scip-query 0.23.0 → 0.26.0

package/CHANGELOG.md

@@ -2,7 +2,496 @@
 
 All notable changes to `scip-query` are documented here. This file starts at 0.11.0; everything below covers behavior changes made since the 0.10.12 release.
 
-## [Unreleased]
+## [0.26.0] - 2026-09-11
+
+### Agent workflows and quality review
+
+- `review --base <ref>` evaluates changed, new, and untracked TS/JS functions
+  for complexity and duplication. Coverage-backed risk analysis requires
+  coverage matched to the reviewed source.
+- `system --source [module]` supplies current module files, exports, imports,
+  consumers, policy, and findings without first building an index. `health`
+  reports concrete source findings instead of an aggregate health score.
+- Consolidated agent guidance into six workflows: `scip-query`, `scip-explore`,
+  `scip-plan`, `scip-architecture-review`, `scip-integrity-audit`, and
+  `scip-setup`. Planning requires documenting the existing end-to-end flow,
+  comparable features, shared owners, and reuse choices before implementation.
+  Use ordinary file tools for source reading and scip-query for relationships,
+  architecture, quality findings, and change impact.
+
+### Output and migration notes
+
+- Oversized human output now saves the complete result to a temporary file
+  and prints a preview and file location. Automatic continuation prompts and
+  routine metadata footers are removed. Explicit pagination and the internal
+  `continue` command remain available. Use `--json --json-output <path>` for
+  programmatic filtering; human output is not a stable parsing interface.
+- Source and graph additions are opt-in: for example, `inspect --bindings`
+  requests binding details and `evidence --detail` requests detailed edges.
+- Removed overlapping CLI commands: `trace`, `reference-neighborhood`,
+  `value-flow`, `reference-reachability`, `isolated`, `similar-chains`,
+  `extract-candidates`, `wrapper-candidates`, `stale-abstractions`,
+  `complexity-hotspots`, and `self-audit`. Use `evidence` for explicit typed
+  relationships, `refs` for reference sites, `dead` for unused-code candidates,
+  `dependence-slice` / `slice-cohesion` for local flow questions, and
+  `health` / `review` / `complexity` for quality findings. See
+  [the current command inventory](docs/CURRENT_COMMANDS.md) for scope and
+  [the command reference](docs/COMMAND_REFERENCE.md) for arguments.
+- Removed obsolete JavaScript package subpaths under `scip-query/queries/`:
+  `anchors`, `complexity-hotspots`, `convergence`, `dataflow`, `deep-chains`,
+  `system-map`, `extract-candidates`, `isolated`, `plan-context`,
+  `reference-neighborhood`, `reference-reachability`, `self-audit`,
+  `similar-chains`, `slice`, `stale-abstractions`, `trace`, `twin-ab`,
+  `value-flow`, and `wrapper-candidates`. Update imports to supported query
+  entries; replacements are not necessarily signature-compatible.
+
+### TypeScript accuracy and incremental indexing
+
+- Corrected compiler identity and source binding handling across index
+  partitions, anonymous/default exports, mutable bindings, and nested value
+  reads. Graph results retain the distinction between established edges,
+  derived observations, and candidates that require confirmation.
+- Strengthened stale-input detection, source dependency tracking, cache
+  invalidation, failed-publication recovery, and incremental compiler-state
+  recovery. Failed compiler work does not publish a partially replaced index.
+- Preserved watcher ownership through cleanup failures and made unavailable
+  incremental-service recovery explicit. Configured rebuild policy and
+  disabled watchers remain respected.
+- Added reproducible property-based tests and state-transition coverage for
+  indexing, caches, query inputs, and publication recovery, alongside
+  independent known-answer graph tests. These tests do not establish complete
+  TypeScript or runtime coverage.
+
+### Indexing performance
+
+- Reuse verified compiler documents and runtime analysis after incremental
+  edits; avoid repeated reference preparation and runtime mount parsing.
+- Share parsed TypeScript sources across bounded compiler batches and reuse
+  focused source facts during graph analysis.
+- On the recorded LaunchPoint backend snapshot, the final compiler-batch
+  change reduced a cold index from 192.9 to 167.4 seconds and compiler work
+  from 119.7 to 95.1 seconds. All 9,485 compiler documents and recorded
+  runtime facts matched the preceding build. Peak process-tree memory rose
+  from 11.8 to 12.5 GiB; the one-minute cold-index target remains unmet.
+  Results are workload-specific, not a universal latency or memory guarantee.
+- The Windows sidecar remains pinned to `scip-query-scip-windows@0.13.1`.
+  Node.js 22 or later is still required.
+
+### Release checks
+
+- Build before the complete test suite so CLI contracts exercise the artifact
+  that will be packed. Use the compiled CLI in the source-reading contract
+  suites and share Node's compilation cache between release test subprocesses,
+  with temporary-cache cleanup and explicit cache/coverage controls preserved.
+- Reduce temporary SQLite journal churn in generated read-proof tests while
+  retaining the separate reader, every edit checkpoint, and existing timeouts.
+  Keep the two-worker test limit and all release checks.
+
+## [0.25.0]
+
+### Slice-based cohesion
+
+- New `slice-cohesion [symbol]` command. For every value a TypeScript
+  function hands out (its return value, each property of a returned object
+  literal, an effect call, a write to a parameter or field, a throw) it
+  takes the backward slice over the compiler-owned local flow graph and
+  partitions the body by which outputs share statements. Outputs whose
+  slices never meet are separate local computations; the largest cluster
+  stays in place and every other qualifying cluster is reported as an
+  extraction with its line ranges, the outputs it produces, and the
+  parameters it would take. Exit-only guards (including branches that only
+  log before leaving), shared setup derived only from inputs, and writes
+  that reach a parameter through an alias (`bucket = map.get(k)`,
+  `map.set(k, bucket)`) are modeled so that one-computation functions stay
+  whole.
+- The model keeps failure handling with the operation it protects: every
+  statement in a `catch` or `finally` block depends on the try block it
+  handles. A function's return value is one output no matter how many
+  return statements produce it, and the same field on several returned
+  object literals is one output, so alternate returns and guard clauses
+  are not seams.
+- React bodies are modeled by state ownership. A tuple state hook
+  (`const [x, setX] = useState()`) makes `setX(...)` a write to `x` when it
+  runs at render time or inside an effect callback (directly, through
+  promise continuations and timers, or through a `useCallback` closure the
+  effect calls), so later reads of `x` depend on it. Event handlers declared
+  and passed away write nothing until invoked. Candidates carry an
+  archetype (`calculation`, `react-component`, `react-hook`,
+  `orchestration`), clusters carry a kind (`calculation`, `hook`,
+  `effects`) and a role (`remainder`, `extraction`, `below-threshold`), and
+  the recommendation names a pure calculation, custom hook, or effect
+  sequence candidate rather than a generic function split.
+- Guards are structural: a then-branch that only prepares or reports an exit
+  (calls, local bindings, then a return or throw whose value is not computed
+  in the branch or an enclosing loop) is an exit, so `return empty` after a
+  shared constant, a log line before `return null`, and `return
+suppress(params)` do not form clusters. Every unit also depends on the
+  predicates that syntactically enclose it, so a strategy branch inside a
+  `try` shares its branch with the fallback that follows. Shared setup is
+  judged against the partition: a unit read by outputs of one cluster only
+  returns to that cluster. Clusters that compute a result while awaiting or
+  producing effects are `operation` candidates, not pure calculations.
+- A keep-whole verdict explains what joins the outputs (statements feeding
+  every output, statements feeding several, chaining through predicates or
+  state writes, or setup-only reads) instead of a bare shared count, and
+  bodies whose only extractions are effect sequences rank after
+  calculations, operations, and hooks with an advisory note that
+  orchestration may be intentional.
+- Extraction interfaces count only what would become a parameter:
+  function parameters, `this`, shared-setup bindings, and locals of an
+  enclosing function. Imports, module-level names, globals, and JSX tags
+  stay what they are. The `signal` tier requires a complete local model
+  and at least one extraction within five parameters; the remainder never
+  needs an interface. Orchestration roots (bodies whose value outputs are
+  all calls) and code under scripts, tools, bin, or migration directories
+  are reported at support tier and ranked last.
+- Coverage names its scope: `coverage.model` is `function-local-flow`,
+  `coverage.candidateEdgeEffect` records that candidate flow edges were
+  treated as dependencies and can only merge clusters, and a partial model
+  turns the recommendation into an inspection request. The JSON envelope
+  reports one row per finding, a targeted symbol reports complete
+  coverage, a scan without a cap reports complete coverage, and a capped
+  scan reports what it omitted. Scan results omit per-unit listings and
+  slice arrays (a targeted symbol keeps them), `--scan-limit <n>` bounds
+  the analysis work independently of `-n`, help states that `--full` and
+  `--limit` cannot be combined, and long scans report progress on stderr.
+- Performance: the analyzer builds one in-memory compiler program per file
+  and previously re-parsed the standard library, re-resolved every import
+  and `@types` package, and looked for `@typescript/lib-*` replacements on
+  each of them. Library and `@types` declaration files are now parsed once
+  per process, imports resolve only when an `@types` package can back
+  them, lib replacement lookup is off, property accesses are keyed by
+  their receiver and member name instead of an inferred property symbol,
+  reaching definitions and postdominators run as bit-set worklists in
+  reverse postorder, and a scan evaluates a file's callables together so
+  its flow graph and parse are shared. On a 7,900-file Next.js repository
+  the `.tsx`-scoped scan went from 177 s to 8 s and the unbounded scan from
+  more than 30 minutes to 33 s.
+
+### Local flow models try, catch, and finally
+
+- The TypeScript local flow CFG now builds try, catch, and finally regions
+  instead of treating a try statement as one opaque node that invalidated
+  every reaching definition. Any node inside a try block may raise, so the
+  state before each of them flows to the catch entry; a `throw` inside the
+  block lands in the catch; the catch binding is a definition; normal
+  completion of either block continues through the finally block. A finally
+  block after a return, break, or continue inside its try or catch is the
+  one remaining disclosed gap. Control dependence is derived from predicate
+  nodes only, so raise edges do not become spurious branches.
+
+### Local flow covers destructuring, element writes, and loop variables
+
+- The TypeScript local definition-use analysis now binds every leaf of an
+  object or array pattern in parameters and declarations, feeds pattern
+  defaults into the definition, records `container[index] = value` as a
+  partial definition that does not kill earlier definitions of the
+  container, draws a `for...of` or `for...in` variable from its iterable,
+  and resolves a shorthand property (`{ value }`) to the local binding
+  rather than the property it creates. Previously a destructuring statement
+  or element write invalidated every reaching definition after it, which
+  truncated `dependence-slice`, `value-flow`, and every consumer of the flow
+  graph.
+
+## [0.24.1]
+
+### Solution-style tsconfigs and a live type checker
+
+- A repository whose root `tsconfig.json` only references other projects
+  (`files: []` plus `references`) crashed every compiler-backed command in
+  0.24.0 (`Cannot read properties of undefined (reading 'flags')`): the
+  root's empty program received each file as an ad hoc addition and the
+  provider kept using a checker from the program before the addition. The
+  root is now replaced by the projects it references, and the provider reads
+  the current program's checker on every use.
+- A function whose return type holds an object type literal
+  (`): Promise<{ url: string }> {`) had its body read from the wrong brace;
+  thin-forwarder, wrapper, twin, and duplicate-body checks now skip type and
+  value literals when locating a body.
+
+### Health counts cycles on the import graph
+
+- The health report's circular-dependency axis counts real cycles on the
+  import graph, where a cycle is a runtime dependency a reader can break.
+  A component that cycles only through type or symbol references (the
+  `cycles` command's default basis) is disclosed as a policy exclusion with
+  its file count instead of being scored. On Launchpoint this turns one
+  725-file symbol-reference component into a disclosure and no counted
+  cycle.
+
+### Detector calibration on a third and fourth repository
+
+Label sets for SuplierScout (Express + React, solution-style tsconfig) and
+Stable_Management (workspace monorepo, five tsconfigs) under
+`docs/validation/labels/`. Only the rules those labels measured as an
+improvement shipped.
+
+- `similar`: two functions in one file sharing four or more callees at
+  similarity 0.5 or more are direct findings whatever the vocabulary class
+  (create/update/delete workflows, archive/restore pairs), because the file's
+  own imports are the scaffolding vocabulary. A cross-file pair whose shared
+  evidence mixes domain behavior with scaffolding is direct from similarity
+  0.6. Precision holds at 1.0 on Launchpoint (recall 0.43 to 0.71) and on
+  Stable_Management (recall 0.33 to 0.92); no labeled false row is promoted
+  on any of the four repositories.
+- `co-change`: a `<Name>.script.ts` companion is a single-file component's
+  script block, so a view script changing with its model is model-view
+  coupling rather than a schema-with-script sweep. Stable_Management recall
+  0.82 to 1.0 at precision 1.0.
+- `extract-candidates`: a selected region that is one statement (an awaited
+  call with callback arguments, a resource or form declaration, a nested
+  function) is support tier, because extracting it would only wrap that
+  statement. SuplierScout precision 0.9 to 1.0 with recall unchanged; Vega
+  unchanged.
+- `extract-candidates`: every tier reason now names the line range it was
+  decided on. The reason said "the largest region" while describing the most
+  actionable region, which is often a different one.
+- `passthrough-candidates`: a body whose parameter carries a default value
+  reshapes its input and is not a literal passthrough (source-facts payload
+  version 10).
+
+## [0.24.0]
+
+### Oversized compiler projects are served from file closures
+
+- A tsconfig that lists more files than the semantic worker's heap can hold
+  (by the same estimate that sizes the heap: 2,560 MB plus 1.25 MB per
+  file) is no longer loaded whole and no longer declined. Its compiler
+  program starts empty and grows by the import closure of each requested
+  file, so callees, callee coverage, signatures, and import usage stay
+  exact per file; references and hierarchies, which need every file, are
+  declined per request and the cheap paths answer them. The service status
+  and provider availability report `projectScope: file-closure`.
+
+### Second-repository review: layering, facades, stubs, and configuration entry points
+
+- A member that calls another member of its twin cluster leaves the cluster
+  before pairing, so a facade method no longer pairs with its near-name
+  siblings either; the delegation check follows one re-export hop, so a
+  caller importing through a barrel is recognized. A thin forwarder whose
+  single call has a different name than its own (a web client calling
+  `apiClient.getData`, a vendor adapter) is a stub over its peer's concept,
+  not a twin of it. Overrides of one abstract member and key-qualified
+  lookup members (`getBySlug`, `findByEmail`) on unrelated classes are
+  convention, not drift.
+- A class whose methods forward to members of several collaborators is a
+  composed-service facade even when no single collaborator receives three
+  forwards. A body of the form `return handler(async () => {...})(req, res,
+next)` is a curried handler, not a literal passthrough.
+- A wrapper forwarding through a module-private variable
+  (`return loadedLanguages.has(lang)`) is a boundary signal: inlining it
+  would export the state it hides.
+- Rendered extraction regions grow to element boundaries: a region cut
+  inside a JSX element now reaches its closing tag or, when it only
+  straddles two elements, fails the size rules instead of reporting a
+  fragment. Growth stops at the function's own `return`, and the candidate's
+  region is the largest extractable one rather than the largest one, so a
+  smaller signal-tier region beside a region that holds the function's
+  return is the advice.
+- Concise arrow bodies are read past braces in parameter types and type
+  arguments (`(x) => client.patchData<{ ok: true }>(x)`), so arrow-function
+  wrappers, twins, and duplicate bodies see the real body. A file of
+  wrappers that all forward through one receiver (a copy catalog, a client
+  object) is a facade over it and its wrappers are signal tier.
+- Co-change findings carry an action tier. Pairs whose shared commits were
+  only broad sweeps, stale pairs with at most two focused co-changes, and
+  configuration, schema, documentation, or generated partners are signal
+  tier and no longer count toward the hidden-coupling score.
+- Source files a root configuration names by path (`next.config.js`
+  `images.loaderFile`, a `package.json` script running `src/scripts/x.ts`)
+  are entry surfaces: their exports are invoked by the framework or tool,
+  not dead.
+- `duplicate-bodies --json` no longer prints policy-exclusion lines into
+  the JSON document or export file; they remain in human output.
+- Label sets for dead code, similar pairs, stale abstractions, complexity
+  hotspots, large components, and co-change on Launchpoint, and for twin
+  drift, wrappers, passthroughs, and extraction on Vega, live under
+  `docs/validation/labels/`.
+
+### Human output redirected to a file is complete
+
+- When stdout is a regular file (`scip-query health --full > report.txt`),
+  human output is written in full. Page cursors remain for terminals and
+  pipes, where the reader is an agent whose context the page budget
+  protects from a client that truncates long tool results.
+
+### Call sites the grammar wraps are no longer dropped
+
+- `await client.getData<T>(...)` parses with the `await` bound to the member
+  expression, and `(a as B).run()`, `a!.run()`, and `(fn)()` wrap the target
+  the same way. The call-site extractor now reads through those wrappers,
+  so the occurrence and AST callee tiers see the call; source facts carry
+  a new payload version. Found by the Vega self-audit's one oracle-only edge.
+
+### Evidence products keyed by build
+
+- File and project evidence rows are keyed by the running build's digest
+  as well as their payload version, and rows another build wrote are pruned
+  when the cache opens. A development build with changed analysis logic
+  never reads a previous build's rows; compiler-derived callee and reference
+  rows keep their schema-only keys.
+
+### Dependency cycles classified by component content
+
+- A cyclic component is classified by what remains after its barrels,
+  tests, and entry files are removed: if the product files still cycle,
+  that cycle is the finding and its witness is reported; if not, the
+  component only cycles through module bookkeeping. Previously the
+  verdict followed one witness path, which could run through a barrel that
+  a genuine product cycle sat beside.
+
+### Wrapper, passthrough, and twin-drift findings reviewed against source
+
+- A wrapper is `forwarding`-shaped only when its body is exactly one call
+  with plain-value arguments; a preparatory statement, a callback, a nested
+  call, or a literal the body builds now makes it a helper (signal tier, not
+  counted by health). The two-statement allowance had classified computed
+  keys, reductions, and two-step operations as inline advice.
+- Boundary-term evidence for wrappers and passthroughs reads owner-qualified
+  leaf names (`BaseLogger log`) instead of path-qualified short names, so a
+  directory both sides live in (`lib/auth/`, `social-providers/`) no longer
+  reads as a boundary while an enclosing class still counts, and a term
+  present on both sides (`toBaseRate` forwarding to `parseBaseRate`) is
+  shared vocabulary rather than a reason to demote the finding.
+- A twin-drift member that calls its same-name counterpart (an operations
+  function over its use-case, a component over the function it renders)
+  is a layer, not a parallel implementation; the delegation exclusion no
+  longer requires the caller to be a thin forwarder, and an aliased import
+  of the counterpart counts only under its alias.
+- Reviewed label sets for the three detectors on `launchpoint-backend`
+  live under `docs/validation/labels/launchpoint-backend/`; the label
+  scorer understands the `direct | signal` tier vocabulary.
+
+### The semantic worker loads one compiler project at a time
+
+- Compiler projects are built lazily: a tsconfig's project exists only once a
+  request needs one of its files, files are routed to the tsconfig that
+  lists them, and a project that was never asked for costs nothing. The
+  semantic worker now carries the same soft-memory retirement mark as the
+  index worker, restarts once after a failure, and a batch whose worker died
+  of memory is retried as file halves down to single files before the
+  service counts as failed. Worker heaps are sized to the indexed document
+  count, capped by physical memory or the container's cgroup limit,
+  whichever is lower.
+
+### Self-audit distinguishes what the compiler cannot see
+
+- A cheap-path answer in a file outside every tsconfig (a test excluded from
+  the build config) is reported as outside oracle coverage rather than as a
+  false positive, and precision is measured over the rest.
+
+### Health report cache keyed by build
+
+- The cache key carries a digest of the running entry bundle, so two builds
+  under one version string never serve each other's reports.
+
+### Compiler callees resolve imported functions, and self-audit measures callee precision
+
+- The compiler callee path bound an imported call to its import alias and then
+  looked for a definition at the import statement, so every cross-file call to
+  an imported function was dropped from the semantic callee product and from
+  the self-audit oracle. Aliases now resolve to their declaration; cached
+  compiler callees carry a new schema so they recompute.
+- The compiler now also reports, per definition, how many call and render
+  sites it resolved inside the repository, resolved to a library or ambient
+  symbol, or could not bind at all. `self-audit` treats a definition with no
+  unbound site as a complete oracle and measures callee and render precision
+  over those symbols; a cheap-only answer next to a partial oracle stays
+  unverified. Scores report `completeOracleSymbols`.
+
+### Whole-project semantic passes stay inside memory
+
+- `extract-candidates --full` (and every other full-mode semantic pass) sent
+  the whole candidate set to the semantic service in one request; on a large
+  repository the service's worker died at its heap limit and the command then
+  loaded the compiler in-process and died at its own. Bulk callee requests are
+  now sent in bounded per-file batches, a service failure on a large index
+  disables semantic enrichment for the run instead of loading the compiler
+  in-process (with a stderr notice), a service that merely lacks a request
+  kind keeps serving the others, and the service sizes its compiler worker
+  heaps from the indexed document count with a machine-memory ceiling.
+  Decoded occurrence data is held in a bounded cache instead of per run.
+
+### Extraction candidates require a real block and stay out of control flow
+
+- A region must span eight lines, and a region holding a `return` statement
+  of the function itself is support tier: it is the function's control flow,
+  not a helper. Exclusive call spans inside one multi-line statement (a
+  fluent query chain, a large literal) now form one region, since a region
+  never cuts through a statement; rendered subtrees keep the proximity rule
+  because a subtree is a legitimate cut inside a `return`. A reviewed
+  Launchpoint label set
+  (`docs/validation/labels/launchpoint-backend/extract-candidates.json`)
+  scores against the current output.
+
+### Carried publications keep the deferred-companion marker
+
+- A publication that carried every language shard rewrote the metadata
+  without the `scipCompanion` marker while its publication record still said
+  `deferred`; the marker is now carried from the accepted generation.
+
+### Health reports name the input they were computed from
+
+- `health` now records provenance: the immutable index generation identity
+  (with its publication time and mode when the generation store has them),
+  the git HEAD, branch, and uncommitted-path count, and the computation time.
+  The text report prints it as an `Input:` line under the file and symbol
+  counts; `health --json` carries it as `provenance`. Two reports whose
+  provenance differs were computed from different inputs, which the file and
+  symbol counts alone could not show.
+
+### Incremental TypeScript refresh survives a reused-shard publication
+
+- A publication that reused the TypeScript shard (only non-TypeScript inputs
+  changed) advances the project snapshot without writing a new overlay, so
+  the next TypeScript edit looked for an overlay named by the new snapshot,
+  found nothing, and every refresh failed with "deferred TypeScript SCIP
+  base has no matching overlay generation" until an explicit
+  `--allow-expensive-rebuild`. The incremental planner now bases the next
+  overlay on the overlay generation the accepted publication carries, which
+  is the overlay that exists.
+
+### Extraction candidates are exclusive regions, not line coincidences
+
+- `extract-candidates` now reports contiguous line ranges whose callees are
+  used nowhere else in the function, grown over the enclosing block's opener
+  and closer, and only when the range is at least five lines, at most three
+  quarters of the body, and leaves the rest of the function with callees of
+  its own. Callees used across the body (loggers, translators) are reported
+  as ambient instead of gluing every region together. When the indexer
+  emitted local-symbol occurrences, each region lists the bindings an
+  extraction would take as parameters and hand back. The previous
+  implementation keyed callee co-occurrence on a source line, so its
+  "clusters" were names sharing one line and its isolation score was always
+  100%; `ExtractCandidate.clusters` is replaced by `regions` and the kinds
+  are now `call-region` and `render-region`.
+
+### Callee edges start from the indexer's own bindings
+
+- The cheap callee path now reads the compiler-resolved occurrence the index
+  already stores for each call line before falling back to leaf-name
+  resolution. Member calls through typed receivers (`this.service.method()`)
+  resolve exactly, and a call the indexer bound to a library or ambient symbol
+  is no longer guessed onto a same-named repository function. Occurrences are
+  decoded per file from the chunk blobs, so no query loads the whole SCIP
+  artifact. `CalleeRow.source` gains `scip-occurrence`, `graph` prints it as
+  `O`, and `self-audit` reports cheap rows by evidence source. On a NestJS +
+  Next.js monorepo, callee recall against the compiler moved from 0.29 to 0.98.
+
+### Eight judgment skills restored to the bundled suite
+
+- `install-skills` and `setup` now also link `principal-maintainability-review`,
+  `scip-system-compression`, `scip-root-cause`, `scip-claim-audit`,
+  `scip-probe-reachability`, `scip-twin-drift`, `scip-calibrate`, and
+  `conductor` into Claude Code, Codex, and the shared agent root. Each is the
+  last full version from this repository's history, ported to the current
+  command surface: retired `diff-gate`, `cleanup-apply`, `plan-context`,
+  `effectiveness`, and `symbols` references are replaced with `diff-impact`,
+  `architecture`, `outline`, and the standalone detectors, and every
+  `metadata.commands` template validates against the live descriptors.
+- The repo-local `.agents/skills/principal-maintainability-review` and
+  `.agents/skills/scip-system-compression` stubs are removed; the bundled
+  skills supersede them.
 
 ## [0.23.0]
 
@@ -256,7 +745,7 @@ All notable changes to `scip-query` are documented here. This file starts at 0.1
   in-process. When more than 256 files have cold fragments and no watch
   service is running, the semantic consumer tier is reported as failed with
   the remedy (`scip-query health --full` once, or `scip-query watch
-  --daemon`) and the source-fallback tier still runs; on a 7,800-file
+--daemon`) and the source-fallback tier still runs; on a 7,800-file
   repository the in-process computation took longer than the 10-minute batch
   budget while the service or the prewarm warms the same rows in the
   background. With warm fragments the same diff-impact takes seconds.