scip-query 0.20.0 → 0.21.0

package/docs/CONFIGURATION_WRITE_SAFETY.md

@@ -1,9 +1,8 @@
 # Configuration and setup write safety
 
 scip-query updates files that people and other agents may edit at the same
-time: `.scipquery.json`, provider hook JSON, `.git/info/exclude`,
-`AGENTS.md`, `CLAUDE.md`, structured suppression records, and an owned
-pre-commit hook. A conflict-aware writer is a file updater that transforms one
+time: `.scipquery.json`, `.git/info/exclude`, `AGENTS.md`, `CLAUDE.md`, and
+structured suppression records. A conflict-aware writer is a file updater that transforms one
 identified revision and refuses to claim success if an independent revision
 wins before commit. Its defining behavior is preservation: it either applies
 its narrow change to the newest valid input or leaves the newest input
@@ -43,11 +42,6 @@ the caller's observed value, the latest value, and the requested value:
 - a different latest value for the same field is an explicit stale-field
   conflict.
 
-Hook setup rereads the latest valid provider object on every bounded retry,
-removes only scip-query-owned hook entries, and merges the current owned hook
-groups. Unknown top-level fields and non-scip hook entries survive installation
-and removal.
-
 Malformed latest JSON is never repaired by replacement because doing so could
 erase information the writer cannot classify. The command reports the parse
 failure and leaves the exact bytes in place.
@@ -68,6 +62,14 @@ hint, the writer still publishes a current record and reports `changed: true`.
 Unknown root and nested fields survive because migration begins from the
 latest complete object and removes only the owned legacy discriminator.
 
+A collaboration domain is the merge-intended family of repository copies that
+share durable project decisions. Its real-world referents are branches,
+clones, linked worktrees, and contributor forks whose records are expected to
+rejoin; the committed `collaborationDomainId` distinguishes that family
+without confusing a filesystem path, host, or mutable remote URL for its
+identity. `init` and `setup` create one opaque UUID when it is missing. A
+concurrent winner is adopted, and later runs never rotate an established ID.
+
 A non-integer discriminator, non-object top level, invalid `$schema` hint, or
 unsupported older/future version fails before options are exposed to runtime
 consumers. The loader names the supported legacy/current versions. A setup
@@ -95,9 +97,8 @@ New records use suppression schema version 1 and include the
 `scip-query` writer version. Unversioned legacy records and v1 records written
 before the discriminator was added remain readable. They remain byte-for-byte
 unchanged on an idempotent replay and are upgraded only by an explicit
-compare-and-replace policy change. Incompatible files are counted and reported
-by `diff-gate`; they never authorize a suppression. See
-[`COMMITTED_RECORD_COMPATIBILITY.md`](COMMITTED_RECORD_COMPATIBILITY.md).
+compare-and-replace policy change. Incompatible files are reported by
+`config-validate`; they never authorize a suppression.
 
 ## Managed text rules
 
@@ -107,8 +108,8 @@ Missing markers permit first installation, but incomplete, duplicated, or
 reordered markers are a conflict because the intended ownership boundary is
 ambiguous.
 
-Managed Markdown and owned pre-commit operations use a strict final revision
-check rather than silently recomputing across an intervening edit. The command
+Managed Markdown uses a strict final revision check rather than silently
+recomputing across an intervening edit. The command
 reports the expected and latest revision hashes and does not write.
 `.git/info/exclude` can safely retry because its exact owned marker block is
 recomputed from the newest text.

package/docs/DETECTOR_EVIDENCE_CONTRACTS.md

@@ -0,0 +1,84 @@
+# Detector evidence contracts
+
+Generated from `DETECTOR_EVIDENCE_CONTRACTS`.
+
+## dead
+
+The symbol has no visible repository reference after entry, framework, and rooted-symbol exclusions.
+
+- Calibration: `mixed`; provider coverage: `partial`.
+- Relations: `identity/references` (exact), `execution/call` (exact).
+- Structural evidence: entry-surface exclusions; framework/source fallback references; rooted-symbol exclusions.
+- Does not establish: Absence of visible references does not prove absence of reflection, generated dispatch, or external use.
+- Recover with: `scip-query evidence --symbol <symbol> --edge execution --edge runtime --edge identity --direction both --depth 2 --max-edges 100`
+
+## isolated
+
+The callable has no visible non-self caller or callee after entry, framework, and rooted-symbol exclusions.
+
+- Calibration: `mixed`; provider coverage: `partial`.
+- Relations: `execution/call` (exact), `identity/references` (exact).
+- Structural evidence: entry-surface exclusions; framework contract exclusions; source fallback callers.
+- Does not establish: Visible graph isolation does not establish runtime unreachability through reflection or generated dispatch.
+- Recover with: `scip-query evidence --symbol <symbol> --edge execution --edge runtime --edge identity --direction both --depth 2 --max-edges 100`
+
+## wrapper-candidates
+
+A small callable has one visible consumer and wrapper-shaped delegation, after boundary evidence is disclosed.
+
+- Calibration: `candidate`; provider coverage: `partial`.
+- Relations: `execution/call` (exact), `ownership/contains` (exact).
+- Structural evidence: callable body shape; public and runtime-boundary signals; consumer fan-in.
+- Does not establish: Wrapper shape does not prove that an API, ownership, observability, or compatibility boundary is unnecessary.
+- Recover with: `scip-query inspect --symbol <symbol> --view behavior`
+
+## passthrough-candidates
+
+A small callable visibly forwards to one callee, with public-facade and boundary signals disclosed.
+
+- Calibration: `mixed`; provider coverage: `partial`.
+- Relations: `execution/call` (exact), `contract/uses-contract-symbol` (exact).
+- Structural evidence: statement-complete forwarding shape; public facade evidence; runtime-boundary signals.
+- Does not establish: Literal forwarding does not prove the callable has no contract, naming, policy, or compatibility role.
+- Recover with: `scip-query inspect --symbol <symbol> --view behavior`
+
+## stale-abstractions
+
+A type-like abstraction has zero or one visible real consumer after re-export and ownership distinctions.
+
+- Calibration: `mixed`; provider coverage: `partial`.
+- Relations: `identity/references` (exact), `ownership/contains` (exact).
+- Structural evidence: definition kind; barrel-only consumer distinction; defining-file usage.
+- Does not establish: Low visible consumer count does not prove a public contract or runtime-registered type is obsolete.
+- Recover with: `scip-query evidence --symbol <symbol> --edge identity --edge ownership --edge contract --direction both --depth 2 --max-edges 100`
+
+## complexity-hotspots
+
+A callable concentrates local branch/control pressure and graph fan-in or fan-out.
+
+- Calibration: `mixed`; provider coverage: `partial`.
+- Relations: `execution/predicate-consequence` (exact), `execution/call` (exact).
+- Structural evidence: AST branch count or disclosed regex fallback; call fan-in; callee count.
+- Does not establish: Structural complexity does not establish runtime frequency, latency, defect density, or a required refactor.
+- Recover with: `scip-query inspect --symbol <symbol> --view behavior`
+
+## decorative-checkers
+
+A checker-shaped callable lacks a visible failure terminal directly or through one resolved delegate.
+
+- Calibration: `mixed`; provider coverage: `partial`.
+- Relations: `execution/returns` (exact), `execution/throws` (exact).
+- Structural evidence: checker naming shape; direct terminal behavior; one-hop delegate body.
+- Does not establish: No visible terminal does not prove the checker cannot fail through an opaque call, exception, or process exit.
+- Recover with: `scip-query inspect --symbol <symbol> --view behavior`
+
+## duplicate and similarity detectors
+
+Two source units share the detector-specific structural or token pattern.
+
+- Calibration: `candidate`; provider coverage: `partial`.
+- Relations: none; structural detector.
+- Structural evidence: normalized source/token/JSX/template similarity.
+- Does not establish: Structural similarity does not establish shared domain identity or justify consolidation.
+- Recover with: `scip-query inspect --symbol <symbol-a> --symbol <symbol-b> --view behavior`
+

package/docs/DETECTOR_GUIDE.md

@@ -1,138 +1,46 @@
-# Which Detector Do I Want?
-
-scip-query has several detectors that sound alike but answer different
-questions. This guide explains what each one actually measures, the
-differences inside each confusable cluster, and which check to run after which
-kind of change. (The companion doc [AI_FAILURE_MODES.md](AI_FAILURE_MODES.md)
-maps these to the agent behaviors that create the problems.)
-
----
-
-## Cluster 1 — "This structure shouldn't exist" (the speculation family)
-
-Same disease — structure built for a future that never came — detected at
-four different altitudes:
-
-| Command                  | Altitude                    | What it measures                                                                                                                                                                 | The fix                                                                                           |
-| ------------------------ | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
-| `unused-params`          | **parameter**               | Trailing parameters no body ever uses. TS/JS only, trailing-run only — removals that are type-safe by construction. `_`-prefixed and externally-published signatures are exempt. | Delete the parameters and their call-site arguments.                                              |
-| `passthrough-candidates` | **function (fan-out view)** | Functions with exactly **one callee** and a small body — they just forward arguments to the real implementation.                                                                 | Inline it: call the target directly.                                                              |
-| `wrapper-candidates`     | **function (fan-in view)**  | Symbols with exactly **one caller** — indirection that provides no reuse. Strongest when the sole caller is itself widely used.                                                  | Fold the body into the caller.                                                                    |
-| `stale-abstractions`     | **type**                    | Classes, interfaces, and type aliases with 0–1 _real_ cross-file consumers (barrel re-exports don't count as consumers). Single-implementation interfaces, misplaced types.      | De-abstract: replace the interface with the concrete thing, or move the type to its one consumer. |
-
-How to keep them straight:
-
-- `passthrough` looks **down** (what does this function call? one thing) —
-  `wrapper` looks **up** (who calls this function? one caller). A function can
-  be both: a one-line forwarder with a single caller is the purest bloat.
-- `unused-params` is _inside_ a signature; the other three are _about whole
-  symbols_.
-- `stale-abstractions` is the only one about **types**, not behavior. Note its
-  confidence ranking: a single-consumer `class` is usually deliberate
-  encapsulation (low), a single-consumer `interface` is worth questioning
-  (medium), a zero-consumer type is just dead (high).
-
-## Cluster 2 — "This already exists" (the similarity family)
-
-All of these find duplication, but at different granularities and with
-different evidence — and two of them add _direction_:
-
-| Command                | Granularity                          | Evidence                                                   | Question it answers                                                                                         |
-| ---------------------- | ------------------------------------ | ---------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
-| `similar <symbol>`     | function                             | callee-fingerprint cosine (TF-IDF), source-token fallback  | "What else does roughly what this function does?"                                                           |
-| `similar-signatures`   | function                             | normalized parameter + return types                        | "What has the same _shape_, regardless of body?"                                                            |
-| `similar-files`        | file                                 | Jaccard on import/dependency profiles                      | "Which files are copy-paste variants of each other?"                                                        |
-| `similar-chains`       | pipeline                             | edit distance on infrastructure-filtered dependency chains | "Which end-to-end flows are parallel re-implementations?"                                                   |
-| `recent-duplicates`    | callable/frontend unit + **git age** | callable, React, and Vue similarity + file-add history     | "Which side is the established original, which is the fresh echo?" (ECHO = new copies old; TWIN = both new) |
-| `incomplete-migration` | function + **git diff**              | callee _containment_ vs new-in-diff helpers                | "I just extracted a helper — which call sites still have the logic inline and were never migrated?"         |
-| `convergence <a> <b>`  | a known pair                         | shared/unique callees                                      | "I already know these two overlap — give me the merge prescription."                                        |
-
-How to keep them straight:
-
-- Use `similar` when you have **one symbol** in hand; `similar-files` /
-  `similar-chains` for repo-wide sweeps at coarser grain;
-  `similar-signatures` when implementations differ but the shape repeats.
-- `recent-duplicates` is duplicate evidence **plus direction in time** - it tells you
-  which copy to delete. Run it after agent sessions. It covers generic callables,
-  React component structure, React hook behavior, Vue template structure, and
-  Vue composable-like behavior.
-- `incomplete-migration` is the **inverse of an echo**: the _new_ code is the
-  canonical one (the helper you just extracted), and the _established_ code is
-  what should disappear. It also scores by containment, not symmetric
-  similarity, because an un-migrated site holds the helper's logic _plus_ its
-  own — cosine under-scores exactly those.
-- `extract-candidates` is the **before** picture: seams inside one big
-  function that _should_ become a helper. `incomplete-migration` is the
-  **after** picture: you made the helper but didn't finish moving everyone
-  onto it.
-
-## Cluster 3 — "Things drifting apart" (the drift family)
-
-Three detectors share the word "drift" or the concept; they watch different
-gaps:
-
-| Command     | Watches the gap between                           | Evidence                                                                                                      |
-| ----------- | ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
-| `drift`     | a file and its **siblings/declared architecture** | reference graph: unused imports, project-owned forbidden boundary edges, "no sibling imports this" deviations |
-| `doc-drift` | **docs** and the code they describe               | doc file-citations + doc↔code co-change history; flags broken references and staleness scores                 |
-| `co-change` | two **files** with an invisible contract          | git history: pairs that change together with no dependency edge                                               |
-
-How to keep them straight: `drift` is structural and intra-code, `doc-drift`
-is prose-vs-code, `co-change` is code-vs-code where the connection exists only
-in commit history. The diff gate includes doc/code and hidden-coupling coverage
-through the `doc-reference` and `co-change-partner` checks; run `drift
---architecture` when you need direct dependency-rule findings beside boundary
-coverage, reciprocity, and connected-group signals.
-
-<!-- BEGIN GENERATED DIFF-GATE CHECKS -->
-| Check | What it catches | When it runs |
-| --- | --- | --- |
-| `echo` | Changed symbols that newly echo established code elsewhere. | Default diff gate. |
-| `incomplete-migration` | New helpers or abstractions wired into some sites while older inline sites remain. | Default diff gate. |
-| `co-change-partner` | Historically coupled files that usually change together but are missing from this diff. | Default diff gate. |
-| `twin-partner` | A changed symbol has a same-(near-)name twin (identical or already-divergent) elsewhere that this diff left untouched. | Default diff gate. Advisory: findings print but never cause a nonzero exit by themselves. |
-| `coverage-contract` | A configured `coverageContracts` entry (.scipquery.json) drifted: its declared key set no longer matches its ground-truth source. | Default diff gate, only when either side of a configured contract changed. |
-| `architecture` | A declared architecture boundary rule has a violation absent from the committed health baseline. | Default diff gate when closed dependency rows, requireCompletePolicy, requireAcyclic, requireResolvedBoundaries, requireMinimalPolicy, maxBoundaryFanOut/maxBoundaryFiles, or testPaths are configured and a baseline exists. |
-| `doc-reference` | Docs that cite changed files and may need a matching update. Dated snapshot docs (docs.snapshotPaths) are excluded by policy. | Default diff gate. Advisory (21.2) for bare file-mention citations; blocking when the citation has a line anchor or the cited file was deleted/renamed. |
-| `unused-params` | Fresh trailing parameters or options that no changed body uses. | Default diff gate. |
-| `new-dead` | Changed production symbols with zero indexed consumers. | Default diff gate. |
-| `baseline` | New health finding identities compared with the committed health baseline. | Only with `diff-gate --baseline`. |
-<!-- END GENERATED DIFF-GATE CHECKS -->
-
-Baseline identities use `detector:file:shortName`. File or symbol renames can legitimately show as one fixed baseline identity plus one new identity; update the baseline after reviewing intentional renames.
-
-## Cluster 4 — "Nothing uses this" (the deadness family)
-
-| Command        | Scope       | Question                                                                                                              |
-| -------------- | ----------- | --------------------------------------------------------------------------------------------------------------------- |
-| `dead`         | symbols     | "What has zero consumers?" (evidence-ranked, entrypoint-aware)                                                        |
-| `isolated`     | callables   | "What is fully disconnected — no callers _and_ no callees?"                                                           |
-| `cleanup-plan` | the cascade | "If I delete the dead stuff, what _becomes_ dead next — and will my compiler vouch for the whole batch?" (`--verify`) |
-
-`dead` finds candidates; `isolated` finds the most extreme subset;
-`cleanup-plan --verify` turns candidates into a compiler-proven deletion plan.
-Don't hand-delete from `dead` output when `cleanup-plan` can prove it.
-
----
-
-## After-the-change check matrix
-
-The reflex to build (and the one the `scip-query` router skill teaches
-agents): match the check to what the change _did_. `diff-gate` runs the
-broad sweep on every diff; these are the targeted follow-ups.
-
-| You just...                                           | Run                                                                                                     |
-| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
-| Extracted a helper / created an abstraction           | `scip-query incomplete-migration` — did every site migrate?                                             |
-| Wrote a brand-new helper or module                    | `scip-query similar <it>` and `scip-query recent-duplicates` — did it already exist?                    |
-| Added parameters, options, or config flags            | `scip-query unused-params` — does anything use them yet?                                                |
-| Added a forwarding/wrapper layer                      | `scip-query wrapper-candidates` and `scip-query passthrough-candidates` — does it earn its indirection? |
-| Added an interface, base class, or type alias         | `scip-query stale-abstractions` — does it have more than one real consumer?                             |
-| Changed a schema, contract, config, or generated file | `scip-query co-change <file>` — who historically moves with it?                                         |
-| Changed code that docs describe                       | `scip-query doc-drift` — which docs now lie?                                                            |
-| Deleted code                                          | `scip-query cleanup-plan --verify` — what else just became dead, and does the compiler agree?           |
-| Anything at all, before saying "done"                 | `scip-query reindex && scip-query diff-gate`                                                            |
-
-And before any non-trivial change: plan with `scip-query plan-context
-<target>` (or the `scip-plan` skill, which requires a scip-query citation
-for every claim in the plan).
+# Detector guide
+
+A detector is a repository analysis that selects source locations with a
+shared evidence pattern. Compiler-graph detectors report resolved program
+relationships. Heuristic detectors report candidates that require source
+confirmation.
+
+## Repository overview
+
+```bash
+scip-query health --full
+```
+
+The health report combines graph structure, duplication, drift, complexity,
+history, suppressions, coverage contracts, and React and Vue analyses. Its
+score is a summary, not proof of correctness.
+
+## Focused detector families
+
+| Concern | Commands |
+| --- | --- |
+| Exact or near duplication | `duplicate-bodies`, `similar`, `recent-duplicates` |
+| Parallel implementations | `twin-drift`, `incomplete-migration`, `drift` |
+| Unused or disconnected code | `dead`, `isolated`, `unused-params` |
+| Excess indirection | `wrapper-candidates`, `passthrough-candidates`, `stale-abstractions`, `redundant-reexports` |
+| Change pressure | `complexity-hotspots`, `co-change`, `cycles` |
+| Documentation | `doc-drift` |
+| React | `react-component-duplicates`, `react-hook-candidates`, `react-large-component-pressure` |
+| Vue | `vue-component-duplicates`, `vue-composable-candidates`, `vue-large-view-pressure` |
+| Team structure policy | `architecture` |
+
+Run focused commands through the `scip-query` CLI. Add `--full` only when that
+command supports it and exhaustive command coverage can change the decision.
+
+## Acting on findings
+
+1. Read the cited source.
+2. Identify the shared concept or violated rule.
+3. Preserve intentional variation.
+4. Make one coherent edit.
+5. Run native checks and the relevant detector again.
+6. Use `scip-query diff-impact` when downstream consumers may have changed.
+
+Suppress a false or accepted finding with `scip-query suppress <id>` and a
+specific reason. A suppression addresses one finding; it must not disable an
+unrelated detector family.

package/docs/DURABILITY.md

@@ -112,7 +112,6 @@ could not confirm the stronger durability guarantee.
 | Watch refresh request, claim, and completion records | Durable immutable admission and acknowledgement                    | Accepted intent survives activity replacement and owner crashes; exclusive claims may be recovered only by the next lock owner                                                                 |
 | Cache ownership credential                           | Directory-durable where supported                                  | A complete file is flushed privately, hardening is revalidated, the public credential is linked exclusively, and its directory is flushed before detailed publication success                  |
 | npm release state                                    | Directory-durable where supported; file-flushed on bounded hosts   | The registry is freshly reconciled and remains external authority; the local coordinate-pair recovery record reports its exact achieved guarantee                                              |
-| Outcome event                                        | File publication locally; repository-durable only after Git commit | The event becomes shared history through the committed repository record, not merely because a checkout-local file exists                                                                      |
 | TypeScript fragment/overlay manifests                | Visibility-atomic                                                  | Content-addressed cache artifacts are validated and rebuildable                                                                                                                                |
 | Repository GC state                                  | Visibility-atomic                                                  | Sweep history can be reconstructed conservatively                                                                                                                                              |
 | Affected-set shadow latest record                    | Visibility-atomic                                                  | Calibration telemetry does not control publication                                                                                                                                             |
@@ -126,6 +125,13 @@ stable compatibility mirrors, and their crash ordering are defined in
 idempotency, claim recovery, and acknowledgement ordering are defined in
 [Watch Refresh Requests](WATCH_REFRESH_REQUESTS.md).
 
+The outcome-event journal was retired in version `0.20.0` together with
+autonomous completion state. Current scip-query neither writes nor reads those
+records and therefore makes no current durability claim for them. Git history
+retains the removed repository records; deprecated record-shape types remain
+temporarily available only for consumer-owned historical data. See
+[Workflow API retirement compatibility](api/compatibility/2026-08-09-workflow-retirement.md).
+
 ## Executable crash model
 
 `tests/helpers/persistence-frontier.ts` models the two states a normal

package/docs/INDEX_GENERATIONS.md

@@ -121,6 +121,12 @@ publishes a lease containing its random token, generation identity, PID, and
 operating-system process-start identity when available. Closing the database
 removes that exact lease idempotently.
 
+Reader admission flushes the lock's complete ownership record but deliberately
+does not force its directory entry to durable storage. The lock coordinates
+live processes immediately; after a host storage crash every reader is dead, so
+a lost name is safe and a resurrected complete name is attributable and
+reclaimable. Publication and collection locks remain directory-durable.
+
 Publication and collection use the same token-owned process lock. Collection
 always protects the current generation, the named recovery generation, and
 every live reader generation. It removes only oldest unprotected generations

package/docs/LOCK_PROTOCOL.md

@@ -58,6 +58,14 @@ owner. A crash before the link can leave a private candidate, but it cannot
 expose an empty or truncated public lock. Successful publication removes the
 private name and flushes the containing directory where supported.
 
+The SQLite generation reader-admission lock is the one narrower durability
+class. It still flushes the complete private ownership record before exclusive
+publication, but it does not force the containing directory on acquire or
+release. A host storage crash ends every admitted reader: losing the public name
+is then harmless, while a resurrected name contains the flushed record for a
+dead process instance and is reclaimed through the same guarded recovery path.
+All other process locks retain directory-durable acquire and release.
+
 ## Observation and Recovery
 
 | Observed state                                                     | Recovery decision                                                       |

package/docs/REINDEX_METADATA_COMPATIBILITY.md

@@ -18,9 +18,10 @@ classifies an input as:
   invalid field in a recognized version.
 
 The decoder shares only dependency-free object-record, timestamp,
-scalar-number, and string-or-null-record predicates in
-`src/domain/record-validation.ts`; moving those generic primitives out of
-individual decoders does not change any version or capability decision.
+scalar-number, non-empty string, bounded one-line string, and
+string-or-null-record predicates in `src/domain/record-validation.ts`; moving
+those generic primitives out of individual decoders does not change any
+version or capability decision.
 
 No consumer may cast an unsupported or malformed record to the current model.
 The decoder returns the original accepted v2/v3 object, so an authorized
@@ -45,6 +46,15 @@ additionally require it to be an object. Language lists contain unique names
 from the same
 `SUPPORTED_LANGUAGES` catalog used by configuration.
 
+When the fingerprint also decodes as the current versioned
+`ProjectInputSnapshot`, a fixed-snapshot receipt projects it as
+`scip-query:index-inputs`. This is a derived identity over the existing
+fingerprint bytes, not a second persisted identity field. The receipt compares
+that projection only with a current fixed snapshot built under the same
+project-input version; malformed, older, or otherwise unrecognized fingerprint
+shapes remain usable only for the capabilities above and do not acquire an
+index-alignment claim.
+
 The SQLite layout field is an additive v3 upgrade boundary rather than a wire
 version migration. A v3 record without it remains queryable, evidence-usable,
 and eligible for language-shard reuse. It is not eligible for whole-SQLite

package/docs/SECURITY_MODEL.md

@@ -40,15 +40,14 @@ An input budget is a maximum amount of untrusted data one operation will
 materialize or ask a parser to compile, distinguished from silent truncation by
 failing explicitly with the input kind, observed amount, and accepted limit.
 
-| Input class                                            |                    Limit | Representative users                                                     |
-| ------------------------------------------------------ | -----------------------: | ------------------------------------------------------------------------ |
-| Config, manifest, lock, lease, and other small records |                    8 MiB | `.scipquery.json`, package manifests, generation metadata, hook settings |
-| One source or per-document fragment                    |                   64 MiB | indexed source reads, TypeScript/Vue snapshots, mailbox result payloads  |
-| One SCIP index artifact                                |                  512 MiB | merge, sanitize, Rust occurrence fallback, shared-generation hydration   |
-| Profile or retained JSONL artifact                     |                  256 MiB | profiling audits, legacy event ledgers, rotating diagnostic segments     |
-| Generated TLA trace                                    | 16 MiB and 100,000 steps | `tla instrument` recorder                                                |
-| Repository-supplied regular-expression pattern         |         4,096 characters | entry-root patterns and TLA statement bindings                           |
-| Agent hook standard input                              |                    8 MiB | stop-hook request payload                                                |
+| Input class                                            |                    Limit | Representative users                                                    |
+| ------------------------------------------------------ | -----------------------: | ----------------------------------------------------------------------- |
+| Config, manifest, lock, lease, and other small records |                    8 MiB | `.scipquery.json`, package manifests, generation metadata               |
+| One source or per-document fragment                    |                   64 MiB | indexed source reads, TypeScript/Vue snapshots, mailbox result payloads |
+| One SCIP index artifact                                |                  512 MiB | merge, sanitize, Rust occurrence fallback, shared-generation hydration  |
+| Profile or retained JSONL artifact                     |                  256 MiB | profiling output and rotating diagnostic segments                       |
+| Generated TLA trace                                    | 16 MiB and 100,000 steps | `tla instrument` recorder                                               |
+| Repository-supplied regular-expression pattern         |         4,096 characters | entry-root patterns and TLA statement bindings                          |
 
 Regular files are opened first, checked through that descriptor, read, and
 checked again so replacement or growth cannot bypass the pre-read limit.
@@ -64,15 +63,20 @@ coverage metadata and `--full` remediation.
 
 Output pagination is a resumable transport for one rendered command result,
 distinguished from a result limit by preserving every rendered character.
-Human output above 12,000 characters automatically includes the exact command
-for the next page. Large default JSON remains byte-compatible and writes the
-exact opt-in paging command to stderr before and after the JSON stream.
+Human output above 6,500 characters, or above the smaller content allowance
+required to keep its wrapped page under 8,000 UTF-8 bytes, automatically
+includes the exact command for the next page. Large default JSON remains
+byte-compatible and writes the exact opt-in paging command to stderr before
+and after the JSON stream.
 
 Every command accepts:
 
 ```text
 --output-page-size <characters>
 --output-cursor <cursor>
+--agent-output
+--json-output <path>
+--raw-json
 ```
 
 The opaque cursor binds the command, working directory, non-pagination
@@ -88,44 +92,37 @@ under a process-identity-aware lock. Abandoned writers are reclaimed without
 removing a live writer; complete snapshots expire after one hour and are
 removed after their final page.
 
+`--agent-output` requires JSON, selects the command-owned bounded projection,
+and limits the complete rendered stream to 16 JSON content pages (currently
+56,000 characters). The command fails before delivering partial stdout when
+that fuse is exceeded. This bounds model-context consumption even when every
+individual page would be transport-safe.
+
+`--json-output <path>` requires JSON and captures the complete serialized
+result before publishing it through an atomic mode-`0600` file replacement.
+The destination path is limited to 4,096 UTF-8 bytes and the file to 32 million
+characters and 64 MiB. Stdout receives only a bounded receipt containing the
+absolute path, byte count, and SHA-256 digest. Paging, agent projection, and
+explicit raw streaming are mutually exclusive with file export.
+
 Run commands normally without selecting a page size. If human output is
 oversized, the readable multiline page prints one `Continue exactly:` command;
 run it unchanged until the transport-complete marker. That marker proves every
 rendered character was retrieved; command coverage remains a separate claim.
-Explicit paged `--json`
-returns the versioned object envelope and must be followed until
-`page.complete` is `true`. Do not pipe output through `head`, `tail`, or a
+Explicit paged `--json` and automatic `--json --agent-output` return the
+versioned object envelope and must be followed until `page.complete` is
+`true`. Do not pipe output through `head`, `tail`, or a
 line-range `sed`; those programs discard data without creating a resumable
 position. See [CLI JSON output](CLI_JSON_OUTPUT.md) and the [output-page
 schema](schemas/cli-output-page.schema.json).
 
-## Diff-gate process containment
-
-A diff-gate lease is one live process identity permitted to evaluate a
-project's current diff, distinguished from an ordinary lock file by recording
-and validating the owner's PID, process start, and project identity. CLI and
-Stop-hook gates share this lease, so an overlapping request reports the live
-owner instead of multiplying detector work.
-
-The public gate owns an isolated child process. Its default deadline is 60
-seconds, or 180 seconds with `--full`. On timeout, failure, or interruption the
-parent terminates and reaps that child before releasing the lease. An operator
-may set `SCIP_QUERY_DIFF_GATE_TIMEOUT_MS` to a positive millisecond value; the
-runtime caps it at 10 minutes.
-
-The parent creates a unique, private progress path and one-run token while it
-owns the lease. The child visibility-atomically records the current gate phase
-and detector immediately before and after each detector. A timed-out parent
-accepts only the record carrying its token, reports the active detector or
-phase plus the last completed detector, and removes the record before releasing
-the lease. The progress record is diagnostic evidence, not authority: failure
-to write it cannot turn a passing gate into a failure, and a stale or malformed
-record cannot alter the gate result.
-
-Outcome reconciliation rechecks at most one historical comparison base per
-gate. Deferred bases remain open and the result reports their exact base and
-finding counts, so accumulated event history cannot silently multiply one
-foreground gate into an unbounded replay batch.
+## Analysis process containment
+
+The `health` and `diff-impact` commands split expensive analysis into isolated
+child processes. Each child has a finite deadline and bounded output. On a
+timeout, failure, or interruption, the parent terminates and reaps the child.
+The child must return the expected versioned protocol, command identity, and
+result before its output is accepted.
 
 ## Terminal and JSON output
 

package/docs/accuracy-audit-checklist.md

@@ -3,6 +3,10 @@
 Date: 2026-07-10
 Status: Complete; see the 2026-07-11 closure certificate
 
+> Historical certification snapshot. Command rows below record the surface
+> that existed on 2026-07-10. See [Analyzer inventory](analyzer-inventory.md)
+> for the current product.
+
 ## Purpose
 
 This checklist tracks whether each public command tells the truth about the

package/docs/accuracy-hardening-goal.md

@@ -3,6 +3,12 @@
 Date: 2026-07-10
 Status: Complete for private-shadow readiness; public leaderboard remains a separate program
 
+> Historical certification record. It preserves the evidence and command
+> names used during the 2026-07 program. See
+> [Analyzer inventory](analyzer-inventory.md) and
+> [Analyzer validation protocol](analyzer-validation-protocol.md) for the
+> current product and evaluation standard.
+
 Current execution plan:
 [`2026-07-11-remaining-accuracy-verification-program.md`](./plans/2026-07-11-remaining-accuracy-verification-program.md).
 Closure certificate:
@@ -489,5 +495,6 @@ exist only when an upstream indexer emits them.
   to comparable cohorts.
 - `npm test`, `npm run typecheck`, and `npm run build` pass after each
   implementation slice.
-- Completed code or documentation changes pass `scip-query reindex` and
-  `scip-query diff-gate` before being declared finished.
+- Current changes use native tests plus the relevant `context`, `diff-impact`,
+  `architecture`, or detector command. No scip-query command declares an
+  arbitrary coding task complete.