
+      usage5();
       process.exit(2);
     }
     if (apply6 && dryRun) {
       console.error("neat init: --apply and --dry-run are mutually exclusive");
       process.exit(2);
     }
-    const scanPath = import_node_path91.default.resolve(target);
+    const scanPath = import_node_path92.default.resolve(target);
     const projectExplicit = parsed.project !== null;
-    const projectName = projectExplicit ? project : import_node_path91.default.basename(scanPath);
+    const projectName = projectExplicit ? project : import_node_path92.default.basename(scanPath);
     const projectKey = projectExplicit ? project : DEFAULT_PROJECT;
-    const fallback = pathsForProject(projectKey, import_node_path91.default.join(scanPath, "neat-out")).snapshotPath;
-    const outPath = import_node_path91.default.resolve(process.env.NEAT_OUT_PATH ?? fallback);
+    const fallback = pathsForProject(projectKey, import_node_path92.default.join(scanPath, "neat-out")).snapshotPath;
+    const outPath = import_node_path92.default.resolve(process.env.NEAT_OUT_PATH ?? fallback);
     const result = await runInit({
       scanPath,
       outPath,
@@ -29235,24 +30143,24 @@ async function main() {
     const target = positional[0];
     if (!target) {
       console.error("neat watch: missing <path>");
-      usage4();
+      usage5();
       process.exit(2);
     }
-    const scanPath = import_node_path91.default.resolve(target);
-    const stat = await import_node_fs55.promises.stat(scanPath).catch(() => null);
+    const scanPath = import_node_path92.default.resolve(target);
+    const stat = await import_node_fs56.promises.stat(scanPath).catch(() => null);
     if (!stat || !stat.isDirectory()) {
       console.error(`neat watch: ${scanPath} is not a directory`);
       process.exit(2);
     }
-    const projectPaths = pathsForProject(project, import_node_path91.default.join(scanPath, "neat-out"));
-    const outPath = import_node_path91.default.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
-    const errorsPath = import_node_path91.default.resolve(
-      process.env.NEAT_ERRORS_PATH ?? import_node_path91.default.join(import_node_path91.default.dirname(outPath), import_node_path91.default.basename(projectPaths.errorsPath))
+    const projectPaths = pathsForProject(project, import_node_path92.default.join(scanPath, "neat-out"));
+    const outPath = import_node_path92.default.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
+    const errorsPath = import_node_path92.default.resolve(
+      process.env.NEAT_ERRORS_PATH ?? import_node_path92.default.join(import_node_path92.default.dirname(outPath), import_node_path92.default.basename(projectPaths.errorsPath))
     );
-    const staleEventsPath = import_node_path91.default.resolve(
-      process.env.NEAT_STALE_EVENTS_PATH ?? import_node_path91.default.join(import_node_path91.default.dirname(outPath), import_node_path91.default.basename(projectPaths.staleEventsPath))
+    const staleEventsPath = import_node_path92.default.resolve(
+      process.env.NEAT_STALE_EVENTS_PATH ?? import_node_path92.default.join(import_node_path92.default.dirname(outPath), import_node_path92.default.basename(projectPaths.staleEventsPath))
     );
-    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? import_node_path91.default.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
+    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? import_node_path92.default.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
     const handle = await startWatch(getGraph(project), {
       scanPath,
       outPath,
@@ -29261,7 +30169,7 @@ async function main() {
       project,
       // Resolve NEAT_HOME so a `neat watch` picks up connectors added to
       // ~/.neat/connectors.json (#871). Same resolution the rest of the CLI uses.
-      neatHome: process.env.NEAT_HOME ? import_node_path91.default.resolve(process.env.NEAT_HOME) : import_node_path91.default.join(import_node_os8.default.homedir(), ".neat"),
+      neatHome: process.env.NEAT_HOME ? import_node_path92.default.resolve(process.env.NEAT_HOME) : import_node_path92.default.join(import_node_os8.default.homedir(), ".neat"),
       ...embeddingsCachePath ? { embeddingsCachePath } : {},
       host: process.env.HOST ?? "0.0.0.0",
       port: Number(process.env.PORT ?? 8080),
@@ -29297,7 +30205,7 @@ async function main() {
     const name = positional[0];
     if (!name) {
       console.error("neat pause: missing <name>");
-      usage4();
+      usage5();
       process.exit(2);
     }
     const daemon = await findDaemonByProject(name);
@@ -29322,7 +30230,7 @@ async function main() {
     const name = positional[0];
     if (!name) {
       console.error("neat resume: missing <name>");
-      usage4();
+      usage5();
       process.exit(2);
     }
     const daemon = await findDaemonByProject(name);
@@ -29352,7 +30260,7 @@ async function main() {
     const name = positional[0];
     if (!name) {
       console.error("neat uninstall: missing <name>");
-      usage4();
+      usage5();
       process.exit(2);
     }
     const daemon = await findDaemonByProject(name);
@@ -29439,15 +30347,15 @@ async function main() {
     return;
   }
   console.error(`neat: unknown command "${cmd}"`);
-  usage4();
+  usage5();
   process.exit(1);
 }
 async function tryOrchestrator(cmd, parsed) {
-  const scanPath = import_node_path91.default.resolve(cmd);
-  const stat = await import_node_fs55.promises.stat(scanPath).catch(() => null);
+  const scanPath = import_node_path92.default.resolve(cmd);
+  const stat = await import_node_fs56.promises.stat(scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) return null;
   const projectExplicit = parsed.project !== null;
-  const projectName = projectExplicit ? parsed.project : import_node_path91.default.basename(scanPath);
+  const projectName = projectExplicit ? parsed.project : import_node_path92.default.basename(scanPath);
   const result = await runOrchestrator({
     scanPath,
     project: projectName,
@@ -29469,7 +30377,10 @@ var QUERY_VERBS = /* @__PURE__ */ new Set([
   "stale-edges",
   "policies",
   // Tenth verb (ADR-060) — amends ADR-050's locked allowlist of nine.
-  "divergences"
+  "divergences",
+  // Twelfth verb (ADR-198) — the plain-language door over the whole tool
+  // surface. Amends ADR-050's locked allowlist the same way `divergences` did.
+  "ask"
 ]);
 function resolveProjectFlag(parsed) {
   if (parsed.project) return parsed.project;
@@ -29591,6 +30502,15 @@ async function runQueryVerb(cmd, parsed) {
       makeWork = (project) => runSearch(client, { query: q, ...project ? { project } : {} });
       break;
     }
+    case "ask": {
+      const question = positional.join(" ").trim();
+      if (!question) {
+        console.error("neat ask: missing <question>");
+        return 2;
+      }
+      makeWork = (project) => runAsk(client, { question, ...project ? { project } : {} });
+      break;
+    }
     case "diff": {
       const against = parsed.against ?? parsed.since;
       if (!against) {
@@ -29636,10 +30556,10 @@ async function runQueryVerb(cmd, parsed) {
         const parts = parsed.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
         const out = [];
         for (const p of parts) {
-          const r = import_types97.DivergenceTypeSchema.safeParse(p);
+          const r = import_types98.DivergenceTypeSchema.safeParse(p);
           if (!r.success) {
             console.error(
-              `neat divergences: unknown --type "${p}". allowed: ${import_types97.DivergenceTypeSchema.options.join(", ")}`
+              `neat divergences: unknown --type "${p}". allowed: ${import_types98.DivergenceTypeSchema.options.join(", ")}`
             );
             return 2;
           }