knodin 0.13.0 → 0.14.0

package/dist/src/engine/index.js

@@ -15,8 +15,10 @@ import child_process from "node:child_process";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import { createRequire } from "node:module";
+import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { isDeepStrictEqual } from "node:util";
 import chokidar from "chokidar";
 import Parser from "web-tree-sitter";
 import { ClassConsumerQueryError, } from "../class-consumer-contract.js";
@@ -30,14 +32,18 @@ import { runReadOnlyLspQuery } from "../lsp-readonly.js";
 import { evidenceHandleSecret } from "../progressive-evidence.js";
 import { acquireRepairLease } from "../repair-lease.js";
 import { analyzeResourceReachability, resourceFingerprint, } from "../resource-reachability.js";
+import { assertStorageCapacity, measureDatabaseFamily } from "../storage-budget.js";
+import { assertManagedStorageAllocation, initializeStoragePolicy, postOperationStorageMaintenance, } from "../storage-management.js";
+import { assertStoragePolicyWritable } from "../storage-policy-contract.js";
 import { contentFingerprint, writeStructuralSnapshot, } from "../structural-snapshot.js";
 import { acquireLifecycleCoordination } from "../update-coordination.js";
 import { KNODIN_VERSION } from "../version.js";
 import * as ann from "./ann-hnsw.js";
-import { createApexConsumerCatalog, extractApexClassUses, resolveApexClassUses, } from "./apex-class-uses.js";
-import { apexOrgEntryPoints } from "./apex-entry-points.js";
+import { createApexConsumerCatalog, extractApexClassUses, packApexConsumerCatalog, resolveApexClassUses, unpackApexConsumerCatalog, } from "./apex-class-uses.js";
+import { apexDeadChains } from "./apex-dead-chains.js";
+import { apexOrgEntryPoints, apexPlatformEntryPoints, } from "./apex-entry-points.js";
 import { apexCall, apexDeclaration, apexReceiverCapability, apexReferenceReadGuard, parseApexDeclaration, persistApexReferenceEndpoints, } from "./apex-receiver.js";
-import { allocateCandidate, assertCandidate, discardCandidateFiles, listCandidates, promoteCandidateFile, recoverInterruptedPromotion, sweepAbandonedCandidates, } from "./candidate-database.js";
+import { allocateCandidate, assertCandidate, assertCandidateResumeOwner, bindCandidateDatabase, discardCandidateFiles, listCandidates, promoteCandidateFile, recoverInterruptedPromotion, sweepAbandonedCandidates, } from "./candidate-database.js";
 import { EmbeddingReuseCache, embeddingReuseKey } from "./embedding-reuse.js";
 import { computeSimilarity, generateEmbedding, generateEmbeddings, getEmbeddingCacheIdentity, } from "./embeddings.js";
 import { walkRepoFiles } from "./file-walker.js";
@@ -49,7 +55,7 @@ import { canonicalCoveragePath, coverageContains, coverageGitPathspecBatches, co
 // resolves inside the worker thread, never in this one.
 import { createParsePool, parseWorkersEnabled } from "./parse-pool.js";
 import { beginPerfPhase, measurePerfPhase, measurePerfPhaseSync } from "./perf.js";
-import { isIndexablePath, makeWatchIgnorePredicate } from "./prune.js";
+import { isIndexablePath, makeWatchIgnorePredicate, prunePolicyDescriptor } from "./prune.js";
 import { reflinkCopyFile } from "./reflink-copy.js";
 import { componentBindings, componentCatalog, visualforceInlineScripts, } from "./salesforce-components.js";
 import { readSarifLog, SARIF_DEFAULT_LIMITS, } from "./sarif-import.js";
@@ -57,7 +63,7 @@ import { readScipIndex, SCIP_DEFAULT_LIMITS, } from "./scip-import.js";
 import { isSealedDatabase, listSealedFiles, readSealedSource } from "./seal.js";
 import { isIndexableSourcePath } from "./source-policy.js";
 import { Database } from "./sqlite.js";
-import { lookupMirror, mayWriteToRepository, resolveDbPath, resolveStateDir, } from "./state-paths.js";
+import { isMirror, lookupMirror, mayWriteToRepository, resolveDbPath, resolveStateDir, } from "./state-paths.js";
 import { deleteAllSymbols, deleteSymbolsForFile, deleteSymbolsMatchingPath, ORPHANED_EMBEDDING_PREDICATE, purgeOrphanEmbeddings, } from "./symbol-delete.js";
 import { searchRepoText } from "./text-matches.js";
 // ES Module resolution
@@ -708,7 +714,7 @@ function persistReferenceEndpoints(db, filePaths, deferApex = false) {
         persistApexClassConsumerEndpoints(db);
     }
 }
-const APEX_CONSUMER_BINDING_VERSION = "2-interface-types";
+const APEX_CONSUMER_BINDING_VERSION = "4-instanceof-types";
 /** Classes retain receiver provenance; interfaces use their independent parser span proof. */
 function apexConsumerSymbolOwner(db, symbol, cache) {
     if (symbol.kind === "class" &&
@@ -743,10 +749,12 @@ function apexConsumerSymbolOwner(db, symbol, cache) {
     return matches.length === 1 ? matches[0].ownerPath : null;
 }
 const apexConsumerKinds = new Set([
+    "static_method_receiver",
     "static_field_read",
     "constructor",
     "variable_type",
     "cast",
+    "instanceof_type",
     "class_literal",
     "parameter_type",
     "generic_parameter_type",
@@ -770,6 +778,13 @@ function validConsumerSite(value) {
         typeof site.typePath === "string" &&
         /^[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*$/.test(site.typePath) &&
         (site.memberName === null || typeof site.memberName === "string") &&
+        (site.kind !== "instanceof_type" || site.memberName === null) &&
+        (site.kind === "static_method_receiver"
+            ? typeof site.memberName === "string" &&
+                /^[A-Za-z_]\w*$/.test(site.memberName) &&
+                Number.isSafeInteger(site.arity) &&
+                site.arity >= 0
+            : site.arity === undefined) &&
         (site.lexicalOwner === null || typeof site.lexicalOwner === "string") &&
         [null, "value-shadow", "malformed-source"].includes(site.blockedReason) &&
         validConsumerPosition(site.start) &&
@@ -784,6 +799,10 @@ function readApexConsumerFacts(row) {
         return null;
     try {
         const facts = JSON.parse(row.facts);
+        if (facts.methodReceiverVersion !== undefined && facts.methodReceiverVersion !== 1)
+            return null;
+        if (facts.instanceofTypeVersion !== undefined && facts.instanceofTypeVersion !== 1)
+            return null;
         if (facts.heritageComplete !== undefined && typeof facts.heritageComplete !== "boolean")
             return null;
         if (facts.heritage !== undefined &&
@@ -822,7 +841,12 @@ function readApexConsumerFacts(row) {
             !Array.isArray(facts.unsupportedUses))
             return null;
         if (!facts.declarations.every((decl) => decl.version === 1 &&
-            ["class", "interface", "enum", "field", "property"].includes(decl.kind) &&
+            ["class", "interface", "enum", "field", "property", "method"].includes(decl.kind) &&
+            (decl.kind === "method"
+                ? facts.methodReceiverVersion === 1 &&
+                    Number.isSafeInteger(decl.arity) &&
+                    decl.arity >= 0
+                : decl.arity === undefined) &&
             typeof decl.ownerPath === "string" &&
             typeof decl.name === "string" &&
             typeof decl.static === "boolean" &&
@@ -837,6 +861,12 @@ function readApexConsumerFacts(row) {
                     decl.declarationRange.start.byte <= decl.start.byte &&
                     decl.declarationRange.end.byte >= decl.end.byte))))
             return null;
+        if (facts.methodReceiverVersion !== 1 &&
+            facts.sites.some((site) => site.kind === "static_method_receiver"))
+            return null;
+        if (facts.instanceofTypeVersion !== 1 &&
+            facts.sites.some((site) => site.kind === "instanceof_type"))
+            return null;
         return facts;
     }
     catch {
@@ -847,9 +877,11 @@ function readApexConsumerFacts(row) {
 function apexConsumerMaterializationDigest(db) {
     const hash = crypto.createHash("sha256");
     let after;
+    // Keep the indexed tuple bare so SQLite seeks each page instead of rescanning the prefix.
+    // RHS and ORDER BY collations still explicitly preserve the byte-ordered digest contract.
     for (;;) {
         const rows = db
-            .query(`SELECT filePath,startByte,endByte,kind,raw,status,targetFile,targetOwner,targetIdentity,ownerIdentity,isTest FROM apex_class_uses ${after ? "WHERE (filePath COLLATE BINARY,startByte,endByte,kind COLLATE BINARY)>(? COLLATE BINARY,?,?,? COLLATE BINARY)" : ""} ORDER BY filePath COLLATE BINARY,startByte,endByte,kind COLLATE BINARY LIMIT 500`)
+            .query(`SELECT filePath,startByte,endByte,kind,raw,status,targetFile,targetOwner,targetIdentity,ownerIdentity,isTest FROM apex_class_uses ${after ? "WHERE (filePath,startByte,endByte,kind)>(? COLLATE BINARY,?,?,? COLLATE BINARY)" : ""} ORDER BY filePath COLLATE BINARY,startByte,endByte,kind COLLATE BINARY LIMIT 500`)
             .all(...(after ? [after.filePath, after.startByte, after.endByte, after.kind] : []));
         for (const row of rows)
             hash.update(JSON.stringify(row)).update("\n");
@@ -957,6 +989,10 @@ function missingApexConsumerDescriptorFiles(db) {
             return false;
         if (facts.parseState !== "complete")
             return true;
+        if (facts.methodReceiverVersion !== 1)
+            return false;
+        if (facts.instanceofTypeVersion !== 1)
+            return false;
         if (facts.heritage === undefined &&
             facts.unsupportedUses.some((use) => use.kind === "inheritance"))
             return false;
@@ -978,6 +1014,19 @@ const apexConsumerFastHits = new WeakMap();
 const apexConsumerValidationMemoStats = new WeakMap();
 const APEX_CONSUMER_MEMO_MAX_ENTRIES = 4;
 const APEX_CONSUMER_MEMO_MAX_BYTES = 8 * 1024 * 1024;
+function hydrateApexConsumerMemo(db) {
+    const cached = apexConsumerValidationMemo.get(db);
+    if (!cached)
+        throw new Error("Apex consumer validation memo disappeared");
+    try {
+        return { ...cached.summary, catalog: unpackApexConsumerCatalog(cached.packedCatalog) };
+    }
+    catch (error) {
+        // A fast-proof read intentionally skipped stored facts. Never rebuild from its empty list.
+        apexConsumerValidationMemo.delete(db);
+        throw error;
+    }
+}
 /** Diagnostic counters only; never expose retained source or descriptors. */
 export function getApexConsumerValidationMemoStats(db) {
     return {
@@ -1054,7 +1103,7 @@ function validatedApexConsumerSummary(db, stored, key) {
         stats.hits++;
         apexConsumerValidationMemo.delete(db);
         apexConsumerValidationMemo.set(db, cached);
-        return cached.summary;
+        return hydrateApexConsumerMemo(db);
     }
     stats.misses++;
     apexConsumerValidationMemo.delete(db);
@@ -1063,15 +1112,19 @@ function validatedApexConsumerSummary(db, stored, key) {
         .filter((facts) => facts !== null);
     const summary = {
         validFiles: valid.length,
+        legacyReceiverFiles: valid.filter((facts) => facts.methodReceiverVersion !== 1).length,
+        legacyInstanceofFiles: valid.filter((facts) => facts.instanceofTypeVersion !== 1).length,
         invalidDescriptorFiles: stored.length - valid.length,
         partialFiles: valid.filter((facts) => facts.parseState !== "complete").length,
         expectedSites: valid.reduce((count, facts) => count + facts.sites.length, 0),
         unsupportedUses: valid.reduce((count, facts) => count + facts.unsupportedUses.length, 0),
         catalog: createApexConsumerCatalog(valid),
     };
-    // Account for retained declaration strings/structure, not the much larger raw sites.
-    // Byte and entry caps bound retention; this is not a precise V8 heap measurement.
-    const retainedBytes = Buffer.byteLength(JSON.stringify([Array.from(summary.catalog.classes), Array.from(summary.catalog.members)])) + 256;
+    // Retain only the lossless buffer and scalar metadata, never the hydrated catalog or raw facts.
+    // The cap bounds retained payload, not transient decode/validation heap. Reserve proof overhead.
+    const { catalog, ...counts } = summary;
+    const packedCatalog = packApexConsumerCatalog(catalog);
+    const retainedBytes = packedCatalog.byteLength + Buffer.byteLength(JSON.stringify({ key, summary: counts })) + 1024;
     if (summary.invalidDescriptorFiles === 0 && retainedBytes <= APEX_CONSUMER_MEMO_MAX_BYTES) {
         while (apexConsumerValidationMemo.size >= APEX_CONSUMER_MEMO_MAX_ENTRIES) {
             const oldest = apexConsumerValidationMemo.keys().next().value;
@@ -1079,7 +1132,7 @@ function validatedApexConsumerSummary(db, stored, key) {
                 break;
             apexConsumerValidationMemo.delete(oldest);
         }
-        apexConsumerValidationMemo.set(db, { key, summary, retainedBytes });
+        apexConsumerValidationMemo.set(db, { key, summary: counts, packedCatalog, retainedBytes });
     }
     return summary;
 }
@@ -1281,7 +1334,9 @@ export function readClassConsumerPage(db, repoPath, request) {
                 bindingVersion,
                 expectedMaterialization: getMeta(db, "apexConsumerMaterializationDigest"),
             });
-        const validation = fastProof && memo ? memo.summary : validatedApexConsumerSummary(db, stored, validationDigest);
+        const validation = fastProof && memo
+            ? hydrateApexConsumerMemo(db)
+            : validatedApexConsumerSummary(db, stored, validationDigest);
         const { expectedSites, invalidDescriptorFiles, partialFiles, unsupportedUses, catalog } = validation;
         // Fresh symbol proof is intentionally outside both validation caches. A removed outer
         // interface must not turn retained nested-class rows into a certified zero result.
@@ -1509,6 +1564,8 @@ export function readClassConsumerPage(db, repoPath, request) {
                 partial: !bound ||
                     missingDescriptorFiles > 0 ||
                     partialFiles > 0 ||
+                    validation.legacyReceiverFiles > 0 ||
+                    validation.legacyInstanceofFiles > 0 ||
                     invalidRows ||
                     unresolvedSites > 0 ||
                     unsupportedUses > 0,
@@ -1519,7 +1576,17 @@ export function readClassConsumerPage(db, repoPath, request) {
                 unsupportedUses,
                 exclusions: { targetInternalSites },
                 limitations: [
-                    "Only the nine supported explicit Apex syntax roles are resolved; this is not runtime reachability or complete class-use coverage.",
+                    "Only supported explicit Apex syntax roles are resolved; this is not runtime reachability or complete class-use coverage.",
+                    ...(validation.legacyInstanceofFiles > 0
+                        ? [
+                            "Legacy descriptors lack instanceof type capability; run knodin repair to re-extract affected Apex files before treating zero type checks as complete.",
+                        ]
+                        : []),
+                    ...(validation.legacyReceiverFiles > 0
+                        ? [
+                            "Legacy descriptors lack static-method receiver capability; run knodin repair to re-extract affected Apex files before treating zero receivers as complete.",
+                        ]
+                        : []),
                     "Descriptor, unresolved-site and unsupported-use counters cover the inspected indexed Apex inventory, not just this target.",
                     "Inherited or ambiguous value/type scopes can remain unresolved; target self-file sites are excluded.",
                     "Query results cover this repository's indexed graph scope only, not federated repositories or metadata.",
@@ -1533,6 +1600,248 @@ export function readClassConsumerPage(db, repoPath, request) {
         releaseApexConsumerRead(db, beforeStamp !== null, completed, publishProof);
     }
 }
+/** One bounded source read/parse; selectors retain full indexed-row correspondence. */
+async function verifyPlatformEntryFile(db, repoPath, relativePath, file) {
+    const base = {
+        version: 1,
+        platform: "salesforce",
+        runtimeInvocation: "not-established",
+    };
+    const unavailable = (reason) => () => ({
+        ...base,
+        status: "unavailable",
+        reason,
+    });
+    const maxBytes = 1024 * 1024;
+    let sourceText;
+    try {
+        const sealed = sealedRepositories.get(path.resolve(repoPath));
+        if (sealed) {
+            const text = readSealedSource(sealed, relativePath, maxBytes);
+            if (text === null)
+                return unavailable("Apex sealed source is missing or exceeds the bounded verification limit.");
+            sourceText = text;
+        }
+        else {
+            const fd = fs.openSync(path.resolve(repoPath, relativePath), "r");
+            try {
+                if (!fs.fstatSync(fd).isFile() || fs.fstatSync(fd).size > maxBytes)
+                    return unavailable("Apex source exceeds the bounded platform entry verification limit.");
+                const bytes = Buffer.alloc(maxBytes + 1);
+                let length = 0;
+                while (length < bytes.length) {
+                    const count = fs.readSync(fd, bytes, length, bytes.length - length, null);
+                    if (!count)
+                        break;
+                    length += count;
+                }
+                if (length > maxBytes)
+                    return unavailable("Apex source exceeds the bounded platform entry verification limit.");
+                sourceText = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes.subarray(0, length));
+            }
+            finally {
+                fs.closeSync(fd);
+            }
+        }
+    }
+    catch {
+        return unavailable("Apex source is unavailable; platform entry evidence could not be verified.");
+    }
+    const source = { text: sourceText };
+    let parser;
+    let tree = null;
+    try {
+        const language = await getLanguageForFile(path.join(repoPath, relativePath));
+        if (!language)
+            return unavailable("Apex parser capability is unavailable.");
+        parser = new Parser();
+        parser.setLanguage(language);
+        tree = parser.parse(source.text);
+        if (!tree || tree.rootNode.hasError())
+            return unavailable("Apex source is parse-partial; platform entry evidence is not established.");
+        const nodes = [];
+        const pending = [tree.rootNode];
+        while (pending.length) {
+            const node = pending.pop();
+            if (!node)
+                continue;
+            if (node.type === "class_declaration" || node.type === "method_declaration")
+                nodes.push(node);
+            pending.push(...node.namedChildren);
+        }
+        const rows = db
+            .query("SELECT * FROM symbols WHERE filePath=? AND kind IN ('class','method')")
+            .all(relativePath);
+        if (rows.length !== nodes.length)
+            return unavailable("Indexed Apex declarations do not match source; repair the indexed scope.");
+        const bySpan = new Map();
+        const spanKey = (startLine, startCol, endLine, endCol) => `${startLine}:${startCol}:${endLine}:${endCol}`;
+        for (const node of nodes) {
+            const key = spanKey(node.startPosition.row + 1, node.startPosition.column, node.endPosition.row + 1, node.endPosition.column);
+            bySpan.set(key, [...(bySpan.get(key) ?? []), node]);
+        }
+        const offsets = [...new Set(nodes.flatMap((node) => [node.startIndex, node.endIndex]))].sort((a, b) => a - b);
+        const byteOffsets = new Map();
+        let previousOffset = 0;
+        let byteOffset = 0;
+        for (const offset of offsets) {
+            byteOffset += Buffer.byteLength(source.text.slice(previousOffset, offset));
+            byteOffsets.set(offset, byteOffset);
+            previousOffset = offset;
+        }
+        const declarations = [];
+        const spans = new Map();
+        const used = new Set();
+        for (const row of rows) {
+            const stored = parseApexDeclaration(row.apexDeclaration);
+            if (!stored)
+                return unavailable("Indexed Apex declaration capability is missing or invalid; repair the indexed scope.");
+            const candidates = bySpan.get(spanKey(row.startLine, row.startCol, row.endLine, row.endCol)) ?? [];
+            if (candidates.length !== 1 || used.has(candidates[0].id))
+                return unavailable("Indexed Apex declaration spans are ambiguous or stale; repair the indexed scope.");
+            const node = candidates[0];
+            const actual = apexDeclaration(node);
+            if (actual.name !== row.name ||
+                actual.kind !== row.kind ||
+                !isDeepStrictEqual(stored, actual))
+                return unavailable("Indexed Apex declaration metadata differs from source; repair the indexed scope.");
+            used.add(node.id);
+            const key = String(row.id);
+            declarations.push({ key, file: row.filePath, declaration: actual });
+            spans.set(key, {
+                identity: symbolIdentity(repoPath, row),
+                file,
+                startLine: row.startLine,
+                startColumn: row.startCol + 1,
+                endLine: row.endLine,
+                endColumn: row.endCol + 1,
+                startByte: byteOffsets.get(node.startIndex) ?? 0,
+                endByte: byteOffsets.get(node.endIndex) ?? 0,
+            });
+        }
+        const rowsById = new Map(rows.map((row) => [row.id, row]));
+        const declarationsByKey = new Map(declarations.map((row) => [row.key, row]));
+        const ownerCounts = new Map();
+        for (const row of declarations)
+            if (row.declaration.kind === "class") {
+                const key = row.declaration.owner.toLowerCase();
+                ownerCounts.set(key, (ownerCounts.get(key) ?? 0) + 1);
+            }
+        const entries = apexPlatformEntryPoints(declarations);
+        const sourceHash = crypto.createHash("sha256").update(source.text).digest("hex");
+        return (selected) => {
+            const currentSelected = rowsById.get(selected.id);
+            if (!currentSelected || !isDeepStrictEqual(currentSelected, selected))
+                return unavailable("Selected Apex identity changed during verification; retry the query.")(selected);
+            // Even a selected class cannot establish a unique platform owner through duplicate declarations.
+            const selectedDeclaration = declarationsByKey.get(String(selected.id));
+            if (!selectedDeclaration)
+                return unavailable("Selected Apex declaration is unavailable in the verified source.")(selected);
+            if (ownerCounts.get(selectedDeclaration.declaration.owner.toLowerCase()) !== 1)
+                return unavailable("Apex enclosing declaration is ambiguous; platform entry evidence is not established.")(selected);
+            const entry = entries.get(String(selected.id));
+            if (!entry)
+                return undefined;
+            const declaration = spans.get(String(selected.id));
+            const owner = entry.ownerKey ? spans.get(entry.ownerKey) : undefined;
+            if (!declaration || (entry.ownerKey && !owner))
+                return unavailable("Apex platform declaration source correspondence is unavailable.")(selected);
+            return {
+                ...base,
+                status: "declared",
+                reason: entry.reason,
+                contracts: entry.contracts,
+                sourceHash,
+                declaration,
+                ...(owner ? { owner } : {}),
+            };
+        };
+    }
+    catch {
+        return unavailable("Apex platform entry verification failed; repair or inspect the indexed scope.");
+    }
+    finally {
+        if (tree)
+            freeQuietly(tree);
+        if (parser)
+            freeQuietly(parser);
+    }
+}
+async function explainPlatformEntry(db, repoPath, selected, file) {
+    if (!/\.cls$/i.test(selected.filePath) || !["class", "method"].includes(selected.kind))
+        return undefined;
+    return (await verifyPlatformEntryFile(db, repoPath, selected.filePath, file))(selected);
+}
+async function queryPlatformEntries(db, repoPath, selected, cap, incompleteDeclarations) {
+    const entryLimit = Math.min(cap, 25), fileLimit = 8, fileByteLimit = 1024 * 1024;
+    const collection = {
+        scope: "classified-indexed-declarations",
+        totalClassified: selected.length,
+        returnedCount: 0,
+        verifiedCount: 0,
+        unavailableCount: 0,
+        entryLimit,
+        omittedCount: 0,
+        truncated: false,
+        partial: incompleteDeclarations,
+        continuation: null,
+        omissions: [],
+        work: { fileLimit, fileByteLimit, attemptedFiles: 0, reservedSourceBytes: 0 },
+        entries: [],
+    };
+    const files = new Map();
+    const preview = [...selected]
+        .sort((a, b) => compareBytes(a.filePath, b.filePath) ||
+        a.startLine - b.startLine ||
+        a.startCol - b.startCol ||
+        compareBytes(a.identity ?? "", b.identity ?? ""))
+        .slice(0, entryLimit);
+    for (const row of preview) {
+        // Hydrate only the bounded preview, retaining the original inventory snapshot
+        // as a guard against row reuse or changed declaration metadata.
+        const hydrated = db.query("SELECT * FROM symbols WHERE id=?").get(row.id);
+        const corresponds = hydrated &&
+            Object.entries(row).every(([key, value]) => isDeepStrictEqual(hydrated[key], value));
+        let select = files.get(row.filePath);
+        if (!select) {
+            if (files.size >= fileLimit) {
+                collection.omissions.push("Proof work limit reached; narrow the path or use explain for omitted declarations.");
+                break;
+            }
+            collection.work.attemptedFiles++;
+            collection.work.reservedSourceBytes += fileByteLimit;
+            select = await verifyPlatformEntryFile(db, repoPath, row.filePath, row.filePath);
+            files.set(row.filePath, select);
+        }
+        const proof = (corresponds ? select(hydrated) : undefined) ?? {
+            version: 1,
+            platform: "salesforce",
+            runtimeInvocation: "not-established",
+            status: "unavailable",
+            reason: "Indexed platform classification was not confirmed by source verification; repair the indexed scope.",
+        };
+        collection.entries.push({
+            identity: symbolIdentity(repoPath, row),
+            symbol: row.name,
+            file: row.filePath,
+            line: row.startLine,
+            platformEntry: proof,
+        });
+        if (proof.status === "declared")
+            collection.verifiedCount++;
+        else
+            collection.unavailableCount++;
+    }
+    collection.returnedCount = collection.entries.length;
+    collection.omittedCount = collection.totalClassified - collection.returnedCount;
+    collection.truncated = collection.omittedCount > 0;
+    collection.partial ||= collection.truncated || collection.unavailableCount > 0;
+    if (selected.length > entryLimit)
+        collection.omissions.push("Entry preview limit reached; narrow the path or use explain. This collection has no cursor.");
+    if (incompleteDeclarations)
+        collection.omissions.push("Indexed declaration capability is incomplete; totalClassified does not count unknown platform entries.");
+    return collection;
+}
 function resolveSymbolRows(db, repoPath, name, selector = {}) {
     let rows = db.query("SELECT * FROM symbols WHERE name = ?").all(name);
     if (selector.file)
@@ -7972,11 +8281,33 @@ const SPECIAL_ROUTE_EXTENSIONS = [
     ".prisma",
 ];
 const extractionCoverage = new AsyncLocalStorage();
+const indexedSourceProofs = new WeakMap();
 async function indexFile(...args) {
     const [, , , db] = args;
     if (!coverageContains(requireIndexCoverage(coverageForDatabase(db)), args[1]))
         throw new Error(`knodin: refusing to index outside declared coverage: ${args[1]}`);
-    return extractionCoverage.run(db, () => indexFileInCoverage(...args));
+    // Invalidate before graph writes too: a failed extraction must not leave an
+    // older repair proof attached to partially replaced graph data.
+    db.run("DELETE FROM meta WHERE key=?", [`${REPAIR_CHECKPOINT_PREFIX}${args[1]}`]);
+    indexedSourceProofs.get(db)?.delete(args[1]);
+    // Per-file proof binds actual extraction even before an aggregate epoch is
+    // established. It does not certify a completed clean/scoped repository build.
+    const bytes = !repairSourceAudit.getStore() ? Buffer.alloc(64 * 1024) : null;
+    const sourceHash = bytes ? repairSourceFingerprint(args[2], args[1], bytes) : null;
+    const extracted = await extractionCoverage.run(db, () => indexFileInCoverage(...args));
+    // Unparsed/skipped are completed source reads, not successful graph writes.
+    // Only the error sentinel false is ineligible for consumed-source proof.
+    if (extracted !== false && sourceHash !== null && bytes) {
+        if (repairSourceFingerprint(args[2], args[1], bytes) !== sourceHash)
+            throw new Error(`Source changed during indexing: ${args[1]}; source proof not published.`);
+        let proofs = indexedSourceProofs.get(db);
+        if (!proofs) {
+            proofs = new Map();
+            indexedSourceProofs.set(db, proofs);
+        }
+        proofs.set(args[1], sourceHash);
+    }
+    return extracted !== false;
 }
 async function indexFileInCoverage(absolutePath, relativePath, repoPath, db, unparsed, collectResult) {
     try {
@@ -8034,13 +8365,13 @@ async function indexFileInCoverage(absolutePath, relativePath, repoPath, db, unp
         if (extraction.kind === "unparsed") {
             if (unparsed)
                 tallyOne(unparsed, extensionBucket(relativePath));
-            return;
+            return "unparsed";
         }
         // A parse failure abandons this one file without tallying it as a
         // coverage gap: the file IS supported, it just did not parse, and
         // `extractGenericFileForIndex` has already warned about it.
         if (extraction.kind === "skipped")
-            return;
+            return "skipped";
         if (extraction.kind === "special") {
             const { content, parseContent, tree } = extraction;
             // The tree outlived the function that parsed it, so this is the only
@@ -8093,6 +8424,7 @@ async function indexFileInCoverage(absolutePath, relativePath, repoPath, db, unp
         console.error(`Error indexing file ${relativePath}:`, error);
         if (unparsed)
             tallyOne(unparsed, extensionBucket(relativePath));
+        return false;
     }
 }
 /**
@@ -8824,34 +9156,43 @@ function sumCounts(counts) {
  * costs time, versus resuming onto the wrong tree, which produces a graph that
  * never described any single state of the repository and then promotes it.
  *
- * Stale and unusable candidates are removed as they are found, so a repository
- * does not accumulate abandoned copies of its own database.
+ * Nonselected DB-bearing candidates are preserved. Selection is not deletion
+ * authority; only the owner/policy-fenced non-DB residue sweep may clean up.
  */
 function findResumableCandidate(repoPath) {
     const head = gitHead(repoPath) ?? "";
-    // Swept first, because the loop below can only discard what `listCandidates`
-    // returns and that deliberately excludes database-less directories — which is
-    // exactly what a promoted candidate leaves behind (KNODIN-2). Without this,
-    // the comment above about not accumulating abandoned copies was false for the
-    // most common case.
+    // Only the policy/owner-fenced sweep cleans non-DB residue. Selection below
+    // never borrows deletion authority for DB-bearing candidates.
     sweepAbandonedCandidates(repoPath);
     let resumable = null;
+    let preserved = 0;
     for (const candidate of listCandidates(repoPath)) {
         let usable = false;
         try {
-            const probe = new Database(candidate.databasePath, { readonly: true });
+            assertCandidateResumeOwner(candidate);
+            const bound = bindCandidateDatabase(repoPath, candidate);
             try {
-                usable =
-                    getMeta(probe, CLEAN_INDEX_IN_PROGRESS_META_KEY) === "1" &&
-                        getMeta(probe, CLEAN_INDEX_HEAD_META_KEY) === head;
+                const probe = new Database(candidate.databasePath, { readonly: true });
+                try {
+                    bound.verify();
+                    usable =
+                        getMeta(probe, CLEAN_INDEX_IN_PROGRESS_META_KEY) === "1" &&
+                            getMeta(probe, CLEAN_INDEX_HEAD_META_KEY) === head &&
+                            // Older interrupted builds have no source-start evidence. Restart
+                            // them rather than inventing a new epoch for already indexed rows.
+                            validSourceEpoch(getMeta(probe, CLEAN_INDEX_SOURCE_START_KEY)) !== null;
+                }
+                finally {
+                    probe.close();
+                }
+                bound.verify();
             }
             finally {
-                probe.close();
+                bound.close();
             }
         }
         catch {
-            // Unreadable, not a database, or schema too old to query. Not resumable,
-            // and not worth keeping.
+            // Unreadable or ownership/source proof unavailable: preserve, do not adopt.
             usable = false;
         }
         // Keep only the newest usable one. An older survivor is from an even
@@ -8860,14 +9201,11 @@ function findResumableCandidate(repoPath) {
             resumable = candidate;
             continue;
         }
-        try {
-            discardCandidateFiles(repoPath, candidate);
-        }
-        catch {
-            // Best effort: failing to clean up a stale candidate must not stop the
-            // rebuild that is about to replace it.
-        }
+        // Preserve older, unknown, live and unusable candidates for explicit audit.
+        preserved++;
     }
+    if (preserved)
+        console.error(`knodin storage: preserved ${preserved} nonselected DB-bearing candidate(s); inspect candidate storage explicitly before cleanup.`);
     return resumable;
 }
 /** Write the coverage tally as it stands. Safe to call repeatedly mid-index. */
@@ -8984,7 +9322,38 @@ function isIndexableJsonCandidate(file, repoPath) {
     if (path.basename(file).toLowerCase() !== "manifest.json")
         return false;
     try {
-        return isDbtManifest(fs.readFileSync(path.join(repoPath, file), "utf-8"));
+        const target = path.join(repoPath, file);
+        if (!safeCoveragePath(repoPath, file))
+            return false;
+        const checked = fs.lstatSync(target);
+        if (!checked.isFile() || checked.isSymbolicLink())
+            return false;
+        const descriptor = fs.openSync(target, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+        try {
+            const opened = fs.fstatSync(descriptor);
+            if (opened.dev !== checked.dev || opened.ino !== checked.ino || opened.size !== checked.size)
+                return false;
+            const value = fs.readFileSync(descriptor, "utf-8");
+            const final = fs.fstatSync(descriptor);
+            if (!safeCoveragePath(repoPath, file))
+                return false;
+            const current = fs.lstatSync(target);
+            if (!current.isFile() ||
+                current.isSymbolicLink() ||
+                current.dev !== opened.dev ||
+                current.ino !== opened.ino ||
+                current.size !== opened.size ||
+                current.mtimeMs !== opened.mtimeMs ||
+                current.ctimeMs !== opened.ctimeMs ||
+                final.size !== opened.size ||
+                final.mtimeMs !== opened.mtimeMs ||
+                final.ctimeMs !== opened.ctimeMs)
+                return false;
+            return isDbtManifest(value);
+        }
+        finally {
+            fs.closeSync(descriptor);
+        }
     }
     catch {
         // Deliberate (comment kept from main's equivalent, removed in this merge):
@@ -9020,9 +9389,7 @@ function gitTrackedCandidates(repoPath, intent) {
             if (intent && !coverageContains(intent, file))
                 return false;
             try {
-                return intent?.mode === "scoped"
-                    ? (safeCoveragePath(repoPath, file)?.isFile() ?? false)
-                    : fs.statSync(path.join(repoPath, file)).isFile();
+                return safeCoveragePath(repoPath, file)?.isFile() ?? false;
             }
             catch {
                 return false;
@@ -9082,9 +9449,7 @@ async function collectRepoFilesWithCoverageAbortable(repoPath, signal, db) {
             continue;
         if (candidates) {
             try {
-                if (!(intent.mode === "scoped"
-                    ? safeCoveragePath(repoPath, file)?.isFile()
-                    : fs.statSync(path.join(repoPath, file)).isFile()))
+                if (!safeCoveragePath(repoPath, file)?.isFile())
                     continue;
             }
             catch {
@@ -9162,6 +9527,29 @@ function gitHead(repoPath) {
         return null;
     }
 }
+/** Git proof is required at repository roots, but not at verified nested paths. */
+function hasGitCheckout(repoPath) {
+    // A local marker includes unborn repositories and worktree .git files. Do
+    // not let a failed root probe downgrade either to the stat-only fallback.
+    if (fs.existsSync(path.join(repoPath, ".git")))
+        return true;
+    try {
+        const root = child_process
+            .execFileSync("git", ["rev-parse", "--show-toplevel"], {
+            cwd: repoPath,
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        })
+            .trim();
+        if (root)
+            return isSameDir(root, repoPath);
+    }
+    catch {
+        // Only a successful root mismatch permits the documented nested-path
+        // fallback. A failed probe with other Git evidence remains unverifiable.
+    }
+    return gitHead(repoPath) !== null;
+}
 /** Read a value from the `meta` key/value table (null if absent). */
 function getMeta(db, key) {
     try {
@@ -9304,9 +9692,11 @@ function freshnessFingerprint(value) {
         return null;
     return crypto.createHash("sha256").update(value).digest("hex");
 }
-function buildFreshnessEnvelope(repoPath, db, verifiedAt, stateOverride, gitProbe) {
+function buildFreshnessEnvelope(repoPath, db, verifiedAt, stateOverride, gitProbe, deepSourceVerified = false) {
     const coverage = coverageForDatabase(db);
-    const git = gitProbe === undefined ? gitWorkTreeProbe(repoPath, coverage.intent ?? undefined) : gitProbe;
+    const git = gitProbe === undefined
+        ? gitWorkTreeProbe(repoPath, coverage.intent ?? undefined, db)
+        : gitProbe;
     const intent = coverage.intent;
     const scopedDirty = intent
         ? git?.dirty.filter((file) => coverageContains(intent, file))
@@ -9319,19 +9709,34 @@ function buildFreshnessEnvelope(repoPath, db, verifiedAt, stateOverride, gitProb
     const workingTreeChanged = git !== null &&
         isSameDir(git.root, repoPath) &&
         baseline !== null &&
-        baseline !== (scopedDirty ? coverageDirtyFingerprint(coverage.intent, scopedDirty) : undefined);
+        (baseline !==
+            (scopedDirty ? coverageDirtyFingerprint(coverage.intent, scopedDirty) : undefined) ||
+            (db ? (getMeta(db, "lastProbePolicy") ?? "") : "") !== git.policyFingerprint);
+    const sourceProofUnavailable = db !== null &&
+        hasGitCheckout(repoPath) &&
+        (validSourceEpoch(getMeta(db, CONTENT_PROOF_EPOCH_KEY)) === null ||
+            git === null ||
+            (!deepSourceVerified && !git.statProofReliable) ||
+            (!deepSourceVerified &&
+                (!getMeta(db, "lastProbeContent") ||
+                    dirtyContentFingerprint(repoPath, scopedDirty ?? []) !==
+                        getMeta(db, "lastProbeContent"))));
     const state = stateOverride ??
-        (currentHead === null && indexedHead === null && baseline !== null
-            ? workingTreeChanged
-                ? "stale-working-tree"
-                : "fresh"
-            : relation.commitRelation === "unknown"
+        (sourceProofUnavailable || (git === null && hasGitCheckout(repoPath))
+            ? "unknown"
+            : git !== null && baseline === null
                 ? "unknown"
-                : relation.commitRelation !== "equal"
-                    ? "stale-head"
-                    : workingTreeChanged
+                : currentHead === null && indexedHead === null && baseline !== null
+                    ? workingTreeChanged
                         ? "stale-working-tree"
-                        : "fresh");
+                        : "fresh"
+                    : relation.commitRelation === "unknown"
+                        ? "unknown"
+                        : relation.commitRelation !== "equal"
+                            ? "stale-head"
+                            : workingTreeChanged
+                                ? "stale-working-tree"
+                                : "fresh");
     return {
         currentHead,
         indexCoverage: indexCoverageSummary(coverage),
@@ -9359,9 +9764,17 @@ function buildFreshnessEnvelope(repoPath, db, verifiedAt, stateOverride, gitProb
  * when the file could not be stat'd, which the caller adds harmlessly.
  */
 function recordIndexState(db, repoPath, relPath) {
+    // A normal indexing write supersedes any interrupted repair's content proof,
+    // even when the replacement source happens to preserve its stat tuple.
+    db.run("DELETE FROM meta WHERE key=?", [`${REPAIR_CHECKPOINT_PREFIX}${relPath}`]);
     try {
         const st = fs.statSync(path.join(repoPath, relPath));
         db.run("INSERT INTO index_state(filePath, mtimeMs, size) VALUES (?, ?, ?) ON CONFLICT(filePath) DO UPDATE SET mtimeMs = excluded.mtimeMs, size = excluded.size", [relPath, st.mtimeMs, st.size]);
+        const sourceHash = indexedSourceProofs.get(db)?.get(relPath);
+        indexedSourceProofs.get(db)?.delete(relPath);
+        if (sourceHash) {
+            setMeta(db, `${REPAIR_CHECKPOINT_PREFIX}${relPath}`, JSON.stringify({ version: 1, sourceHash, mtimeMs: st.mtimeMs, size: st.size }));
+        }
         return st.size;
     }
     catch (_) {
@@ -9417,6 +9830,7 @@ function shouldPurgeMissingFile(db) {
 function removeIndexState(db, relPath) {
     if (!shouldPurgeMissingFile(db))
         return;
+    db.run("DELETE FROM meta WHERE key=?", [`${REPAIR_CHECKPOINT_PREFIX}${relPath}`]);
     try {
         db.run("DELETE FROM apex_consumer_files WHERE filePath = ?", [relPath]);
         db.run("DELETE FROM apex_class_uses WHERE filePath = ?", [relPath]);
@@ -9464,9 +9878,9 @@ function parseGitStatusPaths(output) {
  * incremental), so a clean reconcile does no work.
  */
 /**
- * Full mtime/size comparison against `index_state`, used both when there is
- * no git HEAD at all and as a correctness fallback when a git-diff baseline
- * turns out to be unresolvable (see `reconcileIndex`). Not a substitute for
+ * Full mtime/size comparison against `index_state`, used only for verified
+ * non-Git or nested paths. Failed Git content enumeration refuses reconciliation
+ * rather than downgrading to this stat-only comparison. Not a substitute for
  * the git fast path in general: it only detects drift relative to *this*
  * checkout's own recorded state, so a database whose `index_state` rows came
  * from a different physical checkout (fresh mtimes on every file) degrades
@@ -9499,25 +9913,23 @@ async function reconcileIndex(repoPath, db, progress, skipEmbeddings = getMeta(d
         const coverage = requireIndexCoverage(coverageForDatabase(db));
         progress?.("collecting-files", 0, "Checking existing local graph for changes");
         const changed = new Set();
+        // Git has already content-proved these paths changed. Do not narrow that
+        // evidence back to mtime/size, which Git's stat cache can legitimately
+        // consider unchanged after a same-size edit with a restored timestamp.
+        const gitChanged = new Set();
         const head = gitHead(repoPath);
         let canonicalFiles;
-        if (head) {
+        if (hasGitCheckout(repoPath)) {
             // --- git fast path ---
             const lastHead = getMeta(db, "lastIndexedHead");
-            try {
-                for (const pathspecs of coverageGitPathspecBatches(coverage)) {
-                    const status = child_process.execFileSync("git", ["status", "--porcelain=v1", "-z", "--untracked-files=all", ...pathspecs], {
-                        cwd: repoPath,
-                        encoding: "utf-8",
-                        stdio: ["ignore", "pipe", "ignore"],
-                    });
-                    for (const file of parseGitStatusPaths(status))
-                        changed.add(file);
-                }
+            const workTree = gitWorkTreeProbe(repoPath, coverage, db);
+            if (!workTree || workTree.head !== (head ?? ""))
+                throw new Error("Incomplete Git working-tree enumeration; reconciliation baseline unchanged");
+            for (const file of workTree.dirty) {
+                changed.add(file);
+                gitChanged.add(file);
             }
-            catch (_) { }
-            let baselineUnresolved = false;
-            if (lastHead && lastHead !== head) {
+            if (head && lastHead && lastHead !== head) {
                 try {
                     for (const pathspecs of coverageGitPathspecBatches(coverage)) {
                         const diff = child_process.execFileSync("git", [
@@ -9531,30 +9943,19 @@ async function reconcileIndex(repoPath, db, progress, skipEmbeddings = getMeta(d
                             cwd: repoPath,
                             encoding: "utf-8",
                             stdio: ["ignore", "pipe", "ignore"],
+                            maxBuffer: 64 * 1024 * 1024,
                         });
-                        for (const file of splitNulPaths(diff))
+                        for (const file of splitNulPaths(diff)) {
                             changed.add(file);
+                            gitChanged.add(file);
+                        }
                     }
                 }
-                catch (_) {
-                    // `lastHead` is not resolvable in this checkout's object database
-                    // (a shallow clone missing that commit, or a database seeded from
-                    // an unrelated checkout). Silently treating this as "nothing
-                    // changed" would let the graph advance `lastIndexedHead` to the
-                    // new HEAD below while having missed every real change in
-                    // between — fall back to a full comparison instead.
-                    baselineUnresolved = true;
-                }
-            }
-            if (baselineUnresolved) {
-                console.warn(`knodin: cached baseline commit ${lastHead} is not resolvable in this checkout (shallow clone or foreign database) — falling back to a full file-drift comparison`);
-                canonicalFiles = collectRepoFiles(repoPath, db);
-                if (canonicalFiles.length > 50000) {
-                    console.warn(`knodin: skipping full-drift fallback reconcile (${canonicalFiles.length} files exceeds 50k bound)`);
-                }
-                else {
-                    for (const file of detectDriftByStat(repoPath, db, canonicalFiles))
-                        changed.add(file);
+                catch (error) {
+                    // A failed content diff (overflow, missing shallow history, or
+                    // foreign baseline) is not an empty diff. Stat-only comparison
+                    // cannot recover equal-stat edits, at any repository size.
+                    throw new Error("Incomplete Git commit-diff enumeration; run knodin index --clean to recover missing history", { cause: error });
                 }
             }
         }
@@ -9593,10 +9994,29 @@ async function reconcileIndex(repoPath, db, progress, skipEmbeddings = getMeta(d
         });
         let reindexed = 0;
         const reindexedPaths = [];
+        const readParsedProof = repairCheckpointReader(db, repoPath);
         for (const [candidateIndex, rel] of candidates.entries()) {
             const abs = path.join(repoPath, rel);
             if (canonicalPaths.has(rel) && fs.existsSync(abs)) {
-                if (fileDriftedFromIndexState(db, repoPath, rel)) {
+                let forceExtraction = gitChanged.has(rel);
+                if (forceExtraction) {
+                    try {
+                        const before = fs.statSync(abs);
+                        const proof = readParsedProof(rel);
+                        const after = fs.statSync(abs);
+                        forceExtraction =
+                            !proof?.matches ||
+                                before.mtimeMs !== after.mtimeMs ||
+                                before.size !== after.size ||
+                                before.ctimeMs !== after.ctimeMs ||
+                                before.ino !== after.ino ||
+                                before.dev !== after.dev;
+                    }
+                    catch {
+                        forceExtraction = true;
+                    }
+                }
+                if (forceExtraction || fileDriftedFromIndexState(db, repoPath, rel)) {
                     await indexFile(abs, rel, repoPath, db);
                     recordIndexState(db, repoPath, rel);
                     reindexed++;
@@ -9778,82 +10198,204 @@ export function resetFreshnessStats() {
     freshnessStats.probeOverflows = 0;
     freshnessProbes.clear();
 }
-/**
- * HEAD sha, work-tree root, and the dirty set in a SINGLE spawn — process
- * launch dominates this probe's cost, and it runs before every answer past the
- * TTL, so two spawns would be twice the price for the same facts. `rev-parse`
- * emits exactly two lines, so everything after them is the porcelain body.
- * Returns null when `repoPath` is not a git work tree (or git failed), which
- * sends the caller to the mtime fallback.
- */
-function gitWorkTreeProbe(repoPath, intent) {
-    if (intent?.mode === "scoped") {
+function freshnessDirtyPaths(repoPath, paths, intent, db, standardExcludes = []) {
+    const dirty = new Set();
+    const policies = new Set(standardExcludes);
+    // Share a total content-read budget between manifest eligibility and policy
+    // proof. Oversized new manifests need explicit indexing, not an unbounded
+    // read on every status/query. Already indexed paths do not need this read.
+    const bytes = Buffer.alloc(64 * 1024);
+    let remaining = 1024 * 1024;
+    let manifests = 0;
+    const indexedPath = db?.query("SELECT 1 AS present FROM index_state WHERE filePath=?");
+    for (const file of paths) {
+        if (path.posix.basename(file) === ".gitignore" && isIndexablePath(file)) {
+            const directory = path.posix.dirname(file);
+            if (!intent ||
+                intent.mode === "full" ||
+                directory === "." ||
+                intent.files.some((candidate) => candidate.startsWith(`${directory}/`)) ||
+                intent.prefixes.some((prefix) => prefix === directory ||
+                    prefix.startsWith(`${directory}/`) ||
+                    directory.startsWith(`${prefix}/`)))
+                policies.add(path.resolve(repoPath, file));
+        }
+        if (intent && !coverageContains(intent, file))
+            continue;
+        // Previously indexed paths remain observable after deletion or policy changes.
+        const indexed = indexedPath?.get(file);
+        if (indexed) {
+            dirty.add(file);
+            continue;
+        }
+        if (!isIndexableSourcePath(file))
+            continue;
         try {
-            const options = {
-                cwd: repoPath,
-                encoding: "utf8",
-                stdio: ["ignore", "pipe", "ignore"],
-                maxBuffer: 64 * 1024 * 1024,
-            };
-            const root = child_process
-                .execFileSync("git", ["rev-parse", "--show-toplevel"], options)
-                .trim();
-            if (!isSameDir(root, repoPath))
-                return null;
-            const dirty = new Set();
-            for (const pathspecs of coverageGitPathspecBatches(intent)) {
-                const output = child_process.execFileSync("git", ["status", "--porcelain=v1", "-z", "--untracked-files=all", ...pathspecs], options);
-                for (const file of parseGitStatusPaths(output))
-                    if (coverageContains(intent, file) && isIndexablePath(file))
-                        dirty.add(file);
+            if (!safeCoveragePath(repoPath, file)?.isFile())
+                continue;
+        }
+        catch {
+            continue;
+        }
+        if (file.endsWith(".json") && !salesforceExperienceFile(file)) {
+            if (path.basename(file).toLowerCase() !== "manifest.json")
+                continue;
+            if (++manifests > 256)
+                throw new Error("Freshness manifest work limit exceeded");
+            const fd = fs.openSync(path.join(repoPath, file), "r");
+            try {
+                const stat = fs.fstatSync(fd);
+                if (!stat.isFile() || stat.size > remaining)
+                    throw new Error("Freshness manifest byte limit exceeded");
+                const chunks = [];
+                while (true) {
+                    const count = fs.readSync(fd, bytes, 0, Math.min(bytes.length, remaining + 1), null);
+                    if (!count)
+                        break;
+                    remaining -= count;
+                    if (remaining < 0)
+                        throw new Error("Freshness manifest byte limit exceeded");
+                    chunks.push(Buffer.from(bytes.subarray(0, count)));
+                }
+                if (!isDbtManifest(Buffer.concat(chunks).toString("utf8")))
+                    continue;
+            }
+            finally {
+                fs.closeSync(fd);
             }
-            return { root, head: gitHead(repoPath) ?? "", dirty: [...dirty].sort(compareBytes) };
+        }
+        dirty.add(file);
+    }
+    if (policies.size > 256)
+        throw new Error("Freshness ignore-policy work limit exceeded");
+    const hash = crypto.createHash("sha256");
+    // A pruning-policy change invalidates legacy baselines once, allowing the
+    // canonical reconciler to remove old rows without enumerating pruned trees.
+    hash.update(JSON.stringify(prunePolicyDescriptor())).update("\0");
+    for (const file of [...policies].sort(compareBytes)) {
+        hash.update(JSON.stringify(file)).update("\0");
+        let fd;
+        try {
+            fd = fs.openSync(file, "r");
         }
         catch (error) {
-            if (error.code === "ENOBUFS")
-                freshnessStats.probeOverflows++;
-            return null;
+            if (error.code === "ENOENT") {
+                hash.update("deleted\0");
+                continue;
+            }
+            throw error;
+        }
+        try {
+            const stat = fs.fstatSync(fd);
+            // Git supports the platform null device to disable global excludes.
+            // Do not generalize this exception to other devices or streams.
+            if (file === os.devNull && stat.isCharacterDevice()) {
+                hash.update("empty-null-policy\0");
+                continue;
+            }
+            if (!stat.isFile() || stat.size > remaining)
+                throw new Error("Freshness ignore-policy byte limit exceeded");
+            let length = 0;
+            const fileHash = crypto.createHash("sha256");
+            while (true) {
+                const count = fs.readSync(fd, bytes, 0, Math.min(bytes.length, remaining + 1), null);
+                if (!count)
+                    break;
+                length += count;
+                remaining -= count;
+                if (remaining < 0)
+                    throw new Error("Freshness ignore-policy byte limit exceeded");
+                fileHash.update(bytes.subarray(0, count));
+            }
+            hash.update(`${length}:${fileHash.digest("hex")}\0`);
+        }
+        finally {
+            fs.closeSync(fd);
         }
     }
-    let lines;
+    return {
+        dirty: [...dirty].sort(compareBytes),
+        policyFingerprint: hash.digest("hex"),
+    };
+}
+/**
+ * Lossless Git file paths with canonical pruning applied before Git enumerates
+ * untracked content. Source eligibility is then shared with the collector.
+ */
+function gitWorkTreeProbe(repoPath, intent, db) {
     try {
-        lines = child_process
-            .execSync("git rev-parse HEAD --show-toplevel && git status --porcelain", {
+        const options = {
             cwd: repoPath,
-            encoding: "utf-8",
-            stdio: ["pipe", "pipe", "ignore"],
-            // Node's default 1 MB maxBuffer holds only a few thousand dirty
-            // porcelain lines; a large dirty tree then threw here and silently
-            // demoted the probe to the bounded mtime fallback (KNODIN-39).
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
             maxBuffer: 64 * 1024 * 1024,
-        })
-            .split("\n");
+        };
+        const root = child_process
+            .execFileSync("git", ["rev-parse", "--show-toplevel"], options)
+            .trim();
+        if (!isSameDir(root, repoPath))
+            return null;
+        // Hooks may use the physical path while a CLI caller uses a symlink
+        // alias (/var versus /private/var on macOS). Policy identities must
+        // describe the same repository independently of that spelling.
+        const canonicalRoot = fs.realpathSync(root);
+        // Resolve Git's shared/worktree info directory and effective global ignore
+        // source through Git itself, including config includes and ~ expansion.
+        const infoExclude = child_process
+            .execFileSync("git", ["rev-parse", "--git-path", "info/exclude"], options)
+            .replace(/\n$/, "");
+        const defaultExclude = path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config"), "git", "ignore");
+        const globalExclude = child_process
+            .execFileSync("git", ["config", "--path", "--null", "--default", defaultExclude, "--get", "core.excludesFile"], options)
+            .replace(/\0$/, "");
+        const standardExcludes = [path.resolve(canonicalRoot, infoExclude)];
+        if (globalExclude)
+            standardExcludes.push(path.resolve(canonicalRoot, globalExclude));
+        const paths = new Set();
+        // Porcelain can suppress a tracked policy's equal-stat edit. Enumerate
+        // only tracked .gitignore paths, never the source tree, then hash their
+        // bounded content independently of Git's stat-cache verdict.
+        const trackedPolicies = child_process.execFileSync("git", ["ls-files", "-z", "--", ":(glob)**/.gitignore"], options);
+        for (const file of trackedPolicies.split("\0"))
+            if (file)
+                paths.add(file);
+        const statusHash = crypto.createHash("sha256");
+        const trustCtime = child_process
+            .execFileSync("git", ["config", "--type=bool", "--default=true", "--get", "core.trustctime"], options)
+            .trim();
+        const checkStat = child_process
+            .execFileSync("git", ["config", "--default=default", "--get", "core.checkStat"], options)
+            .trim()
+            .toLowerCase();
+        const prune = prunePolicyDescriptor();
+        const excludes = [...prune.directories, ...prune.patterns].map((entry) => `:(exclude,glob)**/${entry}/**`);
+        for (const pathspecs of coverageGitPathspecBatches(intent)) {
+            const output = child_process.execFileSync("git", [
+                "status",
+                "--porcelain=v1",
+                "-z",
+                "--untracked-files=all",
+                ...(pathspecs.length ? pathspecs : ["--", "."]),
+                ":(glob)**/.gitignore",
+                ...excludes,
+            ], options);
+            statusHash.update(JSON.stringify([pathspecs, output]));
+            for (const file of parseGitStatusPaths(output))
+                paths.add(file);
+        }
+        return {
+            root: canonicalRoot,
+            head: gitHead(repoPath) ?? "",
+            statusFingerprint: statusHash.digest("hex"),
+            statProofReliable: trustCtime !== "false" && checkStat !== "minimal",
+            ...freshnessDirtyPaths(canonicalRoot, [...paths], intent, db, standardExcludes),
+        };
     }
     catch (error) {
-        // An overflow is a degradation worth attributing — the fallback path is
-        // bounded and can only answer "unknown" — so it is counted where the perf
-        // harness and tests can see it, unlike a plain not-a-git-repo failure.
         if (error.code === "ENOBUFS")
-            freshnessStats.probeOverflows += 1;
+            freshnessStats.probeOverflows++;
         return null;
     }
-    const head = lines[0]?.trim();
-    const root = lines[1]?.trim();
-    if (!head || !root)
-        return null;
-    const dirty = [];
-    for (const line of lines.slice(2)) {
-        if (!line.trim())
-            continue;
-        // Porcelain: `XY <path>` (or `XY <orig> -> <new>` for renames).
-        for (const part of line.slice(3).split(" -> ")) {
-            const p = part.trim().replace(/^"|"$/g, "");
-            if (p && isIndexablePath(p))
-                dirty.push(p);
-        }
-    }
-    dirty.sort(compareBytes);
-    return { head, root, dirty };
 }
 /** True when two paths name the same directory (symlinks resolved). */
 function isSameDir(a, b) {
@@ -9871,7 +10413,11 @@ function fileDriftedFromIndexState(db, repoPath, relPath) {
         .get(relPath);
     let st = null;
     try {
-        st = fs.statSync(path.join(repoPath, relPath));
+        if (!safeCoveragePath(repoPath, relPath))
+            return Boolean(row);
+        st = fs.lstatSync(path.join(repoPath, relPath));
+        if (!st.isFile() || st.isSymbolicLink())
+            return Boolean(row);
     }
     catch {
         st = null;
@@ -9884,6 +10430,224 @@ function fileDriftedFromIndexState(db, repoPath, relPath) {
         return true;
     return row.mtimeMs !== st.mtimeMs || row.size !== st.size;
 }
+const repairSourceAudit = new AsyncLocalStorage();
+const newRepairSourceAuditState = () => ({
+    verified: new Map(),
+    owned: new Set(),
+});
+const REPAIR_CHECKPOINT_PREFIX = "repair-source-v1:";
+const REPAIR_INITIALIZATION_KEY = "repair-source-initialization-v1";
+const CONTENT_PROOF_EPOCH_KEY = "contentProofEpochV1";
+/**
+ * Audit record for a non-empty graph indexed before 0.13.1 introduced the
+ * versioned content-proof epoch. Ordinary and scoped indexing refuse to mint
+ * one for such a graph, so the only remedy is a clean index; `init` performs
+ * it, and the lifecycle hook must fail loudly rather than report success.
+ */
+export const LEGACY_CONTENT_PROOF_RECORD = "content-proof epoch is missing or invalid; a one-time clean index is required";
+export const LEGACY_CONTENT_PROOF_REPAIR_STEP = "Run `knodin index --clean` once to establish a versioned content-proof epoch.";
+/** Whether an index result or thrown indexing error names the legacy-epoch condition. */
+export function needsLegacyEpochCleanIndex(value) {
+    if (value instanceof Error)
+        return value.message.includes("content-proof epoch");
+    const verification = value?.verification;
+    return Array.isArray(verification?.missing?.records)
+        ? verification.missing.records.includes(LEGACY_CONTENT_PROOF_RECORD)
+        : false;
+}
+const CLEAN_INDEX_SOURCE_START_KEY = "cleanIndexSourceStartV1";
+/** Metadata provenance is a canonical UTC instant, not Date.parse's permissive grammar. */
+function validSourceEpoch(value, now = Date.now()) {
+    if (!value || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value))
+        return null;
+    const epoch = Date.parse(value);
+    return Number.isFinite(epoch) && epoch <= now && new Date(epoch).toISOString() === value
+        ? epoch
+        : null;
+}
+/** Dirty content proof is bounded even for a very large checkout. */
+function dirtyContentFingerprint(repoPath, files) {
+    if (files.length > 256)
+        return null;
+    let remaining = 1024 * 1024;
+    const bytes = Buffer.alloc(64 * 1024);
+    const hash = crypto.createHash("sha256");
+    try {
+        for (const file of files) {
+            hash.update(JSON.stringify(file)).update("\0");
+            let fd;
+            const target = path.join(repoPath, file);
+            let checked;
+            try {
+                checked = fs.lstatSync(target);
+                if (!safeCoveragePath(repoPath, file) || !checked.isFile() || checked.isSymbolicLink())
+                    return null;
+                fd = fs.openSync(target, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+            }
+            catch (error) {
+                if (error.code === "ENOENT") {
+                    hash.update("deleted\0");
+                    continue;
+                }
+                throw error;
+            }
+            try {
+                const stat = fs.fstatSync(fd);
+                if (!stat.isFile() ||
+                    stat.size > remaining ||
+                    stat.dev !== checked.dev ||
+                    stat.ino !== checked.ino)
+                    return null;
+                const fileHash = crypto.createHash("sha256");
+                let length = 0;
+                while (true) {
+                    const count = fs.readSync(fd, bytes, 0, Math.min(bytes.length, remaining + 1), null);
+                    if (!count)
+                        break;
+                    remaining -= count;
+                    if (remaining < 0)
+                        return null;
+                    length += count;
+                    fileHash.update(bytes.subarray(0, count));
+                }
+                hash.update(`${length}:${fileHash.digest("hex")}\0`);
+                const final = fs.fstatSync(fd);
+                if (!safeCoveragePath(repoPath, file))
+                    return null;
+                const current = fs.lstatSync(target);
+                if (current.dev !== stat.dev ||
+                    current.ino !== stat.ino ||
+                    current.size !== stat.size ||
+                    current.mtimeMs !== stat.mtimeMs ||
+                    current.ctimeMs !== stat.ctimeMs ||
+                    final.size !== stat.size ||
+                    final.mtimeMs !== stat.mtimeMs ||
+                    final.ctimeMs !== stat.ctimeMs ||
+                    length !== stat.size)
+                    return null;
+            }
+            finally {
+                fs.closeSync(fd);
+            }
+        }
+        return hash.digest("hex");
+    }
+    catch {
+        return null;
+    }
+}
+/** Fixed-size proofs only for completed repair files, never a source-inventory scan. */
+function repairCheckpointReader(db, repoPath) {
+    const checkpoint = db.query("SELECT value FROM meta WHERE key=? AND length(value)<=512");
+    const indexed = db.query("SELECT filePath,mtimeMs,size FROM index_state WHERE filePath=?");
+    const bytes = Buffer.alloc(64 * 1024);
+    return (file, suppliedRow) => {
+        try {
+            const raw = checkpoint.get(`${REPAIR_CHECKPOINT_PREFIX}${file}`)?.value;
+            const row = suppliedRow ?? indexed.get(file);
+            if (!raw || !row)
+                return null;
+            const proof = JSON.parse(raw);
+            if (proof.version !== 1 ||
+                typeof proof.sourceHash !== "string" ||
+                !/^[a-f0-9]{64}$/.test(proof.sourceHash) ||
+                proof.mtimeMs !== row.mtimeMs ||
+                proof.size !== row.size)
+                return null;
+            const target = path.join(repoPath, file);
+            if (!safeCoveragePath(repoPath, file))
+                throw new Error("Repair source path is unsafe");
+            const stat = fs.lstatSync(target);
+            if (!stat.isFile() || stat.isSymbolicLink())
+                throw new Error("Repair source is not a regular file");
+            return {
+                sourceHash: proof.sourceHash,
+                matches: stat.mtimeMs === row.mtimeMs &&
+                    stat.size === row.size &&
+                    repairSourceFingerprint(repoPath, file, bytes) === proof.sourceHash,
+            };
+        }
+        catch {
+            return null;
+        }
+    };
+}
+/** Repair-only content fence; memory is bounded independently of source size. */
+function repairSourceFingerprint(repoPath, file, bytes) {
+    const target = path.join(repoPath, file);
+    if (!safeCoveragePath(repoPath, file))
+        throw new Error("Repair source path is unsafe");
+    let checked;
+    let fd;
+    try {
+        checked = fs.lstatSync(target);
+        if (!checked.isFile() || checked.isSymbolicLink())
+            throw new Error("Repair source is not a regular file");
+        fd = fs.openSync(target, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+    try {
+        const opened = fs.fstatSync(fd);
+        if (!opened.isFile() || opened.dev !== checked.dev || opened.ino !== checked.ino)
+            throw new Error("Repair source changed during open");
+        const hash = crypto.createHash("sha256");
+        let length = 0;
+        while (true) {
+            const count = fs.readSync(fd, bytes, 0, bytes.length, null);
+            if (!count)
+                break;
+            length += count;
+            hash.update(bytes.subarray(0, count));
+        }
+        if (!safeCoveragePath(repoPath, file))
+            throw new Error("Repair source path changed during read");
+        const final = fs.fstatSync(fd);
+        const current = fs.lstatSync(target);
+        if (!current.isFile() ||
+            current.isSymbolicLink() ||
+            current.dev !== opened.dev ||
+            current.ino !== opened.ino ||
+            current.size !== opened.size ||
+            current.mtimeMs !== opened.mtimeMs ||
+            current.ctimeMs !== opened.ctimeMs ||
+            final.size !== opened.size ||
+            final.mtimeMs !== opened.mtimeMs ||
+            final.ctimeMs !== opened.ctimeMs ||
+            length !== opened.size)
+            throw new Error("Repair source changed during read");
+        return hash.digest("hex");
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+/** Existing indexed rows only; detects equal-stat writes after the proved start. */
+function sourceSnapshotMatches(db, repoPath, epoch) {
+    const readCheckpoint = repairCheckpointReader(db, repoPath);
+    for (const row of db
+        .query("SELECT filePath,mtimeMs,size FROM index_state")
+        .all()) {
+        try {
+            if (!safeCoveragePath(repoPath, row.filePath))
+                return false;
+            const stat = fs.lstatSync(path.join(repoPath, row.filePath));
+            if (!stat.isFile() || stat.isSymbolicLink())
+                return false;
+            if (stat.mtimeMs !== row.mtimeMs ||
+                stat.size !== row.size ||
+                (stat.ctimeMs >= epoch - 1 && !readCheckpoint(row.filePath, row)?.matches))
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    return true;
+}
 /**
  * Record the working-tree state the index now reflects. Called at the end of a
  * full index and of every reconcile so the next probe has a baseline to
@@ -9891,15 +10655,19 @@ function fileDriftedFromIndexState(db, repoPath, relPath) {
  * bump — and self-heals on indexes written before this key existed.
  */
 function coverageDirtyFingerprint(intent, dirty) {
-    return intent?.mode === "scoped" ? JSON.stringify(dirty) : dirty.join("\n");
+    // The prefix invalidates legacy newline baselines (and ambiguous JSON-looking
+    // filenames) once without trying to decode those lossy historical snapshots.
+    return `paths-v2:${intent?.mode ?? "full"}:${JSON.stringify(dirty)}`;
 }
 function recordFreshnessBaseline(repoPath, db) {
     const intent = requireIndexCoverage(coverageForDatabase(db));
-    const git = gitWorkTreeProbe(repoPath, intent);
+    const git = gitWorkTreeProbe(repoPath, intent, db);
     const dirty = git && isSameDir(git.root, repoPath)
         ? git.dirty.filter((file) => coverageContains(intent, file))
         : null;
     setMeta(db, "lastProbeDirty", dirty === null ? "" : coverageDirtyFingerprint(intent, dirty));
+    setMeta(db, "lastProbePolicy", git?.policyFingerprint ?? "");
+    setMeta(db, "lastProbeContent", dirty === null ? "" : (dirtyContentFingerprint(repoPath, dirty) ?? ""));
     setMeta(db, "lastProbeCoverage", indexCoverageSummary(coverageForDatabase(db)).digest ?? "");
 }
 /**
@@ -9929,20 +10697,31 @@ function probeDrift(repoPath, db, gitProbe) {
         (coverage.origin === "explicit" &&
             getMeta(db, "lastProbeCoverage") !== indexCoverageSummary(coverage).digest))
         return { drifted: true, verifiable: true };
-    const git = gitProbe === undefined ? gitWorkTreeProbe(repoPath, intent) : gitProbe;
-    if (!git && intent.mode === "scoped" && fs.existsSync(path.join(repoPath, ".git")))
+    const git = gitProbe === undefined ? gitWorkTreeProbe(repoPath, intent, db) : gitProbe;
+    // An indexed-only stat fallback cannot prove that failed Git/ignore-policy
+    // inspection did not hide newly eligible source. Non-Git worktrees
+    // retain the existing bounded fallback.
+    if (!git && hasGitCheckout(repoPath))
+        return { drifted: false, verifiable: false };
+    if (hasGitCheckout(repoPath) && validSourceEpoch(getMeta(db, CONTENT_PROOF_EPOCH_KEY)) === null)
         return { drifted: false, verifiable: false };
     if (git && isSameDir(git.root, repoPath)) {
         if ((getMeta(db, "lastIndexedHead") ?? "") !== git.head) {
             return { drifted: true, verifiable: true };
         }
         const dirty = git.dirty.filter((file) => coverageContains(intent, file));
-        if (getMeta(db, "lastProbeDirty") !== coverageDirtyFingerprint(intent, dirty)) {
+        if (getMeta(db, "lastProbeDirty") !== coverageDirtyFingerprint(intent, dirty) ||
+            (getMeta(db, "lastProbePolicy") ?? "") !== git.policyFingerprint) {
             return { drifted: true, verifiable: true };
         }
+        if (!git.statProofReliable)
+            return { drifted: false, verifiable: false };
+        const content = dirtyContentFingerprint(repoPath, dirty);
+        if (content === null || !getMeta(db, "lastProbeContent"))
+            return { drifted: false, verifiable: false };
+        if (content !== getMeta(db, "lastProbeContent"))
+            return { drifted: true, verifiable: true };
         for (const rel of dirty) {
-            if (!isIndexablePath(rel))
-                continue;
             if (fileDriftedFromIndexState(db, repoPath, rel))
                 return { drifted: true, verifiable: true };
         }
@@ -10059,7 +10838,31 @@ async function indexRepo(repoPath, db, progress, skipEmbeddings = getMeta(db, "s
  * partially-populated intermediate state and the live graph must never be
  * observable in that condition.
  */
-resume = false) {
+resume = false, explicitClean = false) {
+    if (!explicitClean &&
+        hasGitCheckout(repoPath) &&
+        validSourceEpoch(getMeta(db, CONTENT_PROOF_EPOCH_KEY)) === null &&
+        (db.query("SELECT COUNT(*) count FROM index_state").get()?.count ?? 0) >
+            0)
+        throw new Error("Existing graph has no valid content-proof epoch; a one-time knodin index --clean is required.");
+    // Completion/reconciliation timestamps are not content evidence. Keep the
+    // original start across a resumed clean build so edits during it remain
+    // eligible for the repair-only ctime audit.
+    const contentStart = resume
+        ? getMeta(db, CLEAN_INDEX_SOURCE_START_KEY)
+        : new Date().toISOString();
+    const contentEpoch = validSourceEpoch(contentStart);
+    if (!contentStart || contentEpoch === null)
+        throw new Error("Clean index source epoch is unavailable; restart with knodin index --clean.");
+    const initialGit = gitWorkTreeProbe(repoPath, requireIndexCoverage(coverageForDatabase(db)), db);
+    const originalHead = resume
+        ? (getMeta(db, CLEAN_INDEX_HEAD_META_KEY) ?? "")
+        : (gitHead(repoPath) ?? "");
+    if (hasGitCheckout(repoPath) && (!initialGit || initialGit.head !== originalHead))
+        throw new Error("Repository HEAD changed during clean index; restart with knodin index --clean.");
+    setMeta(db, CLEAN_INDEX_SOURCE_START_KEY, contentStart);
+    if (!resume)
+        db.run("DELETE FROM meta WHERE key=?", [CONTENT_PROOF_EPOCH_KEY]);
     setMeta(db, "semanticDeferred", skipEmbeddings ? "1" : "0");
     progress?.("collecting-files", 0, "Discovering indexable files");
     const collected = measurePerfPhaseSync("file_collection", () => collectRepoFilesWithCoverage(repoPath, db));
@@ -10110,6 +10913,11 @@ resume = false) {
         db.run("DELETE FROM dependencies;");
         db.run("DELETE FROM mcp_tools;");
         db.run("DELETE FROM index_state;");
+        db.run("DELETE FROM meta WHERE key>=? AND key<?", [
+            REPAIR_CHECKPOINT_PREFIX,
+            "repair-source-v1;",
+        ]);
+        db.run("DELETE FROM meta WHERE key=?", [REPAIR_INITIALIZATION_KEY]);
         db.run("DELETE FROM apex_consumer_files;");
         db.run("DELETE FROM apex_class_uses;");
         setMeta(db, "apexConsumerFactsRevision", crypto.randomUUID());
@@ -10127,9 +10935,24 @@ resume = false) {
     let resumedFiles = 0;
     let resumedBytes = 0;
     if (resume) {
+        const eligible = new Set(files);
+        for (const row of db
+            .query("SELECT filePath,mtimeMs,size FROM index_state")
+            .all()) {
+            if (!eligible.has(row.filePath)) {
+                deleteSymbolsForFile(db, row.filePath);
+                db.run('DELETE FROM "references" WHERE callerFile=?', [row.filePath]);
+                db.run("DELETE FROM dependencies WHERE fromFile=?", [row.filePath]);
+                db.run("DELETE FROM mcp_tools WHERE filePath=?", [row.filePath]);
+                removeIndexState(db, row.filePath);
+            }
+        }
+        const readCheckpoint = repairCheckpointReader(db, repoPath);
         const pending = [];
         for (const file of files) {
-            if (fileDriftedFromIndexState(db, repoPath, file)) {
+            const stat = fs.statSync(path.join(repoPath, file));
+            if (fileDriftedFromIndexState(db, repoPath, file) ||
+                (stat.ctimeMs >= contentEpoch - 1 && !readCheckpoint(file)?.matches)) {
                 pending.push(file);
                 continue;
             }
@@ -10155,23 +10978,82 @@ resume = false) {
     // through per-file SAVEPOINTs inside `writeFileIndexResultBatch`).
     let lastYieldAt = Date.now();
     const pendingWrites = [];
+    const cleanProofs = new Map();
+    let batchWritesFailed = false;
     const flushPendingWrites = () => {
         if (pendingWrites.length === 0)
             return;
         const failures = writeFileIndexResultBatch(db, pendingWrites);
+        if (failures.length > 0)
+            batchWritesFailed = true;
         for (const failure of failures) {
             console.error(`Error indexing file ${failure.relativePath}:`, failure.error);
             tallyOne(unparsedByExtension, extensionBucket(failure.relativePath));
+            cleanProofs.delete(failure.relativePath);
+            db.run("DELETE FROM meta WHERE key=?", [
+                `${REPAIR_CHECKPOINT_PREFIX}${failure.relativePath}`,
+            ]);
         }
         pendingWrites.length = 0;
+        // Generic batched writes invalidate old proofs. Restore the proofs
+        // captured around this build's actual parse, including on interruption.
+        for (const [file, proof] of cleanProofs)
+            setMeta(db, `${REPAIR_CHECKPOINT_PREFIX}${file}`, proof);
+        cleanProofs.clear();
     };
     // Progress is reported against a single counter so the pool and the
     // sequential path can interleave without the count going backwards.
     let processed = resumedFiles;
+    const parseStats = new Map();
+    const proofBytes = Buffer.alloc(64 * 1024);
+    // Tracks completed source consumption (including unparsed/skipped outcomes).
+    // Failed writes remain excluded or have their proofs removed during flush.
+    const extractedFiles = new Set();
+    const beforeFile = (file) => {
+        const stat = fs.statSync(path.join(repoPath, file));
+        // Worker extraction bypasses indexFile. Bind its original queued source
+        // too, including pre-epoch files, not a hash observed only after parsing.
+        parseStats.set(file, {
+            ctimeMs: stat.ctimeMs,
+            mtimeMs: stat.mtimeMs,
+            size: stat.size,
+            sourceHash: repairSourceFingerprint(repoPath, file, proofBytes),
+        });
+    };
     const afterFile = async (file) => {
+        const before = parseStats.get(file);
+        const after = fs.statSync(path.join(repoPath, file));
+        if ((!before && after.ctimeMs >= contentEpoch - 1) ||
+            (before &&
+                (before.ctimeMs !== after.ctimeMs ||
+                    before.mtimeMs !== after.mtimeMs ||
+                    before.size !== after.size ||
+                    (before.sourceHash !== null &&
+                        repairSourceFingerprint(repoPath, file, proofBytes) !== before.sourceHash))))
+            throw new Error(`Source changed during clean index: ${file}; restart with knodin index --clean.`);
+        completedBytes += recordIndexState(db, repoPath, file);
+        // A later generic batch write invalidates this extraction's checkpoint.
+        // Retain it for restoration only after that file's successful write.
+        if (pendingWrites.length > 0) {
+            const parsedProof = getMeta(db, `${REPAIR_CHECKPOINT_PREFIX}${file}`);
+            if (parsedProof)
+                cleanProofs.set(file, parsedProof);
+        }
+        if (extractedFiles.has(file) && before && before.sourceHash !== null) {
+            const proof = JSON.stringify({
+                version: 1,
+                sourceHash: before.sourceHash,
+                mtimeMs: after.mtimeMs,
+                size: after.size,
+            });
+            setMeta(db, `${REPAIR_CHECKPOINT_PREFIX}${file}`, proof);
+            if (pendingWrites.length > 0)
+                cleanProofs.set(file, proof);
+        }
+        parseStats.delete(file);
+        extractedFiles.delete(file);
         if (pendingWrites.length >= INDEX_WRITE_BATCH_SIZE)
             flushPendingWrites();
-        completedBytes += recordIndexState(db, repoPath, file);
         processed++;
         // Persisted on the same cadence as the write batches rather than only at
         // the end, so an interrupted index keeps what it learned. Cheap: one meta
@@ -10189,9 +11071,12 @@ resume = false) {
         }
     };
     const indexOneInline = async (file) => {
-        await indexFile(path.join(repoPath, file), file, repoPath, db, unparsedByExtension, (result) => {
+        beforeFile(file);
+        const extracted = await indexFile(path.join(repoPath, file), file, repoPath, db, unparsedByExtension, (result) => {
             pendingWrites.push(result);
         });
+        if (extracted)
+            extractedFiles.add(file);
     };
     // Opt-in for now. `createParsePool` returns null whenever the machine says
     // not to spawn, so an unsuitable host silently keeps today's behavior
@@ -10212,17 +11097,22 @@ resume = false) {
                 else
                     inline.push(file);
             }
+            for (const task of eligible)
+                beforeFile(task.relativePath);
             await pool.run(eligible, async (task, outcome) => {
                 switch (outcome.kind) {
                     case "result":
+                        extractedFiles.add(task.relativePath);
                         if (outcome.result.apexClassUseIncompleteReason)
                             tallyOne(unparsedByExtension, extensionBucket(task.relativePath));
                         pendingWrites.push(outcome.result);
                         break;
                     case "unparsed":
+                        extractedFiles.add(task.relativePath);
                         tallyOne(unparsedByExtension, extensionBucket(task.relativePath));
                         break;
                     case "skipped":
+                        extractedFiles.add(task.relativePath);
                         break;
                     default:
                         // The pool could not finish this file (worker crash, or it
@@ -10249,6 +11139,8 @@ resume = false) {
         await pool?.close();
     }
     flushPendingWrites();
+    if (batchWritesFailed)
+        throw new Error("Index batch writes failed; content-completion proof not published. Resolve the write failure and retry indexing.");
     progress?.("finalizing", 0, "Persisting symbol identities and semantic index");
     await refreshFlowsForApexFiles(db, repoPath, files);
     persistSymbolIdentities(db, repoPath);
@@ -10260,10 +11152,30 @@ resume = false) {
     if (!skipEmbeddings)
         await indexEmbeddings(db, repoPath, progress);
     // Remember the HEAD we indexed at so a later cold start can diff forward.
-    setMeta(db, "lastIndexedHead", gitHead(repoPath) ?? "");
+    const finalGit = gitWorkTreeProbe(repoPath, requireIndexCoverage(coverageForDatabase(db)), db);
+    if (hasGitCheckout(repoPath) &&
+        (!initialGit ||
+            !finalGit ||
+            finalGit.head !== originalHead ||
+            initialGit.policyFingerprint !== finalGit.policyFingerprint ||
+            initialGit.statusFingerprint !== finalGit.statusFingerprint))
+        throw new Error("Repository changed during clean index; restart with knodin index --clean.");
+    const readCheckpoint = repairCheckpointReader(db, repoPath);
+    for (const row of db
+        .query("SELECT filePath,mtimeMs,size FROM index_state")
+        .all()) {
+        const stat = fs.statSync(path.join(repoPath, row.filePath));
+        if (stat.mtimeMs !== row.mtimeMs ||
+            stat.size !== row.size ||
+            (stat.ctimeMs >= contentEpoch - 1 && !readCheckpoint(row.filePath, row)?.matches))
+            throw new Error(`Source changed during clean index: ${row.filePath}; restart with knodin index --clean.`);
+    }
+    setMeta(db, "lastIndexedHead", originalHead);
     setMeta(db, "knodinVersion", KNODIN_VERSION);
     setMeta(db, "lastSuccessfulReconciliation", new Date().toISOString());
     setMeta(db, "mcpBackfillVersion", "17");
+    setMeta(db, CONTENT_PROOF_EPOCH_KEY, contentStart);
+    db.run("DELETE FROM meta WHERE key=?", [CLEAN_INDEX_SOURCE_START_KEY]);
     persistUnparsedTally(db, unparsedByExtension);
     // Only now is the tally a measurement rather than a lower bound. Clearing the
     // marker LAST, after the final write, means any failure above leaves it set
@@ -10893,6 +11805,8 @@ export async function getOrInitDb(repoPath, options = {}) {
             else if (!options.skipContentReconciliation) {
                 // Existing on-disk index: reconcile any offline drift (git pull /
                 // branch switch / rebase / external edit) before serving queries.
+                // Always retain canonical discovery and relationship/semantic maintenance.
+                // Reconciliation skips extraction only per file with retained parsed proof.
                 const reindexed = await reconcileIndex(normalizedPath, db, options.onProgress);
                 const missingIdentities = db
                     .query("SELECT COUNT(*) count FROM symbols WHERE identity IS NULL OR identity = ''")
@@ -13346,6 +14260,10 @@ function withStaleness(engine, claimRepository, openDb, openPolicy) {
             claimRepository(candidate.repo);
             return engine.promoteCandidate(candidate);
         },
+        finalizePromotedStorage(repoPath) {
+            claimRepository(repoPath);
+            engine.finalizePromotedStorage?.(repoPath);
+        },
         discardCandidate(candidate) {
             claimRepository(candidate.repo);
             return engine.discardCandidate(candidate);
@@ -13527,12 +14445,149 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
         for (const suffix of ["-wal", "-shm"])
             fs.rmSync(`${candidate.databasePath}${suffix}`, { force: true });
     };
-    const candidateDigest = (candidate) => crypto.createHash("sha256").update(fs.readFileSync(candidate.databasePath)).digest("hex");
+    const candidateDigest = (candidate) => {
+        const bound = bindCandidateDatabase(candidate.repo, candidate);
+        try {
+            const digest = crypto
+                .createHash("sha256")
+                .update(fs.readFileSync(bound.descriptor))
+                .digest("hex");
+            bound.verify();
+            return digest;
+        }
+        finally {
+            bound.close();
+        }
+    };
+    const storageInitializationPending = (repository) => {
+        if (isMirror(repository))
+            return false;
+        const activePath = resolveDbPath(repository);
+        if (!fs.existsSync(activePath))
+            return true;
+        const active = dbInstances.get(repository);
+        const db = active ?? new Database(activePath, { readonly: true });
+        try {
+            const value = db
+                .query("SELECT value FROM meta WHERE key = ?")
+                .get("storagePolicyInitializationPendingV1")?.value;
+            if (value !== undefined && value !== "1")
+                throw new Error("storage-policy: invalid pending initialization marker");
+            return value === "1";
+        }
+        finally {
+            if (!active)
+                db.close();
+        }
+    };
+    const completeStorageMaintenance = (repository) => {
+        if (process.env.VITEST || process.env.NODE_ENV === "test")
+            return;
+        if (isMirror(repository))
+            return;
+        // This runs only after a successful write and lease release. Storage
+        // maintenance must never undo a committed graph or hide cleanup failures.
+        try {
+            assertStoragePolicyWritable(repository);
+            const lease = acquireRepairLease(repository, "storage-policy-initialization");
+            try {
+                const active = dbInstances.get(repository);
+                const policyDb = active ?? new Database(resolveDbPath(repository));
+                try {
+                    if (getMeta(policyDb, "storagePolicyInitializationPendingV1") === "1") {
+                        const databasePath = resolveDbPath(repository);
+                        const cacheKey = databaseCacheKey(repository);
+                        // The repair lease does not fence every graph writer. Validate
+                        // and perform this metadata-only change under a SQLite writer lock.
+                        policyDb.run("BEGIN IMMEDIATE");
+                        let committed = false;
+                        try {
+                            const identity = fs.lstatSync(databasePath);
+                            const version = policyDb
+                                .query("PRAGMA data_version")
+                                .get()?.data_version;
+                            const beforeFingerprint = databaseFileFingerprint(databasePath, policyDb);
+                            const schema = policyDb.query("PRAGMA user_version").get()
+                                ?.user_version ?? 0;
+                            const persisted = readPersistedStatusAudit(repository, databasePath, beforeFingerprint, schema);
+                            const cached = statusCache.get(cacheKey);
+                            initializeStoragePolicy(repository);
+                            policyDb.run("DELETE FROM meta WHERE key = ? AND value = ?", [
+                                "storagePolicyInitializationPendingV1",
+                                "1",
+                            ]);
+                            policyDb.run("COMMIT");
+                            committed = true;
+                            // Normalize our new WAL frame before binding the audit, so
+                            // an otherwise clean close/reopen does not discard it again.
+                            const checkpoint = policyDb
+                                .query("PRAGMA wal_checkpoint(TRUNCATE)")
+                                .get();
+                            const afterFingerprint = databaseFileFingerprint(databasePath, policyDb);
+                            const afterVersion = policyDb
+                                .query("PRAGMA data_version")
+                                .get()?.data_version;
+                            const afterIdentity = fs.lstatSync(databasePath);
+                            // A foreign commit or promotion after our transaction invalidates
+                            // carry-forward. Preserve original audit timestamps/source proofs.
+                            if (checkpoint?.busy === 0 &&
+                                version !== undefined &&
+                                version === afterVersion &&
+                                identity.dev === afterIdentity.dev &&
+                                identity.ino === afterIdentity.ino &&
+                                !afterIdentity.isSymbolicLink()) {
+                                if (persisted)
+                                    writePersistedStatusAudit(repository, databasePath, afterFingerprint, persisted.result);
+                                if (cached?.generation === indexGeneration &&
+                                    cached.databaseFingerprint === beforeFingerprint &&
+                                    cached.result.status === "healthy" &&
+                                    cached.result.verification.mode === "deep-audit")
+                                    statusCache.set(cacheKey, { ...cached, databaseFingerprint: afterFingerprint });
+                            }
+                        }
+                        finally {
+                            if (!committed) {
+                                try {
+                                    policyDb.run("ROLLBACK");
+                                }
+                                catch {
+                                    /* Preserve the original failure. */
+                                }
+                            }
+                        }
+                    }
+                }
+                finally {
+                    if (!active)
+                        policyDb.close();
+                }
+            }
+            finally {
+                lease.release();
+            }
+            const maintenance = postOperationStorageMaintenance(repository);
+            if (maintenance.warnings.length)
+                process.stderr.write(`knodin storage: ${maintenance.warnings.join("; ")}\n`);
+            if (maintenance.policy?.enabled && !maintenance.policy.dryRun) {
+                let reported = 0;
+                sweepAbandonedCandidates(repository, {
+                    onDiagnostic: (warning) => {
+                        if (reported++ < 8)
+                            process.stderr.write(`knodin storage: ${warning.reason.slice(0, 512)}\n`);
+                    },
+                });
+            }
+        }
+        catch (error) {
+            process.stderr.write(`knodin storage: maintenance failed after graph commit: ${error instanceof Error ? error.message : String(error)}\n`);
+        }
+    };
     async function repairThroughCandidate(resolved, repairKey, options) {
         let outerLease;
         let candidate;
         let candidateEngine;
         let before;
+        let storagePromoted = false;
         const activeOperation = {
             promise: undefined,
             subscribers: new Set(options?.onProgress ? [options.onProgress] : []),
@@ -13563,10 +14618,21 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
         const operation = Promise.resolve()
             .then(async () => {
             outerLease = acquireRepairLease(resolved);
-            before = await engine.status(resolved, {
+            const storagePolicy = assertManagedStorageAllocation(resolved);
+            assertStorageCapacity({
+                stateDirectory: resolveStateDir(resolved),
+                databasePath: resolveDbPath(resolved),
+                operation: "vacuum",
+                reserveBytes: storagePolicy?.minFreeBytes,
+            });
+            // Apply the existing repo-local exclusion before the candidate's
+            // policy proof, not when opening its promoted live database.
+            if (mayWriteToRepository(resolved))
+                await excludeStateDirectoryLocally(resolved);
+            before = await repairSourceAudit.run(newRepairSourceAuditState(), () => engine.status(resolved, {
                 audit: "deep",
                 signal: activeOperation.controller.signal,
-            });
+            }));
             await suspendFileWatcher(resolved);
             const activePath = resolveDbPath(resolved);
             if (fs.existsSync(activePath)) {
@@ -13602,9 +14668,28 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
             if (staged.cancelled || !staged.verified) {
                 await engine.discardCandidate(candidate);
                 candidate = undefined;
-                const after = staged.cancelled
+                let after = staged.cancelled
                     ? before
-                    : await engine.status(resolved, { audit: "deep" });
+                    : await repairSourceAudit.run(newRepairSourceAuditState(), () => engine.status(resolved, { audit: "deep" }));
+                if (!staged.cancelled) {
+                    // The active snapshot can pass ordinary graph checks while the
+                    // candidate lacked commit/source proof. Retain that refusal and
+                    // its actionable remediation rather than reporting zero issues.
+                    after = {
+                        ...after,
+                        repairSteps: [...new Set([...staged.after.repairSteps, ...after.repairSteps])],
+                        ...(after.missing.files.length + after.missing.records.length === 0
+                            ? {
+                                status: "stale",
+                                freshness: { ...after.freshness, state: "unknown" },
+                                missing: {
+                                    ...after.missing,
+                                    records: ["repair candidate could not establish a verified source snapshot"],
+                                },
+                            }
+                            : {}),
+                    };
+                }
                 if (pendingCompleted)
                     deliver(pendingCompleted);
                 return {
@@ -13624,6 +14709,7 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
             if (!audit.healthy)
                 throw new Error(`repair candidate audit failed: ${audit.issues.join(", ")}`);
             await engine.promoteCandidate(candidate);
+            storagePromoted = true;
             candidate = undefined;
             const after = await engine.status(resolved, { audit: "deep" });
             if (pendingCompleted)
@@ -13660,6 +14746,8 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
             if (candidate && candidates.has(candidate.id))
                 await engine.discardCandidate(candidate);
             outerLease?.release();
+            if (storagePromoted)
+                completeStorageMaintenance(resolved);
             options?.signal?.removeEventListener("abort", abortShared);
             if (options?.onProgress)
                 activeOperation.subscribers.delete(options.onProgress);
@@ -13683,6 +14771,18 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
         async createCandidate(repoPath, options) {
             const resolved = path.resolve(repoPath);
             recoverInterruptedPromotion(resolved);
+            if (options?.sourceDatabasePath) {
+                const source = path.resolve(options.sourceDatabasePath);
+                const storagePolicy = assertManagedStorageAllocation(resolved);
+                assertStorageCapacity({
+                    stateDirectory: resolveStateDir(resolved),
+                    databasePath: resolveDbPath(resolved),
+                    operation: "candidate",
+                    reserveBytes: storagePolicy?.minFreeBytes,
+                }, {
+                    measureFamily: () => measureDatabaseFamily(path.dirname(source), source),
+                });
+            }
             const candidate = allocateCandidate(resolved);
             try {
                 if (options?.empty) {
@@ -13695,7 +14795,16 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                         !fs.statSync(source).isFile() ||
                         fs.lstatSync(source).isSymbolicLink())
                         throw new Error("candidate source database must be a regular non-symbolic-link file");
-                    const header = fs.readFileSync(source).subarray(0, 16).toString("binary");
+                    const headerBytes = Buffer.alloc(16);
+                    const sourceDescriptor = fs.openSync(source, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+                    let header;
+                    try {
+                        const count = fs.readSync(sourceDescriptor, headerBytes, 0, 16, 0);
+                        header = headerBytes.subarray(0, count).toString("binary");
+                    }
+                    finally {
+                        fs.closeSync(sourceDescriptor);
+                    }
                     if (header !== "SQLite format 3\u0000")
                         throw new Error("candidate source is not a SQLite database");
                     const { reflinked } = reflinkCopyFile(source, candidate.databasePath);
@@ -13721,6 +14830,22 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                     });
                     closeCandidateDatabase(candidate);
                 }
+                if (!options?.empty) {
+                    const initializePolicy = storageInitializationPending(resolved);
+                    const stamp = new Database(candidate.databasePath);
+                    try {
+                        if (initializePolicy)
+                            stamp.run("INSERT OR REPLACE INTO meta(key, value) VALUES (?, ?)", [
+                                "storagePolicyInitializationPendingV1",
+                                "1",
+                            ]);
+                        else
+                            stamp.run("DELETE FROM meta WHERE key = ?", ["storagePolicyInitializationPendingV1"]);
+                    }
+                    finally {
+                        stamp.close();
+                    }
+                }
                 candidates.set(candidate.id, candidate);
                 return candidate;
             }
@@ -13736,28 +14861,38 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                 throw new Error("candidate is not owned by this engine");
             if (!fs.existsSync(candidate.databasePath))
                 throw new Error("candidate database is missing");
-            const header = fs.readFileSync(candidate.databasePath).subarray(0, 16).toString("binary");
-            if (header !== "SQLite format 3\u0000")
-                throw new Error("candidate is not a SQLite database");
-            const probe = new Database(candidate.databasePath, { readonly: true });
+            const bound = bindCandidateDatabase(candidate.repo, candidate);
             try {
-                const integrity = probe.query("PRAGMA quick_check").all();
-                if (integrity.length !== 1 || Object.values(integrity[0] ?? {})[0] !== "ok")
-                    throw new Error("candidate SQLite integrity check failed");
-                const schemaVersion = probe.query("PRAGMA user_version").get()?.user_version ?? 0;
-                if (schemaVersion !== KNODIN_SCHEMA_VERSION)
-                    throw new Error(`candidate schema ${schemaVersion} is incompatible with ${KNODIN_SCHEMA_VERSION}`);
+                const header = bound.header.toString("binary");
+                if (header !== "SQLite format 3\u0000")
+                    throw new Error("candidate is not a SQLite database");
+                const probe = new Database(candidate.databasePath, { readonly: true });
+                try {
+                    bound.verify();
+                    const integrity = probe.query("PRAGMA quick_check").all();
+                    if (integrity.length !== 1 || Object.values(integrity[0] ?? {})[0] !== "ok")
+                        throw new Error("candidate SQLite integrity check failed");
+                    const schemaVersion = probe.query("PRAGMA user_version").get()?.user_version ??
+                        0;
+                    if (schemaVersion !== KNODIN_SCHEMA_VERSION)
+                        throw new Error(`candidate schema ${schemaVersion} is incompatible with ${KNODIN_SCHEMA_VERSION}`);
+                }
+                finally {
+                    probe.close();
+                }
+                bound.verify();
+                await getOrInitDb(candidate.repo, {
+                    databasePath: candidate.databasePath,
+                    watcher: "disabled",
+                    skipContentReconciliation: true,
+                    skipFreshnessGuard: true,
+                });
+                bound.verify();
+                return candidate;
             }
             finally {
-                probe.close();
+                bound.close();
             }
-            await getOrInitDb(candidate.repo, {
-                databasePath: candidate.databasePath,
-                watcher: "disabled",
-                skipContentReconciliation: true,
-                skipFreshnessGuard: true,
-            });
-            return candidate;
         },
         async reconcileCandidate(candidate, repoPath, changes, options) {
             const resolved = path.resolve(repoPath);
@@ -13767,6 +14902,11 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
             const db = dbInstances.get(databaseCacheKey(resolved, candidate.databasePath));
             if (!db)
                 throw new Error("candidate database did not open");
+            if (!fs.existsSync(resolveDbPath(resolved)))
+                db.run("INSERT OR REPLACE INTO meta(key, value) VALUES (?, ?)", [
+                    "storagePolicyInitializationPendingV1",
+                    "1",
+                ]);
             if (!changes) {
                 const oldCoverage = coverageForDatabase(db);
                 writeCoverageIntent(db, resolved, {
@@ -13782,8 +14922,14 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                 // build of a tree that has since moved on and promote a graph that
                 // never described any single state of the repository.
                 setMeta(db, CLEAN_INDEX_IN_PROGRESS_META_KEY, "1");
-                setMeta(db, CLEAN_INDEX_HEAD_META_KEY, gitHead(resolved) ?? "");
-                await indexRepo(resolved, db, options?.onProgress, options?.skipEmbeddings === true, false, options?.resume === true);
+                const currentHead = gitHead(resolved) ?? "";
+                if (options?.resume === true) {
+                    if (getMeta(db, CLEAN_INDEX_HEAD_META_KEY) !== currentHead)
+                        throw new Error("Repository HEAD changed before clean candidate resume; restart with knodin index --clean.");
+                }
+                else
+                    setMeta(db, CLEAN_INDEX_HEAD_META_KEY, currentHead);
+                await indexRepo(resolved, db, options?.onProgress, options?.skipEmbeddings === true, false, options?.resume === true, true);
                 // Cleared only after indexRepo returns. Anything that fails or is
                 // killed above leaves it set, which is exactly what makes the
                 // candidate recognisable as resumable rather than abandoned.
@@ -13820,18 +14966,71 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
             // A candidate populated from a foreign source (a downloaded shared-index
             // artifact, or another worktree's database) carries index_state mtimes
             // stamped wherever that source was built -- not this `resolved` checkout.
-            // Every file outside `reconciled` is, by construction, content-identical
-            // to what the caller already verified via its own diff, so refresh only
-            // the mtime/size bookkeeping against this checkout's actual disk instead
-            // of re-parsing/re-embedding: a plain stat, not a re-index.
+            // A diff alone is not a source proof. Transfer only an original parsed
+            // hash bound to the copied tuple and identical, stable target bytes.
+            // Missing or invalid evidence requires extraction, never a new hash
+            // invented over potentially stale symbols.
             const reconciledSet = new Set(reconciled);
             const knownPaths = db
-                .query("SELECT filePath FROM index_state")
+                .query("SELECT filePath,mtimeMs,size FROM index_state")
                 .all()
-                .map((row) => row.filePath)
-                .filter((file) => !reconciledSet.has(file));
-            for (const file of knownPaths)
-                recordIndexState(db, resolved, file);
+                .filter((row) => !reconciledSet.has(row.filePath));
+            const seedBytes = Buffer.alloc(64 * 1024);
+            for (const row of knownPaths) {
+                const file = row.filePath;
+                let transferred = false;
+                try {
+                    const raw = db
+                        .query("SELECT value FROM meta WHERE key=? AND length(value)<=512")
+                        .get(`${REPAIR_CHECKPOINT_PREFIX}${file}`)?.value;
+                    const proof = raw ? JSON.parse(raw) : null;
+                    if (proof?.version === 1 &&
+                        typeof proof.sourceHash === "string" &&
+                        /^[a-f0-9]{64}$/.test(proof.sourceHash) &&
+                        proof.mtimeMs === row.mtimeMs &&
+                        proof.size === row.size) {
+                        const before = fs.statSync(path.join(resolved, file));
+                        const hash = repairSourceFingerprint(resolved, file, seedBytes);
+                        const after = fs.statSync(path.join(resolved, file));
+                        if (hash === proof.sourceHash &&
+                            before.mtimeMs === after.mtimeMs &&
+                            before.size === after.size &&
+                            before.ctimeMs === after.ctimeMs &&
+                            before.ino === after.ino &&
+                            before.dev === after.dev) {
+                            recordIndexState(db, resolved, file);
+                            const recorded = db
+                                .query("SELECT filePath,mtimeMs,size FROM index_state WHERE filePath=?")
+                                .get(file);
+                            const final = fs.statSync(path.join(resolved, file));
+                            if (recorded?.mtimeMs === after.mtimeMs &&
+                                recorded.size === after.size &&
+                                final.mtimeMs === after.mtimeMs &&
+                                final.size === after.size &&
+                                final.ctimeMs === after.ctimeMs &&
+                                final.ino === after.ino &&
+                                final.dev === after.dev) {
+                                setMeta(db, `${REPAIR_CHECKPOINT_PREFIX}${file}`, JSON.stringify({
+                                    version: 1,
+                                    sourceHash: proof.sourceHash,
+                                    mtimeMs: after.mtimeMs,
+                                    size: after.size,
+                                }));
+                                transferred = true;
+                            }
+                        }
+                    }
+                }
+                catch {
+                    /* Missing or malformed foreign proof requires extraction. */
+                }
+                if (!transferred) {
+                    await indexFile(path.join(resolved, file), file, resolved, db);
+                    recordIndexState(db, resolved, file);
+                    reconciled.push(file);
+                    reconciledSet.add(file);
+                }
+            }
             const refreshed = await refreshFlowsForApexFiles(db, resolved, reconciled);
             for (const file of refreshed) {
                 if (!reconciledSet.has(file))
@@ -13896,6 +15095,11 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                         issues.push("orphaned-embeddings");
                 }
                 if (tables.has("index_state")) {
+                    const epoch = validSourceEpoch(getMeta(db, CONTENT_PROOF_EPOCH_KEY));
+                    if (hasGitCheckout(candidate.repo) &&
+                        (epoch === null ||
+                            (getMeta(db, "lastIndexedHead") ?? "") !== (gitHead(candidate.repo) ?? "")))
+                        issues.push("source-provenance");
                     if (missingApexConsumerDescriptorFiles(db).length)
                         issues.push("apex-consumer-descriptors");
                     if ((db
@@ -13915,6 +15119,19 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                         issues.push("ineligible-index-state");
                     if (indexed.some((row) => fileDriftedFromIndexState(db, candidate.repo, row.filePath)))
                         issues.push("source-snapshot-drift");
+                    if (epoch !== null) {
+                        const readCheckpoint = repairCheckpointReader(db, candidate.repo);
+                        if (indexed.some((row) => {
+                            try {
+                                return (fs.statSync(path.join(candidate.repo, row.filePath)).ctimeMs >= epoch - 1 &&
+                                    !readCheckpoint(row.filePath, row)?.matches);
+                            }
+                            catch {
+                                return true;
+                            }
+                        }))
+                            issues.push("source-content-drift");
+                    }
                 }
             }
             finally {
@@ -13931,36 +15148,75 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                 databaseSha256,
             };
         },
+        finalizePromotedStorage: completeStorageMaintenance,
         async promoteCandidate(candidate) {
             assertCandidate(candidate.repo, candidate);
-            const auditedDigest = candidateAudits.get(candidate.id);
-            if (!auditedDigest)
-                throw new Error("candidate must pass deep audit before promotion");
-            const confirmation = await engine.auditCandidate(candidate, {
-                mode: "deep",
-            });
-            if (!confirmation.healthy || confirmation.databaseSha256 !== auditedDigest)
-                throw new Error("candidate or repository changed after deep audit");
-            closeCandidateDatabase(candidate);
-            if (candidateDigest(candidate) !== auditedDigest)
-                throw new Error("candidate changed after deep audit");
-            const resolved = candidate.repo;
-            await suspendFileWatcher(resolved);
-            const active = dbInstances.get(resolved);
-            if (active) {
-                active.run("PRAGMA wal_checkpoint(TRUNCATE);");
-                active.close();
-            }
-            dbInstances.delete(resolved);
-            initPromises.delete(resolved);
-            for (const suffix of ["-wal", "-shm"])
-                fs.rmSync(`${resolveDbPath(resolved)}${suffix}`, { force: true });
-            const backupPath = promoteCandidateFile(resolved, candidate);
-            candidates.delete(candidate.id);
-            candidateAudits.delete(candidate.id);
-            invalidateResolutionCaches(resolved);
-            indexGeneration++;
-            return { backupPath };
+            const bound = bindCandidateDatabase(candidate.repo, candidate);
+            try {
+                const auditedDigest = candidateAudits.get(candidate.id);
+                if (!auditedDigest)
+                    throw new Error("candidate must pass deep audit before promotion");
+                const confirmation = await engine.auditCandidate(candidate, {
+                    mode: "deep",
+                });
+                if (!confirmation.healthy || confirmation.databaseSha256 !== auditedDigest)
+                    throw new Error("candidate or repository changed after deep audit");
+                closeCandidateDatabase(candidate);
+                if (candidateDigest(candidate) !== auditedDigest)
+                    throw new Error("candidate changed after deep audit");
+                const resolved = candidate.repo;
+                await suspendFileWatcher(resolved);
+                // Watcher shutdown yields. Re-check source and original HEAD after
+                // that last async boundary, immediately before the atomic swap.
+                const finalConfirmation = await engine.auditCandidate(candidate, { mode: "deep" });
+                if (!finalConfirmation.healthy || finalConfirmation.databaseSha256 !== auditedDigest)
+                    throw new Error("candidate or repository changed before promotion");
+                // The public async audit itself yields on return. A final synchronous
+                // source/Git fence follows it; no voluntary yield remains before swap.
+                bound.verify();
+                const finalSourceDb = new Database(candidate.databasePath, { readonly: true });
+                try {
+                    bound.verify();
+                    const epoch = validSourceEpoch(getMeta(finalSourceDb, CONTENT_PROOF_EPOCH_KEY));
+                    const gitBacked = hasGitCheckout(resolved);
+                    const intent = requireIndexCoverage(coverageForDatabase(finalSourceDb));
+                    const git = gitBacked ? gitWorkTreeProbe(resolved, intent, finalSourceDb) : null;
+                    if ((gitBacked &&
+                        (epoch === null ||
+                            !git ||
+                            (getMeta(finalSourceDb, "lastIndexedHead") ?? "") !== git.head ||
+                            getMeta(finalSourceDb, "lastProbePolicy") !== git.policyFingerprint ||
+                            getMeta(finalSourceDb, "lastProbeDirty") !==
+                                coverageDirtyFingerprint(intent, git.dirty.filter((file) => coverageContains(intent, file))))) ||
+                        !sourceSnapshotMatches(finalSourceDb, resolved, epoch ?? Number.POSITIVE_INFINITY))
+                        throw new Error("Repository source changed at final promotion fence");
+                }
+                finally {
+                    finalSourceDb.close();
+                }
+                closeCandidateDatabase(candidate);
+                if (candidateDigest(candidate) !== auditedDigest)
+                    throw new Error("candidate changed at final promotion fence");
+                bound.verify();
+                const active = dbInstances.get(resolved);
+                if (active) {
+                    active.run("PRAGMA wal_checkpoint(TRUNCATE);");
+                    active.close();
+                }
+                dbInstances.delete(resolved);
+                initPromises.delete(resolved);
+                for (const suffix of ["-wal", "-shm"])
+                    fs.rmSync(`${resolveDbPath(resolved)}${suffix}`, { force: true });
+                const backupPath = promoteCandidateFile(resolved, candidate);
+                candidates.delete(candidate.id);
+                candidateAudits.delete(candidate.id);
+                invalidateResolutionCaches(resolved);
+                indexGeneration++;
+                return { backupPath };
+            }
+            finally {
+                bound.close();
+            }
         },
         async discardCandidate(candidate) {
             assertCandidate(candidate.repo, candidate);
@@ -14133,9 +15389,14 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                 allCallees.length > cap ||
                 allBlastFiles.length > cap ||
                 omissions.length > cap;
+            const selectedDb = allRepos.find((entry) => entry.path === targetRepoPath)?.db;
+            const platformEntry = selectedDb
+                ? await explainPlatformEntry(selectedDb, targetRepoPath, primaryDef, formatPath(targetRepoPath, primaryDef.filePath))
+                : undefined;
             return {
                 ...(indexCoverage ? { indexCoverage } : {}),
                 identity: symbolIdentity(targetRepoPath, primaryDef),
+                ...(platformEntry ? { platformEntry } : {}),
                 symbol,
                 summary,
                 source,
@@ -14981,7 +16242,7 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                     const persisted = readPersistedStatusAudit(resolved, diskDbPath, databaseFingerprint, schemaVersion);
                     if (persisted) {
                         throwIfAborted(options.signal);
-                        const gitProbe = measurePerfPhaseSync("freshness_probe", () => gitWorkTreeProbe(resolved, requireIndexCoverage(coverageForDatabase(db))));
+                        const gitProbe = measurePerfPhaseSync("freshness_probe", () => gitWorkTreeProbe(resolved, requireIndexCoverage(coverageForDatabase(db)), db));
                         const drift = probeDrift(resolved, db, gitProbe);
                         const probeVerifiedAt = new Date().toISOString();
                         const freshness = buildFreshnessEnvelope(resolved, db, probeVerifiedAt, drift.verifiable ? (drift.drifted ? "stale-working-tree" : undefined) : "unknown", gitProbe);
@@ -15151,6 +16412,12 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
             const staleFiles = [];
             const ineligibleFiles = [];
             const damagedFiles = [];
+            const sourceEpoch = validSourceEpoch(getMeta(db, CONTENT_PROOF_EPOCH_KEY)) ?? Number.NaN;
+            // This extra fence addresses Git's stat-cache blind spots. Plain
+            // directories retain their existing committed-file resume checkpoints.
+            const sourceAudit = repairSourceAudit.getStore();
+            const auditSourceEpoch = hasGitCheckout(resolved);
+            const readCheckpoint = auditSourceEpoch ? repairCheckpointReader(db, resolved) : null;
             for (let index = 0; index < indexedRows.length; index++) {
                 if (options.signal && index % 256 === 0) {
                     throwIfAborted(options.signal);
@@ -15164,7 +16431,20 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                 }
                 try {
                     const stat = fs.statSync(path.join(resolved, row.filePath));
-                    if (stat.size !== row.size || stat.mtimeMs !== row.mtimeMs)
+                    const epochCandidate = auditSourceEpoch && (!Number.isFinite(sourceEpoch) || stat.ctimeMs >= sourceEpoch - 1);
+                    const proof = epochCandidate ? readCheckpoint?.(row.filePath, row) : null;
+                    if (proof)
+                        sourceAudit?.owned.add(row.filePath);
+                    if (proof?.matches)
+                        sourceAudit?.verified.set(row.filePath, proof.sourceHash);
+                    // Git may trust restored size/mtime or a coarse ctime cache. The
+                    // existing deep stat pass can still select source changed after
+                    // our completed snapshot, without hashing the entire repository.
+                    // ISO metadata has millisecond precision; include its boundary.
+                    if (stat.size !== row.size ||
+                        stat.mtimeMs !== row.mtimeMs ||
+                        (epochCandidate && Number.isFinite(sourceEpoch) && !proof?.matches) ||
+                        (epochCandidate && proof !== null && proof !== undefined && !proof.matches))
                         damagedFiles.push(row.filePath);
                 }
                 catch {
@@ -15182,6 +16462,8 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
 					   AND NOT (d.fromFile LIKE '.knodin/dbt/%' AND EXISTS (SELECT 1 FROM symbols s WHERE s.filePath=d.fromFile))`),
             };
             const records = staleFiles.map((file) => `indexed file no longer exists: ${file}`);
+            if (auditSourceEpoch && indexedRows.length > 0 && !Number.isFinite(sourceEpoch))
+                records.push(LEGACY_CONTENT_PROOF_RECORD);
             for (const file of missingApexConsumerDescriptorFiles(db))
                 records.push(`Apex class-consumer descriptor missing or invalid: ${file}`);
             if (indexedRows.some((row) => /\.(cls|trigger)$/i.test(row.filePath)) &&
@@ -15202,7 +16484,7 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
             if (coverageForDatabase(db).intentState === "pending")
                 records.push("index coverage operation is pending");
             const needsRepair = missingFiles.length > 0 || records.length > 0;
-            const freshness = buildFreshnessEnvelope(resolved, db, verifiedAt, needsRepair ? "repair-needed" : undefined);
+            const freshness = buildFreshnessEnvelope(resolved, db, verifiedAt, needsRepair ? "repair-needed" : undefined, undefined, !needsRepair);
             const stale = !needsRepair && freshness.state !== "fresh";
             const result = {
                 indexCoverage: indexCoverageSummary(coverageForDatabase(db)),
@@ -15245,7 +16527,9 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                 freshnessMechanism: freshnessMechanismFor(resolved, openPolicy),
                 repairSteps: needsRepair
                     ? [
-                        "Run `knodin repair` to rebuild only missing or damaged local state.",
+                        auditSourceEpoch && !Number.isFinite(sourceEpoch) && indexedRows.length > 0
+                            ? LEGACY_CONTENT_PROOF_REPAIR_STEP
+                            : "Run `knodin repair` to rebuild only missing or damaged local state.",
                         "Run `knodin status` again to verify health.",
                     ]
                     : [],
@@ -15366,10 +16650,11 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                         indexGeneration++;
                 };
                 emitProgress("audit", 0, "Auditing repository health");
-                before = await engine.status(resolved, {
+                const sourceAudit = newRepairSourceAuditState();
+                before = await repairSourceAudit.run(sourceAudit, () => engine.status(resolved, {
                     audit: "deep",
                     signal: activeOperation.controller.signal,
-                });
+                }));
                 emitProgress("audit", 1, "Repository health audit completed", {
                     phaseTotal: 1,
                 });
@@ -15454,11 +16739,85 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                     committedWork = true;
                 const inheritedPostprocessing = getMeta(db, "repairPostprocessingPending") === "1";
                 const eligibleRepairPaths = new Set(collectRepoFiles(resolved, db));
+                const repairIntent = requireIndexCoverage(coverageForDatabase(db));
+                const repairGit = gitWorkTreeProbe(resolved, repairIntent, db);
+                const gitBacked = hasGitCheckout(resolved);
+                let baselineProvable = !gitBacked || repairGit !== null;
+                const contentRepairPaths = new Set(repairGit?.dirty ?? []);
+                const indexedCount = db.query("SELECT COUNT(*) AS count FROM index_state").get()
+                    ?.count ?? 0;
+                const emptyIndex = indexedCount === 0;
+                const initializingResume = getMeta(db, REPAIR_INITIALIZATION_KEY) === "1" &&
+                    sourceAudit.owned.size === indexedCount;
+                if (gitBacked && emptyIndex)
+                    setMeta(db, REPAIR_INITIALIZATION_KEY, "1");
+                const contentProofEpoch = validSourceEpoch(getMeta(db, CONTENT_PROOF_EPOCH_KEY), startedAt);
+                const sourceEpochProvable = !gitBacked || emptyIndex || initializingResume || contentProofEpoch !== null;
+                baselineProvable &&= sourceEpochProvable;
+                // A Git dirty path is content evidence even if size and mtime were
+                // restored. Do not let the stat optimization suppress its repair.
+                // Missing dirty baselines can be recovered from this complete probe;
+                // a missing/unresolvable commit baseline cannot be guessed.
+                if (repairGit) {
+                    const indexedHead = getMeta(db, "lastIndexedHead") ?? "";
+                    if (indexedHead !== repairGit.head) {
+                        if (!indexedHead && (emptyIndex || initializingResume)) {
+                            // First initialization has no historical snapshot to trust.
+                            // Its complete eligible inventory is rebuilt below, so it may
+                            // establish the first commit baseline after that content work.
+                            for (const file of eligibleRepairPaths) {
+                                if (!sourceAudit.verified.has(file))
+                                    contentRepairPaths.add(file);
+                            }
+                        }
+                        else if (!indexedHead || !repairGit.head)
+                            baselineProvable = false;
+                        else {
+                            try {
+                                for (const pathspecs of coverageGitPathspecBatches(repairIntent)) {
+                                    const diff = child_process.execFileSync("git", [
+                                        "diff",
+                                        "--name-only",
+                                        "-z",
+                                        indexedHead,
+                                        repairGit.head,
+                                        ...(pathspecs.length ? pathspecs : ["--"]),
+                                    ], {
+                                        cwd: resolved,
+                                        encoding: "utf8",
+                                        stdio: ["ignore", "pipe", "ignore"],
+                                        maxBuffer: 64 * 1024 * 1024,
+                                    });
+                                    for (const file of splitNulPaths(diff))
+                                        contentRepairPaths.add(file);
+                                }
+                            }
+                            catch {
+                                baselineProvable = false;
+                            }
+                        }
+                    }
+                }
+                const readCheckpoint = repairCheckpointReader(db, resolved);
+                for (const file of contentRepairPaths) {
+                    if (!eligibleRepairPaths.has(file))
+                        continue;
+                    const proof = readCheckpoint(file);
+                    if (proof?.matches)
+                        sourceAudit.verified.set(file, proof.sourceHash);
+                    else if (!repairKinds.has(file))
+                        repairKinds.set(file, "damaged");
+                }
                 repairPaths = [...repairKinds.keys()]
                     .filter((file) => repairKinds.get(file) === "stale" ||
                     descriptorRepairPaths.has(file) ||
+                    repairKinds.get(file) === "damaged" ||
+                    contentRepairPaths.has(file) ||
                     fileDriftedFromIndexState(db, resolved, file))
                     .sort(compareBytes);
+                const repairBytes = Buffer.alloc(64 * 1024);
+                const repairedContent = new Map(sourceAudit.verified);
+                const repairedState = db.query("SELECT filePath,mtimeMs,size FROM index_state WHERE filePath=?");
                 const repairAffectsTypeScriptDi = inheritedPostprocessing || repairPathsAffectTypeScriptDi(db, resolved, repairPaths);
                 counts.skipped = Math.max(0, repairKinds.size - repairPaths.length);
                 overallTotal = repairPaths.length + 4;
@@ -15477,14 +16836,29 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                     // reports repair-needed on every subsequent run.
                     const shouldRemove = !eligibleRepairPaths.has(file) || !fs.existsSync(absolutePath);
                     if (!shouldRemove) {
+                        repairedContent.set(file, repairSourceFingerprint(resolved, file, repairBytes));
                         await indexFile(absolutePath, file, resolved, db);
+                        if (repairSourceFingerprint(resolved, file, repairBytes) !== repairedContent.get(file))
+                            throw new Error("Source changed while repairing a file; checkpoint not recorded");
                         recordIndexState(db, resolved, file);
+                        if (gitBacked) {
+                            const row = repairedState.get(file);
+                            if (!row)
+                                throw new Error("Repaired source has no index-state checkpoint");
+                            setMeta(db, `${REPAIR_CHECKPOINT_PREFIX}${file}`, JSON.stringify({
+                                version: 1,
+                                sourceHash: repairedContent.get(file),
+                                mtimeMs: row.mtimeMs,
+                                size: row.size,
+                            }));
+                        }
                         if (repairKinds.get(file) === "damaged")
                             counts.rebuilt++;
                         else
                             counts.indexed++;
                     }
                     else if (shouldPurgeMissingFile(db)) {
+                        repairedContent.delete(file);
                         db.run("BEGIN TRANSACTION;");
                         try {
                             deleteSymbolsForFile(db, file);
@@ -15632,40 +17006,67 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                     phaseTotal: 1,
                 });
                 cancelBoundary();
-                let after = await engine.status(resolved, {
+                let after = await repairSourceAudit.run(newRepairSourceAuditState(), () => engine.status(resolved, {
                     audit: "deep",
                     signal: activeOperation.controller.signal,
-                });
+                }));
                 cancelBoundary();
                 overallCompleted++;
                 emitProgress("verification", 1, "Repair verification completed", {
                     phaseTotal: 1,
                 });
                 cancelBoundary();
-                if (schemaPrepared || repairKinds.size > 0 || hasOrphans || needsPostprocessing) {
-                    // The first deep audit proves graph-content integrity. Only
-                    // after that proof may this snapshot claim the current
-                    // revision; a second deep audit proves the complete envelope.
-                    const contentVerified = after.coverage.sourceFiles === after.coverage.indexedFiles &&
+                {
+                    // Deep audit proves inventory/stat integrity, not source bytes.
+                    // Dirty and committed-diff sources above were forcibly indexed;
+                    // content and Git fences must still agree before publishing.
+                    const finalGit = gitWorkTreeProbe(resolved, repairIntent, db);
+                    const gitStable = !gitBacked ||
+                        (repairGit !== null &&
+                            finalGit !== null &&
+                            repairGit.head === finalGit.head &&
+                            repairGit.policyFingerprint === finalGit.policyFingerprint &&
+                            repairGit.statusFingerprint === finalGit.statusFingerprint);
+                    let sourceStable = true;
+                    for (const [file, fingerprint] of repairedContent) {
+                        cancelBoundary();
+                        if (repairSourceFingerprint(resolved, file, repairBytes) !== fingerprint)
+                            sourceStable = false;
+                    }
+                    const contentVerified = baselineProvable &&
+                        gitStable &&
+                        sourceStable &&
+                        after.coverage.sourceFiles === after.coverage.indexedFiles &&
                         after.missing.files.length === 0 &&
-                        after.missing.records.every((record) => record === "index coverage operation is pending") &&
+                        after.missing.records.every((record) => record === "index coverage operation is pending" ||
+                            (sourceEpochProvable && record === LEGACY_CONTENT_PROOF_RECORD)) &&
                         Object.values(after.orphaned).every((count) => count === 0);
                     if (contentVerified) {
                         db.run("BEGIN TRANSACTION;");
                         try {
                             markCoverageIntentComplete(db);
-                            if (after.freshness.state === "stale-head" || after.freshness.state === "unknown") {
-                                setMeta(db, "lastIndexedHead", gitHead(resolved) ?? "");
-                            }
+                            if (repairGit)
+                                setMeta(db, "lastIndexedHead", repairGit.head);
                             setMeta(db, "knodinVersion", KNODIN_VERSION);
                             setMeta(db, "lastSuccessfulReconciliation", new Date().toISOString());
+                            setMeta(db, CONTENT_PROOF_EPOCH_KEY, new Date(startedAt).toISOString());
                             recordFreshnessBaseline(resolved, db);
                             statusCache.delete(databaseCacheKey(resolved, openPolicy.databasePath));
-                            const candidate = await engine.status(resolved, {
+                            const candidate = await repairSourceAudit.run(newRepairSourceAuditState(), () => engine.status(resolved, {
                                 audit: "deep",
                                 signal: activeOperation.controller.signal,
-                            });
+                            }));
+                            for (const [file, fingerprint] of repairedContent) {
+                                cancelBoundary();
+                                if (repairSourceFingerprint(resolved, file, repairBytes) !== fingerprint)
+                                    throw new Error("Source changed during repair verification; baseline not published");
+                            }
                             if (candidate.status === "healthy") {
+                                if (!sourceSnapshotMatches(db, resolved, startedAt))
+                                    throw new Error("Source changed during final repair verification; baseline not published");
+                                // Keep bounded per-file proofs for source changed during this
+                                // epoch so ordinary deep audits can verify equal-stat edits.
+                                db.run("DELETE FROM meta WHERE key=?", [REPAIR_INITIALIZATION_KEY]);
                                 db.run("COMMIT;");
                                 after = candidate;
                             }
@@ -15684,6 +17085,20 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                             throw error;
                         }
                     }
+                    else if (!baselineProvable || !gitStable || !sourceStable) {
+                        after = {
+                            ...after,
+                            status: "stale",
+                            freshness: { ...after.freshness, state: "unknown" },
+                            repairSteps: [
+                                !sourceEpochProvable
+                                    ? "Run knodin index --clean once to establish a versioned content-proof epoch."
+                                    : repairGit && !baselineProvable
+                                        ? "Restore the indexed Git commit history, or explicitly run knodin index --clean to rebuild without the missing baseline."
+                                        : "Restore a verifiable Git/source snapshot and run knodin repair again.",
+                            ],
+                        };
+                    }
                 }
                 const outstandingIssues = {
                     files: after.missing.files.length,
@@ -15758,6 +17173,8 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
         },
         async index(repoPath, files, clean = false, options) {
             const resolved = path.resolve(repoPath);
+            const newStore = !openPolicy.databasePath && !fs.existsSync(resolveDbPath(resolved));
+            let storageCommitted = false;
             const scopedUnder = options?.under;
             const normalizeSelector = (file, allowRoot = false) => {
                 const relative = path
@@ -15813,6 +17230,15 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                         prior.close();
                 }
             }
+            if (newStore) {
+                const storagePolicy = assertManagedStorageAllocation(resolved);
+                assertStorageCapacity({
+                    stateDirectory: resolveStateDir(resolved),
+                    databasePath: resolveDbPath(resolved),
+                    operation: "candidate",
+                    reserveBytes: storagePolicy?.minFreeBytes,
+                });
+            }
             const indexCoordination = acquireLifecycleCoordination({
                 command: "index",
                 repository: resolved,
@@ -15824,6 +17250,8 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                     !openPolicy.databasePath &&
                     !process.env.VITEST &&
                     process.env.NODE_ENV !== "test") {
+                    if (mayWriteToRepository(resolved))
+                        await excludeStateDirectoryLocally(resolved);
                     const progress = createIndexProgressReporter(options?.onProgress);
                     // Look for a build a previous run left unfinished before starting a
                     // new one. A candidate survives only when the process was killed —
@@ -15857,6 +17285,7 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                             throw new Error(`clean-index candidate audit failed: ${audit.issues.join(", ")}`);
                         await engine.promoteCandidate(candidate);
                         promoted = true;
+                        storageCommitted = true;
                         const activeDb = await openDb(resolved, {
                             skipContentReconciliation: true,
                             skipFreshnessGuard: true,
@@ -15884,6 +17313,7 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                                 status: health.status,
                                 issueCount,
                                 missing: health.missing,
+                                repairSteps: health.repairSteps,
                                 verifiedAt: health.verification.verifiedAt,
                             },
                         };
@@ -15902,6 +17332,9 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                 const watcherStateBefore = watcherStates.get(resolved)?.watcher;
                 if (!openPolicy.databasePath)
                     await suspendFileWatcher(resolved);
+                let provisionalScopedEpoch;
+                let scopedEpochCompleted = false;
+                let scopedProofDb;
                 try {
                     invalidateResolutionCaches(repoPath);
                     const indexed = [];
@@ -15919,7 +17352,13 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                         skipContentReconciliation: true,
                         skipFreshnessGuard: true,
                     });
+                    if (newStore && !isMirror(resolved))
+                        db.run("INSERT OR REPLACE INTO meta(key, value) VALUES (?, ?)", [
+                            "storagePolicyInitializationPendingV1",
+                            "1",
+                        ]);
                     const existingCoverage = coverageForDatabase(db);
+                    scopedProofDb = db;
                     const freshCoverage = existingCoverage.origin === "legacy" &&
                         !getMeta(db, "lastSuccessfulReconciliation") &&
                         (db.query("SELECT COUNT(*) count FROM index_state").get()
@@ -15942,7 +17381,13 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                             throw new Error(`knodin index --under: no indexable files under ${scopedUnder}`);
                     }
                     let completionMessage = "Local graph is current";
+                    let firstTargetedContentStart;
                     if (files && files.length > 0) {
+                        // A first exact/prefix index reads the whole retained scope without
+                        // going through indexRepo. Existing graphs, including widenings,
+                        // must retain their old epoch: untouched rows were not reverified.
+                        if (!db.query("SELECT 1 FROM index_state LIMIT 1").get())
+                            firstTargetedContentStart = new Date().toISOString();
                         progress("indexing-files", 0, `Checking ${files.length.toLocaleString()} requested files`, {
                             phaseTotal: files.length,
                         });
@@ -15954,8 +17399,30 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                                 unchanged.push(relativePath);
                             }
                             else if (fs.existsSync(absPath)) {
+                                const initialStat = firstTargetedContentStart ? fs.statSync(absPath) : null;
+                                const initialHash = initialStat &&
+                                    initialStat.ctimeMs >= Date.parse(firstTargetedContentStart ?? "") - 1
+                                    ? repairSourceFingerprint(repoPath, relativePath, Buffer.alloc(64 * 1024))
+                                    : null;
                                 await explicitPackageInputs.run(packageInputs, () => indexFile(absPath, relativePath, repoPath, db));
                                 recordIndexState(db, repoPath, relativePath);
+                                if (initialStat) {
+                                    const current = fs.statSync(absPath);
+                                    if (current.ctimeMs !== initialStat.ctimeMs ||
+                                        current.size !== initialStat.size ||
+                                        current.mtimeMs !== initialStat.mtimeMs ||
+                                        (initialHash !== null &&
+                                            repairSourceFingerprint(repoPath, relativePath, Buffer.alloc(64 * 1024)) !==
+                                                initialHash))
+                                        throw new Error("Source changed during first scoped index; retry indexing.");
+                                    if (initialHash !== null)
+                                        setMeta(db, `${REPAIR_CHECKPOINT_PREFIX}${relativePath}`, JSON.stringify({
+                                            version: 1,
+                                            sourceHash: initialHash,
+                                            mtimeMs: current.mtimeMs,
+                                            size: current.size,
+                                        }));
+                                }
                             }
                             else if (shouldPurgeMissingFile(db)) {
                                 // File was deleted
@@ -16014,7 +17481,7 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                             await reconcileIndex(repoPath, db, progress, options?.skipEmbeddings === true);
                         }
                         else {
-                            await indexRepo(repoPath, db, progress, options?.skipEmbeddings === true);
+                            await indexRepo(repoPath, db, progress, options?.skipEmbeddings === true, true, false, clean);
                         }
                         // Reuse the same candidate set as indexing/reconciliation. This keeps
                         // LWC HTML/CSS bundle members visible in the response without admitting
@@ -16080,6 +17547,16 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                     progress("verifying", 0, "Verifying local graph health", {
                         phaseTotal: 1,
                     });
+                    if (firstTargetedContentStart) {
+                        const epoch = validSourceEpoch(firstTargetedContentStart);
+                        if (epoch === null || !sourceSnapshotMatches(db, repoPath, epoch))
+                            throw new Error("Source changed during first scoped index; retry indexing.");
+                        // This is a genuinely empty graph's first complete retained
+                        // scope. Establish its proof before the ordinary deep audit;
+                        // legacy nonempty graphs never enter this path.
+                        setMeta(db, CONTENT_PROOF_EPOCH_KEY, firstTargetedContentStart);
+                        provisionalScopedEpoch = firstTargetedContentStart;
+                    }
                     let health = await engine.status(repoPath, {
                         audit: "deep",
                         ignoreActiveOperation: true,
@@ -16144,6 +17621,9 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                     // the tally on every commit would make the signal meaningless noise.
                     if (scopedUnder !== undefined)
                         setMeta(db, COVERAGE_TALLY_IN_PROGRESS_META_KEY, "1");
+                    scopedEpochCompleted =
+                        health.status === "healthy" && coverageForDatabase(db).intentState === "complete";
+                    storageCommitted = !openPolicy.databasePath && health.status === "healthy";
                     return {
                         indexed,
                         unchanged,
@@ -16159,11 +17639,19 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                             status: health.status,
                             issueCount,
                             missing: health.missing,
+                            repairSteps: health.repairSteps,
                             verifiedAt: health.verification.verifiedAt,
                         },
                     };
                 }
                 finally {
+                    if (provisionalScopedEpoch && !scopedEpochCompleted) {
+                        const proofDb = scopedProofDb;
+                        if (proofDb && getMeta(proofDb, CONTENT_PROOF_EPOCH_KEY) === provisionalScopedEpoch)
+                            proofDb.run("DELETE FROM meta WHERE key=?", [CONTENT_PROOF_EPOCH_KEY]);
+                        freshnessProbes.delete(resolved);
+                        statusCache.delete(databaseCacheKey(resolved, openPolicy.databasePath));
+                    }
                     const activeDb = dbInstances.get(resolved);
                     if (!openPolicy.databasePath &&
                         activeDb &&
@@ -16175,6 +17663,8 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
             }
             finally {
                 indexCoordination.release();
+                if (storageCommitted)
+                    completeStorageMaintenance(resolved);
             }
         },
         async searchText(term, repoPath, options = {}) {
@@ -18152,6 +19642,7 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                     })));
                 }
                 case "dead_code": {
+                    const rootChains = apexDeadChains(db, isTestFilePath);
                     // Importer/export/test-aware: a function/class is only flagged dead when
                     // (1) its name appears in NO reference anywhere — references from test
                     // files already appear here, so "referenced" subsumes "used by a test",
@@ -18244,9 +19735,10 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                         .query("PRAGMA table_info(symbols)")
                         .all()
                         .some((column) => column.name === "apexDeclaration");
-                    const stmt = db.query(`SELECT id, identity, name, kind, filePath, startLine, ${hasApexDeclarations ? "apexDeclaration" : "NULL AS apexDeclaration"} FROM symbols WHERE kind IN ('function', 'class', 'method')`);
+                    const stmt = db.query(`SELECT id, identity, name, kind, filePath, startLine, startCol, endLine, endCol, ${hasApexDeclarations ? "apexDeclaration" : "NULL AS apexDeclaration"} FROM symbols WHERE kind IN ('function', 'class', 'method')`);
                     let rows = stmt.all();
                     stmt.finalize();
+                    const hasApexChainScope = rows.some((row) => /\.cls$/i.test(row.filePath));
                     if (target)
                         rows = rows.filter((row) => row.filePath.includes(target));
                     const declarations = [];
@@ -18262,7 +19754,10 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                     }
                     const protectedApexEntries = apexOrgEntryPoints(declarations);
                     const capability = apexReceiverCapability(db);
+                    const platformEntries = await queryPlatformEntries(db, repoPath, rows.filter((row) => protectedApexEntries.has(String(row.id))), cap, unsupportedApexFiles.size > 0 || capability.partial);
                     rows = rows.filter((r) => {
+                        if (/\.cls$/i.test(r.filePath) && r.identity && rootChains.protected.has(r.identity))
+                            return false;
                         if (protectedApexEntries.has(String(r.id)) || unsupportedApexFiles.has(r.filePath))
                             return false;
                         if (r.kind === "variable")
@@ -18271,7 +19766,7 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                             return false;
                         if (ENTRY.has(r.name) || DUNDER_RE.test(r.name))
                             return false;
-                        if (referenced.has(r.name))
+                        if (referenced.has(r.name) && !(r.identity && rootChains.candidates.has(r.identity)))
                             return false;
                         if (isTestFilePath(r.filePath))
                             return false;
@@ -18297,14 +19792,26 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                     });
                     if (target)
                         rows = rows.filter((r) => r.filePath.includes(target));
+                    const returnedChains = new Set(rows.flatMap((row) => row.identity && rootChains.candidates.has(row.identity)
+                        ? [rootChains.candidates.get(row.identity)]
+                        : []));
+                    rootChains.analysis.chains = rootChains.analysis.chains.filter((chain) => returnedChains.has(chain.identity));
                     return finish(rows.map((r) => ({
+                        ...(r.identity && rootChains.candidates.has(r.identity)
+                            ? {
+                                candidateReason: "unrooted-chain",
+                                chainIdentity: rootChains.candidates.get(r.identity),
+                            }
+                            : {}),
                         symbol: r.name,
                         kind: r.kind,
                         file: r.filePath,
                         line: r.startLine,
                         heuristic: true,
                         identity: r.identity ?? undefined,
-                        sourceEvidence: "No statically resolved references; runtime dispatch, reflection, aliases, and indirect exports remain unresolved.",
+                        sourceEvidence: r.identity && rootChains.candidates.has(r.identity)
+                            ? "No modeled root reaches this indexed chain; excluded callers or org configuration may reach it. This is not permission to delete source."
+                            : "No statically resolved references; runtime dispatch, reflection, aliases, and indirect exports remain unresolved.",
                         drillDown: {
                             operation: "query",
                             pattern: "callers_of",
@@ -18314,13 +19821,16 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                         },
                     })), {
                         deadCodeAnalysis: {
+                            platformEntries,
+                            ...(hasApexChainScope ? { rootReachability: rootChains.analysis } : {}),
                             protectedApexEntries: protectedApexEntries.size,
                             unsupportedApexFiles: unsupportedApexFiles.size,
                             repositoryMissingApexCapabilityFiles: capability.missingFiles,
+                            partialScope: "apex-platform-declarations",
                             partial: unsupportedApexFiles.size > 0 || capability.partial,
                             limitations: [
                                 "Org-facing Apex declarations are excluded; this does not prove runtime use or root reachability. Global visibility alone is not an exemption.",
-                                "Remaining results are static candidates, not safe-to-delete findings; dead chains and dynamic dispatch are not established.",
+                                "Remaining results are static candidates, not safe-to-delete findings; chain results describe only modeled indexed-source roots, not runtime nonuse.",
                                 ...(unsupportedApexFiles.size > 0 || capability.partial
                                     ? [capability.repair]
                                     : []),