scip-query 0.22.0 → 0.24.0

package/CHANGELOG.md

@@ -4,6 +4,506 @@ All notable changes to `scip-query` are documented here. This file starts at 0.1
 
 ## [Unreleased]
 
+## [0.24.0]
+
+### Oversized compiler projects are served from file closures
+
+- A tsconfig that lists more files than the semantic worker's heap can hold
+  (by the same estimate that sizes the heap: 2,560 MB plus 1.25 MB per
+  file) is no longer loaded whole and no longer declined. Its compiler
+  program starts empty and grows by the import closure of each requested
+  file, so callees, callee coverage, signatures, and import usage stay
+  exact per file; references and hierarchies, which need every file, are
+  declined per request and the cheap paths answer them. The service status
+  and provider availability report `projectScope: file-closure`.
+
+### Second-repository review: layering, facades, stubs, and configuration entry points
+
+- A member that calls another member of its twin cluster leaves the cluster
+  before pairing, so a facade method no longer pairs with its near-name
+  siblings either; the delegation check follows one re-export hop, so a
+  caller importing through a barrel is recognized. A thin forwarder whose
+  single call has a different name than its own (a web client calling
+  `apiClient.getData`, a vendor adapter) is a stub over its peer's concept,
+  not a twin of it. Overrides of one abstract member and key-qualified
+  lookup members (`getBySlug`, `findByEmail`) on unrelated classes are
+  convention, not drift.
+- A class whose methods forward to members of several collaborators is a
+  composed-service facade even when no single collaborator receives three
+  forwards. A body of the form `return handler(async () => {...})(req, res,
+next)` is a curried handler, not a literal passthrough.
+- A wrapper forwarding through a module-private variable
+  (`return loadedLanguages.has(lang)`) is a boundary signal: inlining it
+  would export the state it hides.
+- Rendered extraction regions grow to element boundaries: a region cut
+  inside a JSX element now reaches its closing tag or, when it only
+  straddles two elements, fails the size rules instead of reporting a
+  fragment. Growth stops at the function's own `return`, and the candidate's
+  region is the largest extractable one rather than the largest one, so a
+  smaller signal-tier region beside a region that holds the function's
+  return is the advice.
+- Concise arrow bodies are read past braces in parameter types and type
+  arguments (`(x) => client.patchData<{ ok: true }>(x)`), so arrow-function
+  wrappers, twins, and duplicate bodies see the real body. A file of
+  wrappers that all forward through one receiver (a copy catalog, a client
+  object) is a facade over it and its wrappers are signal tier.
+- Co-change findings carry an action tier. Pairs whose shared commits were
+  only broad sweeps, stale pairs with at most two focused co-changes, and
+  configuration, schema, documentation, or generated partners are signal
+  tier and no longer count toward the hidden-coupling score.
+- Source files a root configuration names by path (`next.config.js`
+  `images.loaderFile`, a `package.json` script running `src/scripts/x.ts`)
+  are entry surfaces: their exports are invoked by the framework or tool,
+  not dead.
+- `duplicate-bodies --json` no longer prints policy-exclusion lines into
+  the JSON document or export file; they remain in human output.
+- Label sets for dead code, similar pairs, stale abstractions, complexity
+  hotspots, large components, and co-change on Launchpoint, and for twin
+  drift, wrappers, passthroughs, and extraction on Vega, live under
+  `docs/validation/labels/`.
+
+### Human output redirected to a file is complete
+
+- When stdout is a regular file (`scip-query health --full > report.txt`),
+  human output is written in full. Page cursors remain for terminals and
+  pipes, where the reader is an agent whose context the page budget
+  protects from a client that truncates long tool results.
+
+### Call sites the grammar wraps are no longer dropped
+
+- `await client.getData<T>(...)` parses with the `await` bound to the member
+  expression, and `(a as B).run()`, `a!.run()`, and `(fn)()` wrap the target
+  the same way. The call-site extractor now reads through those wrappers,
+  so the occurrence and AST callee tiers see the call; source facts carry
+  a new payload version. Found by the Vega self-audit's one oracle-only edge.
+
+### Evidence products keyed by build
+
+- File and project evidence rows are keyed by the running build's digest
+  as well as their payload version, and rows another build wrote are pruned
+  when the cache opens. A development build with changed analysis logic
+  never reads a previous build's rows; compiler-derived callee and reference
+  rows keep their schema-only keys.
+
+### Dependency cycles classified by component content
+
+- A cyclic component is classified by what remains after its barrels,
+  tests, and entry files are removed: if the product files still cycle,
+  that cycle is the finding and its witness is reported; if not, the
+  component only cycles through module bookkeeping. Previously the
+  verdict followed one witness path, which could run through a barrel that
+  a genuine product cycle sat beside.
+
+### Wrapper, passthrough, and twin-drift findings reviewed against source
+
+- A wrapper is `forwarding`-shaped only when its body is exactly one call
+  with plain-value arguments; a preparatory statement, a callback, a nested
+  call, or a literal the body builds now makes it a helper (signal tier, not
+  counted by health). The two-statement allowance had classified computed
+  keys, reductions, and two-step operations as inline advice.
+- Boundary-term evidence for wrappers and passthroughs reads owner-qualified
+  leaf names (`BaseLogger log`) instead of path-qualified short names, so a
+  directory both sides live in (`lib/auth/`, `social-providers/`) no longer
+  reads as a boundary while an enclosing class still counts, and a term
+  present on both sides (`toBaseRate` forwarding to `parseBaseRate`) is
+  shared vocabulary rather than a reason to demote the finding.
+- A twin-drift member that calls its same-name counterpart (an operations
+  function over its use-case, a component over the function it renders)
+  is a layer, not a parallel implementation; the delegation exclusion no
+  longer requires the caller to be a thin forwarder, and an aliased import
+  of the counterpart counts only under its alias.
+- Reviewed label sets for the three detectors on `launchpoint-backend`
+  live under `docs/validation/labels/launchpoint-backend/`; the label
+  scorer understands the `direct | signal` tier vocabulary.
+
+### The semantic worker loads one compiler project at a time
+
+- Compiler projects are built lazily: a tsconfig's project exists only once a
+  request needs one of its files, files are routed to the tsconfig that
+  lists them, and a project that was never asked for costs nothing. The
+  semantic worker now carries the same soft-memory retirement mark as the
+  index worker, restarts once after a failure, and a batch whose worker died
+  of memory is retried as file halves down to single files before the
+  service counts as failed. Worker heaps are sized to the indexed document
+  count, capped by physical memory or the container's cgroup limit,
+  whichever is lower.
+
+### Self-audit distinguishes what the compiler cannot see
+
+- A cheap-path answer in a file outside every tsconfig (a test excluded from
+  the build config) is reported as outside oracle coverage rather than as a
+  false positive, and precision is measured over the rest.
+
+### Health report cache keyed by build
+
+- The cache key carries a digest of the running entry bundle, so two builds
+  under one version string never serve each other's reports.
+
+### Compiler callees resolve imported functions, and self-audit measures callee precision
+
+- The compiler callee path bound an imported call to its import alias and then
+  looked for a definition at the import statement, so every cross-file call to
+  an imported function was dropped from the semantic callee product and from
+  the self-audit oracle. Aliases now resolve to their declaration; cached
+  compiler callees carry a new schema so they recompute.
+- The compiler now also reports, per definition, how many call and render
+  sites it resolved inside the repository, resolved to a library or ambient
+  symbol, or could not bind at all. `self-audit` treats a definition with no
+  unbound site as a complete oracle and measures callee and render precision
+  over those symbols; a cheap-only answer next to a partial oracle stays
+  unverified. Scores report `completeOracleSymbols`.
+
+### Whole-project semantic passes stay inside memory
+
+- `extract-candidates --full` (and every other full-mode semantic pass) sent
+  the whole candidate set to the semantic service in one request; on a large
+  repository the service's worker died at its heap limit and the command then
+  loaded the compiler in-process and died at its own. Bulk callee requests are
+  now sent in bounded per-file batches, a service failure on a large index
+  disables semantic enrichment for the run instead of loading the compiler
+  in-process (with a stderr notice), a service that merely lacks a request
+  kind keeps serving the others, and the service sizes its compiler worker
+  heaps from the indexed document count with a machine-memory ceiling.
+  Decoded occurrence data is held in a bounded cache instead of per run.
+
+### Extraction candidates require a real block and stay out of control flow
+
+- A region must span eight lines, and a region holding a `return` statement
+  of the function itself is support tier: it is the function's control flow,
+  not a helper. Exclusive call spans inside one multi-line statement (a
+  fluent query chain, a large literal) now form one region, since a region
+  never cuts through a statement; rendered subtrees keep the proximity rule
+  because a subtree is a legitimate cut inside a `return`. A reviewed
+  Launchpoint label set
+  (`docs/validation/labels/launchpoint-backend/extract-candidates.json`)
+  scores against the current output.
+
+### Carried publications keep the deferred-companion marker
+
+- A publication that carried every language shard rewrote the metadata
+  without the `scipCompanion` marker while its publication record still said
+  `deferred`; the marker is now carried from the accepted generation.
+
+### Health reports name the input they were computed from
+
+- `health` now records provenance: the immutable index generation identity
+  (with its publication time and mode when the generation store has them),
+  the git HEAD, branch, and uncommitted-path count, and the computation time.
+  The text report prints it as an `Input:` line under the file and symbol
+  counts; `health --json` carries it as `provenance`. Two reports whose
+  provenance differs were computed from different inputs, which the file and
+  symbol counts alone could not show.
+
+### Incremental TypeScript refresh survives a reused-shard publication
+
+- A publication that reused the TypeScript shard (only non-TypeScript inputs
+  changed) advances the project snapshot without writing a new overlay, so
+  the next TypeScript edit looked for an overlay named by the new snapshot,
+  found nothing, and every refresh failed with "deferred TypeScript SCIP
+  base has no matching overlay generation" until an explicit
+  `--allow-expensive-rebuild`. The incremental planner now bases the next
+  overlay on the overlay generation the accepted publication carries, which
+  is the overlay that exists.
+
+### Extraction candidates are exclusive regions, not line coincidences
+
+- `extract-candidates` now reports contiguous line ranges whose callees are
+  used nowhere else in the function, grown over the enclosing block's opener
+  and closer, and only when the range is at least five lines, at most three
+  quarters of the body, and leaves the rest of the function with callees of
+  its own. Callees used across the body (loggers, translators) are reported
+  as ambient instead of gluing every region together. When the indexer
+  emitted local-symbol occurrences, each region lists the bindings an
+  extraction would take as parameters and hand back. The previous
+  implementation keyed callee co-occurrence on a source line, so its
+  "clusters" were names sharing one line and its isolation score was always
+  100%; `ExtractCandidate.clusters` is replaced by `regions` and the kinds
+  are now `call-region` and `render-region`.
+
+### Callee edges start from the indexer's own bindings
+
+- The cheap callee path now reads the compiler-resolved occurrence the index
+  already stores for each call line before falling back to leaf-name
+  resolution. Member calls through typed receivers (`this.service.method()`)
+  resolve exactly, and a call the indexer bound to a library or ambient symbol
+  is no longer guessed onto a same-named repository function. Occurrences are
+  decoded per file from the chunk blobs, so no query loads the whole SCIP
+  artifact. `CalleeRow.source` gains `scip-occurrence`, `graph` prints it as
+  `O`, and `self-audit` reports cheap rows by evidence source. On a NestJS +
+  Next.js monorepo, callee recall against the compiler moved from 0.29 to 0.98.
+
+### Eight judgment skills restored to the bundled suite
+
+- `install-skills` and `setup` now also link `principal-maintainability-review`,
+  `scip-system-compression`, `scip-root-cause`, `scip-claim-audit`,
+  `scip-probe-reachability`, `scip-twin-drift`, `scip-calibrate`, and
+  `conductor` into Claude Code, Codex, and the shared agent root. Each is the
+  last full version from this repository's history, ported to the current
+  command surface: retired `diff-gate`, `cleanup-apply`, `plan-context`,
+  `effectiveness`, and `symbols` references are replaced with `diff-impact`,
+  `architecture`, `outline`, and the standalone detectors, and every
+  `metadata.commands` template validates against the live descriptors.
+- The repo-local `.agents/skills/principal-maintainability-review` and
+  `.agents/skills/scip-system-compression` stubs are removed; the bundled
+  skills supersede them.
+
+## [0.23.0]
+
+### Fresh installs work without Go or the scip binary
+
+- The external `scip` binary is no longer required. SCIP is converted to
+  SQLite in-process (since 0.22.0), but `reindex` and `setup` still refused to
+  run without `scip` on PATH; a fresh machine therefore could not index at all
+  unless Go was installed. The requirement now applies only when
+  `SCIP_QUERY_SQLITE_CONVERTER=scip-cli` selects the legacy converter, and
+  `check-deps` and the setup report say so instead of asking for consent.
+- When the legacy converter is selected, `--install-missing` installs the
+  reviewed `scip` release without Go: the pinned archive is downloaded into
+  the scip-query cache, verified against its published SHA-256, and extracted;
+  the cached reviewed binary then outranks any `scip` on PATH. A PATH binary
+  reporting a different version than the pin is reported as unverified, and
+  `--install-missing` replaces it with the reviewed release.
+- Tree-sitter grammars and better-sqlite3 ship prebuilt binaries, so npm 11's
+  install-script policy skipping their build scripts (which it reports as a
+  warning on `npm install -g`) does not affect parsing.
+
+### The watcher stops fighting manual refreshes
+
+- The automatic resource budget is charged only to refreshes the watcher
+  started itself (`watch-*` triggers). `setup` and manual `reindex` runs no
+  longer pause the watcher: on a large repository the first setup build alone
+  exceeded the 1 GiB write allowance and left the watcher "budget-paused,
+  changes pending" for the whole window.
+- When a generation the watcher did not produce is published while work is
+  pending (dirty, cooldown, budget pause, or a debounce wait) and the index
+  matches the working tree, the watcher drops the pending refresh, reports
+  it as suppressed, and returns to idle, instead of holding "changes pending"
+  until the budget window or cooldown expired and then re-running a refresh
+  that would only be suppressed as fresh. The check runs on the Git poll
+  interval and does not depend on a Git checkout.
+
+### The full-health prewarm runs in parallel shards and parses each file once
+
+- The prewarm's three per-file warm sweeps (definitions, imports and
+  re-exports, source facts) parsed the repository twice; they are now one
+  sweep that computes every product while the file's syntax tree is still
+  cached, one parse per file.
+- On a host that can hold several compiler programs, the prewarm now runs as
+  parallel shard workers, each warming a deterministic slice of the indexed
+  files (definitions, reference fragments, callees) with a 12 GB heap, and
+  the parent writes the completion marker once every shard reports its slice
+  warm. The plan takes the memory left after an 8 GB host reserve divided by
+  14 GB per worker, capped by cpu count minus one and by four
+  (`SCIP_QUERY_HEALTH_PREWARM_SHARDS` overrides it); a machine that cannot
+  host two workers runs the single worker as before.
+
+### The fragment warm pass stops recomputing hierarchy targets per batch
+
+- Profiled on a 7,800-file repository, the prewarm's reference scans spent
+  258 s across 61 batches, of which 63 s was the per-file scan; the rest was
+  building the class-hierarchy target map, about 20 s per compiler session,
+  and the pass discarded its session under heap pressure thirteen times.
+  The map depends only on the sources and the definition set, so it is now
+  memoized per session and persisted per project generation as the
+  `typescript-hierarchy-targets` product; a rebuilt session reads it back.
+  A new profile span, `typescript.references-map.hierarchy-targets`, records
+  each computation and whether it was a hit.
+- The prewarm's default isolated heap may now reach 16 GB on machines with
+  at least 32 GB of memory (it stays at half of physical memory below that),
+  so a large compiler program crosses the pressure threshold, and rebuilds
+  its session, far less often.
+
+### Immutable SCIP shards are hard-linked where reflinks are unavailable
+
+- Every reindex staged its SCIP shards into the cache and back with byte
+  copies on filesystems without copy-on-write (ext4: ~325 MB per rebuild).
+  Cached shards and published index files are never opened for writing, so
+  they are now shared by hard link when a reflink is refused; a SQLite
+  candidate, which is patched in place, is still a real copy. Every clone
+  now removes its target first so no method ever writes through an inode
+  another generation still reads. Hard links count as shared bytes in the
+  reindex write telemetry, like reflinks.
+
+### Complexity reads branch counts from source facts
+
+- The source-facts walk now counts branch points per callable (a branch
+  inside a nested function counts toward each enclosing callable, as the
+  complexity query's own AST pass defined it), and the facts payload version
+  is 7. The complexity phase uses that count for every definition whose
+  range matches a callable and parses only the rest, so on a warm cache it
+  parses nothing; it parsed 4,287 files before.
+- Caller-file evidence is memoized per symbol within a process. The two
+  repository scans behind consumer provenance (indexed callsites and
+  source-fallback attribution) answer per symbol independently of which
+  other symbols were asked for, so a later call scans only for symbols it
+  has not seen; the wrapper phase asked three times.
+
+### Health phases stop rebuilding the compiler program
+
+- Measured per child on a 7,800-file repository (cold cache, no watch
+  service): three phase children each spent about 17.5 seconds building the
+  TypeScript program to compute 118, 8, and 2 callee cache misses, and the
+  complexity phase held 1,975 parsed trees at exit because its per-definition
+  source-facts reads parsed every cold file synchronously.
+- The prewarm now persists every file's source-facts product in collecting,
+  yielding batches, and its callee pass covers the production-callable
+  definition sets the phases use (which add interface and class member
+  fallback rows the catalog does not carry), so phase children read the
+  cache and parse nothing.
+
+### Setup reports what is actually missing
+
+- A cold start on a fresh home directory (npm 11, no caches, a fresh clone)
+  installed in 7 seconds, indexed 7,780 TypeScript files in 123 seconds, ran
+  the full health audit, and answered search, evidence, and diff-impact in
+  about 2 seconds each. Its verdict was still `partial`, because setup
+  reported two consent skips for things that were not missing and counted
+  demand-started watching and an absent Rust toolchain as unavailable.
+- Without consent, the AST parser step now probes which selected-language
+  parsers load and reports "nothing to install" when all do; the consent skip
+  remains only for a parser that does not load, naming it. Indexer
+  remediation reports "nothing to install" when every detected language has a
+  runnable indexer. Demand-started watching (the default) is a configured
+  state, and its smoke row and the absent-Rust row are optional, so a
+  TypeScript repository with everything present reaches `ready`.
+- A wait on a path-change wake also compares each watched path's
+  modification time with the last one it settled on, so a change that
+  already happened resolves immediately even when the filesystem event
+  arrives late.
+
+### Children keep the parent's NODE_OPTIONS
+
+- Isolated analysis children (the health prewarm, health phases, diff-impact
+  batches) replaced `NODE_OPTIONS` wholesale with their heap bound, dropping
+  any `--require` preload, inspector flag, or user-set option the parent
+  carried. They now replace only the heap bound, the way reindex already did;
+  the helper is shared.
+- The reindex runtime-boundary sweep collects before each of its event-loop
+  turns, so the trees it parses are freed as it goes.
+- Callee cache scans now record a sample of miss identities in the profile,
+  so a profile can say which definitions a warm pass did not cover.
+- The CLI-spawning contract suites allow 30 seconds per test; they spawn the
+  built CLI and timed out under load at the 5-second default.
+
+### Whole-project parses no longer hold every syntax tree at once
+
+- A parsed Tree-sitter tree is native memory behind a wrapper of a few bytes.
+  V8 never feels its weight, so it rarely collects the wrapper, and the
+  finalizer that frees the tree runs only after a collection has found the
+  wrapper dead and the event loop has turned. A whole-project parse therefore
+  held every tree it made: on a 7,800-file repository the full-health prewarm
+  reached 14,000 trees and ~8.5 GB outside the V8 heap while `heapUsed` sat at
+  160 MB. Measured on the same box, forcing a full collection at each batch
+  boundary and yielding once keeps a 3,000-file sweep flat at 139 MB across
+  three passes; a minor collection frees almost nothing.
+- The prewarm now persists every file's import and re-export products in
+  batches that end with a full collection and one event-loop turn, before the
+  semantic provider builds, so the provider's synchronous dependency-graph
+  build reads products and parses nothing. A non-incremental reindex does the
+  same for the previous generation before the affected-set shadow builds its
+  graph, and only when that shadow will build one.
+- The native-pressure estimate behind every parse assumed a tree costs 10x its
+  source bytes; measured, it is about 23x, so forced collections came several
+  gigabytes too late. The estimate is now 24x.
+- The prewarm's first stage read every file's definitions synchronously, and a
+  file whose definition product is cold is parsed to compute them: 6,978 trees
+  were alive 43 seconds in, before any other stage ran, setting a ~4.7 GB
+  high-water mark the process never gave back. Candidate definitions are now
+  read in the same collecting, yielding batches; the per-file product they
+  persist makes the health phases' later synchronous reads parse nothing.
+- The dependency-graph sweep parsed each file twice, once for imports and
+  once for re-exports; the import parse now goes through the exact-bytes tree
+  cache, so the re-export pass reuses the same tree.
+- Freed tree memory stays reusable inside the process but is not returned to
+  the OS by glibc; the resident high-water mark is now set by one batch plus
+  the bounded tree cache rather than by the repository.
+
+### Faster full health and a durable dossier
+
+- `health --full` phases run in a memory-gated pool instead of strictly one
+  at a time: one isolated child per ~7 GiB of half the machine's memory, at
+  most four (`SCIP_QUERY_HEALTH_FULL_CONCURRENCY` still overrides). A 61 GiB
+  host runs four phases at once; a 16 GiB laptop keeps one. The pool starts
+  the heaviest phases first (wrapper candidates, complexity hotspots,
+  passthrough candidates, stale abstractions, similar/extract), so the last
+  worker does not finish alone. Measured on a 7,800-file repository with
+  warm caches and no watch service: 4:20 → 1:29, peak 5.8 GiB.
+- The health dossier is published atomically, so an interrupted setup leaves
+  the previous complete dossier in place instead of a half-written one. Each
+  audit first records an attempt marker (`health-dossier.attempt.json`, run
+  id, start time, index generation) that is cleared only after the dossier
+  is written; a later setup reports an interrupted audit instead of letting
+  the older dossier pass as current, and the dossier names the index
+  generation and attempt it completed.
+- The project-wide TypeScript reference map assembled from persisted
+  fragments is now kept per database for the life of the process, so a child
+  that runs several health phases (or `isolated`, `dead`, and consumer
+  evidence in one command) builds it once instead of once per consumer.
+
+### Architecture policy is clean again
+
+- The file-access recorder moved from `platform` to `domain` (it has no
+  dependencies and is consumed by analysis, symbols, and source code), and the
+  compiler-shard planner reads bounded files through the `platform` re-export,
+  so `scip-query architecture` reports no forbidden edges and the setup-installed
+  Stop hook passes again. Both edges were introduced by the 0.22.0 performance
+  work.
+
+### Setup no longer replaces symbolic links or misreports configured projects
+
+- `setup` (and every other revision-aware file mutation: agent guidance,
+  hook files, config, suppressions) now writes through a symbolic link to its
+  target instead of renaming a regular file over the link. A repository with
+  `CLAUDE.md -> AGENTS.md` keeps the link and receives the guidance block once,
+  in `AGENTS.md`; previously the link was silently replaced by a regular copy
+  (git mode 120000 → 100644). A dangling link is resolved to the path it names
+  so the file is created there.
+- A TypeScript-only project no longer gets a `partial` setup verdict because
+  the Rust semantic session was inapplicable, and `watch.enabled=false` or
+  `watch.autoStart=false` is reported as a configured state rather than
+  incomplete setup. Skips that still mean incomplete setup (no supported
+  language, config errors, an incomplete initial refresh) keep `partial`.
+
+### Bounded full-health semantic prewarm
+
+- `health --full` no longer assembles the project-wide TypeScript reference
+  map inside its isolated prewarm child. The prewarm persists reference
+  fragments file by file (existence-checked without reading payloads, written
+  one provider batch at a time), materializes the remaining per-definition
+  references in persisted file batches, and yields between batches so native
+  memory is reclaimed. Those fragment rows are the evidence the health phases
+  read, so the warm state is unchanged; only the transient multi-gigabyte map
+  is gone. On a ~7,800-file TypeScript repository with no watch service
+  running (for example during `setup --health`), the child previously grew
+  past 17 GiB and aborted with SIGABRT.
+- Heap-pressure relief forces a collection before deciding to discard the
+  compiler session, so batch garbage is no longer mistaken for live pressure,
+  and the release threshold is 75% of the isolated heap.
+- The prewarm child's default heap is derived from physical memory (half of
+  RAM, bounded to 2–8 GiB) instead of a fixed 8 GiB;
+  `SCIP_QUERY_HEALTH_SEMANTIC_PREWARM_HEAP_MB` still overrides it.
+- Every consumer of TypeScript reference fragments (health phases,
+  `diff-impact` batches, the prewarm) now relieves heap pressure between
+  persisted fragment batches: measure after a forced collection, and discard
+  the in-process compiler session when live state still exceeds 75% of the
+  isolated heap, so the next batch resolves a fresh session. A cold cache with
+  no watch service previously failed `diff-impact` on a large repository with
+  "JavaScript heap out of memory" because one batch child hosted the whole
+  compiler program without ever releasing it.
+- `diff-impact` batch children also run with a bounded isolated heap (half of
+  RAM, bounded to 2–6 GiB; `SCIP_QUERY_DIFF_IMPACT_BATCH_HEAP_MB` overrides
+  it) instead of Node's default old-space limit, and get the full-health phase
+  time budget (10 minutes; `SCIP_QUERY_DIFF_IMPACT_BATCH_TIMEOUT_MS` overrides
+  it) instead of the generic 3-minute analysis timeout.
+- A diff-impact batch no longer computes a whole project's reference fragments
+  in-process. When more than 256 files have cold fragments and no watch
+  service is running, the semantic consumer tier is reported as failed with
+  the remedy (`scip-query health --full` once, or `scip-query watch
+--daemon`) and the source-fallback tier still runs; on a 7,800-file
+  repository the in-process computation took longer than the 10-minute batch
+  budget while the service or the prewarm warms the same rows in the
+  background. With warm fragments the same diff-impact takes seconds.
+
 ## [0.22.0]
 
 ### Bounded indexing for large TypeScript repositories

package/README.md

@@ -37,6 +37,17 @@ cd your-repository
 scip-query setup
 ```
 
+npm 11 and newer skip dependency install scripts by default and print an
+`install-scripts` warning listing them. For scip-query every listed script is
+a prebuild check (`node-gyp-build`) or the package's own install hint; the
+Tree-sitter grammars and SQLite binding ship prebuilt binaries for macOS,
+Linux, and Windows, so nothing needs to compile and the warning can be
+ignored. The one grammar without prebuilds, Kotlin, falls back to text
+parsing unless a C toolchain is present and the scripts are allowed. To
+silence the warning for global installs, run the `npm config set
+allow-scripts=... --location=user` command npm prints; `--allow-scripts` is
+rejected inside a project directory by design.
+
 Setup detects supported languages, installs or checks their indexers, builds
 the local index, installs the bundled skills, and writes concise agent guidance.
 When the repository declares valid architecture rules, setup also installs one
@@ -295,6 +306,8 @@ If output prints `Continue exactly:`, run the emitted command unchanged until
 transport is complete. Transport completion means every rendered character was
 retrieved; it does not make bounded analysis exhaustive.
 
+Output redirected to a regular file (`scip-query health --full > report.txt`) is written in full; page cursors apply to terminals and pipes, where the reader is an agent whose context the page budget protects.
+
 Use `--full` only when complete command coverage can change a decision. Always
 read a command's coverage note before claiming that every caller, consumer, or
 finding was considered.

package/dist/augment-vue-worker.js

@@ -1,2 +1,2 @@
-import{d as t}from"./chunk-FFJQZG6J.js";import"./chunk-YUKYB54I.js";import"./chunk-BJT7LSPK.js";import"./chunk-YXPUP5G2.js";import"./chunk-NRBNAECH.js";import"./chunk-IW5XQG5G.js";import"./chunk-AK3PYTIK.js";import{writeFileSync as s}from"fs";import{workerData as o}from"worker_threads";var r=o;try{let e=t({projectRoot:r.projectRoot,dbPath:r.dbPath,tsconfig:r.tsconfig,vueFiles:r.vueFiles,tasks:r.tasks});s(r.resultPath,JSON.stringify({version:1,runId:r.runId,workerId:r.workerId,taskIds:r.taskIds,ok:!0,result:e}))}catch(e){s(r.resultPath,JSON.stringify({version:1,runId:r.runId,workerId:r.workerId,taskIds:r.taskIds,ok:!1,error:e instanceof Error?e.message:String(e)}))}
+import{d as t}from"./chunk-3LO4FST5.js";import"./chunk-YUKYB54I.js";import"./chunk-BJT7LSPK.js";import"./chunk-YXPUP5G2.js";import"./chunk-MWN53KRN.js";import"./chunk-IW5XQG5G.js";import"./chunk-7HXT6YLU.js";import"./chunk-7F45LJKI.js";import{writeFileSync as s}from"fs";import{workerData as o}from"worker_threads";var r=o;try{let e=t({projectRoot:r.projectRoot,dbPath:r.dbPath,tsconfig:r.tsconfig,vueFiles:r.vueFiles,tasks:r.tasks});s(r.resultPath,JSON.stringify({version:1,runId:r.runId,workerId:r.workerId,taskIds:r.taskIds,ok:!0,result:e}))}catch(e){s(r.resultPath,JSON.stringify({version:1,runId:r.runId,workerId:r.workerId,taskIds:r.taskIds,ok:!1,error:e instanceof Error?e.message:String(e)}))}
 //# sourceMappingURL=augment-vue-worker.js.map

package/dist/by-kind-H3P6BR5G.js

@@ -0,0 +1,2 @@
+import{a,b}from"./chunk-NGKBOT6G.js";import"./chunk-MTDBHTSF.js";import"./chunk-2VAHDDLM.js";import"./chunk-YXPUP5G2.js";import"./chunk-BL6DCHQP.js";import"./chunk-ATXPTSEI.js";import"./chunk-CKBUBRYD.js";import"./chunk-IW5XQG5G.js";import"./chunk-H5EXS3HM.js";import"./chunk-HGFDYOVB.js";import"./chunk-7HXT6YLU.js";import"./chunk-7F45LJKI.js";export{a as byKind,b as kindCounts};
+//# sourceMappingURL=by-kind-H3P6BR5G.js.map

package/dist/call-graph-VTG2CUOQ.js

@@ -0,0 +1,2 @@
+import{a}from"./chunk-ZGIHTH27.js";import"./chunk-7KCZELVM.js";import"./chunk-BGBBVSH4.js";import"./chunk-AADQLOQ4.js";import"./chunk-MTDBHTSF.js";import"./chunk-WDSFQDPN.js";import"./chunk-ANLNLY66.js";import"./chunk-JCSAZ35V.js";import"./chunk-FI7VGOR4.js";import"./chunk-WRQXLNYE.js";import"./chunk-L7KTFEAV.js";import"./chunk-2USA3S3P.js";import"./chunk-BJT7LSPK.js";import"./chunk-5BIKR67W.js";import"./chunk-CZW5MZ5B.js";import"./chunk-F4FNK44D.js";import"./chunk-ODPDP7A4.js";import"./chunk-MOKUWRHO.js";import"./chunk-FVFDOIM3.js";import"./chunk-2VAHDDLM.js";import"./chunk-YXPUP5G2.js";import"./chunk-BL6DCHQP.js";import"./chunk-EHYDXE3Z.js";import"./chunk-2OOY75BW.js";import"./chunk-U6KCHXJ4.js";import"./chunk-T3I6NHBH.js";import"./chunk-ATXPTSEI.js";import"./chunk-CKBUBRYD.js";import"./chunk-IW5XQG5G.js";import"./chunk-T3CZAZSI.js";import"./chunk-B3PYOSCX.js";import"./chunk-H5EXS3HM.js";import"./chunk-HGFDYOVB.js";import"./chunk-JFMEXGFE.js";import"./chunk-7HXT6YLU.js";import"./chunk-7F45LJKI.js";export{a as callGraph};
+//# sourceMappingURL=call-graph-VTG2CUOQ.js.map

package/dist/call-graph-evidence-BociKRpF.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Where a callee edge came from. `scip-occurrence` is the indexer's own
+ * binding at the call line (compiler-resolved at index time); `ast-callsite`
+ * is a leaf-name resolution over imports and local receivers; the other two
+ * are the on-demand compiler and chunk co-occurrence paths.
+ */
+type CalleeEvidenceSource = 'scip-occurrence' | 'ast-callsite' | 'semantic-callee' | 'scip-chunk';
+interface CalleeRow {
+    symbol: string;
+    file: string;
+    chunkId: number;
+    source: CalleeEvidenceSource;
+    /** Zero-based source line of the call expression when retained by the evidence source. */
+    callsiteLine?: number;
+    /** `jsx-render` when the edge is a rendered component element rather than a call expression. */
+    kind?: 'jsx-render';
+}
+
+export type { CalleeRow as C, CalleeEvidenceSource as a };

package/dist/chunk-2BMSSRBH.js

@@ -0,0 +1,2 @@
+import{a as L}from"./chunk-BGBBVSH4.js";import{a as I}from"./chunk-BJWFVAA5.js";import{i as fe}from"./chunk-U3SXIMII.js";import{b as te,d as oe,e as re,f as ae,g as se,h as le,j as T,k as ce,l as _}from"./chunk-SKKXTABJ.js";import{d as ie}from"./chunk-KK7GPALL.js";import{f as ee,h as ne}from"./chunk-NJQISBL4.js";import{b as C}from"./chunk-FLMTCX5R.js";import{b as Q}from"./chunk-BOW7SSQH.js";import{a as U,e as W,i as P,j as A,l as X,m as Y,v,w as J,x as Z,y as $,z as N}from"./chunk-C7C6AKAT.js";import{t as z,v as S}from"./chunk-RBAD4GJ2.js";import{A as y,B as O,O as H,a as M}from"./chunk-ZLMXIQLC.js";import{h as B,m as D}from"./chunk-ETC674NS.js";import{d as w,y as G}from"./chunk-KNLQGXVH.js";function j(n,e,t={}){let i=new Map;if(e&&e.length===0)return i;let r=M(n,{includeIgnored:!1}),o=ae(n),a=e??J(n),f=new Set(a.map(m=>m.symbolId)),c=Ce(a);return ge(n,i,r,o,f,c),he(n,i,a,f),ve(n,i,r,o,f,c),t.semantic!==!1&&t.semanticEvidence&&Le(i,t.semanticEvidence.callerMap(n,Ie(a))),i}function ge(n,e,t,i,r,o){for(let a of t){if(!y(a))continue;let f=z(n,a);if(f)for(let c of f){if(o&&!o.has(c.calleeLeaf))continue;let m=oe(a,i.get(c.calleeLeaf)??[]);if(!m||m.length===0)continue;let s=re(n,a,m,c.memberAccess,c.calleeQualifier);s&&r.has(s.symbolId)&&s.file!==a&&K(e,s.symbolId,a)}}}function he(n,e,t,i){let r=Me(t);for(let o of Re(n,i))n.isIgnored(o.relative_path)||De(o,r.get(o.symbol_id))||K(e,o.symbol_id,o.relative_path)}function Re(n,e){return ie(n,e?[...e]:void 0)}function Me(n){let e=new Map;for(let t of n)e.set(t.symbolId,{docId:t.documentId,startLine:t.startLine,endLine:t.endLine});return e}function De(n,e){return!!e&&e.docId===n.document_id&&n.chunk_start>=e.startLine&&n.chunk_end<=e.endLine}function ve(n,e,t,i,r,o){for(let a of t){if(y(a)!=="rust")continue;let f=S(n,a,{includeRustAttributeNames:!0});if(f.length!==0)for(let{name:c}of f){if(o&&!o.has(c))continue;let m=i.get(c);if(m)for(let s of m)r.has(s.symbolId)&&s.file!==a&&K(e,s.symbolId,a)}}}function K(n,e,t){let i=n.get(e);i||(i=new Set,n.set(e,i)),i.add(t)}function Ce(n){let e=new Set;for(let t of n){let i="leaf"in t&&typeof t.leaf=="string"?t.leaf:"symbol"in t&&typeof t.symbol=="string"?W(t.symbol):"";i&&e.add(i)}return e.size>0?e:null}function Ie(n){return n.filter(e=>"relativePath"in e&&"symbol"in e&&"leaf"in e)}function Le(n,e){for(let[t,i]of e){let r=n.get(t);r||(r=new Set,n.set(t,r));for(let o of i)r.add(o)}}var Fe=w("cross-file-caller-files",{clearGroups:["whole-project","source-file"]}),xe=w("source-fallback-caller-files",{clearGroups:["whole-project","source-file"]});function ue(n,e,t){let i=e.filter(o=>!n.has(o.symbolId));if(i.length>0){let o=t(i);for(let a of i)n.set(a.symbolId,o.get(a.symbolId)??new Set)}let r=new Map;for(let o of e){let a=n.get(o.symbolId);a&&a.size>0&&r.set(o.symbolId,new Set(a))}return r}function q(n,e,t={}){if(e===void 0)return j(n,e,t);let i=ue(Fe.get(n,()=>new Map),e,r=>j(n,r,{semantic:!1}));return t.semantic===!1||!t.semanticEvidence?i:me(i,t.semanticEvidence.callerMap(n,e.filter(r=>"relativePath"in r&&"symbol"in r&&"leaf"in r)))}function V(n,e,t={}){return t.skipPath?_(n,e,t):ue(xe.get(n,()=>new Map),e,i=>_(n,i))}function de(n,e,t={}){let i=q(n,e,{semantic:t.semantic,semanticEvidence:t.semanticEvidence});return t.sourceFallback===!1?i:me(i,V(n,e))}function me(n,e){let t=new Map;for(let[i,r]of n)t.set(i,new Set(r));for(let[i,r]of e){let o=t.get(i)??new Set;for(let a of r)o.add(a);t.set(i,o)}return t}function be(n,e,t){let i=e.identifierResolution==="strict"?T:ce,r=e.candidateNames?se(e.candidateNames):null,o=0,a=0,f=0,c=0,m="";for(let s of e.paths)if(o+=1,m=s,!(!y(s)&&!(e.includeVueSfc&&O(s)))&&!n.isIgnored(s)&&!e.skipPath?.(s))try{if(r&&!le(B(n,s),r))continue;a+=1;let h=(u,b,k,g)=>{if(e.candidateNames&&!e.candidateNames.has(u))return;f+=1;let R=e.resolveTargets?e.resolveTargets({sourceFile:s,name:u,kind:b,defaultTargets:g}):g();for(let E of R)c+=1,t({sourceFile:s,name:u,target:E,occurrences:k,kind:b})},x=te(n,s);for(let[u,b]of x)h(u,"identifier",b.length,()=>i(n,s,u));for(let u of S(n,s,{includeCrossLanguageDispatchNames:e.includeCrossLanguageDispatchNames,includeRustAttributeNames:e.includeRustAttributeNames})){let b=u.kind==="cross-language-dispatch"?()=>T(n,s,u.name):()=>i(n,s,u.name);h(u.name,u.kind,u.occurrences,b)}}finally{e.afterPath?.(s),o%10===0&&G("source-reference-scan.progress",()=>{},()=>({scannedPaths:o,currentPath:m,candidateMatchedPaths:a,visitedNames:f,visitedHits:c}))}}function pe(n,e={}){let{scope:t,files:i,minLoc:r=1,maxLoc:o=Number.POSITIVE_INFINITY,excludeSymbol:a,excludeEntrySurfaces:f=!1,excludeTypesFiles:c=!1,excludeRootedSymbols:m=!1,requireFunctionLikeSymbol:s=!1,requireCallableSymbol:F=!1,excludeRustTraitImplMembers:h=!1,includeSuppressed:x=!1,sortByLocDesc:u=!1}=e,b=[],k=ke(n,{scope:t,files:i,requireFunctionLikeSymbol:s,requireCallableSymbol:F}),g=new Map,R=new Map,E=l=>{let d=g.get(l);if(d!==void 0)return d;let p=ee(n,l);return g.set(l,p),p},Se=l=>{let d=R.get(l);if(d!==void 0)return d;let p=C(l);return R.set(l,p),p};for(let l of k){let d=l.relativePath;if(n.isIgnored(d)||f&&E(d)||!Ee(l,{requireFunctionLikeSymbol:s,requireCallableSymbol:F})||a!==void 0&&l.symbol===a)continue;let p=L(l);p<r||p>o||c&&we(d)||m&&ne(n,l.symbol,d)||h&&X(l.symbol)||Se(d)!=="test"&&(Y(l.symbol)||!x&&D(n,d,l.startLine)||b.push(l))}return u?b.sort((l,d)=>L(d)-L(l)):b}function ke(n,e){return e.files!==void 0?[...new Set(e.files.map(i=>i.replace(/\\/g,"/")))].sort().filter(i=>!e.scope||i.includes(e.scope)).flatMap(i=>v(n,i)):e.requireCallableSymbol?N(n,{scope:e.scope,symbolMatches:P,sqlPrefilter:"callable"}):e.requireFunctionLikeSymbol?N(n,{scope:e.scope,symbolMatches:A,sqlPrefilter:"function-like"}):$(n,e.scope)}function Ee(n,e){return e.requireCallableSymbol?P(n.symbol):e.requireFunctionLikeSymbol?A(n.symbol):n.isFunctionLike}function we(n){return(n.split("/").pop()??"").includes("types")}var ye=class{constructor(e){this.db=e}db;scopedDefinitions(e){return Z(this.db,e)}definitionsForFile(e){return v(this.db,e)}productionCallableDefinitions(e={}){return pe(this.db,e)}calleeMap(e,t={}){return fe(this.db,e,{...t,semanticEvidence:I})}crossFileCallerMap(e,t={}){return q(this.db,e,{...t,semanticEvidence:I})}sourceFallbackCallerFiles(e,t={}){return V(this.db,e,t)}callerFileMap(e,t={}){return de(this.db,e,{...t,semanticEvidence:I})}frameworkReferencedSymbolIds(e){let t=new Map;for(let r of e){if(!r.leaf)continue;let o=t.get(r.leaf)??[];o.push(r.symbolId),t.set(r.leaf,o)}let i=new Set;for(let r of M(this.db,{includeIgnored:!1}))if(y(r)==="rust")for(let{name:o}of S(this.db,r,{includeRustAttributeNames:!0}))for(let a of t.get(o)??[])i.add(a);return i}symbolsWithNonSelfCallees(e,t={}){if(e.length===0)return new Set;let i=new Map(e.map(o=>[o.symbolId,o.symbol])),r=this.calleeMap(e,t);return new Set([...r.entries()].filter(([o,a])=>{let f=i.get(o);return a.some(c=>c.symbol!==f)}).map(([o])=>o))}fileDependencyGraph(e){return Q(this.db,e)}fileKind(e){return C(e)}hasSuppressionComment(e){return D(this.db,e.relativePath,e.startLine)}sourceFiles(){return H(this.db)}scanSourceReferences(e,t){be(this.db,e,t)}callableSignature(e){let t=U(this.db).forFile(e.relativePath,{facts:!0}).facts?.callables.find(i=>i.startLine===e.startLine&&i.endLine===e.endLine);return t?{paramCount:t.paramCount}:null}};export{V as a,me as b,ye as c};
+//# sourceMappingURL=chunk-2BMSSRBH.js.map

package/dist/{chunk-TAYD3AE7.js → chunk-2GJSD5GY.js}

@@ -1,3 +1,3 @@
-import{e as i}from"./chunk-TD7VKJ2Y.js";import{a as o}from"./chunk-42W3LFUK.js";import{E as s}from"./chunk-Q7GBK5T7.js";function u(r,e){let t=s(r,e.relativePath);if(t.length===0)return!1;let n=i(e.symbol);if(!n)return!1;let c=t.slice(Math.max(0,e.startLine-2),e.startLine+1).join(`
+import{e as i}from"./chunk-C7C6AKAT.js";import{a as o}from"./chunk-RBAD4GJ2.js";import{k as s}from"./chunk-ETC674NS.js";function u(r,e){let t=s(r,e.relativePath);if(t.length===0)return!1;let n=i(e.symbol);if(!n)return!1;let c=t.slice(Math.max(0,e.startLine-2),e.startLine+1).join(`
 `),a=o(n);return new RegExp(`^\\s*export\\s+(?:default\\s+)?(?:(?:async\\s+)?function\\s+${a}\\b|(?:abstract\\s+)?class\\s+${a}\\b|(?:interface|type|enum|namespace|module)\\s+${a}\\b|(?:const|let|var)\\s+${a}\\b)`,"m").test(c)?!0:p(t,n)}function p(r,e){if(!e)return!1;let t=new RegExp(`^\\s*export\\s*\\{[^}\\n]*\\b${o(e)}\\b`);return r.some(n=>t.test(n))}export{u as a};
-//# sourceMappingURL=chunk-TAYD3AE7.js.map
+//# sourceMappingURL=chunk-2GJSD5GY.js.map