@quolu/lattice 0.43.0 → 0.44.0

package/sensor/dist/mcp/server-instructions.d.ts

@@ -15,7 +15,7 @@
  * burn tokens. ADR 0049 / 0059 require the eight compatibility tools to remain
  * visible by default; provider identity is Lattice regardless of their names.
  */
-export declare const SERVER_INSTRUCTIONS = "# Lattice sensor \u2014 code intelligence over an indexed knowledge graph\n\nProvider identity: lattice. The lattice_sensor_* names below are compatibility tool names served by Lattice's own bundled sensor; they do not call or require the independent Lattice sensor product.\n\nLattice sensor is a SQLite knowledge graph of every symbol, edge, and file in\nthe workspace \u2014 pre-computed structure you would otherwise re-derive by\nreading files (cached intelligence: thousands of parse/trace decisions you\ndon't pay to re-reason each run). Reads are sub-millisecond; the index lags\nwrites by ~1s through the file watcher. Reach for it BEFORE *and* while\nwriting or editing code \u2014 not just for questions: one call returns the\nverbatim source PLUS who calls it and what it affects, so you edit with the\nblast radius in view. More accurate context, in far fewer tokens and\nround-trips than reading files yourself.\n\n## One tool: lattice_sensor_explore \u2014 use it instead of reading files\n\nThere is a single tool, `lattice_sensor_explore`, and it is Read-equivalent. It\ntakes either a natural-language question or a bag of symbol/file names and\nreturns the **verbatim, line-numbered source** of the relevant symbols\ngrouped by file \u2014 the same `<n>\\t<line>` shape `Read` gives you, safe to\n`Edit` from \u2014 PLUS the call path among them (including dynamic-dispatch hops\nlike callbacks, React re-render, and JSX children that grep can't follow) and\na blast-radius summary of what depends on them.\n\nWhether you're answering \"how does X work\" or implementing a change (fixing a\nbug, adding a feature), call `lattice_sensor_explore` before you Read. ONE call\nusually answers the whole question. Lattice sensor IS the pre-built search index \u2014\nso running your own grep + read loop, or delegating the lookup to a separate\nfile-reading sub-task/agent, repeats work lattice sensor already did and costs more\nfor the same answer. A direct lattice sensor answer is typically one to a few\ncalls; a grep/read exploration is dozens.\n\n## How to query\n\n- **Almost any question \u2014 \"how does X work\", architecture, a bug, \"what/where is X\", or surveying an area** \u2192 `lattice_sensor_explore` with a natural-language question or the relevant names. ONE capped call returns the verbatim source grouped by file; most often the ONLY call you need.\n- **\"How does X reach/become Y? / the flow / the path from X to Y\"** \u2192 `lattice_sensor_explore`, naming the symbols that span the flow (e.g. `mutateElement renderScene`) \u2014 it surfaces the call path among them, riding dynamic-dispatch hops, and returns their source.\n- **Reading or editing a file/symbol you can name** \u2192 put its name or file path in the `lattice_sensor_explore` query \u2014 it returns that current line-numbered source (safe to `Edit` from) with the call path and blast radius attached, so you don't Read it separately. For an overloaded name it returns every matching definition's body in one call.\n- **Need more?** Call `lattice_sensor_explore` again with more specific names \u2014 treat the source it returns as already Read.\n\n## Anti-patterns\n\n- **Trust lattice sensor's results \u2014 don't re-verify them with grep.** They come from a full AST parse; re-checking with grep is slower, less accurate, and wastes context.\n- **Don't grep or Read first** to find or understand indexed code \u2014 ONE `lattice_sensor_explore` returns the relevant symbols' source together in a single round-trip. Reach for raw `Read`/`Grep` only to confirm a specific detail lattice sensor didn't cover, or for what lattice sensor doesn't index (configs, docs).\n- **Don't reconstruct a flow by hand** \u2014 name the endpoints in one `lattice_sensor_explore` and it surfaces the path between them, dynamic-dispatch hops included.\n- **After editing, check the staleness banner.** When a tool response starts with \"\u26A0\uFE0F Some files referenced below were edited since the last index sync\u2026\", the listed files are pending re-index \u2014 Read those specific files for accurate content. Every file NOT in that banner is fresh, so still trust lattice sensor. A different, rarer banner \u2014 \"\u26A0\uFE0F LatticeSensor auto-sync is DISABLED\u2026\" \u2014 means live watching stopped entirely (the whole index is frozen, not just a few files); until it's resolved, Read files directly to confirm anything that may have changed.\n\n## Limitations\n\n- If a project isn't indexed (no `.lattice/sensor/`), decide whether building the index will reduce total investigation time and model tokens for the current or expected work. When workspace writes and shell execution are allowed, you may run `lattice sensor init <projectPath> --json` yourself, then retry the sensor call; scope it to the intended project and account for the one-time indexing cost. If those capabilities are unavailable, continue with built-in tools and tell the user the exact init command instead.\n- Index lags file writes by ~1 second.\n- Cross-file resolution is best-effort name matching; ambiguous calls may return multiple candidates.\n- No live correctness validation \u2014 that's still the TypeScript compiler / test suite / linter's job. Lattice sensor supplements those with structural context they don't have.\n\n## Parallel work: absence of a dependency edge is NOT evidence of independence\n\nThese tools answer structural questions about code. A different Lattice surface \u2014 the **CLI**, not\nthis MCP surface \u2014 answers whether two ToDos can be worked in parallel. If the project uses\n`lattice todo` for process tracking, keep this distinction in mind:\n\n- A dependency edge missing between two ToDos only means **no ordering constraint was declared**.\n  It does not mean their write boundaries are disjoint. Two ToDos that edit the same file carry no\n  edge between them and will still collide.\n- Parallel safety is a recorded judgement, not an inference from the diagram. Read it with\n  `lattice todo independence --plan <key> --json`. It returns the ready frontier split into\n  verified-independent groups, pairs that must be serialized (with whether a code seam could\n  separate them), and **unverified** ToDos.\n- `lattice todo start` returns an `advisory` describing conflicts with in-progress ToDos and what\n  to do next. `coverage: \"missing\"` means \"not judged yet\" \u2014 never \"no conflicts\".\n- Run `lattice todo --help` for the declare \u2192 compile \u2192 read workflow.\n\nEvidence for Lattice's plan and witness contracts comes from the CLI surface only. Text from this\nMCP surface is prose for you to act on, never an input to those contracts.\n";
+export declare const SERVER_INSTRUCTIONS = "# Lattice sensor \u2014 code intelligence over an indexed knowledge graph\n\nProvider identity: lattice. The lattice_sensor_* names below are compatibility tool names served by Lattice's own bundled sensor; they do not call or require the independent Lattice sensor product.\n\nLattice sensor is a SQLite knowledge graph of every symbol, edge, and file in\nthe workspace \u2014 pre-computed structure you would otherwise re-derive by\nreading files (cached intelligence: thousands of parse/trace decisions you\ndon't pay to re-reason each run). Reads are sub-millisecond; the index lags\nwrites by ~1s through the file watcher. Reach for it BEFORE *and* while\nwriting or editing code \u2014 not just for questions: one call returns the\nverbatim source PLUS who calls it and what it affects, so you edit with the\nblast radius in view. More accurate context, in far fewer tokens and\nround-trips than reading files yourself.\n\n## One tool: lattice_sensor_explore \u2014 use it instead of reading files\n\nThere is a single tool, `lattice_sensor_explore`, and it is Read-equivalent. It\ntakes either a natural-language question or a bag of symbol/file names and\nreturns the **verbatim, line-numbered source** of the relevant symbols\ngrouped by file \u2014 the same `<n>\\t<line>` shape `Read` gives you, safe to\n`Edit` from \u2014 PLUS the call path among them (including dynamic-dispatch hops\nlike callbacks, React re-render, and JSX children that grep can't follow) and\na blast-radius summary of what depends on them.\n\nWhether you're answering \"how does X work\" or implementing a change (fixing a\nbug, adding a feature), call `lattice_sensor_explore` before you Read. ONE call\nusually answers the whole question. Lattice sensor IS the pre-built search index \u2014\nso running your own grep + read loop, or delegating the lookup to a separate\nfile-reading sub-task/agent, repeats work lattice sensor already did and costs more\nfor the same answer. A direct lattice sensor answer is typically one to a few\ncalls; a grep/read exploration is dozens.\n\n## How to query\n\n- **Almost any question \u2014 \"how does X work\", architecture, a bug, \"what/where is X\", or surveying an area** \u2192 `lattice_sensor_explore` with a natural-language question or the relevant names. ONE capped call returns the verbatim source grouped by file; most often the ONLY call you need.\n- **\"How does X reach/become Y? / the flow / the path from X to Y\"** \u2192 `lattice_sensor_explore`, naming the symbols that span the flow (e.g. `mutateElement renderScene`) \u2014 it surfaces the call path among them, riding dynamic-dispatch hops, and returns their source.\n- **Reading or editing a file/symbol you can name** \u2192 put its name or file path in the `lattice_sensor_explore` query \u2014 it returns that current line-numbered source (safe to `Edit` from) with the call path and blast radius attached, so you don't Read it separately. For an overloaded name it returns every matching definition's body in one call.\n- **Need more?** Call `lattice_sensor_explore` again with more specific names \u2014 treat the source it returns as already Read.\n\n## Anti-patterns\n\n- **Trust lattice sensor's results \u2014 don't re-verify them with grep.** They come from a full AST parse; re-checking with grep is slower, less accurate, and wastes context.\n- **Don't grep or Read first** to find or understand indexed code \u2014 ONE `lattice_sensor_explore` returns the relevant symbols' source together in a single round-trip. Reach for raw `Read`/`Grep` only to confirm a specific detail lattice sensor didn't cover, or for what lattice sensor doesn't index (configs, docs).\n- **Don't reconstruct a flow by hand** \u2014 name the endpoints in one `lattice_sensor_explore` and it surfaces the path between them, dynamic-dispatch hops included.\n- **After editing, check the staleness banner.** When a tool response starts with \"\u26A0\uFE0F Some files referenced below were edited since the last index sync\u2026\", the listed files are pending re-index \u2014 Read those specific files for accurate content. Every file NOT in that banner is fresh, so still trust lattice sensor. A different, rarer banner \u2014 \"\u26A0\uFE0F LatticeSensor auto-sync is DISABLED\u2026\" \u2014 means live watching stopped entirely (the whole index is frozen, not just a few files); until it's resolved, Read files directly to confirm anything that may have changed.\n- **A file flagged \"\u26A0 changed on disk after the last index sync\" drifted from its index** (most common on projects queried via `projectPath`, which have no live watcher). LatticeSensor never serves a possibly-mis-sliced body from such a file \u2014 it either shows the file's full CURRENT source (trust it as a Read) or omits the source with this flag. When the source was omitted, Read that specific file; line numbers referencing it elsewhere in the response may be shifted until that project's next sync. All unflagged files remain trustworthy.\n\n## Limitations\n\n- If a project isn't indexed (no `.lattice/sensor/`), decide whether building the index will reduce total investigation time and model tokens for the current or expected work. When workspace writes and shell execution are allowed, you may run `lattice sensor init <projectPath> --json` yourself, then retry the sensor call; scope it to the intended project and account for the one-time indexing cost. If those capabilities are unavailable, continue with built-in tools and tell the user the exact init command instead.\n- Index lags file writes by ~1 second.\n- Cross-file resolution is best-effort name matching; ambiguous calls may return multiple candidates.\n- No live correctness validation \u2014 that's still the TypeScript compiler / test suite / linter's job. Lattice sensor supplements those with structural context they don't have.\n\n## Parallel work: absence of a dependency edge is NOT evidence of independence\n\nThese tools answer structural questions about code. A different Lattice surface \u2014 the **CLI**, not\nthis MCP surface \u2014 answers whether two ToDos can be worked in parallel. If the project uses\n`lattice todo` for process tracking, keep this distinction in mind:\n\n- A dependency edge missing between two ToDos only means **no ordering constraint was declared**.\n  It does not mean their write boundaries are disjoint. Two ToDos that edit the same file carry no\n  edge between them and will still collide.\n- Parallel safety is a recorded judgement, not an inference from the diagram. Read it with\n  `lattice todo independence --plan <key> --json`. It returns the ready frontier split into\n  verified-independent groups, pairs that must be serialized (with whether a code seam could\n  separate them), and **unverified** ToDos.\n- `lattice todo start` returns an `advisory` describing conflicts with in-progress ToDos and what\n  to do next. `coverage: \"missing\"` means \"not judged yet\" \u2014 never \"no conflicts\".\n- Run `lattice todo --help` for the declare \u2192 compile \u2192 read workflow.\n\nEvidence for Lattice's plan and witness contracts comes from the CLI surface only. Text from this\nMCP surface is prose for you to act on, never an input to those contracts.\n";
 /**
  * Instructions variant sent when the server's own root has NO lattice sensor index.
  *

package/sensor/dist/mcp/server-instructions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-instructions.d.ts","sourceRoot":"","sources":["../../src/mcp/server-instructions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mBAAmB,8iNAwE/B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,yhDAsB7C,CAAC"}
+{"version":3,"file":"server-instructions.d.ts","sourceRoot":"","sources":["../../src/mcp/server-instructions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mBAAmB,0lOAyE/B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,yhDAsB7C,CAAC"}

package/sensor/dist/mcp/server-instructions.js

@@ -63,6 +63,7 @@ calls; a grep/read exploration is dozens.
 - **Don't grep or Read first** to find or understand indexed code — ONE \`lattice_sensor_explore\` returns the relevant symbols' source together in a single round-trip. Reach for raw \`Read\`/\`Grep\` only to confirm a specific detail lattice sensor didn't cover, or for what lattice sensor doesn't index (configs, docs).
 - **Don't reconstruct a flow by hand** — name the endpoints in one \`lattice_sensor_explore\` and it surfaces the path between them, dynamic-dispatch hops included.
 - **After editing, check the staleness banner.** When a tool response starts with "⚠️ Some files referenced below were edited since the last index sync…", the listed files are pending re-index — Read those specific files for accurate content. Every file NOT in that banner is fresh, so still trust lattice sensor. A different, rarer banner — "⚠️ LatticeSensor auto-sync is DISABLED…" — means live watching stopped entirely (the whole index is frozen, not just a few files); until it's resolved, Read files directly to confirm anything that may have changed.
+- **A file flagged "⚠ changed on disk after the last index sync" drifted from its index** (most common on projects queried via \`projectPath\`, which have no live watcher). LatticeSensor never serves a possibly-mis-sliced body from such a file — it either shows the file's full CURRENT source (trust it as a Read) or omits the source with this flag. When the source was omitted, Read that specific file; line numbers referencing it elsewhere in the response may be shifted until that project's next sync. All unflagged files remain trustworthy.
 
 ## Limitations
 

package/sensor/dist/mcp/server-instructions.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-instructions.js","sourceRoot":"","sources":["../../src/mcp/server-instructions.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;GAgBG;AACU,QAAA,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwElC,CAAC;AAEF;;;;;;;;;;;GAWG;AACU,QAAA,iCAAiC,GAAG;;;;;;;;;;;;;;;;;;;;;;CAsBhD,CAAC"}
+{"version":3,"file":"server-instructions.js","sourceRoot":"","sources":["../../src/mcp/server-instructions.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;GAgBG;AACU,QAAA,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyElC,CAAC;AAEF;;;;;;;;;;;GAWG;AACU,QAAA,iCAAiC,GAAG;;;;;;;;;;;;;;;;;;;;;;CAsBhD,CAAC"}

package/sensor/dist/mcp/tools.d.ts

@@ -5,6 +5,7 @@
  */
 import type LatticeSensor from '../index';
 import type { QueryPool } from './query-pool';
+export declare function __setLoadLatticeSensorForTests(cls: typeof import('../index').default | null): void;
 import type { PendingFile } from '../sync';
 /**
  * An expected, recoverable "lattice sensor can't serve this" condition — most
@@ -377,6 +378,32 @@ export declare class ToolHandler {
      * Cost when nothing is pending — the common case — is one boolean check.
      * No I/O, no parsing of markdown beyond a per-pending-file substring scan.
      */
+    private driftCache;
+    private static readonly DRIFT_TTL_MS;
+    /**
+     * On-disk drift check for a single indexed file (issue #1474). The code
+     * renderers slice CURRENT bytes at INDEXED line ranges; when the file
+     * changed after its last index sync those ranges can point at a DIFFERENT
+     * symbol's code — served under the requested name with `isError: false`.
+     * The watcher-based pending/degraded banners can't cover this for a
+     * project reached via `projectPath` (cross-project instances have no
+     * watcher, by construction), so freshness is verified here, at the point
+     * of emission, from data the index already stores.
+     *
+     * Cheap and precise: one stat() per file (size + mtime, the same
+     * comparison the sync fast path uses); only on a stat mismatch is the
+     * content hashed (sha256, matching extraction's `hashContent`) so a
+     * touch/checkout that rewrote identical bytes never false-positives.
+     * Results are memoized briefly so one response rendering the same file in
+     * several sections pays for the check once.
+     *
+     * Returns true when the on-disk file differs from what was indexed —
+     * i.e. indexed line ranges for it are NOT trustworthy. Any failure
+     * (missing files-table row, stat/read error) reports false: those cases
+     * are handled by the existing not-found paths, and a wrong "stale" flag
+     * would needlessly push the agent back to Read.
+     */
+    private isFileStaleOnDisk;
     private withStalenessNotice;
     /**
      * Execute a tool by name
@@ -501,6 +528,14 @@ export declare class ToolHandler {
      * qualify so a leaf-only exploration stays clean.
      */
     private buildBlastRadiusSection;
+    /**
+     * Test-coverage note for a blast-radius entry whose DIRECT callers include no
+     * test file. A helper called only by production code can still be exercised
+     * by tests further up the caller chain (#1475: 40% of directly-unflagged
+     * symbols had a test within 2-3 hops), so walk up to 2 more hops before
+     * claiming anything — and even then claim only what was measured.
+     */
+    private indirectTestNote;
     /**
      * Graph-connectivity relevance via Random-Walk-with-Restart (personalized
      * PageRank) from the query's matched SEED nodes over the call/reference graph.
@@ -550,6 +585,19 @@ export declare class ToolHandler {
     private handleFileView;
     /** Render one symbol: details + (optional) body/outline + its caller/callee trail. */
     private renderNodeSection;
+    private static readonly STALE_WHOLE_FILE_MAX_LINES;
+    private static readonly STALE_WHOLE_FILE_MAX_CHARS;
+    /**
+     * lattice_sensor_node render for a symbol whose file changed on disk after the
+     * last index sync (issue #1474). The indexed line range is no longer
+     * trustworthy, so no slice is emitted: a small file gets its full CURRENT
+     * source (Read-parity — sufficiency preserved, the agent still doesn't need
+     * Read); a large one gets an explicit notice steering to the tool's own
+     * file-read mode (or Read) — honest absence instead of confident wrongness.
+     * Location/signature stay (they're the index's answer) but are flagged as
+     * possibly shifted.
+     */
+    private renderStaleNodeSection;
     /**
      * Build the "trail" for a symbol: its direct callees (what it calls) and
      * callers (what calls it), each with file:line — so lattice_sensor_node doubles as

package/sensor/dist/mcp/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/mcp/tools.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,aAAa,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAgB9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAW3C;;;;;;;;;;GAUG;AACH,qBAAa,eAAgB,SAAQ,KAAK;CAAG;AAE7C;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;CAAG;AAE9C;;;;;;;;;;;GAWG;AACH,qBAAa,cAAe,SAAQ,KAAK;CAAG;AAiD5C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAO5D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAM1D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,mBAAmB;IAClC,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,eAAe,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,eAAe,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,sBAAsB,EAAE,MAAM,CAAC;IAC/B,0EAA0E;IAC1E,2BAA2B,EAAE,MAAM,CAAC;IACpC,2CAA2C;IAC3C,oBAAoB,EAAE,OAAO,CAAC;IAC9B,yEAAyE;IACzE,sBAAsB,EAAE,OAAO,CAAC;IAChC,sEAAsE;IACtE,yBAAyB,EAAE,OAAO,CAAC;IACnC,sDAAsD;IACtD,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;;;;;OAOG;IACH,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAkG7E;AA6FD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,CAc9D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,CAa9D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAOlE;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAC3C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IACF,kEAAkE;IAClE,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,eAAe;IAC9B,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,oFAAoF;IACpF,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,2EAA2E;IAC3E,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AA6BD;;;;;;;;GAQG;AACH,eAAO,MAAM,KAAK,EAAE,cAAc,EAkNjC,CAAC;AAgCF;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,cAAc,EAAE,CAOjD;AAWD;;;;;GAKG;AACH,qBAAa,WAAW;IAyCV,OAAO,CAAC,EAAE;IAvCtB,OAAO,CAAC,YAAY,CAAyC;IAG7D,OAAO,CAAC,kBAAkB,CAAuB;IAMjD,OAAO,CAAC,qBAAqB,CAAwD;IAUrF,OAAO,CAAC,WAAW,CAA8B;IAKjD,OAAO,CAAC,SAAS,CAA0B;IAO3C,OAAO,CAAC,WAAW,CAAsB;IAMzC,OAAO,CAAC,aAAa,CAA0F;gBAE3F,EAAE,EAAE,aAAa,GAAG,IAAI;IAE5C;;;;;OAKG;IACH,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,GAAG,IAAI;IAI1C;;;OAGG;IACH,uBAAuB,CAAC,EAAE,EAAE,aAAa,GAAG,IAAI;IAKhD;;;;;;;OAOG;IACH,cAAc,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,GAAG,IAAI;IAIvC;;;;;OAKG;IACH,gBAAgB,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAIjE,qEAAqE;IACrE,gBAAgB,IAAI;QAAE,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAIjE;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;IAI7C;;;;;;;;OAQG;YACW,gBAAgB;IA4B9B;;;OAGG;IACH,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAIjD;;OAEG;IACH,uBAAuB,IAAI,OAAO;IAIlC;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa;IAQrB,kFAAkF;IAClF,OAAO,CAAC,aAAa;IAKrB;;;;;OAKG;IACH,QAAQ,IAAI,cAAc,EAAE;IAsC5B;;;;;;;;OAQG;IACH,OAAO,CAAC,gBAAgB;IA8FxB;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;IAef;;OAEG;IACH,QAAQ,IAAI,IAAI;IAQhB;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc;IAgBtB;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAgB5B;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IA6B3B;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IAa1B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,mBAAmB;IA2F3B;;OAEG;IACG,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;IAsFnF;;;;;;;;;;;;OAYG;IACG,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;IAkB3F;;;;;OAKG;YACW,YAAY;IAa1B;;OAEG;YACW,YAAY;IAmC1B;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IA2BxB,qEAAqE;IACrE,OAAO,CAAC,iBAAiB;IAMzB;;OAEG;YACW,aAAa;IAsE3B;;OAEG;YACW,aAAa;IAmE3B;;OAEG;YACW,YAAY;IA6D1B;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAsFrB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,yBAAyB;IA4QjC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IA6C9B;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,0BAA0B;IAoElC;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IA2D1B;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB;IAoD/B;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,qBAAqB;IAuD7B;;;;;;;;;;OAUG;YACW,aAAa;IA+sC3B;;OAEG;YACW,UAAU;IAoHxB;;;;;;;;;;;;OAYG;YACW,cAAc;IAkI5B,sFAAsF;YACxE,iBAAiB;IAkB/B;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IA8BnB;;OAEG;YACW,YAAY;IAkI1B;;OAEG;YACW,WAAW;IA2DzB;;OAEG;IACH,OAAO,CAAC,WAAW;IAUnB;;OAEG;IACH,OAAO,CAAC,eAAe;IAcvB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA6B1B;;OAEG;IACH,OAAO,CAAC,eAAe;IA4EvB;;;OAGG;IACH;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,aAAa;IAqCrB;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IA+CzB;;;OAGG;IACH,OAAO,CAAC,cAAc;IA0DtB;;OAEG;IACH,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,mBAAmB;IAgB3B,OAAO,CAAC,cAAc;IAgBtB;;;;;OAKG;IACH,OAAO,CAAC,SAAS;IASjB,OAAO,CAAC,YAAY;IA4BpB;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB;IAe7B,OAAO,CAAC,iBAAiB;IA8BzB,OAAO,CAAC,UAAU;IAMlB,OAAO,CAAC,WAAW;CAMpB"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/mcp/tools.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,aAAa,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAgB9C,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,cAAc,UAAU,EAAE,OAAO,GAAG,IAAI,GAAG,IAAI,CAElG;AAOD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAa3C;;;;;;;;;;GAUG;AACH,qBAAa,eAAgB,SAAQ,KAAK;CAAG;AAE7C;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;CAAG;AAE9C;;;;;;;;;;;GAWG;AACH,qBAAa,cAAe,SAAQ,KAAK;CAAG;AAiD5C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAO5D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAM1D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,mBAAmB;IAClC,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,eAAe,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,eAAe,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,sBAAsB,EAAE,MAAM,CAAC;IAC/B,0EAA0E;IAC1E,2BAA2B,EAAE,MAAM,CAAC;IACpC,2CAA2C;IAC3C,oBAAoB,EAAE,OAAO,CAAC;IAC9B,yEAAyE;IACzE,sBAAsB,EAAE,OAAO,CAAC;IAChC,sEAAsE;IACtE,yBAAyB,EAAE,OAAO,CAAC;IACnC,sDAAsD;IACtD,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;;;;;OAOG;IACH,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAkG7E;AA6FD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,CAc9D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,CAa9D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAOlE;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAC3C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IACF,kEAAkE;IAClE,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,eAAe;IAC9B,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,oFAAoF;IACpF,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,2EAA2E;IAC3E,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AA6BD;;;;;;;;GAQG;AACH,eAAO,MAAM,KAAK,EAAE,cAAc,EAkNjC,CAAC;AAgCF;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,cAAc,EAAE,CAOjD;AAWD;;;;;GAKG;AACH,qBAAa,WAAW;IAyCV,OAAO,CAAC,EAAE;IAvCtB,OAAO,CAAC,YAAY,CAAyC;IAG7D,OAAO,CAAC,kBAAkB,CAAuB;IAMjD,OAAO,CAAC,qBAAqB,CAAwD;IAUrF,OAAO,CAAC,WAAW,CAA8B;IAKjD,OAAO,CAAC,SAAS,CAA0B;IAO3C,OAAO,CAAC,WAAW,CAAsB;IAMzC,OAAO,CAAC,aAAa,CAA0F;gBAE3F,EAAE,EAAE,aAAa,GAAG,IAAI;IAE5C;;;;;OAKG;IACH,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,GAAG,IAAI;IAI1C;;;OAGG;IACH,uBAAuB,CAAC,EAAE,EAAE,aAAa,GAAG,IAAI;IAKhD;;;;;;;OAOG;IACH,cAAc,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,GAAG,IAAI;IAIvC;;;;;OAKG;IACH,gBAAgB,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAIjE,qEAAqE;IACrE,gBAAgB,IAAI;QAAE,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAIjE;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;IAI7C;;;;;;;;OAQG;YACW,gBAAgB;IA4B9B;;;OAGG;IACH,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAIjD;;OAEG;IACH,uBAAuB,IAAI,OAAO;IAIlC;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa;IAQrB,kFAAkF;IAClF,OAAO,CAAC,aAAa;IAKrB;;;;;OAKG;IACH,QAAQ,IAAI,cAAc,EAAE;IAsC5B;;;;;;;;OAQG;IACH,OAAO,CAAC,gBAAgB;IA8FxB;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;IAef;;OAEG;IACH,QAAQ,IAAI,IAAI;IAQhB;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc;IAgBtB;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAgB5B;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IA6B3B;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IAa1B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,UAAU,CAAqD;IACvE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAQ;IAE5C;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,iBAAiB;IAmCzB,OAAO,CAAC,mBAAmB;IA2F3B;;OAEG;IACG,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;IAsFnF;;;;;;;;;;;;OAYG;IACG,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;IAkB3F;;;;;OAKG;YACW,YAAY;IAa1B;;OAEG;YACW,YAAY;IAmC1B;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IA2BxB,qEAAqE;IACrE,OAAO,CAAC,iBAAiB;IAMzB;;OAEG;YACW,aAAa;IAsE3B;;OAEG;YACW,aAAa;IAmE3B;;OAEG;YACW,YAAY;IA6D1B;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAsFrB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,yBAAyB;IA4QjC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IA6C9B;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,0BAA0B;IAoElC;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IA2D1B;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB;IAoD/B;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAsCxB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,qBAAqB;IAuD7B;;;;;;;;;;OAUG;YACW,aAAa;IAmwC3B;;OAEG;YACW,UAAU;IAoHxB;;;;;;;;;;;;OAYG;YACW,cAAc;IAkI5B,sFAAsF;YACxE,iBAAiB;IA8B/B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,0BAA0B,CAAO;IACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,0BAA0B,CAAS;IAE3D;;;;;;;;;OASG;IACH,OAAO,CAAC,sBAAsB;IA2C9B;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IA8BnB;;OAEG;YACW,YAAY;IAkI1B;;OAEG;YACW,WAAW;IA2DzB;;OAEG;IACH,OAAO,CAAC,WAAW;IAUnB;;OAEG;IACH,OAAO,CAAC,eAAe;IAcvB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA6B1B;;OAEG;IACH,OAAO,CAAC,eAAe;IA4EvB;;;OAGG;IACH;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,aAAa;IAqCrB;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IA+CzB;;;OAGG;IACH,OAAO,CAAC,cAAc;IA0DtB;;OAEG;IACH,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,mBAAmB;IAgB3B,OAAO,CAAC,cAAc;IAgBtB;;;;;OAKG;IACH,OAAO,CAAC,SAAS;IASjB,OAAO,CAAC,YAAY;IA4BpB;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB;IAe7B,OAAO,CAAC,iBAAiB;IA8BzB,OAAO,CAAC,UAAU;IAMlB,OAAO,CAAC,WAAW;CAMpB"}

package/sensor/dist/mcp/tools.js

@@ -6,6 +6,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ToolHandler = exports.tools = exports.IndexOpenError = exports.PathRefusalError = exports.NotIndexedError = void 0;
+exports.__setLoadLatticeSensorForTests = __setLoadLatticeSensorForTests;
 exports.normalizeQuerySpelling = normalizeQuerySpelling;
 exports.getExploreBudget = getExploreBudget;
 exports.getExploreOutputBudget = getExploreOutputBudget;
@@ -20,10 +21,20 @@ const version_1 = require("./version");
 // schemas), but it must NOT drag in sqlite/query layers before the daemon binds;
 // LatticeSensor is pulled in only when a tool actually opens a project. require() is
 // sync + cached (CommonJS build).
-const loadLatticeSensor = () => require('../index').default;
+const loadLatticeSensor = () => loadLatticeSensorForTests ?? require('../index').default;
+// Test seam (same pattern as the watcher's `__setFsWatchForTests`): vitest's
+// module transform can't service the lazy `require('../index')` above, so
+// in-process tests that exercise a genuine cross-project open (an explicit
+// `projectPath` to a different project — issue #1474's repro shape) inject the
+// already-imported class here. Never set outside tests.
+let loadLatticeSensorForTests = null;
+function __setLoadLatticeSensorForTests(cls) {
+    loadLatticeSensorForTests = cls;
+}
 const worktree_1 = require("../sync/worktree");
 const query_utils_1 = require("../search/query-utils");
 const fs_1 = require("fs");
+const crypto_1 = require("crypto");
 const utils_1 = require("../utils");
 const generated_detection_1 = require("../extraction/generated-detection");
 const dynamic_boundaries_1 = require("./dynamic-boundaries");
@@ -1124,6 +1135,68 @@ class ToolHandler {
      * Cost when nothing is pending — the common case — is one boolean check.
      * No I/O, no parsing of markdown beyond a per-pending-file substring scan.
      */
+    driftCache = new Map();
+    static DRIFT_TTL_MS = 2000;
+    /**
+     * On-disk drift check for a single indexed file (issue #1474). The code
+     * renderers slice CURRENT bytes at INDEXED line ranges; when the file
+     * changed after its last index sync those ranges can point at a DIFFERENT
+     * symbol's code — served under the requested name with `isError: false`.
+     * The watcher-based pending/degraded banners can't cover this for a
+     * project reached via `projectPath` (cross-project instances have no
+     * watcher, by construction), so freshness is verified here, at the point
+     * of emission, from data the index already stores.
+     *
+     * Cheap and precise: one stat() per file (size + mtime, the same
+     * comparison the sync fast path uses); only on a stat mismatch is the
+     * content hashed (sha256, matching extraction's `hashContent`) so a
+     * touch/checkout that rewrote identical bytes never false-positives.
+     * Results are memoized briefly so one response rendering the same file in
+     * several sections pays for the check once.
+     *
+     * Returns true when the on-disk file differs from what was indexed —
+     * i.e. indexed line ranges for it are NOT trustworthy. Any failure
+     * (missing files-table row, stat/read error) reports false: those cases
+     * are handled by the existing not-found paths, and a wrong "stale" flag
+     * would needlessly push the agent back to Read.
+     */
+    isFileStaleOnDisk(cg, relPath, content) {
+        let root;
+        try {
+            root = cg.getProjectRoot();
+        }
+        catch {
+            return false;
+        }
+        const key = `${root}\0${relPath}`;
+        const now = Date.now();
+        const hit = this.driftCache.get(key);
+        if (hit && now - hit.at < ToolHandler.DRIFT_TTL_MS)
+            return hit.stale;
+        let stale = false;
+        try {
+            const rec = cg.getFile(relPath);
+            const absPath = rec ? (0, utils_1.validatePathWithinRoot)(root, relPath) : null;
+            if (rec && absPath && (0, fs_1.existsSync)(absPath)) {
+                const st = (0, fs_1.statSync)(absPath);
+                // Same freshness test as the sync fast path (extraction/index.ts):
+                // equal size + equal floored mtime ⇒ unchanged, no read needed.
+                if (st.size !== rec.size || Math.floor(st.mtimeMs) !== Math.floor(rec.modifiedAt)) {
+                    const data = content ?? (0, fs_1.readFileSync)(absPath, 'utf-8');
+                    // Must stay byte-identical to extraction's `hashContent` (sha256 over
+                    // the utf-8 string) — the identical-rewrite test in
+                    // mcp-stale-slice.test.ts pins the parity. Inlined (not imported)
+                    // to keep the extraction module off the MCP startup path.
+                    stale = (0, crypto_1.createHash)('sha256').update(data).digest('hex') !== rec.contentHash;
+                }
+            }
+        }
+        catch {
+            stale = false;
+        }
+        this.driftCache.set(key, { at: now, stale });
+        return stale;
+    }
     withStalenessNotice(result, projectPath) {
         if (result.isError)
             return result;
@@ -2326,7 +2399,7 @@ class ToolHandler {
             const where = nonTest.length > 0 ? ` in ${shown}${more}` : '';
             const tests = testFiles.length > 0
                 ? `; tests: ${testFiles.slice(0, FILE_CAP).map((f) => `\`${f}\``).join(', ')}${testFiles.length > FILE_CAP ? ` +${testFiles.length - FILE_CAP}` : ''}`
-                : '; ⚠️ no covering tests found';
+                : this.indirectTestNote(cg, uniq, rel);
             entries.push(`- \`${root.name}\` (${rel(root.filePath)}:${root.startLine}) — ${uniq.length} caller${uniq.length === 1 ? '' : 's'}${where}${tests}`);
         }
         if (entries.length === 0)
@@ -2338,6 +2411,59 @@ class ToolHandler {
             '',
         ].join('\n');
     }
+    /**
+     * Test-coverage note for a blast-radius entry whose DIRECT callers include no
+     * test file. A helper called only by production code can still be exercised
+     * by tests further up the caller chain (#1475: 40% of directly-unflagged
+     * symbols had a test within 2-3 hops), so walk up to 2 more hops before
+     * claiming anything — and even then claim only what was measured.
+     */
+    indirectTestNote(cg, directCallers, rel) {
+        const MAX_HOPS = 3; // direct callers are hop 1
+        const BUDGET = 64; // getCallers lookups per entry — bounds god-fan-in symbols
+        const FILE_CAP = 2;
+        let budget = BUDGET;
+        const visited = new Set(directCallers.map((n) => n.id));
+        let frontier = directCallers;
+        for (let hop = 2; hop <= MAX_HOPS && frontier.length > 0 && budget > 0; hop++) {
+            const next = [];
+            const found = new Set();
+            for (const node of frontier) {
+                if (budget-- <= 0)
+                    break;
+                let callers = [];
+                try {
+                    callers = cg.getCallers(node.id);
+                }
+                catch {
+                    continue;
+                }
+                for (const c of callers) {
+                    const n = c?.node;
+                    if (!n || visited.has(n.id))
+                        continue;
+                    visited.add(n.id);
+                    const f = rel(n.filePath);
+                    if ((0, query_utils_1.isTestFile)(f))
+                        found.add(f);
+                    else
+                        next.push(n);
+                }
+            }
+            if (found.size > 0) {
+                const files = [...found];
+                const shown = files.slice(0, FILE_CAP).map((f) => `\`${f}\``).join(', ');
+                const more = files.length > FILE_CAP ? ` +${files.length - FILE_CAP}` : '';
+                return `; tested via callers: ${shown}${more}`;
+            }
+            frontier = next;
+        }
+        // Budget exhaustion means hops 2-3 weren't fully searched — fall back to
+        // the weaker claim that IS established by the direct-caller check.
+        return budget > 0
+            ? `; no tests found within ${MAX_HOPS} caller hops`
+            : '; no test calls this directly';
+    }
     /**
      * Graph-connectivity relevance via Random-Walk-with-Restart (personalized
      * PageRank) from the query's matched SEED nodes over the call/reference graph.
@@ -3075,6 +3201,9 @@ class ToolHandler {
         };
         lines.push('**Source Code**');
         lines.push('');
+        // Recorded so the drift pass below (#1474) can append a per-file exception
+        // to this guarantee after the render loop knows which files drifted.
+        const verbatimHeaderIdx = lines.length;
         lines.push('> The code below is the **verbatim, current on-disk source** of these files — re-read from disk on this call and line-numbered, byte-for-byte identical to what the Read tool returns. It is NOT a summary, outline, or stale cache. Treat each block as a Read you have already performed: do not Read a file shown here.');
         lines.push('');
         let totalChars = lines.join('\n').length;
@@ -3083,6 +3212,14 @@ class ToolHandler {
         // (#1046) — it must reflect what we show, not the raw candidate gather.
         const renderedFilePaths = [];
         let anyFileTrimmed = false;
+        // Files that changed on disk after their last index sync (#1474). Their
+        // indexed line ranges are untrustworthy, so sliced renders (adaptive /
+        // skeleton / clusters) are OFF for them: a small drifted file still ships
+        // whole (current bytes, correct by construction → staleRendered), a big one
+        // is omitted with an explicit notice (→ staleOmitted) — honest absence
+        // instead of a different symbol's code under the requested name.
+        const staleRendered = [];
+        const staleOmitted = [];
         for (const [filePath, group] of sortedFiles) {
             if (filesIncluded >= maxFiles)
                 break;
@@ -3107,6 +3244,10 @@ class ToolHandler {
             }
             const fileLines = fileContent.split('\n');
             const lang = group.nodes[0]?.language || '';
+            // Disk-drift gate (#1474): every render branch below except whole-file
+            // slices fileContent (CURRENT bytes) at INDEXED line ranges. Content is
+            // already in hand, so the check costs one stat (hash only on mismatch).
+            const fileStale = this.isFileStaleOnDisk(cg, filePath, fileContent);
             // Adaptive sizing (LATTICE_SENSOR_ADAPTIVE_EXPLORE, default on): collapse a file
             // to a per-symbol view when it's a redundant member of a polymorphic family.
             // Engages iff ALL hold:
@@ -3145,7 +3286,7 @@ class ToolHandler {
             const onSpineGodFile = hasSpineNode
                 && namedBodyChars > budget.maxCharsPerFile
                 && group.nodes.some(n => CALLABLE_BODY.has(n.kind) && flow.uniqueNamedNodeIds.has(n.id) && !flow.pathNodeIds.has(n.id));
-            if (adaptiveExploreEnabled() && flow.pathNodeIds.size > 0
+            if (!fileStale && adaptiveExploreEnabled() && flow.pathNodeIds.size > 0
                 && (onSpineGodFile || (!hasSpineNode && isPolymorphicSibling(group.nodes) && !spared))) {
                 const syms = group.nodes
                     .filter(n => n.kind !== 'import' && n.kind !== 'export' && n.startLine > 0)
@@ -3270,7 +3411,11 @@ class ToolHandler {
                         .map(n => `${n.name}(${n.kind})`))];
                 const headerNames = uniqSymbols.slice(0, budget.maxSymbolsInFileHeader);
                 const omitted = uniqSymbols.length - headerNames.length;
-                const wholeHeader = fileSectionHeader(filePath, omitted > 0 ? `${headerNames.join(', ')}, +${omitted} more` : headerNames.join(', '));
+                // A drifted file rendered WHOLE is still correct (current bytes,
+                // numbered from 1) — only the index-derived symbol list / line refs to
+                // it elsewhere in this response may be shifted (#1474). Flag that.
+                const staleSuffix = fileStale ? ' · ⚠ changed since last index sync — source below is current; the symbol list may be outdated' : '';
+                const wholeHeader = fileSectionHeader(filePath, (omitted > 0 ? `${headerNames.join(', ')}, +${omitted} more` : headerNames.join(', ')) + staleSuffix);
                 if (!fileNecessary && totalChars + wholeSection.length + 200 > budget.maxOutputChars) {
                     // Don't slice a whole file mid-method: an incidental file that doesn't
                     // fit is skipped; a necessary one (below) renders in full. Half a file
@@ -3282,6 +3427,19 @@ class ToolHandler {
                 totalChars += wholeSection.length + 200;
                 renderedFilePaths.push(filePath);
                 filesIncluded++;
+                if (fileStale)
+                    staleRendered.push(filePath);
+                continue;
+            }
+            // Drifted file too big for the whole-file window (#1474): the cluster /
+            // skeleton renders below would slice current bytes at indexed ranges —
+            // on a shifted file that serves a DIFFERENT symbol's code under the
+            // requested name. Omit the source with an explicit notice instead;
+            // never render a possibly-wrong slice.
+            if (fileStale) {
+                staleOmitted.push(filePath);
+                lines.push(fileSectionHeader(filePath, '⚠ changed on disk after the last index sync — source omitted (indexed line ranges no longer match, so a slice could show the wrong code). Read this file directly for current content; the change is picked up on that project\'s next index sync.'), '');
+                totalChars += 260;
                 continue;
             }
             // Cluster nearby symbols to avoid reading huge gaps between distant symbols.
@@ -3572,6 +3730,18 @@ class ToolHandler {
             renderedFilePaths.push(filePath);
             filesIncluded++;
         }
+        // Drift epilogue (#1474). The "verbatim / do not Read" guarantee above
+        // stays TRUE for everything actually rendered (drifted files ship whole or
+        // not at all — never as a possibly-wrong slice), but two caveats must be
+        // explicit: omitted files need Reading, and index-derived LINE REFERENCES
+        // to any drifted file (flow steps, blast radius, trail) may be shifted.
+        if (staleOmitted.length > 0) {
+            lines[verbatimHeaderIdx] += ' (Exception: files flagged "⚠ changed on disk" below drifted from the index after their last sync — their source is omitted rather than risk a mis-sliced block; Read those specific files.)';
+        }
+        const staleAll = [...new Set([...staleOmitted, ...staleRendered])];
+        if (staleAll.length > 0) {
+            lines.push('', `> ⚠ Changed on disk after the last index sync: ${staleAll.join(', ')}. Line numbers referencing ${staleAll.length === 1 ? 'this file' : 'these files'} elsewhere in this response (flow steps, blast radius, symbol lists) may be shifted until that project's next sync re-indexes ${staleAll.length === 1 ? 'it' : 'them'}.`);
+        }
         // The curated header count is computed from the files that SURVIVE the final
         // truncation (see end of method) — `filesIncluded` can over-count when the
         // hard ceiling drops trailing sections — so leave a sentinel here and fill it
@@ -3914,6 +4084,14 @@ class ToolHandler {
     }
     /** Render one symbol: details + (optional) body/outline + its caller/callee trail. */
     async renderNodeSection(cg, node, includeCode) {
+        // Disk-drift gate (issue #1474): the body below is CURRENT bytes sliced at
+        // INDEXED line ranges. If the file changed since its last index sync, that
+        // slice can be a DIFFERENT symbol's code served under this node's name —
+        // confidently wrong, with no watcher banner to catch it on a `projectPath`
+        // (cross-project) target. Never emit a slice from a drifted file.
+        if (this.isFileStaleOnDisk(cg, node.filePath)) {
+            return this.renderStaleNodeSection(cg, node, includeCode);
+        }
         let code = null;
         let outline = null;
         if (includeCode) {
@@ -3930,6 +4108,55 @@ class ToolHandler {
         }
         return this.formatNodeDetails(node, code, outline) + this.formatTrail(cg, node);
     }
+    // Whole-file fallback caps for a drifted file (#1474): small enough to fit
+    // lattice_sensor_node's output cap (MAX_OUTPUT_LENGTH) with headroom for the
+    // header + trail. A file within these bounds is served WHOLE and CURRENT
+    // (Read-parity, correct by construction) instead of a possibly-wrong slice.
+    static STALE_WHOLE_FILE_MAX_LINES = 300;
+    static STALE_WHOLE_FILE_MAX_CHARS = 12000;
+    /**
+     * lattice_sensor_node render for a symbol whose file changed on disk after the
+     * last index sync (issue #1474). The indexed line range is no longer
+     * trustworthy, so no slice is emitted: a small file gets its full CURRENT
+     * source (Read-parity — sufficiency preserved, the agent still doesn't need
+     * Read); a large one gets an explicit notice steering to the tool's own
+     * file-read mode (or Read) — honest absence instead of confident wrongness.
+     * Location/signature stay (they're the index's answer) but are flagged as
+     * possibly shifted.
+     */
+    renderStaleNodeSection(cg, node, includeCode) {
+        const lines = [
+            `**${node.name}** (${node.kind})`,
+            '',
+            `**Location:** ${node.filePath}${node.startLine ? `:${node.startLine}` : ''} — ⚠ as of the last index sync; the file has changed on disk since, so this line may be shifted`,
+        ];
+        if (node.signature) {
+            lines.push(`**Signature:** \`${node.signature}\``);
+        }
+        lines.push('');
+        let embedded = false;
+        if (includeCode) {
+            try {
+                const absPath = (0, utils_1.validatePathWithinRoot)(cg.getProjectRoot(), node.filePath);
+                if (absPath && (0, fs_1.existsSync)(absPath) && !(0, utils_1.isConfigLeafNode)(node)) {
+                    const content = (0, fs_1.readFileSync)(absPath, 'utf-8');
+                    const body = content.replace(/\n+$/, '');
+                    if (body.length <= ToolHandler.STALE_WHOLE_FILE_MAX_CHARS &&
+                        body.split('\n').length <= ToolHandler.STALE_WHOLE_FILE_MAX_LINES) {
+                        lines.push(`> ⚠ \`${node.filePath}\` changed on disk after it was last indexed, so the indexed line range for this symbol may no longer match. Showing the file's full CURRENT source instead (Read-parity — treat it as already Read):`, '', '```' + (node.language || ''), numberSourceLines(body, 1), '```');
+                        embedded = true;
+                    }
+                }
+            }
+            catch {
+                /* fall through to the notice */
+            }
+        }
+        if (!embedded) {
+            lines.push(`> ⚠ \`${node.filePath}\` changed on disk after it was last indexed — the indexed line range for this symbol no longer reliably matches, so its body is omitted rather than risk showing a different symbol's code. For current content, call lattice_sensor_node with \`file: "${node.filePath}"\` (no symbol; \`offset\`/\`limit\` narrow it like Read), or Read the file. The change is picked up automatically on that project's next index sync.`);
+        }
+        return lines.join('\n') + this.formatTrail(cg, node);
+    }
     /**
      * Build the "trail" for a symbol: its direct callees (what it calls) and
      * callers (what calls it), each with file:line — so lattice_sensor_node doubles as