knodin 0.12.2 → 0.13.0

package/docs/MCP.md

@@ -156,6 +156,21 @@ operation remains available in the gateway while a worker is being replaced.
 `KNODIN_MCP_DEADLINE_MS` may be set to a positive value up to 300000 for local
 testing of the cooperative repair path.
 
+Multi-file evidence bundle byte/token accounting covers the compact JSON in the
+MCP text content. It excludes the surrounding JSON-RPC/MCP transport envelope
+and request/trace metadata. The gateway preserves that compact serialization so
+pagination receipts and reported source budgets describe the delivered text.
+
+The gateway retains at most four repository workers by default and retires each
+after five minutes idle. Set `KNODIN_MCP_MAX_WORKERS` and
+`KNODIN_MCP_IDLE_TIMEOUT_MS` to positive integers to tune these limits (maximum
+2147483647). At capacity the least recently used idle worker is retired; the
+replacement waits for shutdown before starting. Active, starting, and queued
+requests protect their worker from eviction. If every worker is busy, a new
+repository receives `KNODIN_WORKER_CAPACITY` immediately and can retry after an
+active request completes. These are process-count and idle-residency limits,
+not a byte-level memory cap. Revisiting an evicted repository incurs cold startup.
+
 Checked-in process replays prove a real SQLite held lock, abrupt worker exit,
 disconnect/cancellation race against a stuck worker, hard kill, bounded restart,
 warm-worker reuse, worktree isolation, and the next independent success. The
@@ -181,3 +196,55 @@ centrality, and bounded Git-history facts separately. Churn, co-change, and
 coupling include contributing commits, bounds, omissions, confidence, and the
 response's graph freshness. See `docs/GIT-HISTORY-REVIEW.md`; co-change is
 correlation only and never an ownership, defect, or remediation assertion.
+
+### Local flow-analysis budgets
+
+For `query` with `pattern: "flow_analysis"`, the effective response ceiling must
+be at least 1536 serialized bytes (384 estimated tokens). It is the stricter of
+`byteBudget` and `tokenBudget × 4`. Smaller ceilings are rejected, not silently
+increased; larger required evidence or qualifications can still need more space.
+Defaults and other patterns' budget policies are unchanged.
+
+Flow response-budget metadata and drill-down continuation guidance identify
+operation `query:flow_analysis` on both MCP and CLI. This is narrowing/retry
+guidance, not a signed resumable cursor.
+
+### Paged Apex class-use evidence
+
+`query` with `pattern: "inheritors_of"` and an unselected name aggregates nominal
+inheritance across languages, not one globally resolved target. The fixed
+`inheritanceQuery` qualification preserves mode, partial/truncation flags, and
+Apex resolution status even when only non-Apex evidence is available. Apex rows
+require verified typed endpoints; Apex `file`/`identity` selectors establish a
+selected typed target. Non-Apex inheritance retains legacy name matching, not
+an exact identity-resolution promise. An insufficient budget fails closed rather than dropping the
+qualification. The restricted `query_batch` operation does not accept this pattern.
+The tuple reports engine analysis bounds; `responseBudget.truncated` separately
+reports wire-size trimming. Neither qualifier can substitute for the other.
+
+Call `query` with `pattern: "class_consumers"`, an Apex class or interface `symbol`, and optional
+`identity`/`file`, `testScope` (`all`, `test`, `production`), canonical `path` prefix,
+and `limit` (1–1000 sites). This is separate from method calls and Java config
+`consumers_of`. `count` counts observed sites, `consumerFileCount` counts files,
+and `returnedCount` counts delivered sites; page-local `files` aggregates do not
+enumerate every matching file until paging is complete.
+The protected `targetKind` is `class` or `interface`. Interface targets admit
+supported type-position roles, not constructor/static-field uses. `implements`
+relationships and concrete runtime dispatch are not typed consumer sites.
+
+Use the returned `continuation` with the same target and filters. Byte/token/item
+budgets may vary. The signed token is interchangeable with CLI `--continuation`
+in the same repository and unchanged graph snapshot. All evidence and scope
+qualifications fit before the cursor is signed; no generic truncation follows.
+An extra limit-one backend read currently revalidates the snapshot before delivery;
+this correctness guard is not a claim of optimized paging cost.
+
+The nine supported Apex roles exclude target-self-file sites and do not establish
+complete class-use or runtime reachability. `classConsumerAnalysis` reports partial
+extraction and indexed-inventory counters, separately from `indexCoverage`. Unknown
+targets and ambiguity are unavailable, never successful zero-site answers.
+`CLASS_CONSUMER_TARGET_CAPABILITY_MISSING` with `targetResolution: "capability-missing"`
+means retained indexed interface evidence exists but its symbol capability is
+missing. It is unavailable without a fabricated target identity or zero count;
+follow the returned scope-preserving repair guidance. This differs from an unknown
+target and does not expand indexed coverage.

package/docs/PROGRESSIVE-EVIDENCE.md

@@ -35,3 +35,65 @@ absolute/traversal paths, and symlinks are refused.
 
 This protocol does not summarize source and does not support token-savings or
 task-success claims. See the C83 checked-in replay and limitations for bounds.
+
+## Graph-backed file bundles
+
+The additive bundle protocol (`knodin-evidence-bundle-v1`) accepts an explicit
+list of repository-relative `files`. At `evidence` level it returns those files;
+at `expand` level an injected graph adapter can add related files with their
+identity, relationship, confidence, and source-location provenance. It never
+searches the repository for matching names. Stale or unknown graph relationships
+are omitted explicitly; each selected file's source is read and hashed locally.
+The original single-file API and its `pev1` handles remain compatible.
+
+Each response includes a per-file hash/byte manifest. Its `evidenceHandle` is
+`null` until the complete file has been delivered across the signed cursor
+chain; only then is a signed `peb1` completion receipt issued. Pass completed
+receipts as `alreadyPresent` to omit unchanged files you still hold. A changed
+file invalidates only its own receipt and returns current source. Forged,
+cross-repository, incomplete, and wrong-purpose handles are rejected. Reading
+only the manifest or an initial source page does not authorize source omission.
+
+Continue a truncated bundle with its `continuation`, preserving `files`, `level`,
+and `alreadyPresent`. The cursor binds selected files, hashes, graph provenance,
+and reuse assertions. Content or graph changes reject the cursor and require a
+fresh request, preventing a stale cursor from skipping newly changed source.
+Pages contain exact source line ranges, so line-aligned chunks can be joined
+with a newline. Per-file handles and bundle continuations are not interchangeable.
+
+The manifest and all response metadata count toward the hard UTF-8 byte/token
+budget. The item cap counts returned source lines and reused-file records. If
+the manifest cannot fit, narrow the file list or increase the budget. A source
+line too large for the remaining budget is omitted with a continuation; increase
+the byte/token budget to retrieve it. Requests are bounded to 32 selected files
+and 8 MiB of source. These are local static associations, not runtime proof;
+graph omissions remain visible even after every selected source file is returned.
+
+CLI:
+
+```bash
+knodin evidence expand --files src/widget.ts --items 100 --json
+knodin evidence evidence --files src/widget.ts,src/caller.ts --items 20 --json
+knodin evidence evidence --files src/widget.ts,src/caller.ts \
+  --continuation '<bundle-continuation>' --items 20 --json
+knodin evidence evidence --files src/widget.ts,src/caller.ts \
+  --already-present '<completed-receipt>,<completed-receipt>' --json
+```
+
+The MCP equivalents use `operation: "evidence"`, `evidenceLevel:
+"evidence"|"expand"`, and `evidenceFiles: ["src/widget.ts", "src/caller.ts"]`.
+Use `itemBudget`, `byteBudget`, and `tokenBudget` for limits; `continuation` and
+`alreadyPresent` accept the same handles on either surface. Supply `file` for
+the original single-file protocol or `evidenceFiles` for a bundle, never both.
+The current graph adapter follows whitelisted file dependencies breadth-first through
+`imports_of` and `importers_of`, including supported Salesforce Flow, QuickAction,
+App Builder, controller, Apex method binding, and component relationships. It
+does not treat those bindings as executed calls. These associations are labeled
+heuristic; source text and its hashes remain exact.
+
+Discovery stops at two dependency hops and 32 files including the requested seeds.
+Cycles are visited once; query truncation, omitted files and uninspected depth
+frontiers are reported explicitly. A generation or freshness change during any
+hop withholds all graph-selected relationships. This bounded discovery is not
+whole-repository reachability or proof of complete source delivery: use the
+continuation and completion receipts for delivery verification.

package/docs/SALESFORCE-BINDINGS.md

@@ -0,0 +1,121 @@
+# Salesforce metadata bindings
+
+Knodin records a bounded set of literal, local Salesforce DX bindings as
+file-to-file dependencies. These indicate source declarations, not successful
+deployment, configured org availability, runtime reachability, or execution.
+
+| Source | Literal declaration | Target | Dependency kind |
+| --- | --- | --- | --- |
+| `force-app/main/default/quickActions/[Object.]Name.quickAction-meta.xml` | `type=LightningComponent` and one `lightningComponent` value | Unique local Aura `aura/Name/Name.cmp` | `quickaction_lightning_component` |
+| `force-app/main/default/lwc/Name/Name.js-meta.xml` | A `targetConfig` property with `datasource="apex://ClassName"` | Unique local `ClassName.cls` | `appbuilder_apex_datasource` |
+| `force-app/main/default/aura/Name/Name.design` | A `design:attribute` with `datasource="apex://ClassName"` | Unique local `ClassName.cls` | `appbuilder_apex_datasource` |
+
+Edges point from the declaring metadata file to the target source file and
+retain the XML tag/attribute as source evidence. Query `importers_of` with the
+target file to discover these consumers. They are not inserted as executed
+method calls, so `callers_of ClassName` is not a substitute for this query.
+
+QuickAction component values accept bare local names or the explicit `c:`
+namespace. Other namespaces, computed values, missing targets, and duplicate
+matching target files produce no resolved edge. The `lightningComponent` field
+is the Aura bridge; the separate LWC QuickAction field is not implemented by
+this extractor. App Builder extraction ignores comments, CDATA, static lists,
+non-Apex URLs, description text, duplicate datasource attributes, and dynamic
+or namespaced Apex values. Target filename matching preserves exact spelling;
+case-normalized Apex resolution is a separate follow-up.
+
+Target changes, additions, deletions, and newly introduced duplicates revisit
+indexed binding sources, including declarations that previously had no edge.
+Source-only edits replace old outgoing edges. A bounded repository/generation
+catalog avoids a repository walk for every individual binding. On upgrading
+an existing graph, unchanged metadata needs re-extraction before new bindings
+can be claimed; a clean selected-source replay does not establish that an old
+real-world graph has been migrated.
+
+## Component markup and Lightning pages
+
+Within the same canonical `force-app/main/default/` layout, Knodin also records:
+
+| Source declaration | Target file | Dependency kind |
+| --- | --- | --- |
+| Aura `.cmp`/`.app` literal `<c:Name>` | Unique Aura `Name.cmp` | `aura_component` |
+| Aura `.cmp`/`.app` literal `<c:Name>` | Unique LWC `Name.js` | `aura_lwc_component` |
+| LWC `.html` literal `<c-name>` | Unique LWC entrypoint `.js` | `lwc_template_component` |
+| FlexiPage component-instance `componentName` | Unique Aura `.cmp` or LWC `.js` | `flexipage_component` |
+| FlexiPage direct `template/name` | Unique Aura `.cmp` | `flexipage_template` |
+| Flow direct `screens/fields/extensionName` with literal `c:Name` | Unique Aura `.cmp` or LWC `.js` | `flow_screen_component` |
+| Aura application direct `aura:dependency resource="c:Name"` | Unique Aura `.cmp` or LWC `.js` | `aura_resource_component` |
+| Visualforce page inline `$Lightning.use("c:Name", ...)` | Unique Aura `.app` | `visualforce_lightning_out` |
+| WebLink direct `linkType=page` and singleton `page` | Unique Visualforce `.page` | `weblink_visualforce_page` |
+
+FlexiPage identifiers may be bare or prefixed with `c:`. Modern
+`flexiPageRegions/itemInstances/componentInstance` and legacy
+`flexiPageRegions/componentInstances` containers are recognized; unrelated
+`name`/`componentName` fields are not. Aura/LWC name collisions are withheld,
+not resolved by preferring one framework. LWC HTML aliases are generated from
+declared bundle names: camelCase becomes kebab-case while underscores remain
+underscores. Case-preserving metadata matching does not inherit Apex's
+case-insensitive receiver rules.
+
+Flow screen bindings require exactly one literal `extensionName` in the direct
+screen-field context. When `fieldType` is present, it must be exactly one literal
+`ComponentInstance`; omission remains supported for existing LWC metadata. This
+is bounded source extraction, not full Flow schema validation. Unrelated XML
+contexts, duplicate declarations, comments, computed names, and ambiguous
+Aura/LWC targets are withheld. These bindings receive the same target-only
+refresh handling as component markup and Lightning pages.
+Flow exports may declare the standard `xmlns:xsi` schema-instance namespace for
+unrelated nullable metadata values. Other bindings or rebindings of that prefix
+are unsupported; `xsi` annotations on screen/component identity elements are
+withheld, not treated as literal component identities.
+
+Lightning Out extraction recognizes literal JavaScript member calls in bounded
+inline scripts within canonical Visualforce pages. Comments, strings, dynamic
+names, malformed scripts, computed calls and ambiguous raw-script boundaries
+do not supply bindings. A declaration or reassignment involving `$Lightning`
+in any parsed script withholds all of the page's Lightning Out bindings,
+including declarations in other scripts. External script behavior, runtime
+global mutation and Visualforce merge-expression evaluation are not analyzed;
+these edges identify static configuration, not guaranteed platform execution.
+Application and Visualforce page names use separate exact target namespaces.
+WebLink extraction requires the canonical object `webLinks` path and direct XML
+fields; unrelated fields and duplicate page/link-type declarations are withheld.
+
+The XML paths reuse the shipped parser and additionally reject unsupported
+namespaces, DTDs, undeclared entities, malformed markup, and nonliteral identity
+values. Comments, CDATA, and attribute strings cannot supply component tags.
+LWC HTML uses a separate bounded literal subset. Raw-text contents such as
+`script`, `style`, and `textarea`, and SVG/MathML subtrees are opaque while ordinary
+component siblings remain eligible. Namespace re-entry through `foreignObject`
+or other integration points is not modeled. Unclosed raw-text boundaries and
+HTML `plaintext` remain unsupported. A document is also withheld when script
+comments/nested script markers make its closing boundary ambiguous. Dynamic component
+creation, foreign namespaces, and arbitrary directories named `lwc` or `aura`
+do not become local component dependencies.
+
+Target-only additions, deletions, and Aura/LWC collisions revisit indexed source
+bindings, including previously unresolved ones. A newly recognized source in an
+old index still needs re-extraction, for example an explicit structural refresh
+with `knodin index --under force-app/main/default --force --skip-embeddings`.
+These are direct file edges: a parent LWC consumer is its `.html` file, not an
+invented JavaScript call site or a claim of complete bundle-level reachability.
+
+The schemas are documented in Salesforce's [QuickAction metadata reference](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_quickaction.htm),
+[LWC XML configuration reference](https://developer.salesforce.com/docs/platform/lwc/guide/reference-configuration-tags.html),
+and [dynamic picklist configuration guide](https://developer.salesforce.com/docs/atlas.en-us.lightning.meta/lightning/components_config_for_app_builder_dynamic_picklists.htm).
+
+## Apex class-use sites are a separate query
+
+`query class_consumers` exposes static-field reads, constructors, variable types,
+casts, class literals, parameter types, generic parameter types, loop-variable
+types, and generic type arguments. It does not widen metadata bindings or method
+call edges. Case-insensitive type resolution requires unique declarations and
+validated owner chains; value/type shadows, malformed source and ambiguous
+catalog entries cannot become confident class matches.
+
+Results exclude the target's own source file and include test files by default.
+Missing descriptors, unresolved uses and unsupported forms qualify the observed
+counts. Static method receivers, return types, inheritance and writes are not
+promoted into these nine roles. These source-evidenced sites are not complete
+Apex usage enumeration or runtime reachability proof. See the CLI/MCP paging
+sections for signed continuations and exact site-position conventions.

package/docs/SALESFORCE-DEAD-CODE.md

@@ -0,0 +1,45 @@
+# Salesforce dead-code candidates
+
+`dead_code` returns static candidates, not permission to delete code. A symbol
+without a locally resolved caller can still be reached through org configuration,
+runtime dispatch, reflection, or an unsupported dependency kind.
+
+Native Apex declaration evidence now excludes recognized org-facing boundaries:
+REST resource classes and annotated static methods; Invocable, Lightning and
+future static methods; SOAP methods; and supported Queueable, Batchable,
+Schedulable and inbound-email contracts and callback signatures. The owner class
+and its constructors are protected when an org-facing member is recognized.
+
+This does **not** exempt every method in such a class. Ordinary helpers remain
+candidates. Callback matching checks the declaring class, method name, public or
+global instance visibility, arity and parameter types. For example,
+`execute(String)` does not become a Queueable entry point merely because another
+overload accepts `QueueableContext`. Nested classes and same-named declarations
+in different files are not merged. `global` visibility alone is not an exemption.
+
+The response's `deadCodeAnalysis` reports protected declaration counts, files
+whose Apex declarations are unsupported, repository-wide missing Apex capability
+counts, and whether the analysis is partial. Old/malformed declaration evidence
+cannot support an unused-code verdict: affected Apex files are withheld and a
+refresh instruction is returned. For old sealed artifacts, refresh the source
+graph and produce a new sealed artifact; a read-only artifact cannot acquire
+missing extraction evidence in place.
+
+## Limits
+
+Recognition is source-declaration evidence, not a compiler validity check or proof
+that an org actually invokes a class. Native parameter matching does not infer
+arbitrary user-defined type aliases or runtime overload selection. Batchable
+collection parameters are recognized as lists/arrays; generic-type compatibility
+is not a Salesforce compiler judgment. Dead-chain/root reachability, complete
+class/type consumer enumeration, and org-only configuration remain separate gaps.
+
+For local pre-release verification without publishing or changing live indexes:
+
+```sh
+node scripts/knodin-outcome-replay.mjs --manifest benchmarks/evaluations/knodin-41-outcomes/dead-code-manifest.json --out /tmp/knodin-dead-code-new-run
+```
+
+Build the current checkout first. The runner copies the pinned actual sources
+into a private temporary graph and refuses an existing output directory. Its
+small selected-source corpus is not a whole-repository dead-code assessment.

package/docs/SCOPED-INDEXING.md

@@ -0,0 +1,76 @@
+# Scoped indexing
+
+Use a scoped first index when a repository is too large to index before a bounded
+investigation. Scope is durable graph state, not a temporary output filter:
+
+```sh
+knodin index --under force-app/main/default/aura --skip-embeddings
+knodin index --under force-app/main/default/quickActions --skip-embeddings
+knodin query importers_of force-app/main/default/aura/MyComponent/MyComponent.cmp
+```
+
+The second index adds its prefix to the first. Cold reopen, query reconciliation,
+watcher updates, deep status audits, and repair retain that union; they do not
+silently index the rest of the repository. Prefix matching respects directory
+boundaries: `aura` does not include `aura-old`.
+
+An explicit file list remains an exact file selection, including on cold reopen:
+
+```sh
+knodin index src/one.ts src/two.ts --skip-embeddings
+```
+
+Adding a containing prefix subsumes those exact selectors. Updating a subset of
+an already full graph never shrinks its coverage. An explicit full index on a
+scoped graph builds and verifies an isolated candidate; only successful atomic
+promotion replaces the active scoped graph.
+
+## Inventory and safety
+
+Git-backed prefix discovery uses literal, bounded Git pathspec batches before
+enumerating source files. It includes tracked and unignored untracked files,
+subject to the existing source eligibility rules. Git errors or output overflow
+fail closed instead of falling back to an unfiltered filesystem walk. Non-Git
+repositories walk only the selected prefixes or exact files. Selectors must stay
+inside the repository; scoped discovery does not follow symbolic links.
+
+Use tracked or unignored paths for explicit file selections. The policy for an
+explicitly requested Git-ignored file is not yet part of this scoped-indexing
+contract; it must not be used as an implicit ignore override.
+
+The complete intent is stored locally, with version and revision. Graph-backed
+query and health summaries contain only bounded counts and selector previews, plus a digest
+binding the intent. Git argument batches are limited to 256 literal selectors
+and approximately 32 KiB each. Persisted intent is limited to 100,000 selectors
+and 16 MB; oversized or malformed intent is rejected rather than broadened.
+
+## Completion and negative answers
+
+`indexCoverage` reports `mode`, `origin`, `revision`, `digest`, `intentState`,
+`repositoryComplete`, and `negativeScope`, with bounded selector counts/previews.
+
+- A complete scoped intent has `repositoryComplete: false` and
+  `negativeScope: "declared-scope"`. A missing result is not a repository-wide
+  absence claim.
+- A pending or unknown intent has `negativeScope: "unknown"`; interrupted work
+  must not be described as a completed inventory.
+- Older graphs without explicit intent retain legacy full-mode compatibility,
+  but do not gain measured completeness merely from their age or full intent.
+- Malformed intent fails closed. Restore valid metadata or explicitly rebuild a
+  full candidate; ordinary queries and repair must not guess the missing scope.
+
+These fields describe inventory extent, not completeness of the language parser,
+call graph, type/configuration references, dynamic dispatch, or runtime behavior.
+Existing target ambiguity, extraction capability, freshness, and response-budget
+limitations still apply. A completed index can subsequently become stale; check
+the result's freshness as well as its coverage summary.
+
+Intent and a pending marker are persisted before scoped work. A failed or empty
+prefix selection therefore remains visible as pending instead of reverting to
+an accidental full index. Repair or subsequent reconciliation can complete the
+declared inventory. Structure-only intent also preserves embedding deferral
+through recovery; reading a graph does not request inference.
+
+Source-only operations such as text search, file metrics, and language-server
+queries have their own traversal/coverage contracts. Scoped graph intent does
+not imply that every nongraph command is restricted to those selectors.

package/docs/apex-receiver-resolution.md

@@ -0,0 +1,41 @@
+# Static Apex receiver evidence
+
+The native generic parser preserves versioned Apex declaration and call
+provenance. Worker threads transport the same plain extraction result as the
+serial parser. SQLite stores raw `apexDeclaration` and `apexCall` payloads; file
+capability epochs distinguish refreshed files from older graphs.
+
+After identities are persisted, a repository-scoped indexed catalog binds a
+literal class receiver to one declared static method with the same owner and
+argument count. Identifier comparison is case-insensitive. Declaration spelling
+is used for the resolved endpoint without overwriting raw receiver/member text.
+An explicit construction binds to the class symbol only when its constructor
+arity is unique; a class with no explicit constructors permits the implicit
+zero-argument construction. This is constructor evidence, not proof that a
+particular handler method executes.
+
+Same-arity overloads, duplicate class identities, dynamic receivers, value
+shadowing, inherited-scope uncertainty, and unqualified nested-owner ambiguity
+remain unresolved. The conservative shadow check can also reject a receiver
+when a same-named binding exists elsewhere in its containing class. Qualified
+nested owners are supported when uniquely declared. Runtime instance/interface
+dispatch, overload selection by inferred argument type, inherited method lookup,
+and general class-consumer enumeration are not supplied by these edges.
+
+Changed Apex batches re-resolve persisted raw calls, including previously
+unresolved ones, against the current indexed catalog. Thus target-only rename,
+deletion, creation, and duplicate/overload introduction do not require reparsing
+every caller. This currently scans indexed Apex declarations and raw calls once
+per resolver invocation; it is not a constant-time incremental dependency index.
+The resolver does not traverse or open repository source files per call.
+
+Older indexes are not silently upgraded by name-only matching. Caller/callee
+responses expose `apexReceiverCapability`, including missing-file counts,
+bounded missing paths, and malformed/unknown payload counts. Refresh selected
+Apex paths with `knodin index <files> --force --skip-embeddings`, or use a scoped
+`--under` rebuild. Capability checks also work on older read-only artifacts
+without adding tables or columns. Payload validation is a keyset-paged indexed
+data scan, not source-file traversal; it adds work to these queries.
+
+These additions do not require a full graph rebuild or change existing stored
+embedding inputs. Explicit semantic deferral remains available during refresh.

package/docs/releases/0.13.0.md

@@ -0,0 +1,62 @@
+# knodin 0.13.0
+
+This release adds task-oriented investigation and Salesforce evidence queries,
+with explicit indexing coverage and bounded, recoverable results. It also
+improves repeated graph reads and embedding reuse. Work is tracked under
+KNODIN-41 through KNODIN-47.
+
+This is a pre-1.0 breaking minor release: callers requesting flow-analysis
+budgets below the new minimum must increase their requested limit.
+
+## Source-evidenced investigations
+
+- Task-oriented investigation, implementation search, and evidence bundles
+  assemble related source evidence for CLI and MCP consumers.
+- File dependency evidence includes re-exports; coverage travels with results
+  so a scoped or partially parsed graph is not presented as whole-repository
+  proof.
+- Scoped and structural-only indexing provide explicit alternatives to a full
+  semantic index. Unchanged embedding inputs can reuse existing vectors.
+
+## Salesforce analysis
+
+- Apex class-use queries and entry-point-aware dead-code analysis distinguish
+  supported source uses from inheritance and implementation relationships.
+- Receiver resolution and Salesforce component bindings add evidence for
+  supported Apex and Lightning relationships without claiming runtime coverage.
+- Class-consumer paging uses authenticated cursors, scope-bound evidence, and
+  delivery-time validation to reject stale or mismatched results.
+
+## Reliability and response budgets
+
+- Evidence bundles reject malformed UTF-8 instead of issuing receipts for lossy
+  decoded text. Graph-expanded bundles pin selected source bytes and recheck the
+  graph before delivery, refusing results that change across that boundary.
+- Repeated class-consumer reads reuse validated native evidence where safe.
+  Their post-query health check defers optional WAL checkpoint maintenance;
+  correctness checks remain in place. A later eligible audit or close can
+  checkpoint the WAL; no separate checkpoint job is scheduled.
+- Flow analysis now requires at least **1,536 serialized bytes**, or **384
+  estimated tokens**. When both limits are supplied, the stricter limit applies.
+  Smaller requests fail explicitly; the tool does not silently enlarge them.
+  This is a minimum request size, not a guarantee every result will fit.
+- Flow truncation guidance describes how to retry; it is not an authenticated
+  continuation cursor. Other operations retain their existing minimum budgets.
+
+## Dependency maintenance
+
+- Update Sharp to 0.35.4, Hono to 4.13.7, and Vitest with its aligned tooling
+  to 4.1.11 to address newly reported dependency advisories. This does not
+  claim that every outstanding dependency advisory is resolved.
+
+## Evidence and known bounds
+
+The checked-in KNODIN-41 evaluation reports distinguish private copies of actual
+SalesforceCI and minions sources from synthetic fixtures. Selected-source
+success does not certify either entire repository. Unsupported cases, partial
+parses, and historical source blockers remain visible in those reports.
+
+Measured performance has been mixed across cold, warm, indexing, and public
+command paths. This release makes no overall speedup or superiority claim.
+See `roadmap/competitive-roadmap.md` for the remaining product and distribution
+certification boundaries.

package/docs/structural-only-indexing.md

@@ -0,0 +1,20 @@
+# Structural-only indexing
+
+Use `knodin index --skip-embeddings` to build native structure without running
+semantic inference. It also works with `--clean`/`--force`, explicit file paths,
+and `--under <directory>`. Scoped indexing still discovers the repository file
+inventory before filtering; it is not a constant-time directory operation.
+
+Intentional deferral is persisted in the local graph. Reopening the graph for a
+structural query, read-side reconciliation, or watcher updates does not silently
+complete the semantic backlog. Semantic readiness remains `absent` or `partial`
+until the missing vectors are built; semantic retrieval may under-return.
+
+Run an explicit `knodin index` without `--skip-embeddings` to resume inference.
+An explicit-file index without the flag also completes the missing-vector pass,
+including deferred symbols outside those files. Existing vectors are retained.
+
+A deferred clean candidate must still pass SQLite, source coverage, source
+snapshot, and orphan checks before promotion. Only the requirement for complete
+semantic coverage is waived for an intentionally deferred graph. An interrupted
+ordinary semantic build does not gain that exemption.

package/package.json

@@ -1,8 +1,8 @@
 {
 	"name": "knodin",
-	"version": "0.12.2",
+	"version": "0.13.0",
 	"knodin": {
-		"compatibility": "compatible"
+		"compatibility": "breaking"
 	},
 	"description": "knodin — source-evidenced local code intelligence with known bounds. Stable identity, fresh evidence, truthful budgets, and recoverable bounded views.",
 	"license": "MIT",
@@ -46,12 +46,17 @@
 		"docs/PT-ACCESS-RECOMMENDATION.md",
 		"docs/RELEASE-0.3-EVIDENCE.md",
 		"docs/REPOSITORIES-AND-WORKTREES.md",
+		"docs/SALESFORCE-BINDINGS.md",
+		"docs/SALESFORCE-DEAD-CODE.md",
+		"docs/SCOPED-INDEXING.md",
 		"docs/SCIP-IMPORT.md",
 		"docs/SHARED-INDEX-CONTRACT.md",
 		"docs/SIGNED-UPDATES.md",
 		"docs/SYSTEMS-AND-RELATIONSHIPS.md",
 		"docs/TELEMETRY.md",
 		"docs/TOKEN-OPTIMIZER-SCORECARD.md",
+		"docs/apex-receiver-resolution.md",
+		"docs/structural-only-indexing.md",
 		"docs/assets/knodin-favicon.svg",
 		"docs/prompts/declare-multi-repository-system.md",
 		"docs/releases/0.10.0.md",
@@ -67,6 +72,7 @@
 		"docs/releases/0.12.0.md",
 		"docs/releases/0.12.1.md",
 		"docs/releases/0.12.2.md",
+		"docs/releases/0.13.0.md",
 		"docs/releases/0.3.0.md",
 		"docs/releases/0.4.0.md",
 		"docs/releases/0.4.1.md",
@@ -187,17 +193,17 @@
 		"@hono/node-server": "^2.0.5",
 		"adm-zip": "^0.6.0",
 		"fast-uri": "^4.1.1",
-		"sharp": "^0.35.3"
+		"sharp": "^0.35.4"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "2.4.6",
 		"@types/bun": "^1.3.14",
 		"@types/node": "^24.10.0",
-		"@vitest/coverage-v8": "^4.1.10",
+		"@vitest/coverage-v8": "^4.1.11",
 		"ajv": "8.20.0",
 		"lefthook": "^2.1.5",
 		"tsx": "^4.21.0",
 		"typescript": "^5.9.3",
-		"vitest": "^4.1.3"
+		"vitest": "^4.1.11"
 	}
 }