scip-query 0.24.0 → 0.26.0

package/CHANGELOG.md

@@ -2,7 +2,253 @@
 
 All notable changes to `scip-query` are documented here. This file starts at 0.11.0; everything below covers behavior changes made since the 0.10.12 release.
 
-## [Unreleased]
+## [0.26.0] - 2026-09-11
+
+### Agent workflows and quality review
+
+- `review --base <ref>` evaluates changed, new, and untracked TS/JS functions
+  for complexity and duplication. Coverage-backed risk analysis requires
+  coverage matched to the reviewed source.
+- `system --source [module]` supplies current module files, exports, imports,
+  consumers, policy, and findings without first building an index. `health`
+  reports concrete source findings instead of an aggregate health score.
+- Consolidated agent guidance into six workflows: `scip-query`, `scip-explore`,
+  `scip-plan`, `scip-architecture-review`, `scip-integrity-audit`, and
+  `scip-setup`. Planning requires documenting the existing end-to-end flow,
+  comparable features, shared owners, and reuse choices before implementation.
+  Use ordinary file tools for source reading and scip-query for relationships,
+  architecture, quality findings, and change impact.
+
+### Output and migration notes
+
+- Oversized human output now saves the complete result to a temporary file
+  and prints a preview and file location. Automatic continuation prompts and
+  routine metadata footers are removed. Explicit pagination and the internal
+  `continue` command remain available. Use `--json --json-output <path>` for
+  programmatic filtering; human output is not a stable parsing interface.
+- Source and graph additions are opt-in: for example, `inspect --bindings`
+  requests binding details and `evidence --detail` requests detailed edges.
+- Removed overlapping CLI commands: `trace`, `reference-neighborhood`,
+  `value-flow`, `reference-reachability`, `isolated`, `similar-chains`,
+  `extract-candidates`, `wrapper-candidates`, `stale-abstractions`,
+  `complexity-hotspots`, and `self-audit`. Use `evidence` for explicit typed
+  relationships, `refs` for reference sites, `dead` for unused-code candidates,
+  `dependence-slice` / `slice-cohesion` for local flow questions, and
+  `health` / `review` / `complexity` for quality findings. See
+  [the current command inventory](docs/CURRENT_COMMANDS.md) for scope and
+  [the command reference](docs/COMMAND_REFERENCE.md) for arguments.
+- Removed obsolete JavaScript package subpaths under `scip-query/queries/`:
+  `anchors`, `complexity-hotspots`, `convergence`, `dataflow`, `deep-chains`,
+  `system-map`, `extract-candidates`, `isolated`, `plan-context`,
+  `reference-neighborhood`, `reference-reachability`, `self-audit`,
+  `similar-chains`, `slice`, `stale-abstractions`, `trace`, `twin-ab`,
+  `value-flow`, and `wrapper-candidates`. Update imports to supported query
+  entries; replacements are not necessarily signature-compatible.
+
+### TypeScript accuracy and incremental indexing
+
+- Corrected compiler identity and source binding handling across index
+  partitions, anonymous/default exports, mutable bindings, and nested value
+  reads. Graph results retain the distinction between established edges,
+  derived observations, and candidates that require confirmation.
+- Strengthened stale-input detection, source dependency tracking, cache
+  invalidation, failed-publication recovery, and incremental compiler-state
+  recovery. Failed compiler work does not publish a partially replaced index.
+- Preserved watcher ownership through cleanup failures and made unavailable
+  incremental-service recovery explicit. Configured rebuild policy and
+  disabled watchers remain respected.
+- Added reproducible property-based tests and state-transition coverage for
+  indexing, caches, query inputs, and publication recovery, alongside
+  independent known-answer graph tests. These tests do not establish complete
+  TypeScript or runtime coverage.
+
+### Indexing performance
+
+- Reuse verified compiler documents and runtime analysis after incremental
+  edits; avoid repeated reference preparation and runtime mount parsing.
+- Share parsed TypeScript sources across bounded compiler batches and reuse
+  focused source facts during graph analysis.
+- On the recorded LaunchPoint backend snapshot, the final compiler-batch
+  change reduced a cold index from 192.9 to 167.4 seconds and compiler work
+  from 119.7 to 95.1 seconds. All 9,485 compiler documents and recorded
+  runtime facts matched the preceding build. Peak process-tree memory rose
+  from 11.8 to 12.5 GiB; the one-minute cold-index target remains unmet.
+  Results are workload-specific, not a universal latency or memory guarantee.
+- The Windows sidecar remains pinned to `scip-query-scip-windows@0.13.1`.
+  Node.js 22 or later is still required.
+
+### Release checks
+
+- Build before the complete test suite so CLI contracts exercise the artifact
+  that will be packed. Use the compiled CLI in the source-reading contract
+  suites and share Node's compilation cache between release test subprocesses,
+  with temporary-cache cleanup and explicit cache/coverage controls preserved.
+- Reduce temporary SQLite journal churn in generated read-proof tests while
+  retaining the separate reader, every edit checkpoint, and existing timeouts.
+  Keep the two-worker test limit and all release checks.
+
+## [0.25.0]
+
+### Slice-based cohesion
+
+- New `slice-cohesion [symbol]` command. For every value a TypeScript
+  function hands out (its return value, each property of a returned object
+  literal, an effect call, a write to a parameter or field, a throw) it
+  takes the backward slice over the compiler-owned local flow graph and
+  partitions the body by which outputs share statements. Outputs whose
+  slices never meet are separate local computations; the largest cluster
+  stays in place and every other qualifying cluster is reported as an
+  extraction with its line ranges, the outputs it produces, and the
+  parameters it would take. Exit-only guards (including branches that only
+  log before leaving), shared setup derived only from inputs, and writes
+  that reach a parameter through an alias (`bucket = map.get(k)`,
+  `map.set(k, bucket)`) are modeled so that one-computation functions stay
+  whole.
+- The model keeps failure handling with the operation it protects: every
+  statement in a `catch` or `finally` block depends on the try block it
+  handles. A function's return value is one output no matter how many
+  return statements produce it, and the same field on several returned
+  object literals is one output, so alternate returns and guard clauses
+  are not seams.
+- React bodies are modeled by state ownership. A tuple state hook
+  (`const [x, setX] = useState()`) makes `setX(...)` a write to `x` when it
+  runs at render time or inside an effect callback (directly, through
+  promise continuations and timers, or through a `useCallback` closure the
+  effect calls), so later reads of `x` depend on it. Event handlers declared
+  and passed away write nothing until invoked. Candidates carry an
+  archetype (`calculation`, `react-component`, `react-hook`,
+  `orchestration`), clusters carry a kind (`calculation`, `hook`,
+  `effects`) and a role (`remainder`, `extraction`, `below-threshold`), and
+  the recommendation names a pure calculation, custom hook, or effect
+  sequence candidate rather than a generic function split.
+- Guards are structural: a then-branch that only prepares or reports an exit
+  (calls, local bindings, then a return or throw whose value is not computed
+  in the branch or an enclosing loop) is an exit, so `return empty` after a
+  shared constant, a log line before `return null`, and `return
+suppress(params)` do not form clusters. Every unit also depends on the
+  predicates that syntactically enclose it, so a strategy branch inside a
+  `try` shares its branch with the fallback that follows. Shared setup is
+  judged against the partition: a unit read by outputs of one cluster only
+  returns to that cluster. Clusters that compute a result while awaiting or
+  producing effects are `operation` candidates, not pure calculations.
+- A keep-whole verdict explains what joins the outputs (statements feeding
+  every output, statements feeding several, chaining through predicates or
+  state writes, or setup-only reads) instead of a bare shared count, and
+  bodies whose only extractions are effect sequences rank after
+  calculations, operations, and hooks with an advisory note that
+  orchestration may be intentional.
+- Extraction interfaces count only what would become a parameter:
+  function parameters, `this`, shared-setup bindings, and locals of an
+  enclosing function. Imports, module-level names, globals, and JSX tags
+  stay what they are. The `signal` tier requires a complete local model
+  and at least one extraction within five parameters; the remainder never
+  needs an interface. Orchestration roots (bodies whose value outputs are
+  all calls) and code under scripts, tools, bin, or migration directories
+  are reported at support tier and ranked last.
+- Coverage names its scope: `coverage.model` is `function-local-flow`,
+  `coverage.candidateEdgeEffect` records that candidate flow edges were
+  treated as dependencies and can only merge clusters, and a partial model
+  turns the recommendation into an inspection request. The JSON envelope
+  reports one row per finding, a targeted symbol reports complete
+  coverage, a scan without a cap reports complete coverage, and a capped
+  scan reports what it omitted. Scan results omit per-unit listings and
+  slice arrays (a targeted symbol keeps them), `--scan-limit <n>` bounds
+  the analysis work independently of `-n`, help states that `--full` and
+  `--limit` cannot be combined, and long scans report progress on stderr.
+- Performance: the analyzer builds one in-memory compiler program per file
+  and previously re-parsed the standard library, re-resolved every import
+  and `@types` package, and looked for `@typescript/lib-*` replacements on
+  each of them. Library and `@types` declaration files are now parsed once
+  per process, imports resolve only when an `@types` package can back
+  them, lib replacement lookup is off, property accesses are keyed by
+  their receiver and member name instead of an inferred property symbol,
+  reaching definitions and postdominators run as bit-set worklists in
+  reverse postorder, and a scan evaluates a file's callables together so
+  its flow graph and parse are shared. On a 7,900-file Next.js repository
+  the `.tsx`-scoped scan went from 177 s to 8 s and the unbounded scan from
+  more than 30 minutes to 33 s.
+
+### Local flow models try, catch, and finally
+
+- The TypeScript local flow CFG now builds try, catch, and finally regions
+  instead of treating a try statement as one opaque node that invalidated
+  every reaching definition. Any node inside a try block may raise, so the
+  state before each of them flows to the catch entry; a `throw` inside the
+  block lands in the catch; the catch binding is a definition; normal
+  completion of either block continues through the finally block. A finally
+  block after a return, break, or continue inside its try or catch is the
+  one remaining disclosed gap. Control dependence is derived from predicate
+  nodes only, so raise edges do not become spurious branches.
+
+### Local flow covers destructuring, element writes, and loop variables
+
+- The TypeScript local definition-use analysis now binds every leaf of an
+  object or array pattern in parameters and declarations, feeds pattern
+  defaults into the definition, records `container[index] = value` as a
+  partial definition that does not kill earlier definitions of the
+  container, draws a `for...of` or `for...in` variable from its iterable,
+  and resolves a shorthand property (`{ value }`) to the local binding
+  rather than the property it creates. Previously a destructuring statement
+  or element write invalidated every reaching definition after it, which
+  truncated `dependence-slice`, `value-flow`, and every consumer of the flow
+  graph.
+
+## [0.24.1]
+
+### Solution-style tsconfigs and a live type checker
+
+- A repository whose root `tsconfig.json` only references other projects
+  (`files: []` plus `references`) crashed every compiler-backed command in
+  0.24.0 (`Cannot read properties of undefined (reading 'flags')`): the
+  root's empty program received each file as an ad hoc addition and the
+  provider kept using a checker from the program before the addition. The
+  root is now replaced by the projects it references, and the provider reads
+  the current program's checker on every use.
+- A function whose return type holds an object type literal
+  (`): Promise<{ url: string }> {`) had its body read from the wrong brace;
+  thin-forwarder, wrapper, twin, and duplicate-body checks now skip type and
+  value literals when locating a body.
+
+### Health counts cycles on the import graph
+
+- The health report's circular-dependency axis counts real cycles on the
+  import graph, where a cycle is a runtime dependency a reader can break.
+  A component that cycles only through type or symbol references (the
+  `cycles` command's default basis) is disclosed as a policy exclusion with
+  its file count instead of being scored. On Launchpoint this turns one
+  725-file symbol-reference component into a disclosure and no counted
+  cycle.
+
+### Detector calibration on a third and fourth repository
+
+Label sets for SuplierScout (Express + React, solution-style tsconfig) and
+Stable_Management (workspace monorepo, five tsconfigs) under
+`docs/validation/labels/`. Only the rules those labels measured as an
+improvement shipped.
+
+- `similar`: two functions in one file sharing four or more callees at
+  similarity 0.5 or more are direct findings whatever the vocabulary class
+  (create/update/delete workflows, archive/restore pairs), because the file's
+  own imports are the scaffolding vocabulary. A cross-file pair whose shared
+  evidence mixes domain behavior with scaffolding is direct from similarity
+  0.6. Precision holds at 1.0 on Launchpoint (recall 0.43 to 0.71) and on
+  Stable_Management (recall 0.33 to 0.92); no labeled false row is promoted
+  on any of the four repositories.
+- `co-change`: a `<Name>.script.ts` companion is a single-file component's
+  script block, so a view script changing with its model is model-view
+  coupling rather than a schema-with-script sweep. Stable_Management recall
+  0.82 to 1.0 at precision 1.0.
+- `extract-candidates`: a selected region that is one statement (an awaited
+  call with callback arguments, a resource or form declaration, a nested
+  function) is support tier, because extracting it would only wrap that
+  statement. SuplierScout precision 0.9 to 1.0 with recall unchanged; Vega
+  unchanged.
+- `extract-candidates`: every tier reason now names the line range it was
+  decided on. The reason said "the largest region" while describing the most
+  actionable region, which is often a different one.
+- `passthrough-candidates`: a body whose parameter carries a default value
+  reshapes its input and is not a literal passthrough (source-facts payload
+  version 10).
 
 ## [0.24.0]
 

package/README.md

@@ -1,31 +1,31 @@
 # scip-query
 
-scip-query is a compiler-backed repository-understanding system for coding
-agents.
-
-A repository-understanding system turns indexed code facts into accurate,
-navigable abstractions of the systems in a codebase. Its essential service is
-structure-preserving compression: an agent can see the relevant regions and
-relationships before an edit, drill into several material regions together,
-and keep exact source identities for its plan without reading every
-implementation. scip-query differs from text search because it uses
-compiler-produced SCIP indexes: two matching words count as the same symbol
-only when the language tooling resolves them to the same definition. It also
-reports coverage gaps, so omitted evidence is not mistaken for evidence that a
-relationship does not exist.
-
-The tool helps an agent answer four practical questions:
-
-- What is this code connected to?
-- Which systems participate in this behavior from entry to final effect?
-- Who consumes it, and what could a change affect?
-- Does the repository declare a structural rule for this dependency?
-- Where do React, Vue, duplication, drift, complexity, or cleanup detectors
-  point to code worth inspecting?
-
-The agent still owns the task, plan, implementation, tests, and final judgment.
-scip-query does not create goals, act as an acceptance test, or decide that work
-is complete.
+For the normal **explore → plan → implement → review** workflow, use `scip-query system --source` for a module inventory, `scip-query health` for cleanup candidates, and `scip-query review --base HEAD` after edits. These inspect current TS/JS source without an index. See [agent workflows and module evidence](docs/SKILLS.md), [review and coverage](docs/REVIEW.md), and the [product vision](docs/PRODUCT_VISION.md).
+
+scip-query helps coding agents inspect code relationships and review changes.
+It uses compiler-produced symbol identities to distinguish definitions that happen
+to share a name, then attaches source locations and coverage to the relationships
+it reports.
+
+The core workflow is to locate the code, inspect the relationships relevant to a
+change, make the change, and check its consumers and declared architectural rules.
+The tool supplies evidence; design decisions still require understanding the
+project's responsibilities and verifying behavior with tests.
+
+| Question | Evidence to use |
+| --- | --- |
+| Which definition does this reference mean? | Search, outline, references, exact source |
+| What can call this, or be called by it? | Execution relationships |
+| Where does a value come from? | Value transfers and function-local dependence slices |
+| What state or external boundary does this operation touch? | State and runtime relationships, with provider limits |
+| Which dependencies are permitted? | Explicit architecture rules |
+| What might my edit affect? | Changed symbols and downstream consumers from diff-impact |
+| Which code warrants review? | Individual health findings, exclusions, and analysis coverage |
+
+Containment identifies where a symbol is declared. Domain ownership identifies
+which module is responsible for enforcing a rule or controlling a resource;
+containment alone cannot establish that responsibility. Neither a dependency count
+nor a detector finding establishes architectural quality.
 
 ## Install
 
@@ -49,7 +49,7 @@ allow-scripts=... --location=user` command npm prints; `--allow-scripts` is
 rejected inside a project directory by design.
 
 Setup detects supported languages, installs or checks their indexers, builds
-the local index, installs the bundled skills, and writes concise agent guidance.
+the local index, installs the six agent workflows, and writes concise agent guidance.
 When the repository declares valid architecture rules, setup also installs one
 checkout-local Stop hook that checks those rules after indexed source changes.
 It does not install a completion gate, pre-commit gate, or CI enforcement.
@@ -63,81 +63,36 @@ scip-query capabilities
 
 ## The normal workflow
 
-Use scip-query as the primary reading surface for indexed source. First name the
-few material repository facts the answer depends on. Locate exact referents with
-`search` for trustworthy text, `outline` for a known file, or `entrypoints` for
-an external callable surface. Then select exact symbols or file/line constructs
-and project only the relationship families and directions capable of establishing
-those facts. scip-query resolves identity, typed edges, evidence strength, provider
-support, and bounded coverage; it does not decide which facts matter to the task.
+Use ordinary file search and source reads for implementation details. Use
+scip-query to inspect relationships, discover reuse opportunities, evaluate
+module dependencies and review actual changes. For a substantial change, map
+the existing central path and comparable features before choosing an extension
+point; document what will be reused and which consumers are affected.
 
 ```bash
-scip-query search 'work_session_stream_events'
-scip-query evidence \
-  --symbol 'appendWorkSessionStreamEvents' \
-  --edge execution \
-  --edge runtime \
-  --direction both \
-  --depth 2 \
-  --max-edges 32
+scip-query system --source
+scip-query evidence --at src/service.ts:42 --edge execution --direction incoming --depth 1 --max-edges 30
 ```
 
-Treat the evidence inventory, facts, calibration, coverage, and recovery paths as
-one contract. Missing output is not evidence of absence. If a material fact still
-requires implementation behavior, batch its exact constructs into `inspect --view
-behavior`. Use `code` only when exact syntax can change the decision. Do not reread
-source already rendered by either command, and do not expand unrelated frontiers.
-
-Before answering, audit the draft itself against the material claims. A fact
-seen in evidence but left implicit in the answer is not recovered. Copy returned
-file and line identities exactly rather than reconstructing citation paths.
-
-A broad literal is counted exactly and returned with recoverable structural scopes.
-Narrow only when a named material fact requires one of those scopes.
-
-`code` accepts up to 24 exact symbols, ranges, or indexed file paths. A file
-path returns its exported definitions—or its top-level definitions when the
-language has no explicit export surface—plus the file-local definitions they
-reference, then lists every omitted local definition as an exact range. This
-keeps the default source surface small without hiding what remains available.
-Use `--members all` only when the complete file matters. If a proposed packet
-would exceed the active output budget, `code` emits no partial source and
-prints exact complete-packet splits; narrow to the exact units still needed
-before deciding whether every split remains necessary.
-
-Start an unknown path with `search`; batch related text, symbol, and file-line
-anchors with `inspect`; use `evidence` when one symbol and its real uses are the
-center of the question. For tracked nonbinary repository content, keep
-exploration on scip-query. Native tools are for applying edits, running checks,
-binary content, or a specific unsupported gap that scip-query has explicitly
-reported.
-
-```bash
-scip-query search work_session_stream_events
-scip-query inspect --search sessionStreamEvents --search work_session_stream_events --view behavior
-scip-query evidence appendWorkSessionStreamEvents --include definition,references,callers,callees
-```
-
-`inspect --view behavior` returns the cheapest faithful syntax-derived view of
-each complete source unit. Compact units stay raw. Larger units become
-hierarchical outlines only when that representation is materially smaller;
-every source statement is represented, and unsupported or
-compression-sensitive statements are copied verbatim. Coverage reports the
-represented, copied, and omitted counts. Exact source can be requested for any
-unit whose complete implementation matters. `inspect --symbol` includes definitions,
-references, callers, callees, dependencies, and consumers by default.
-
-Search, location, and relationship evidence is deduplicated into one ranked
-packet. Exact locations and definitions rank first; later units must add new
-file, role, scope, symbol, or behavior coverage. A default packet materializes
-at most 12 matching lines per text selector, then applies a soft ceiling of 48
-units or 60,000 displayed-evidence characters without clipping a returned
-syntax unit. Its omission ledger groups everything withheld by scope and role,
-reports what each group contains, and gives an exact command for drilling into
-that group. Drill into several relevant groups together; use `--full` only when
-all omitted evidence can change the decision. Large rendered output from other
-commands can still use the universal byte-transport continuation printed by
-every command.
+The module inventory shows groups and dependencies; selecting a printed group
+reveals its files, exports and import sites. The evidence command answers a
+chosen relationship question. Use incoming/outgoing execution for callers and
+callees, dataflow for values, runtime for handoffs and dependencies for imports.
+Candidate edges require confirmation. Missing or bounded evidence cannot
+establish absence. `evidence --detail` adds inventory and provider explanations
+when their limitations matter.
+
+`search`, `outline`, `entrypoints`, `code` and `inspect` remain optional tools
+for compiler identity, nesting, external roots or grouped source reads. `code`
+accepts exact symbols, file ranges or file paths; `--members all` selects a
+complete file and `--local-calls` adds same-file callees of a selected range.
+`inspect --view behavior` can provide a statement-accounted view of a selected
+construct. Both source commands add external literal values only with
+`--bindings`. Their machine results retain detailed evidence.
+
+Load the relevant [workflow skill](docs/SKILLS.md), batch useful questions and
+stop when the facts needed for the change are settled. There is no requirement
+to exhaust the command catalogue, unrelated relationships or saved output.
 
 Before a nonlocal change:
 
@@ -146,7 +101,7 @@ scip-query context RetryPolicy
 ```
 
 `context` returns a bounded evidence packet for a symbol, file, or module. It
-combines definitions, references, calls, data flow, dependencies, consumers,
+combines definitions, references, call neighborhoods, dependencies, consumers,
 change risk, history, suppressions, and possible reuse sites. A bounded packet
 is a deliberately limited result: it is useful for a decision but does not
 claim to contain every possible relationship.
@@ -221,7 +176,6 @@ scip-query incomplete-migration --full
 scip-query doc-drift --full
 scip-query unused-params --full
 scip-query dead --full
-scip-query isolated --full
 scip-query cycles --full
 scip-query co-change --full
 ```
@@ -244,14 +198,12 @@ still pass.
 
 ## Focused graph queries
 
-Use the aggregate `context` command first for ordinary planning. Reach for a
-focused query when one unresolved relationship can change the decision:
+Choose a focused query when one unresolved relationship can change the decision:
 
 ```bash
 scip-query refs SomeSymbol --full
-scip-query trace SomeSymbol
 scip-query call-graph SomeSymbol
-scip-query value-flow SomeSymbol
+scip-query evidence --symbol SomeSymbol --edge dataflow --direction both --depth 2 --max-edges 48
 scip-query affected SomeSymbol --full
 scip-query system src/payments
 scip-query surface src/payments
@@ -262,6 +214,43 @@ scip-query rdeps src/payments/service.ts
 Do not repeat an unchanged query after context compaction. Re-run when source,
 the index generation, the command input, or the required coverage changed.
 
+## Value flow and slicing
+
+A value transfer connects a particular value-producing occurrence to an occurrence
+that receives it. `evidence --edge dataflow` reports supported static transfer relationships,
+including argument-to-parameter and consumed return-value relationships. Each
+edge distinguishes confirmed evidence from candidates and reports provider limits.
+
+A backward slice identifies the source occurrences that can affect a chosen
+variable occurrence through assignments, value use, or conditions governing
+execution. A forward slice follows those dependencies toward affected occurrences.
+`dependence-slice` computes these within one TypeScript or JavaScript callable:
+
+```bash
+scip-query dependence-slice src/payments/service.ts:42 --variable total
+scip-query dependence-slice src/payments/service.ts:42 --variable total --column 10
+scip-query dependence-slice src/payments/service.ts:12 --variable amount --forward
+```
+
+Lines and columns in command arguments are one-based. Ambiguous occurrences are
+listed for refinement. The default traverses the local graph to completion;
+`--depth` limits hops and `--max-edges` bounds rendered edges. Coverage distinguishes
+output bounds from an incomplete analysis. Calls into other functions, general heap
+aliasing (different references to the same stored object), closure invocation order,
+and unsupported exception behavior require separate evidence. This is a dependency
+slice, not a proof that extracting its statements into a function preserves behavior.
+
+`slice-cohesion` compares slices for a function's different outputs to suggest
+possible separations. Its suggestions require source confirmation and tests; partial
+models cannot earn an extraction signal. Health reports retain the individual
+findings and coverage without aggregate quality grades.
+
+## Optional skills
+
+Setup and `install-skills` install `scip-query` and `scip-explore` by default.
+Use `scip-query install-skills --all` to install the shipped specialist workflows.
+Existing specialist installations and user-owned skill directories are preserved.
+
 ## Suppressions
 
 A suppression is a versioned repository record that says one detector finding
@@ -289,28 +278,26 @@ line numbers readable. Programmatic consumers can use:
 scip-query context RetryPolicy --json --result-only
 ```
 
-Search output separates a complete occurrence ledger from source
-materialization. Every exact matching path and line is listed with its owner;
-the default expands only a representative source subset. Use the emitted
-batched drilldowns for selected owners. `search --full` expands every source
-window and is not needed to establish complete text-match coverage.
-
-Cross-command evidence citations are off by default. With an explicit
-`SCIP_QUERY_SESSION`, a complete source unit, a byte-identical exact subset of a
-prior exact source read, or a graph unit/edge may be replaced by a visible
-receipt from the same index generation. Preview coverage never suppresses an
-exact unit. Changed bytes, changed graph content, a new generation, or
-`--reemit` force full evidence.
+Search displays selected matching windows once, with exact locations, optional
+compiler owners and an honest total. Use `--scope` to narrow or `--full` to
+expand all matching windows. The JSON result retains identity metadata.
 
-If output prints `Continue exactly:`, run the emitted command unchanged until
-transport is complete. Transport completion means every rendered character was
-retrieved; it does not make bounded analysis exhaustive.
+Oversized ordinary human output is saved to a private temporary file, with a
+short preview and absolute path. Read or filter the file selectively using
+normal tools; no automatic `continue` call is required. Saved previews expire
+after one hour or can be reclaimed earlier under storage pressure. Redirect
+stdout to your own file for durable output:
 
-Output redirected to a regular file (`scip-query health --full > report.txt`) is written in full; page cursors apply to terminals and pipes, where the reader is an agent whose context the page budget protects.
+```bash
+scip-query health --full > report.txt
+scip-query health --json --json-output report.json
+```
 
-Use `--full` only when complete command coverage can change a decision. Always
-read a command's coverage note before claiming that every caller, consumer, or
-finding was considered.
+Small results, regular-file redirects and machine JSON contracts are preserved.
+Explicit pagination remains a compatibility option. Cross-command evidence
+receipts remain opt-in through `SCIP_QUERY_SESSION`; `--reemit` forces full
+evidence. Material omissions and unsupported/stale evidence remain visible,
+without routine successful coverage footers. See [output modes](docs/CLI_JSON_OUTPUT.md).
 
 ## Configuration
 
@@ -339,8 +326,8 @@ and focused use of the React, Vue, and general cleanup detectors.
 ```bash
 npm install
 npm run typecheck
-npm test
 npm run build
+npm test
 ```
 
 The React and Vue detector suites are part of the normal test surface and must

package/dist/augment-vue-worker.js

@@ -1,2 +1,2 @@
-import{d as t}from"./chunk-3LO4FST5.js";import"./chunk-YUKYB54I.js";import"./chunk-BJT7LSPK.js";import"./chunk-YXPUP5G2.js";import"./chunk-MWN53KRN.js";import"./chunk-IW5XQG5G.js";import"./chunk-7HXT6YLU.js";import"./chunk-7F45LJKI.js";import{writeFileSync as s}from"fs";import{workerData as o}from"worker_threads";var r=o;try{let e=t({projectRoot:r.projectRoot,dbPath:r.dbPath,tsconfig:r.tsconfig,vueFiles:r.vueFiles,tasks:r.tasks});s(r.resultPath,JSON.stringify({version:1,runId:r.runId,workerId:r.workerId,taskIds:r.taskIds,ok:!0,result:e}))}catch(e){s(r.resultPath,JSON.stringify({version:1,runId:r.runId,workerId:r.workerId,taskIds:r.taskIds,ok:!1,error:e instanceof Error?e.message:String(e)}))}
+import{d as t}from"./chunk-YOQVEXVE.js";import"./chunk-O2C4UILI.js";import"./chunk-WXU3DGPU.js";import"./chunk-YUKYB54I.js";import"./chunk-H75GSPRV.js";import"./chunk-QOIXNWQR.js";import"./chunk-GZKFETP5.js";import"./chunk-YULZRALL.js";import"./chunk-TKD34PHN.js";import"./chunk-2HLAFUCY.js";import"./chunk-U5RIG3JP.js";import"./chunk-62BDNPMI.js";import{writeFileSync as s}from"fs";import{workerData as o}from"worker_threads";var r=o;try{let e=t({projectRoot:r.projectRoot,dbPath:r.dbPath,tsconfig:r.tsconfig,vueFiles:r.vueFiles,tasks:r.tasks});s(r.resultPath,JSON.stringify({version:1,runId:r.runId,workerId:r.workerId,taskIds:r.taskIds,ok:!0,result:e}))}catch(e){s(r.resultPath,JSON.stringify({version:1,runId:r.runId,workerId:r.workerId,taskIds:r.taskIds,ok:!1,error:e instanceof Error?e.message:String(e)}))}
 //# sourceMappingURL=augment-vue-worker.js.map

package/dist/by-kind-PRVFAGTQ.js

@@ -0,0 +1,2 @@
+import{a,b}from"./chunk-QJRMOK5N.js";import"./chunk-DVFP6PZI.js";import"./chunk-J5FJMODQ.js";import"./chunk-WOFQ5DTB.js";import"./chunk-PH52RA7D.js";import"./chunk-7Y5T6XDP.js";import"./chunk-X6RMKHJQ.js";import"./chunk-JEVRKFRL.js";import"./chunk-QOIXNWQR.js";import"./chunk-GZKFETP5.js";import"./chunk-HRRFKWPZ.js";import"./chunk-YULZRALL.js";import"./chunk-HGFDYOVB.js";import"./chunk-TKD34PHN.js";import"./chunk-2HLAFUCY.js";import"./chunk-U5RIG3JP.js";import"./chunk-62BDNPMI.js";export{a as byKind,b as kindCounts};
+//# sourceMappingURL=by-kind-PRVFAGTQ.js.map

package/dist/call-graph-DVPAQV2F.js

@@ -0,0 +1,2 @@
+import{a}from"./chunk-VB3GOKOS.js";import"./chunk-BGBBVSH4.js";import"./chunk-7VPEEAAG.js";import"./chunk-S6CZA3MV.js";import"./chunk-65245JCM.js";import"./chunk-NJJMVD65.js";import"./chunk-ZHMRSZFD.js";import"./chunk-ZGTYGDMF.js";import"./chunk-WRQXLNYE.js";import"./chunk-DVFP6PZI.js";import"./chunk-QIWXRW72.js";import"./chunk-LOVIZBJ4.js";import"./chunk-QXEUDXBT.js";import"./chunk-O2C4UILI.js";import"./chunk-WXU3DGPU.js";import"./chunk-YUKYB54I.js";import"./chunk-TRBI4UKT.js";import"./chunk-WKPV2TDZ.js";import"./chunk-F4FNK44D.js";import"./chunk-ZLADLUE6.js";import"./chunk-6FFVZZL4.js";import"./chunk-4XQ4O6IM.js";import"./chunk-BZB4QPIP.js";import"./chunk-CN5EH7O3.js";import"./chunk-T3I6NHBH.js";import"./chunk-J5FJMODQ.js";import"./chunk-WOFQ5DTB.js";import"./chunk-PH52RA7D.js";import"./chunk-7Y5T6XDP.js";import"./chunk-X6RMKHJQ.js";import"./chunk-JEVRKFRL.js";import"./chunk-QOIXNWQR.js";import"./chunk-GZKFETP5.js";import"./chunk-3JIQS44J.js";import"./chunk-O4UZSPPI.js";import"./chunk-B3PYOSCX.js";import"./chunk-HRRFKWPZ.js";import"./chunk-YULZRALL.js";import"./chunk-HGFDYOVB.js";import"./chunk-QZ7KQZRN.js";import"./chunk-TKD34PHN.js";import"./chunk-2HLAFUCY.js";import"./chunk-U5RIG3JP.js";import"./chunk-62BDNPMI.js";export{a as callGraph};
+//# sourceMappingURL=call-graph-DVPAQV2F.js.map

package/dist/{call-graph-evidence-BociKRpF.d.ts → call-graph-evidence-CUtj8V2I.d.ts}

@@ -4,7 +4,7 @@
  * is a leaf-name resolution over imports and local receivers; the other two
  * are the on-demand compiler and chunk co-occurrence paths.
  */
-type CalleeEvidenceSource = 'scip-occurrence' | 'ast-callsite' | 'semantic-callee' | 'scip-chunk';
+type CalleeEvidenceSource = 'scip-occurrence' | 'scip-declaration' | 'ast-callsite' | 'semantic-callee' | 'scip-chunk';
 interface CalleeRow {
     symbol: string;
     file: string;