sigmap 6.13.0 → 6.15.0

package/gen-context.js

@@ -5506,476 +5506,559 @@ __factories["./src/graph/impact"] = function(module, exports) {
 
 // ── ./src/mcp/handlers ──
 __factories["./src/mcp/handlers"] = function(module, exports) {
-  
-  const fs   = require('fs');
-  const path = require('path');
-  const { execSync } = require('child_process');
-  
-  const CONTEXT_FILE = path.join('.github', 'copilot-instructions.md');
-  
-  // Section header keywords in PROJECT_MAP.md
-  const MAP_SECTIONS = {
-    imports: '### Import graph',
-    classes: '### Class hierarchy',
-    routes: '### Route table',
-  };
-  
-  /**
-   * read_context({ module? }) → string
-   *
-   * Returns the full context file, or just the sections whose file paths
-   * contain the given module substring.
-   */
-  function readContext(args, cwd) {
-    const contextPath = path.join(cwd, CONTEXT_FILE);
-    if (!fs.existsSync(contextPath)) {
+'use strict';
+
+const fs   = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+
+const CONTEXT_FILE = path.join('.github', 'copilot-instructions.md');
+const CONTEXT_COLD_FILE = path.join('.github', 'context-cold.md');
+
+function _readContextFiles(cwd) {
+  const paths = [path.join(cwd, CONTEXT_FILE), path.join(cwd, CONTEXT_COLD_FILE)];
+  const chunks = [];
+  for (const p of paths) {
+    if (fs.existsSync(p)) chunks.push(fs.readFileSync(p, 'utf8'));
+  }
+  return chunks.join('\n');
+}
+
+// Section header keywords in PROJECT_MAP.md
+const MAP_SECTIONS = {
+  imports: '### Import graph',
+  classes: '### Class hierarchy',
+  routes: '### Route table',
+};
+
+/**
+ * read_context({ module? }) → string
+ *
+ * Returns the full context file, or just the sections whose file paths
+ * contain the given module substring.
+ */
+function readContext(args, cwd) {
+  const content = _readContextFiles(cwd);
+  if (!content) {
+    return 'No context file found. Run: node gen-context.js';
+  }
+
+  if (!args || !args.module) return content;
+
+  const mod = args.module.replace(/\\/g, '/').replace(/\/$/, '');
+  const lines = content.split('\n');
+  const result = [];
+  let capturing = false;
+
+  for (const line of lines) {
+    if (line.startsWith('### ')) {
+      const filePath = line.slice(4).trim().replace(/\\/g, '/');
+      // Match if file path starts with mod or contains /mod/ or /mod
+      capturing =
+        filePath === mod ||
+        filePath.startsWith(mod + '/') ||
+        filePath.includes('/' + mod + '/') ||
+        filePath.includes('/' + mod);
+      if (capturing) result.push(line);
+      continue;
+    }
+    if (capturing) result.push(line);
+  }
+
+  if (result.length === 0) return `No signatures found for module: ${mod}`;
+  return result.join('\n');
+}
+
+/**
+ * search_signatures({ query }) → string
+ *
+ * Case-insensitive search through all signature lines.
+ * Returns matching lines grouped by file path.
+ */
+function searchSignatures(args, cwd) {
+  if (!args || !args.query) return 'Missing required argument: query';
+
+  const query = args.query.toLowerCase();
+  try {
+    const { buildSigIndex } = __require('./src/retrieval/ranker');
+    const index = buildSigIndex(cwd);
+    if (index.size === 0) {
       return 'No context file found. Run: node gen-context.js';
     }
-  
-    const content = fs.readFileSync(contextPath, 'utf8');
-  
-    if (!args || !args.module) return content;
-  
-    const mod = args.module.replace(/\\/g, '/').replace(/\/$/, '');
-    const lines = content.split('\n');
+
     const result = [];
-    let capturing = false;
-  
-    for (const line of lines) {
-      if (line.startsWith('### ')) {
-        const filePath = line.slice(4).trim().replace(/\\/g, '/');
-        // Match if file path starts with mod or contains /mod/ or /mod
-        capturing =
-          filePath === mod ||
-          filePath.startsWith(mod + '/') ||
-          filePath.includes('/' + mod + '/') ||
-          filePath.includes('/' + mod);
-        if (capturing) result.push(line);
-        continue;
-      }
-      if (capturing) result.push(line);
+    for (const [file, sigs] of index.entries()) {
+      const hits = sigs.filter((s) => s.toLowerCase().includes(query));
+      if (hits.length === 0) continue;
+      if (result.length > 0) result.push('');
+      result.push(`### ${file}`);
+      result.push(...hits);
     }
-  
-    if (result.length === 0) return `No signatures found for module: ${mod}`;
+
+    if (result.length === 0) return `No signatures found matching: ${args.query}`;
     return result.join('\n');
+  } catch (err) {
+    return `_search_signatures failed: ${err.message}_`;
   }
-  
-  /**
-   * search_signatures({ query }) → string
-   *
-   * Case-insensitive search through all signature lines.
-   * Returns matching lines grouped by file path.
-   */
-  function searchSignatures(args, cwd) {
-    if (!args || !args.query) return 'Missing required argument: query';
-    const query = args.query.toLowerCase();
+}
 
-    try {
-      const { buildSigIndex } = __require('./src/retrieval/ranker');
-      const index = buildSigIndex(cwd);
-      if (index.size === 0) {
-        return 'No context file found. Run: node gen-context.js';
-      }
+/**
+ * get_map({ type }) → string
+ *
+ * Returns a section from PROJECT_MAP.md.
+ * type: 'imports' | 'classes' | 'routes'
+ */
+function getMap(args, cwd) {
+  if (!args || !args.type) return 'Missing required argument: type';
 
-      const result = [];
-      for (const [file, sigs] of index.entries()) {
-        const hits = sigs.filter((s) => s.toLowerCase().includes(query));
-        if (hits.length === 0) continue;
-        if (result.length > 0) result.push('');
-        result.push(`### ${file}`);
-        result.push(...hits);
-      }
+  const header = MAP_SECTIONS[args.type];
+  if (!header) {
+    return `Unknown map type: "${args.type}". Use: imports, classes, routes`;
+  }
 
-      if (result.length === 0) return `No signatures found matching: ${args.query}`;
-      return result.join('\n');
-    } catch (err) {
-      return `_search_signatures failed: ${err.message}_`;
-    }
+  const mapPath = path.join(cwd, 'PROJECT_MAP.md');
+  if (!fs.existsSync(mapPath)) {
+    return 'PROJECT_MAP.md not found. Run: node gen-project-map.js';
   }
-  
-  /**
-   * get_map({ type }) → string
-   *
-   * Returns a section from PROJECT_MAP.md.
-   * type: 'imports' | 'classes' | 'routes'
-   */
-  function getMap(args, cwd) {
-    if (!args || !args.type) return 'Missing required argument: type';
-  
-    const header = MAP_SECTIONS[args.type];
-    if (!header) {
-      return `Unknown map type: "${args.type}". Use: imports, classes, routes`;
+
+  const content = fs.readFileSync(mapPath, 'utf8');
+  const idx = content.indexOf(header);
+  if (idx === -1) {
+    return `Section "${header}" not found in PROJECT_MAP.md`;
+  }
+
+  // Extract from this header to the next ### header
+  const after = content.slice(idx);
+  const nextMatch = after.slice(header.length).search(/\n###\s/);
+  return nextMatch === -1 ? after : after.slice(0, header.length + nextMatch);
+}
+
+/**
+ * create_checkpoint({ note? }) → string
+ *
+ * Returns a markdown checkpoint summarising current project state:
+ * - Timestamp and optional user note
+ * - Active git branch + last 5 commit messages
+ * - Token count of current context file
+ * - List of modules present in the context
+ * - Route count (if PROJECT_MAP.md exists)
+ */
+function createCheckpoint(args, cwd) {
+  const note = (args && args.note) ? args.note.trim() : '';
+  const now = new Date().toISOString().replace('T', ' ').slice(0, 19) + ' UTC';
+  const lines = [
+    '# SigMap Checkpoint',
+    `**Created:** ${now}`,
+  ];
+
+  if (note) lines.push(`**Note:** ${note}`);
+  lines.push('');
+
+  // ── Git info ────────────────────────────────────────────────────────────
+  lines.push('## Git state');
+  try {
+    const branch = execSync('git rev-parse --abbrev-ref HEAD', {
+      cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
+    }).trim();
+    lines.push(`**Branch:** ${branch}`);
+  } catch (_) {
+    lines.push('**Branch:** (not a git repo)');
+  }
+
+  try {
+    const log = execSync(
+      'git log --oneline -5 --no-decorate 2>/dev/null',
+      { cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }
+    ).trim();
+    if (log) {
+      lines.push('');
+      lines.push('**Recent commits:**');
+      for (const l of log.split('\n')) lines.push(`- ${l}`);
     }
-  
-    const mapPath = path.join(cwd, 'PROJECT_MAP.md');
-    if (!fs.existsSync(mapPath)) {
-      return 'PROJECT_MAP.md not found. Run: node gen-project-map.js';
+  } catch (_) {} // ignore — not every project uses git
+  lines.push('');
+
+  // ── Context stats ────────────────────────────────────────────────────────
+  lines.push('## Context snapshot');
+  const contextPath = path.join(cwd, CONTEXT_FILE);
+  if (fs.existsSync(contextPath)) {
+    const content = fs.readFileSync(contextPath, 'utf8');
+    const tokens = Math.ceil(content.length / 4);
+
+    // Count modules (### headers are file paths)
+    const modules = content.split('\n').filter((l) => l.startsWith('### ')).map((l) => l.slice(4).trim());
+    lines.push(`**Token count:** ~${tokens}`);
+    lines.push(`**Modules in context:** ${modules.length}`);
+
+    if (modules.length > 0) {
+      lines.push('');
+      lines.push('**Modules:**');
+      for (const m of modules.slice(0, 20)) lines.push(`- ${m}`);
+      if (modules.length > 20) lines.push(`- … and ${modules.length - 20} more`);
     }
-  
-    const content = fs.readFileSync(mapPath, 'utf8');
-    const idx = content.indexOf(header);
-    if (idx === -1) {
-      return `Section "${header}" not found in PROJECT_MAP.md`;
+  } else {
+    lines.push('_No context file found. Run: node gen-context.js_');
+  }
+  lines.push('');
+
+  // ── Route summary ────────────────────────────────────────────────────────
+  const mapPath = path.join(cwd, 'PROJECT_MAP.md');
+  if (fs.existsSync(mapPath)) {
+    const mapContent = fs.readFileSync(mapPath, 'utf8');
+    const routeLines = mapContent.split('\n').filter((l) => l.startsWith('| ') && !l.startsWith('| Method') && !l.startsWith('|---'));
+    if (routeLines.length > 0) {
+      lines.push('## Routes');
+      lines.push(`**Total routes detected:** ${routeLines.length}`);
+      lines.push('');
+      for (const r of routeLines.slice(0, 10)) lines.push(r);
+      if (routeLines.length > 10) lines.push(`| … | +${routeLines.length - 10} more | |`);
+      lines.push('');
     }
-  
-    // Extract from this header to the next ### header
-    const after = content.slice(idx);
-    const nextMatch = after.slice(header.length).search(/\n###\s/);
-    return nextMatch === -1 ? after : after.slice(0, header.length + nextMatch);
   }
-  
-  /**
-   * create_checkpoint({ note? }) → string
-   *
-   * Returns a markdown checkpoint summarising current project state:
-   * - Timestamp and optional user note
-   * - Active git branch + last 5 commit messages
-   * - Token count of current context file
-   * - List of modules present in the context
-   * - Route count (if PROJECT_MAP.md exists)
-   */
-  function createCheckpoint(args, cwd) {
-    const note = (args && args.note) ? args.note.trim() : '';
-    const now = new Date().toISOString().replace('T', ' ').slice(0, 19) + ' UTC';
-    const lines = [
-      '# SigMap Checkpoint',
-      `**Created:** ${now}`,
-    ];
-  
-    if (note) lines.push(`**Note:** ${note}`);
-    lines.push('');
-  
-    // ── Git info ────────────────────────────────────────────────────────────
-    lines.push('## Git state');
-    try {
-      const branch = execSync('git rev-parse --abbrev-ref HEAD', {
-        cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
-      }).trim();
-      lines.push(`**Branch:** ${branch}`);
-    } catch (_) {
-      lines.push('**Branch:** (not a git repo)');
-    }
-  
-    try {
-      const log = execSync(
-        'git log --oneline -5 --no-decorate 2>/dev/null',
-        { cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }
-      ).trim();
-      if (log) {
-        lines.push('');
-        lines.push('**Recent commits:**');
-        for (const l of log.split('\n')) lines.push(`- ${l}`);
-      }
-    } catch (_) {} // ignore — not every project uses git
-    lines.push('');
-  
-    // ── Context stats ────────────────────────────────────────────────────────
-    lines.push('## Context snapshot');
-    const contextPath = path.join(cwd, CONTEXT_FILE);
-    if (fs.existsSync(contextPath)) {
-      const content = fs.readFileSync(contextPath, 'utf8');
-      const tokens = Math.ceil(content.length / 4);
-  
-      // Count modules (### headers are file paths)
-      const modules = content.split('\n').filter((l) => l.startsWith('### ')).map((l) => l.slice(4).trim());
-      lines.push(`**Token count:** ~${tokens}`);
-      lines.push(`**Modules in context:** ${modules.length}`);
-  
-      if (modules.length > 0) {
-        lines.push('');
-        lines.push('**Modules:**');
-        for (const m of modules.slice(0, 20)) lines.push(`- ${m}`);
-        if (modules.length > 20) lines.push(`- … and ${modules.length - 20} more`);
+
+  lines.push('---');
+  lines.push('_Generated by SigMap `create_checkpoint`_');
+
+  return lines.join('\n');
+}
+
+/**
+ * get_routing({}) → string
+ *
+ * Reads the current context file, classifies all indexed files by complexity,
+ * and returns a formatted markdown routing guide showing which files belong
+ * to the fast/balanced/powerful model tier.
+ */
+function getRouting(args, cwd) {
+  const contextPath = path.join(cwd, CONTEXT_FILE);
+  if (!fs.existsSync(contextPath)) {
+    return (
+      '_No context file found. Run `node gen-context.js --routing` first._\n\n' +
+      'This generates routing hints that map each file to a model tier:\n' +
+      '- **fast** (haiku/gpt-4o-mini) — config, markup, trivial utilities\n' +
+      '- **balanced** (sonnet/gpt-4o) — standard application code\n' +
+      '- **powerful** (opus/gpt-4-turbo) — complex, security-critical, or large modules'
+    );
+  }
+
+  // Parse file list from context (### headings are file paths)
+  const content = fs.readFileSync(contextPath, 'utf8');
+  const fileRels = content.split('\n')
+    .filter((l) => l.startsWith('### '))
+    .map((l) => l.slice(4).trim());
+
+  // Build synthetic fileEntries for the classifier
+  // We don't have live sig arrays here, so rebuild from the context blocks
+  const entries = [];
+  const blocks = content.split(/^### /m).slice(1); // slice past the header
+  for (const block of blocks) {
+    const firstLine = block.split('\n')[0].trim();
+    const codeBlock = block.match(/```\n([\s\S]*?)```/);
+    const sigs = codeBlock ? codeBlock[1].trim().split('\n').filter(Boolean) : [];
+    entries.push({ filePath: path.join(cwd, firstLine), sigs });
+  }
+
+  try {
+    const { classifyAll } = __require('./src/routing/classifier');
+    const { formatRoutingSection } = __require('./src/routing/hints');
+    const groups = classifyAll(entries, cwd);
+    return formatRoutingSection(groups);
+  } catch (err) {
+    return `_Routing classification failed: ${err.message}_`;
+  }
+}
+
+/**
+ * explain_file({ path }) → string
+ *
+ * Returns a file's signatures, its direct imports, and files that import it.
+ * path: relative path from project root (e.g. 'src/services/auth.ts')
+ */
+function explainFile(args, cwd) {
+  if (!args || !args.path) return 'Missing required argument: path';
+
+  const targetRel = args.path.replace(/\\/g, '/').replace(/^\//, '');
+  const targetAbs = path.resolve(cwd, targetRel);
+  const contextPath = path.join(cwd, CONTEXT_FILE);
+
+  const lines = ['# explain_file: ' + targetRel, ''];
+
+  // ── Signatures (hot + cold + cache via buildSigIndex) ───────────────────
+  lines.push('## Signatures');
+  let indexedFiles = [];
+
+  try {
+    const { buildSigIndex } = __require('./src/retrieval/ranker');
+    const index = buildSigIndex(cwd);
+    let sigs = index.get(targetRel);
+    if (!sigs) {
+      for (const [file, fileSigs] of index.entries()) {
+        if (file === targetRel || file.endsWith('/' + targetRel) || targetRel.endsWith('/' + file)) {
+          sigs = fileSigs;
+          break;
+        }
       }
+    }
+    if (sigs && sigs.length > 0) {
+      lines.push(...sigs);
     } else {
-      lines.push('_No context file found. Run: node gen-context.js_');
+      lines.push('_No signatures indexed for this file. Run: node gen-context.js_');
     }
+    indexedFiles = [...index.keys()].map((rel) => path.resolve(cwd, rel));
+  } catch (_) {
+    lines.push('_No context file found. Run: node gen-context.js_');
+  }
+
+  if (!fs.existsSync(targetAbs)) {
     lines.push('');
-  
-    // ── Route summary ────────────────────────────────────────────────────────
-    const mapPath = path.join(cwd, 'PROJECT_MAP.md');
-    if (fs.existsSync(mapPath)) {
-      const mapContent = fs.readFileSync(mapPath, 'utf8');
-      const routeLines = mapContent.split('\n').filter((l) => l.startsWith('| ') && !l.startsWith('| Method') && !l.startsWith('|---'));
-      if (routeLines.length > 0) {
-        lines.push('## Routes');
-        lines.push(`**Total routes detected:** ${routeLines.length}`);
-        lines.push('');
-        for (const r of routeLines.slice(0, 10)) lines.push(r);
-        if (routeLines.length > 10) lines.push(`| … | +${routeLines.length - 10} more | |`);
-        lines.push('');
-      }
-    }
-  
-    lines.push('---');
-    lines.push('_Generated by SigMap `create_checkpoint`_');
-  
+    lines.push('> File not found on disk: ' + targetRel);
     return lines.join('\n');
   }
-  
-  /**
-   * get_routing({}) → string
-   *
-   * Reads the current context file, classifies all indexed files by complexity,
-   * and returns a formatted markdown routing guide showing which files belong
-   * to the fast/balanced/powerful model tier.
-   */
-  function getRouting(args, cwd) {
-    const contextPath = path.join(cwd, CONTEXT_FILE);
-    if (!fs.existsSync(contextPath)) {
-      return (
-        '_No context file found. Run `node gen-context.js --routing` first._\n\n' +
-        'This generates routing hints that map each file to a model tier:\n' +
-        '- **fast** (haiku/gpt-4o-mini) — config, markup, trivial utilities\n' +
-        '- **balanced** (sonnet/gpt-4o) — standard application code\n' +
-        '- **powerful** (opus/gpt-4-turbo) — complex, security-critical, or large modules'
-      );
-    }
-  
-    // Parse file list from context (### headings are file paths)
-    const content = fs.readFileSync(contextPath, 'utf8');
-    const fileRels = content.split('\n')
-      .filter((l) => l.startsWith('### '))
-      .map((l) => l.slice(4).trim());
-  
-    // Build synthetic fileEntries for the classifier
-    // We don't have live sig arrays here, so rebuild from the context blocks
-    const entries = [];
-    const blocks = content.split(/^### /m).slice(1); // slice past the header
-    for (const block of blocks) {
-      const firstLine = block.split('\n')[0].trim();
-      const codeBlock = block.match(/```\n([\s\S]*?)```/);
-      const sigs = codeBlock ? codeBlock[1].trim().split('\n').filter(Boolean) : [];
-      entries.push({ filePath: path.join(cwd, firstLine), sigs });
-    }
-  
-    try {
-      const { classifyAll } = __require('./src/routing/classifier');
-      const { formatRoutingSection } = __require('./src/routing/hints');
-      const groups = classifyAll(entries, cwd);
-      return formatRoutingSection(groups);
-    } catch (err) {
-      return `_Routing classification failed: ${err.message}_`;
+
+  lines.push('');
+
+  // ── Direct imports ────────────────────────────────────────────────────────
+  lines.push('## Imports (direct dependencies)');
+  try {
+    const { extractImports } = __require('./src/map/import-graph');
+    const fileContent = fs.readFileSync(targetAbs, 'utf8');
+    const fileSet = new Set(indexedFiles);
+    fileSet.add(targetAbs);
+    const imports = extractImports(targetAbs, fileContent, fileSet);
+    if (imports.length > 0) {
+      for (const imp of imports) lines.push('- ' + path.relative(cwd, imp).replace(/\\/g, '/'));
+    } else {
+      lines.push('_No resolvable relative imports found._');
     }
+  } catch (err) {
+    lines.push('_Could not analyze imports: ' + err.message + '_');
   }
-  
-  function explainFile(args, cwd) {
-    if (!args || !args.path) return 'Missing required argument: path';
-  
-    const targetRel = args.path.replace(/\\/g, '/').replace(/^\//, '');
-    const targetAbs = path.resolve(cwd, targetRel);
-    const contextPath = path.join(cwd, CONTEXT_FILE);
-  
-    const lines = ['# explain_file: ' + targetRel, ''];
-  
-    lines.push('## Signatures');
-    let indexedFiles = [];
-  
-    if (fs.existsSync(contextPath)) {
-      const ctxContent = fs.readFileSync(contextPath, 'utf8');
-      const ctxLines = ctxContent.split('\n');
-      let capturing = false;
-      const sigLines = [];
-  
-      for (const line of ctxLines) {
-        if (line.startsWith('### ')) {
-          if (capturing) break;
-          const rel = line.slice(4).trim().replace(/\\/g, '/');
-          capturing = rel === targetRel || rel.endsWith('/' + targetRel) || targetRel.endsWith('/' + rel);
-          if (capturing) continue;
-        } else if (capturing) {
-          sigLines.push(line);
-        }
-      }
-  
-      const sigs = sigLines.filter((l) => l !== '```' && l.trim() !== '');
-      if (sigs.length > 0) {
-        lines.push(...sigs);
-      } else {
-        lines.push('_No signatures indexed for this file. Run: node gen-context.js_');
-      }
-  
-      indexedFiles = ctxContent
-        .split('\n')
-        .filter((l) => l.startsWith('### '))
-        .map((l) => path.resolve(cwd, l.slice(4).trim()));
-    } else {
-      lines.push('_No context file found. Run: node gen-context.js_');
+
+  lines.push('');
+
+  // ── Callers (reverse-import lookup) ──────────────────────────────────────
+  lines.push('## Callers (files that import this file)');
+  try {
+    const { extractImports } = __require('./src/map/import-graph');
+    const fileSet = new Set(indexedFiles);
+    fileSet.add(targetAbs);
+    const callers = [];
+    for (const f of indexedFiles) {
+      if (f === targetAbs || !fs.existsSync(f)) continue;
+      try {
+        const fc = fs.readFileSync(f, 'utf8');
+        const imps = extractImports(f, fc, fileSet);
+        if (imps.includes(targetAbs)) callers.push(path.relative(cwd, f).replace(/\\/g, '/'));
+      } catch (_) {}
     }
-  
-    if (!fs.existsSync(targetAbs)) {
-      lines.push('');
-      lines.push('> File not found on disk: ' + targetRel);
-      return lines.join('\n');
+    if (callers.length > 0) {
+      for (const c of callers) lines.push('- ' + c);
+    } else {
+      lines.push('_No indexed files import this file._');
     }
-  
-    lines.push('');
-  
-    lines.push('## Imports (direct dependencies)');
-    try {
-      const { extractImports } = __require('./src/map/import-graph');
-      const fileContent = fs.readFileSync(targetAbs, 'utf8');
-      const fileSet = new Set(indexedFiles);
-      fileSet.add(targetAbs);
-      const imports = extractImports(targetAbs, fileContent, fileSet);
-      if (imports.length > 0) {
-        for (const imp of imports) lines.push('- ' + path.relative(cwd, imp).replace(/\\/g, '/'));
-      } else {
-        lines.push('_No resolvable relative imports found._');
-      }
-    } catch (err) {
-      lines.push('_Could not analyze imports: ' + err.message + '_');
+  } catch (err) {
+    lines.push('_Could not analyze callers: ' + err.message + '_');
+  }
+
+  return lines.join('\n');
+}
+
+/**
+ * list_modules({}) → string
+ *
+ * Lists all srcDir modules present in the context file, sorted by token count
+ * descending. Helps agents decide which module to query with read_context.
+ */
+function listModules(args, cwd) {
+  try {
+    const { buildSigIndex } = __require('./src/retrieval/ranker');
+    const index = buildSigIndex(cwd);
+    if (index.size === 0) {
+      return 'No context file found. Run: node gen-context.js';
     }
-  
-    lines.push('');
-  
-    lines.push('## Callers (files that import this file)');
-    try {
-      const { extractImports } = __require('./src/map/import-graph');
-      const fileSet = new Set(indexedFiles);
-      fileSet.add(targetAbs);
-      const callers = [];
-      for (const f of indexedFiles) {
-        if (f === targetAbs || !fs.existsSync(f)) continue;
-        try {
-          const fc = fs.readFileSync(f, 'utf8');
-          const imps = extractImports(f, fc, fileSet);
-          if (imps.includes(targetAbs)) callers.push(path.relative(cwd, f).replace(/\\/g, '/'));
-        } catch (_) {}
-      }
-      if (callers.length > 0) {
-        for (const c of callers) lines.push('- ' + c);
-      } else {
-        lines.push('_No indexed files import this file._');
-      }
-    } catch (err) {
-      lines.push('_Could not analyze callers: ' + err.message + '_');
+
+    const groups = {};
+    for (const [rel, sigs] of index.entries()) {
+      const parts = rel.replace(/\\/g, '/').split('/');
+      const mod = parts.length > 1 ? parts[0] : '.';
+      if (!groups[mod]) groups[mod] = { fileCount: 0, tokenCount: 0 };
+      groups[mod].fileCount++;
+      groups[mod].tokenCount += Math.ceil(sigs.join('\n').length / 4);
     }
-  
-    return lines.join('\n');
-  }
-  
-  function listModules(args, cwd) {
-    try {
-      const { buildSigIndex } = __require('./src/retrieval/ranker');
-      const index = buildSigIndex(cwd);
-      if (index.size === 0) {
-        return 'No context file found. Run: node gen-context.js';
-      }
 
-      const groups = {};
-      for (const [rel, sigs] of index.entries()) {
-        const parts = rel.split('/');
-        const mod = parts.length > 1 ? parts[0] : '.';
-        if (!groups[mod]) groups[mod] = { fileCount: 0, tokenCount: 0 };
-        groups[mod].fileCount++;
-        groups[mod].tokenCount += Math.ceil(sigs.join('\n').length / 4);
-      }
+  const sorted = Object.entries(groups)
+    .map(([mod, data]) => ({ module: mod, fileCount: data.fileCount, tokenCount: data.tokenCount }))
+    .sort((a, b) => b.tokenCount - a.tokenCount);
 
-      const sorted = Object.entries(groups)
-        .map(([mod, data]) => ({ module: mod, fileCount: data.fileCount, tokenCount: data.tokenCount }))
-        .sort((a, b) => b.tokenCount - a.tokenCount);
+  if (sorted.length === 0) return 'No modules found in context file.';
 
-      if (sorted.length === 0) return 'No modules found in context file.';
+  const total = sorted.reduce((s, m) => s + m.tokenCount, 0);
 
-      const total = sorted.reduce((s, m) => s + m.tokenCount, 0);
+  return [
+    '# Modules',
+    '',
+    '| Module | Files | Tokens |',
+    '|--------|-------|--------|',
+    ...sorted.map((m) => `| ${m.module} | ${m.fileCount} | ~${m.tokenCount} |`),
+    '',
+    `**Total context tokens: ~${total}**`,
+    '',
+    '_Use `read_context({ module: "name" })` to get signatures for a specific module._',
+  ].join('\n');
+  } catch (err) {
+    return `_list_modules failed: ${err.message}_`;
+  }
+}
 
-      return [
-        '# Modules',
-        '',
-        '| Module | Files | Tokens |',
-        '|--------|-------|--------|',
-        ...sorted.map((m) => `| ${m.module} | ${m.fileCount} | ~${m.tokenCount} |`),
-        '',
-        `**Total context tokens: ~${total}**`,
-        '',
-        '_Use `read_context({ module: "name" })` to get signatures for a specific module._',
-      ].join('\n');
-    } catch (err) {
-      return `_list_modules failed: ${err.message}_`;
-    }
+/**
+ * query_context({ query, topK? }) → string
+ *
+ * Ranks context-file entries by relevance to the query and returns the
+ * top-K most relevant files with their signatures and scores.
+ */
+function queryContext(args, cwd) {
+  if (!args || !args.query) return 'Missing required argument: query';
+
+  try {
+    const { rank, buildSigIndex, formatRankTable } = __require('./src/retrieval/ranker');
+    const { buildFromCwd } = __require('./src/graph/builder');
+    const index = buildSigIndex(cwd);
+    if (index.size === 0) return 'No signatures indexed. Run: node gen-context.js';
+
+    const topK = Math.min(Math.max(1, parseInt(args.topK, 10) || 10), 25);
+    // Build dependency graph for neighbor boost — non-fatal if it fails
+    let graph = null;
+    try { graph = buildFromCwd(cwd); } catch (_) {}
+    const results = rank(args.query, index, { topK, cwd, graph });
+    return formatRankTable(results, args.query);
+  } catch (err) {
+    return `_query_context failed: ${err.message}_`;
   }
-  
-  function queryContext(args, cwd) {
-    if (!args || !args.query) return 'Missing required argument: query';
-    const contextPath = path.join(cwd, CONTEXT_FILE);
-    if (!fs.existsSync(contextPath)) return 'No context file found. Run: node gen-context.js';
-    try {
-      const { rank, buildSigIndex, formatRankTable } = __require('./src/retrieval/ranker');
-      const index = buildSigIndex(cwd);
-      if (index.size === 0) return 'No signatures indexed. Run: node gen-context.js';
-      const topK = Math.min(Math.max(1, parseInt(args.topK, 10) || 10), 25);
-      const results = rank(args.query, index, { topK, cwd });
-      return formatRankTable(results, args.query);
-    } catch (err) {
-      return `_query_context failed: ${err.message}_`;
-    }
+}
+
+/**
+ * get_impact({ file, depth? }) → string
+ *
+ * Returns a formatted markdown impact report for the given file:
+ * direct importers, transitive importers, affected tests, affected routes.
+ */
+function getImpact(args, cwd) {
+  if (!args || !args.file) return 'Missing required argument: file';
+
+  try {
+    const { analyzeImpact, formatImpact } = __require('./src/graph/impact');
+    const depth = Math.max(0, parseInt(args.depth, 10) || 3);
+    const results = analyzeImpact(args.file, cwd, { depth });
+    if (results.length === 0) return `No impact data for: ${args.file}`;
+    return results.map((r) => formatImpact(r.impact)).join('\n\n---\n\n');
+  } catch (err) {
+    return `_get_impact failed: ${err.message}_`;
   }
-  
-  function getImpact(args, cwd) {
-    if (!args || !args.file) return 'Missing required argument: file';
-    try {
-      const { analyzeImpact, formatImpact } = __require('./src/graph/impact');
-      const depth = Math.max(0, parseInt(args.depth, 10) || 3);
-      const results = analyzeImpact(args.file, cwd, { depth });
-      return results.map((r) => formatImpact(r.impact)).join('\n\n---\n\n');
-    } catch (err) {
-      return `_get_impact failed: ${err.message}_`;
-    }
+}
+
+/**
+ * get_lines({ file, start, end }) → string
+ *
+ * Surgical Context demand-driven fetch: returns an exact, clamped line range from a
+ * source file. The path is resolved inside the project root (no traversal escape) and
+ * the returned lines are secret-scanned via the same redactor used for signatures.
+ */
+function getLines(args, cwd) {
+  if (!args || !args.file) return 'Missing required argument: file';
+
+  const rel = String(args.file).replace(/\\/g, '/').replace(/^\//, '');
+  const abs = path.resolve(cwd, rel);
+
+  // Sandbox: refuse paths that resolve outside the project root.
+  const root = path.resolve(cwd);
+  if (abs !== root && !abs.startsWith(root + path.sep)) {
+    return `Refused: ${rel} resolves outside the project root`;
+  }
+  if (!fs.existsSync(abs) || !fs.statSync(abs).isFile()) {
+    return `File not found: ${rel}`;
   }
 
-  function getLines(args, cwd) {
-    if (!args || !args.file) return 'Missing required argument: file';
+  const start = parseInt(args.start, 10);
+  const end = parseInt(args.end, 10);
+  if (!Number.isFinite(start) || !Number.isFinite(end)) {
+    return 'Arguments "start" and "end" must be numbers (1-based line numbers).';
+  }
 
-    const rel = String(args.file).replace(/\\/g, '/').replace(/^\//, '');
-    const abs = path.resolve(cwd, rel);
+  let lines;
+  try {
+    lines = fs.readFileSync(abs, 'utf8').split('\n');
+  } catch (err) {
+    return `Could not read ${rel}: ${err.message}`;
+  }
 
-    // Sandbox: refuse paths that resolve outside the project root.
-    const root = path.resolve(cwd);
-    if (abs !== root && !abs.startsWith(root + path.sep)) {
-      return `Refused: ${rel} resolves outside the project root`;
-    }
-    if (!fs.existsSync(abs) || !fs.statSync(abs).isFile()) {
-      return `File not found: ${rel}`;
-    }
+  const total = lines.length;
+  const from = Math.max(1, Math.min(start, end));
+  const to = Math.min(total, Math.max(start, end));
+  if (from > total) return `${rel} has only ${total} lines; requested ${start}-${end}`;
 
-    const start = parseInt(args.start, 10);
-    const end = parseInt(args.end, 10);
-    if (!Number.isFinite(start) || !Number.isFinite(end)) {
-      return 'Arguments "start" and "end" must be numbers (1-based line numbers).';
-    }
+  const slice = lines.slice(from - 1, to);
 
-    let lines;
-    try {
-      lines = fs.readFileSync(abs, 'utf8').split('\n');
-    } catch (err) {
-      return `Could not read ${rel}: ${err.message}`;
-    }
+  // Redaction scan: reuse the signature secret scanner line-by-line.
+  let safeLines = slice;
+  try {
+    const { scan } = __require('./src/security/scanner');
+    safeLines = scan(slice, rel).safe;
+  } catch (_) {} // non-fatal: fall back to raw slice
 
-    const total = lines.length;
-    const from = Math.max(1, Math.min(start, end));
-    const to = Math.min(total, Math.max(start, end));
-    if (from > total) return `${rel} has only ${total} lines; requested ${start}-${end}`;
+  return [
+    `# ${rel}:${from}-${to}`,
+    '```',
+    ...safeLines,
+    '```',
+  ].join('\n');
+}
 
-    const slice = lines.slice(from - 1, to);
+/**
+ * read_memory({ limit? }) → string
+ *
+ * Recall the cross-session decision log (notes) plus the last ranking-session
+ * focus, formatted for an agent to consume at the start of a task.
+ */
+function readMemory(args, cwd) {
+  let limit = parseInt(args && args.limit, 10);
+  if (!Number.isFinite(limit) || limit <= 0) limit = 10;
+  limit = Math.min(limit, 50);
 
-    let safeLines = slice;
-    try {
-      const { scan } = __require('./src/security/scanner');
-      safeLines = scan(slice, rel).safe;
-    } catch (_) {}
+  const out = ['# SigMap memory'];
 
-    return [
-      `# ${rel}:${from}-${to}`,
-      '```',
-      ...safeLines,
-      '```',
-    ].join('\n');
+  let notes = [];
+  try {
+    const { readNotes, formatNotes } = __require('./src/session/notes');
+    notes = readNotes(cwd, limit);
+    out.push('');
+    out.push(`## Recent notes (${notes.length})`);
+    // Most recent first for quick scanning.
+    out.push(formatNotes(notes.slice().reverse()));
+  } catch (_) {
+    out.push('');
+    out.push('_No notes available._');
   }
 
-  module.exports = { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getImpact, getLines };
-};
+  // Last ranking-session focus (if any) — extends src/session/memory.js.
+  try {
+    const { loadSession } = __require('./src/session/memory');
+    const s = loadSession(cwd);
+    if (s && (s.lastQuery || (s.topFiles && s.topFiles.length))) {
+      out.push('');
+      out.push('## Last session');
+      if (s.lastQuery) out.push(`**Last query:** ${s.lastQuery}`);
+      if (s.topFiles && s.topFiles.length) {
+        out.push(`**Focus files:** ${s.topFiles.map((f) => f.file).slice(0, 5).join(', ')}`);
+      }
+    }
+  } catch (_) { /* session optional */ }
+
+  return out.join('\n');
+}
 
+module.exports = { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getImpact, getLines, readMemory };
+
+};
 // ── ./src/learning/weights ──
 __factories["./src/learning/weights"] = function(module, exports) {
   'use strict';
@@ -6135,344 +6218,364 @@ __factories["./src/learning/weights"] = function(module, exports) {
 
 // ── ./src/mcp/server ──
 __factories["./src/mcp/server"] = function(module, exports) {
-  
-  /**
-   * SigMap MCP server — zero npm dependencies.
-   *
-   * Wire protocol: JSON-RPC 2.0 over stdio.
-   * One JSON object per line on both stdin and stdout.
-   *
-   * Supported methods:
-   *   initialize        → serverInfo + capabilities
-   *   tools/list        → 10 tool definitions
-   *   tools/call        → dispatch to handler, return result
-   */
+'use strict';
 
-  const readline = require('readline');
-  const { TOOLS } = __require('./src/mcp/tools');
-  const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getImpact, getLines } = __require('./src/mcp/handlers');
+/**
+ * SigMap MCP server — zero npm dependencies.
+ *
+ * Wire protocol: JSON-RPC 2.0 over stdio.
+ * One JSON object per line on both stdin and stdout.
+ *
+ * Supported methods:
+ *   initialize        → serverInfo + capabilities
+ *   tools/list        → 11 tool definitions
+ *   tools/call        → dispatch to handler, return result
+ */
 
-  const SERVER_INFO = {
-    name: 'sigmap',
-  version: '6.13.0',
-    description: 'SigMap MCP server — code signatures on demand',
-  };
-  
-  // ---------------------------------------------------------------------------
-  // JSON-RPC helpers
-  // ---------------------------------------------------------------------------
-  function respond(id, result) {
-    process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id, result }) + '\n');
+const readline = require('readline');
+const { TOOLS } = __require('./src/mcp/tools');
+const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, explainFile, listModules, queryContext, getImpact, getLines, readMemory } = __require('./src/mcp/handlers');
+
+const SERVER_INFO = {
+  name: 'sigmap',
+  version: '6.15.0',
+  description: 'SigMap MCP server — code signatures on demand',
+};
+
+// ---------------------------------------------------------------------------
+// JSON-RPC helpers
+// ---------------------------------------------------------------------------
+function respond(id, result) {
+  process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id, result }) + '\n');
+}
+
+function respondError(id, code, message) {
+  process.stdout.write(
+    JSON.stringify({ jsonrpc: '2.0', id, error: { code, message } }) + '\n'
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Method dispatcher
+// ---------------------------------------------------------------------------
+function dispatch(msg, cwd) {
+  const { method, id, params } = msg;
+
+  // Notifications (no id) need no response
+  if (method === 'notifications/initialized' || method === 'notifications/cancelled') {
+    return;
   }
-  
-  function respondError(id, code, message) {
-    process.stdout.write(
-      JSON.stringify({ jsonrpc: '2.0', id, error: { code, message } }) + '\n'
-    );
+
+  if (method === 'initialize') {
+    respond(id, {
+      protocolVersion: (params && params.protocolVersion) || '2024-11-05',
+      serverInfo: SERVER_INFO,
+      capabilities: { tools: {} },
+    });
+    return;
   }
-  
-  // ---------------------------------------------------------------------------
-  // Method dispatcher
-  // ---------------------------------------------------------------------------
-  function dispatch(msg, cwd) {
-    const { method, id, params } = msg;
-  
-    // Notifications (no id) need no response
-    if (method === 'notifications/initialized' || method === 'notifications/cancelled') {
-      return;
-    }
-  
-    if (method === 'initialize') {
-      respond(id, {
-        protocolVersion: (params && params.protocolVersion) || '2024-11-05',
-        serverInfo: SERVER_INFO,
-        capabilities: { tools: {} },
-      });
-      return;
-    }
-  
-    if (method === 'tools/list') {
-      respond(id, { tools: TOOLS });
-      return;
-    }
-  
-    if (method === 'tools/call') {
-      const name = params && params.name;
-      const args = (params && params.arguments) || {};
-  
-      let text;
-      try {
-        if (name === 'read_context') text = readContext(args, cwd);
-        else if (name === 'search_signatures') text = searchSignatures(args, cwd);
-        else if (name === 'get_map') text = getMap(args, cwd);
-        else if (name === 'create_checkpoint') text = createCheckpoint(args, cwd);
-        else if (name === 'get_routing') text = getRouting(args, cwd);
-        else if (name === 'explain_file') text = explainFile(args, cwd);
-        else if (name === 'list_modules') text = listModules(args, cwd);
-        else if (name === 'query_context') text = queryContext(args, cwd);
-        else if (name === 'get_impact') text = getImpact(args, cwd);
-        else if (name === 'get_lines') text = getLines(args, cwd);
-        else {
-          respondError(id, -32601, `Unknown tool: ${name}`);
-          return;
-        }
-      } catch (err) {
-        respondError(id, -32603, `Tool error: ${err.message}`);
+
+  if (method === 'tools/list') {
+    respond(id, { tools: TOOLS });
+    return;
+  }
+
+  if (method === 'tools/call') {
+    const name = params && params.name;
+    const args = (params && params.arguments) || {};
+
+    let text;
+    try {
+      if (name === 'read_context') text = readContext(args, cwd);
+      else if (name === 'search_signatures') text = searchSignatures(args, cwd);
+      else if (name === 'get_map') text = getMap(args, cwd);
+      else if (name === 'create_checkpoint') text = createCheckpoint(args, cwd);
+      else if (name === 'get_routing') text = getRouting(args, cwd);
+      else if (name === 'explain_file') text = explainFile(args, cwd);
+      else if (name === 'list_modules') text = listModules(args, cwd);
+      else if (name === 'query_context') text = queryContext(args, cwd);
+      else if (name === 'get_impact') text = getImpact(args, cwd);
+      else if (name === 'get_lines') text = getLines(args, cwd);
+      else if (name === 'read_memory') text = readMemory(args, cwd);
+      else {
+        respondError(id, -32601, `Unknown tool: ${name}`);
         return;
       }
-  
-      respond(id, {
-        content: [{ type: 'text', text: String(text) }],
-      });
+    } catch (err) {
+      respondError(id, -32603, `Tool error: ${err.message}`);
       return;
     }
-  
-    // Unknown method
-    if (id !== undefined && id !== null) {
-      respondError(id, -32601, `Method not found: ${method}`);
-    }
-  }
-  
-  // ---------------------------------------------------------------------------
-  // Server entry point
-  // ---------------------------------------------------------------------------
-  function start(cwd) {
-    const rl = readline.createInterface({ input: process.stdin, terminal: false });
-  
-    rl.on('line', (line) => {
-      const trimmed = line.trim();
-      if (!trimmed) return;
-  
-      let msg;
-      try {
-        msg = JSON.parse(trimmed);
-      } catch (_) {
-        // Cannot respond without a valid id — ignore malformed input
-        return;
-      }
-  
-      try {
-        dispatch(msg, cwd);
-      } catch (err) {
-        const id = (msg && msg.id) != null ? msg.id : null;
-        respondError(id, -32603, `Internal error: ${err.message}`);
-      }
-    });
-  
-    rl.on('close', () => {
-      process.exit(0);
+
+    respond(id, {
+      content: [{ type: 'text', text: String(text) }],
     });
+    return;
   }
-  
-  module.exports = { start };
-  
-};
 
+  // Unknown method
+  if (id !== undefined && id !== null) {
+    respondError(id, -32601, `Method not found: ${method}`);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Server entry point
+// ---------------------------------------------------------------------------
+function start(cwd) {
+  const rl = readline.createInterface({ input: process.stdin, terminal: false });
+
+  rl.on('line', (line) => {
+    const trimmed = line.trim();
+    if (!trimmed) return;
+
+    let msg;
+    try {
+      msg = JSON.parse(trimmed);
+    } catch (_) {
+      // Cannot respond without a valid id — ignore malformed input
+      return;
+    }
+
+    try {
+      dispatch(msg, cwd);
+    } catch (err) {
+      const id = (msg && msg.id) != null ? msg.id : null;
+      respondError(id, -32603, `Internal error: ${err.message}`);
+    }
+  });
+
+  rl.on('close', () => {
+    process.exit(0);
+  });
+}
+
+module.exports = { start };
+
+};
 // ── ./src/mcp/tools ──
 __factories["./src/mcp/tools"] = function(module, exports) {
-  
-  /**
-   * MCP tool definitions for SigMap.
-   * Three tools: read_context, search_signatures, get_map.
-   */
-  
-  const TOOLS = [
-    {
-      name: 'read_context',
-      description:
-        'Read extracted code signatures for the project or a specific module path. ' +
-        'Returns the full copilot-instructions.md content (~500–4K tokens) or a ' +
-        'filtered subset when a module path is provided (~50–500 tokens).',
-      inputSchema: {
-        type: 'object',
-        properties: {
-          module: {
-            type: 'string',
-            description:
-              'Optional subdirectory path to scope results (e.g. "src/services"). ' +
-              'Omit to get the full codebase context.',
-          },
+'use strict';
+
+/**
+ * MCP tool definitions for SigMap (11 tools).
+ * read_context, search_signatures, get_map, create_checkpoint, get_routing,
+ * explain_file, list_modules, query_context, get_impact, get_lines, read_memory.
+ */
+
+const TOOLS = [
+  {
+    name: 'read_context',
+    description:
+      'Read extracted code signatures for the project or a specific module path. ' +
+      'Returns the full copilot-instructions.md content (~500–4K tokens) or a ' +
+      'filtered subset when a module path is provided (~50–500 tokens).',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        module: {
+          type: 'string',
+          description:
+            'Optional subdirectory path to scope results (e.g. "src/services"). ' +
+            'Omit to get the full codebase context.',
         },
-        required: [],
       },
+      required: [],
     },
-    {
-      name: 'search_signatures',
-      description:
-        'Search extracted code signatures for a keyword, function name, or class name. ' +
-        'Returns matching signature lines with their file paths.',
-      inputSchema: {
-        type: 'object',
-        properties: {
-          query: {
-            type: 'string',
-            description: 'Keyword to search for in signatures (case-insensitive).',
-          },
+  },
+  {
+    name: 'search_signatures',
+    description:
+      'Search extracted code signatures for a keyword, function name, or class name. ' +
+      'Returns matching signature lines with their file paths.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        query: {
+          type: 'string',
+          description: 'Keyword to search for in signatures (case-insensitive).',
         },
-        required: ['query'],
       },
+      required: ['query'],
     },
-    {
-      name: 'get_map',
-      description:
-        'Read a section from PROJECT_MAP.md — import graph, class hierarchy, or route table. ' +
-        'Requires gen-project-map.js to have been run first.',
-      inputSchema: {
-        type: 'object',
-        properties: {
-          type: {
-            type: 'string',
-            enum: ['imports', 'classes', 'routes'],
-            description: 'Which section to retrieve: imports, classes, or routes.',
-          },
+  },
+  {
+    name: 'get_map',
+    description:
+      'Read a section from PROJECT_MAP.md — import graph, class hierarchy, or route table. ' +
+      'Requires gen-project-map.js to have been run first.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        type: {
+          type: 'string',
+          enum: ['imports', 'classes', 'routes'],
+          description: 'Which section to retrieve: imports, classes, or routes.',
         },
-        required: ['type'],
       },
+      required: ['type'],
     },
-    {
-      name: 'create_checkpoint',
-      description:
-        'Create a session checkpoint summarising current project state. ' +
-        'Returns recent git commits, active branch, token count, and a ' +
-        'compact snapshot of the codebase context — ideal for session handoffs ' +
-        'or periodic saves during long coding sessions.',
-      inputSchema: {
-        type: 'object',
-        properties: {
-          note: {
-            type: 'string',
-            description: 'Optional free-text note to include in the checkpoint (e.g. what you were working on).',
-          },
+  },
+  {
+    name: 'create_checkpoint',
+    description:
+      'Create a session checkpoint summarising current project state. ' +
+      'Returns recent git commits, active branch, token count, and a ' +
+      'compact snapshot of the codebase context — ideal for session handoffs ' +
+      'or periodic saves during long coding sessions.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        note: {
+          type: 'string',
+          description: 'Optional free-text note to include in the checkpoint (e.g. what you were working on).',
         },
-        required: [],
       },
+      required: [],
     },
-    {
-      name: 'get_routing',
-      description:
-        'Get model routing hints for this project — which files belong to which complexity ' +
-        'tier (fast/balanced/powerful) and which AI model to use for each type of task. ' +
-        'Helps reduce API costs by 40–80% by routing simple tasks to cheaper models.',
-      inputSchema: {
-        type: 'object',
-        properties: {},
-        required: [],
-      },
+  },
+  {
+    name: 'get_routing',
+    description:
+      'Get model routing hints for this project — which files belong to which complexity ' +
+      'tier (fast/balanced/powerful) and which AI model to use for each type of task. ' +
+      'Helps reduce API costs by 40–80% by routing simple tasks to cheaper models.',
+    inputSchema: {
+      type: 'object',
+      properties: {},
+      required: [],
     },
-    {
-      name: 'explain_file',
-      description:
-        'Explain a specific file: returns its extracted signatures, direct imports ' +
-        '(files it depends on), and callers (files that import it). ' +
-        'Ideal for understanding a file in isolation without reading raw source. ' +
-        'Requires the context file to have been generated first.',
-      inputSchema: {
-        type: 'object',
-        properties: {
-          path: {
-            type: 'string',
-            description:
-              'Relative path from the project root (e.g. "src/services/auth.ts"). ' +
-              'Use the paths shown in read_context output.',
-          },
+  },
+  {
+    name: 'explain_file',
+    description:
+      'Explain a specific file: returns its extracted signatures, direct imports ' +
+      '(files it depends on), and callers (files that import it). ' +
+      'Ideal for understanding a file in isolation without reading raw source. ' +
+      'Requires the context file to have been generated first.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        path: {
+          type: 'string',
+          description:
+            'Relative path from the project root (e.g. "src/services/auth.ts"). ' +
+            'Use the paths shown in read_context output.',
         },
-        required: ['path'],
       },
+      required: ['path'],
     },
-    {
-      name: 'list_modules',
-      description:
-        'List all top-level modules (srcDirs) present in the context file, ' +
-        'sorted by token count descending. Use this to decide which module to ' +
-        'pass to read_context before querying a specific area of the codebase.',
-      inputSchema: {
-        type: 'object',
-        properties: {},
-        required: [],
+  },
+  {
+    name: 'list_modules',
+    description:
+      'List all top-level modules (srcDirs) present in the context file, ' +
+      'sorted by token count descending. Use this to decide which module to ' +
+      'pass to read_context before querying a specific area of the codebase.',
+    inputSchema: {
+      type: 'object',
+      properties: {},
+      required: [],
+    },
+  },
+  {
+    name: 'query_context',
+    description:
+      'Rank and return the most relevant files for a specific task or question. ' +
+      'Uses keyword + symbol + path scoring to surface only the top-K files relevant ' +
+      'to the query — much cheaper than reading all context. ' +
+      'Returns ranked file list with signatures and relevance scores.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        query: {
+          type: 'string',
+          description:
+            'Natural language task description or keyword(s) to rank files against. ' +
+            'E.g. "add a new language extractor", "fix secret scanning", "auth module".',
+        },
+        topK: {
+          type: 'number',
+          description: 'Maximum number of files to return (default: 10, max: 25).',
+        },
       },
+      required: ['query'],
     },
-    {
-      name: 'query_context',
-      description:
-        'Rank and return the most relevant files for a specific task or question. ' +
-        'Uses keyword + symbol + path scoring to surface only the top-K files relevant ' +
-        'to the query — much cheaper than reading all context. ' +
-        'Returns ranked file list with signatures and relevance scores.',
-      inputSchema: {
-        type: 'object',
-        properties: {
-          query: {
-            type: 'string',
-            description:
-              'Natural language task description or keyword(s) to rank files against. ' +
-              'E.g. "add a new language extractor", "fix secret scanning", "auth module".',
-          },
-          topK: {
-            type: 'number',
-            description: 'Maximum number of files to return (default: 10, max: 25).',
-          },
+  },
+  {
+    name: 'get_impact',
+    description:
+      'Show every file that is impacted when a given file changes — direct importers, ' +
+      'transitive importers, affected tests, and affected routes/controllers. ' +
+      'Gives agents instant blast-radius awareness before making a change. ' +
+      'Handles circular dependencies safely (no infinite loops).',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        file: {
+          type: 'string',
+          description:
+            'Relative path from the project root of the file that changed ' +
+            '(e.g. "src/extractors/python.js"). Use forward slashes.',
+        },
+        depth: {
+          type: 'number',
+          description: 'BFS traversal depth limit (default: 3). Use 0 for unlimited.',
         },
-        required: ['query'],
       },
+      required: ['file'],
     },
-    {
-      name: 'get_impact',
-      description:
-        'Show every file that is impacted when a given file changes — direct importers, ' +
-        'transitive importers, affected tests, and affected routes/controllers. ' +
-        'Gives agents instant blast-radius awareness before making a change. ' +
-        'Handles circular dependencies safely (no infinite loops).',
-      inputSchema: {
-        type: 'object',
-        properties: {
-          file: {
-            type: 'string',
-            description:
-              'Relative path from the project root of the file that changed ' +
-              '(e.g. "src/extractors/python.js"). Use forward slashes.',
-          },
-          depth: {
-            type: 'number',
-            description: 'BFS traversal depth limit (default: 3). Use 0 for unlimited.',
-          },
+  },
+  {
+    name: 'get_lines',
+    description:
+      'Fetch an exact line range from a source file on demand — the Surgical Context ' +
+      'workhorse. Signatures carry `path:start-end` anchors; call this to read just those ' +
+      'lines instead of re-opening the whole file. Lines are clamped to the file bounds and ' +
+      'secret-scanned (redacted) before return. Path is sandboxed to the project root.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        file: {
+          type: 'string',
+          description:
+            'Relative path from the project root (e.g. "src/config/loader.js"). ' +
+            'Use the path shown in a signature anchor. Use forward slashes.',
+        },
+        start: {
+          type: 'number',
+          description: '1-based start line (inclusive). Clamped to the file bounds.',
+        },
+        end: {
+          type: 'number',
+          description: '1-based end line (inclusive). Clamped to the file bounds.',
         },
-        required: ['file'],
       },
+      required: ['file', 'start', 'end'],
     },
-    {
-      name: 'get_lines',
-      description:
-        'Fetch an exact line range from a source file on demand — the Surgical Context ' +
-        'workhorse. Signatures carry `path:start-end` anchors; call this to read just those ' +
-        'lines instead of re-opening the whole file. Lines are clamped to the file bounds and ' +
-        'secret-scanned (redacted) before return. Path is sandboxed to the project root.',
-      inputSchema: {
-        type: 'object',
-        properties: {
-          file: {
-            type: 'string',
-            description:
-              'Relative path from the project root (e.g. "src/config/loader.js"). ' +
-              'Use the path shown in a signature anchor. Use forward slashes.',
-          },
-          start: {
-            type: 'number',
-            description: '1-based start line (inclusive). Clamped to the file bounds.',
-          },
-          end: {
-            type: 'number',
-            description: '1-based end line (inclusive). Clamped to the file bounds.',
-          },
+  },
+  {
+    name: 'read_memory',
+    description:
+      'Recall the project decision log — recent notes left by humans or agents ' +
+      'across sessions (via `sigmap note`), plus the last ranking-session focus. ' +
+      'Call this at the start of a task to kill cold-start: it answers ' +
+      '"what were we doing and why" without re-reading the whole codebase.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        limit: {
+          type: 'number',
+          description: 'How many of the most recent notes to return (default: 10, max: 50).',
         },
-        required: ['file', 'start', 'end'],
       },
+      required: [],
     },
-  ];
+  },
+];
 
-  module.exports = { TOOLS };
-  
-};
+module.exports = { TOOLS };
 
+};
 // ── ./src/routing/classifier ──
 __factories["./src/routing/classifier"] = function(module, exports) {
   
@@ -7007,6 +7110,110 @@ __factories["./src/tracking/logger"] = function(module, exports) {
   
 };
 
+// ── ./src/session/notes ──
+__factories["./src/session/notes"] = function(module, exports) {
+'use strict';
+
+/**
+ * Decision-log notes (Memory, v6.15.0).
+ *
+ * A tiny append-only log of human/agent notes that survives across sessions,
+ * so an agent starting cold can recall "what were we doing / why". Stored as
+ * NDJSON under `.context/` to match the project's other state logs
+ * (usage.ndjson, benchmark-history.ndjson). Zero dependencies.
+ *
+ * Consumed by the `read_memory` MCP tool and the `sigmap note` / `sigmap status`
+ * commands. Complements `src/session/memory.js` (ranking session) rather than
+ * duplicating it.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+
+const NOTES_FILE = path.join('.context', 'notes.ndjson');
+const MAX_TEXT = 2000;
+
+function notesPath(cwd) {
+  return path.join(cwd, NOTES_FILE);
+}
+
+function _currentBranch(cwd) {
+  try {
+    return execSync('git rev-parse --abbrev-ref HEAD', {
+      cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
+    }).trim() || null;
+  } catch (_) {
+    return null;
+  }
+}
+
+/**
+ * Append a note. Returns the stored entry.
+ * @param {string} cwd
+ * @param {string} text
+ * @param {object} [opts]
+ * @param {string|null} [opts.branch]  override branch (default: current git branch)
+ * @param {string} [opts.tag]          optional category tag
+ */
+function addNote(cwd, text, opts = {}) {
+  const clean = String(text == null ? '' : text).trim().slice(0, MAX_TEXT);
+  if (!clean) throw new Error('note text is empty');
+  const entry = {
+    ts: new Date().toISOString(),
+    text: clean,
+    branch: opts.branch !== undefined ? opts.branch : _currentBranch(cwd),
+  };
+  if (opts.tag) entry.tag = String(opts.tag).trim().slice(0, 40);
+  const p = notesPath(cwd);
+  fs.mkdirSync(path.dirname(p), { recursive: true });
+  fs.appendFileSync(p, JSON.stringify(entry) + '\n');
+  return entry;
+}
+
+/**
+ * Read notes in chronological order (oldest first).
+ * @param {string} cwd
+ * @param {number} [limit=0]  keep only the most recent N (0 = all)
+ * @returns {object[]}
+ */
+function readNotes(cwd, limit = 0) {
+  let raw;
+  try { raw = fs.readFileSync(notesPath(cwd), 'utf8'); }
+  catch (_) { return []; }
+  const out = [];
+  for (const line of raw.split('\n')) {
+    const t = line.trim();
+    if (!t) continue;
+    try { out.push(JSON.parse(t)); } catch (_) { /* skip corrupt line */ }
+  }
+  if (limit > 0 && out.length > limit) return out.slice(out.length - limit);
+  return out;
+}
+
+/** Format notes as a Markdown list (pass already-ordered notes). */
+function formatNotes(notes) {
+  if (!notes || !notes.length) {
+    return 'No notes recorded yet. Add one with: sigmap note "<text>"';
+  }
+  return notes.map((n) => {
+    const when = String(n.ts || '').replace('T', ' ').slice(0, 16);
+    const br = n.branch ? ` (${n.branch})` : '';
+    const tag = n.tag ? ` #${n.tag}` : '';
+    return `- [${when}${br}]${tag} ${n.text}`;
+  }).join('\n');
+}
+
+/** Delete the notes log. Returns true if a file was removed. */
+function clearNotes(cwd) {
+  try { fs.unlinkSync(notesPath(cwd)); return true; }
+  catch (_) { return false; }
+}
+
+module.exports = { notesPath, addNote, readNotes, formatNotes, clearNotes };
+
+};
+
 // ── ./src/session/memory ──
 __factories["./src/session/memory"] = function(module, exports) {
   'use strict';
@@ -8873,112 +9080,951 @@ __factories["./src/discovery/r-manifest"] = function(module, exports) {
         if (!defs.has(m[1])) defs.set(m[1], filePath);
       }
     }
-    return defs;
+    return defs;
+  }
+};
+
+// ── ./src/workspace/detector ──
+__factories["./src/workspace/detector"] = function(module, exports) {
+  'use strict';
+  const fs   = require('fs');
+  const path = require('path');
+  module.exports = { detectWorkspaces, inferPackage, scopeToPackage };
+
+  function detectWorkspaces(cwd) {
+    const pkgPath = path.join(cwd, 'package.json');
+    if (!fs.existsSync(pkgPath)) return [];
+
+    let pkg;
+    try {
+      pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+    } catch {
+      return [];
+    }
+
+    const patterns = pkg.workspaces || [];
+    const dirs = [];
+
+    // Handle both flat array and object with packages field (Yarn v2 format)
+    const patternArray = Array.isArray(patterns) ? patterns : (patterns.packages || []);
+
+    for (const p of patternArray) {
+      const base = p.replace(/\/\*\*?$/, '');
+      const resolved = path.join(cwd, base);
+      if (fs.existsSync(resolved)) {
+        try {
+          for (const entry of fs.readdirSync(resolved, { withFileTypes: true })) {
+            if (entry.isDirectory()) dirs.push(path.join(resolved, entry.name));
+          }
+        } catch (_) {}
+      }
+    }
+
+    return dirs;
+  }
+
+  // Infer package from query tokens: "add rate limiting to payments" → "packages/payments"
+  function inferPackage(query, workspaceDirs, cwd) {
+    const tokens = query.toLowerCase().split(/\W+/).filter(t => t.length > 2);
+
+    // Find longest matching package name
+    let bestMatch = null;
+    let bestLen = 0;
+    let bestMatchLen = 0;
+
+    for (const dir of workspaceDirs) {
+      const name = path.basename(dir).toLowerCase();
+      for (const token of tokens) {
+        const matchLen = _getMatchLength(name, token);
+        // Only consider matches; use longest match, and break ties by longest package name
+        if (matchLen > 0 && (matchLen > bestLen || (matchLen === bestLen && name.length > bestMatchLen))) {
+          bestMatch = dir;
+          bestLen = matchLen;
+          bestMatchLen = name.length;
+        }
+      }
+    }
+
+    return bestMatch;
+  }
+
+  function _getMatchLength(name, token) {
+    if (name === token) return 1000 + name.length;  // Exact match is best
+    if (name.startsWith(token) && token.length >= 3) return 100 + token.length;
+    if (token.startsWith(name) && name.length >= 3) return name.length;
+    return 0;
+  }
+
+  // Return boost multiplier for files inside the inferred package
+  function scopeToPackage(filePath, packageDir) {
+    const normalized = filePath.replace(/\\/g, '/');
+    const normalizedPkg = packageDir.replace(/\\/g, '/');
+
+    // Ensure we match the directory boundary, not just a prefix
+    // e.g., packages/payment should not match packages/payment-old
+    if (normalized.startsWith(normalizedPkg)) {
+      const afterPrefix = normalized.slice(normalizedPkg.length);
+      // Check if next char is / or if it's the exact match
+      if (afterPrefix === '' || afterPrefix[0] === '/') {
+        return 0.30;
+      }
+    }
+    return 0;
+  }
+};
+
+/**
+ * SigMap — gen-context.js v1.2.0
+ * Zero-dependency AI context engine.
+ * Runs with: node gen-context.js
+ * No npm install required. Node 18+ built-ins only.
+ */
+
+// ── ./src/verify/parsers ──
+__factories["./src/verify/parsers"] = function(module, exports) {
+'use strict';
+
+/**
+ * Parsers for the Hallucination Guard (verify-ai-output).
+ *
+ * Extract the verifiable claims an AI answer makes about a codebase:
+ *   - file paths it references
+ *   - import / require statements it shows
+ *   - function / class symbols it calls
+ *   - fenced code blocks (so callers can scope checks to code vs prose)
+ *
+ * Everything here is deterministic and offline — pure string analysis.
+ */
+
+// Extensions we are confident name a source/code/config file (no slash required).
+const KNOWN_CODE_EXT = new Set([
+  'js', 'jsx', 'mjs', 'cjs', 'ts', 'tsx', 'py', 'pyw', 'rb', 'go', 'rs',
+  'java', 'kt', 'swift', 'c', 'h', 'cpp', 'hpp', 'cs', 'php', 'r',
+  'vue', 'svelte', 'css', 'scss', 'less', 'html', 'json', 'yml', 'yaml',
+  'toml', 'xml', 'sql', 'graphql', 'gql', 'proto', 'tf', 'md', 'sh',
+  'gd', 'gdscript',
+]);
+
+/**
+ * Extract fenced code blocks.
+ * @param {string} text
+ * @returns {{ lang: string, content: string, line: number }[]}
+ */
+function extractCodeBlocks(text) {
+  const blocks = [];
+  const lines = text.split('\n');
+  let inBlock = false;
+  let lang = '';
+  let buf = [];
+  let startLine = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const m = lines[i].match(/^```(\w*)/);
+    if (m) {
+      if (!inBlock) {
+        inBlock = true;
+        lang = m[1] || '';
+        buf = [];
+        startLine = i + 2; // first content line (1-based)
+      } else {
+        blocks.push({ lang, content: buf.join('\n'), line: startLine });
+        inBlock = false;
+      }
+      continue;
+    }
+    if (inBlock) buf.push(lines[i]);
+  }
+  return blocks;
+}
+
+/**
+ * Extract file-path references (deduped, first-seen line kept).
+ * A token counts as a path when it has a `.<letter…>` extension AND
+ * either contains a `/` or carries a known code/config extension.
+ * @param {string} text
+ * @returns {{ path: string, line: number }[]}
+ */
+function extractFilePaths(text) {
+  const lines = text.split('\n');
+  const seen = new Map();
+  const re = /(?:^|[\s`"'(\[<])([A-Za-z0-9_][\w./-]*\.[A-Za-z][A-Za-z0-9]*)/g;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    let m;
+    re.lastIndex = 0;
+    while ((m = re.exec(line)) !== null) {
+      const p = m[1];
+      if (/^https?:/i.test(p)) continue;
+      const ext = (p.split('.').pop() || '').toLowerCase();
+      const hasSlash = p.includes('/');
+      if (!hasSlash && !KNOWN_CODE_EXT.has(ext)) continue;
+      if (!seen.has(p)) seen.set(p, i + 1);
+    }
+  }
+  return [...seen.entries()].map(([p, line]) => ({ path: p, line }));
+}
+
+/**
+ * Extract import / require statements.
+ * @param {string} text
+ * @returns {{ module: string, kind: 'js'|'py', relative: boolean, line: number, raw: string }[]}
+ */
+function extractImports(text) {
+  const lines = text.split('\n');
+  const out = [];
+  const push = (module, kind, line, raw) => {
+    if (!module) return;
+    out.push({ module, kind, relative: /^[./]/.test(module), line, raw: raw.trim() });
+  };
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    let m;
+    // JS/TS: import ... from 'x'  |  export ... from 'x'
+    if ((m = line.match(/\b(?:import|export)\b[^'"]*\bfrom\s*['"]([^'"]+)['"]/))) {
+      push(m[1], 'js', i + 1, line);
+    } else if ((m = line.match(/\bimport\s*['"]([^'"]+)['"]/))) {
+      // side-effect import 'x'
+      push(m[1], 'js', i + 1, line);
+    }
+    // require('x') / dynamic import('x') — may co-occur, scan separately
+    const reqRe = /\b(?:require|import)\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+    let r;
+    while ((r = reqRe.exec(line)) !== null) push(r[1], 'js', i + 1, line);
+
+    // TS: import X = require('mod')
+    if ((m = line.match(/\bimport\s+[A-Za-z_$][\w$]*\s*=\s*require\s*\(\s*['"]([^'"]+)['"]\s*\)/))) {
+      push(m[1], 'js', i + 1, line);
+    }
+
+    // Python: from x import y  |  import x
+    if ((m = line.match(/^\s*from\s+([.\w]+)\s+import\b/))) {
+      push(m[1], 'py', i + 1, line);
+    } else if ((m = line.match(/^\s*import\s+([A-Za-z_][\w.]*)/))) {
+      push(m[1], 'py', i + 1, line);
+    }
+  }
+
+  // Multi-line JS/TS imports, e.g.
+  //   import {
+  //     A as B,
+  //   } from './mod';
+  // The per-line pass above misses these because `from '…'` sits on a later
+  // line. Trigger only when the opening line has no quote and no `from` yet,
+  // then gather forward until the source string appears.
+  for (let i = 0; i < lines.length; i++) {
+    const start = lines[i];
+    if (!/^\s*(?:import|export)\b/.test(start)) continue;
+    if (/['"]/.test(start) || /\bfrom\b/.test(start)) continue; // single-line, already handled
+    let joined = start;
+    for (let j = i + 1; j < Math.min(lines.length, i + 12); j++) {
+      joined += ' ' + lines[j];
+      const fm = joined.match(/\bfrom\s*['"]([^'"]+)['"]/);
+      if (fm) { push(fm[1], 'js', i + 1, start.trim()); break; }
+      if (/['"]/.test(lines[j]) && !/\bfrom\b/.test(joined)) break; // a string that isn't a source — bail
+    }
+  }
+  return out;
+}
+
+/**
+ * Extract npm/pnpm/yarn script invocations (`npm run <name>`).
+ * Only the explicit `run` form is matched, to avoid confusing package-manager
+ * subcommands (`yarn add`, `pnpm install`) with script names.
+ * @param {string} text
+ * @returns {{ name: string, line: number }[]}
+ */
+function extractNpmScripts(text) {
+  const lines = text.split('\n');
+  const out = [];
+  const seen = new Set();
+  const re = /\b(?:npm|pnpm|yarn)\s+run(?:-script)?\s+([A-Za-z0-9:_-]+)/g;
+  for (let i = 0; i < lines.length; i++) {
+    let m;
+    re.lastIndex = 0;
+    while ((m = re.exec(lines[i])) !== null) {
+      const name = m[1];
+      if (seen.has(name)) continue;
+      seen.add(name);
+      out.push({ name, line: i + 1 });
+    }
+  }
+  return out;
+}
+
+/**
+ * Extract function/class symbol references that look like calls.
+ * Restricted to backtick-wrapped calls (`foo(...)`) for high precision.
+ * @param {string} text
+ * @returns {{ name: string, line: number }[]}
+ */
+function extractSymbols(text) {
+  const lines = text.split('\n');
+  const out = [];
+  const seen = new Set();
+  const re = /`([A-Za-z_$][\w$]*)\s*\([^`]*\)`/g;
+  for (let i = 0; i < lines.length; i++) {
+    let m;
+    re.lastIndex = 0;
+    while ((m = re.exec(lines[i])) !== null) {
+      const name = m[1];
+      const key = name + '@' + (i + 1);
+      if (seen.has(key)) continue;
+      seen.add(key);
+      out.push({ name, line: i + 1 });
+    }
+  }
+  return out;
+}
+
+module.exports = {
+  extractCodeBlocks,
+  extractFilePaths,
+  extractImports,
+  extractSymbols,
+  extractNpmScripts,
+};
+
+};
+
+// ── ./src/verify/closest-match ──
+__factories["./src/verify/closest-match"] = function(module, exports) {
+'use strict';
+
+/**
+ * Closest-match suggestions for the Hallucination Guard (v6.15.0).
+ *
+ * Heuristic layer (plan §5 labels this "Medium" confidence): given a name the
+ * detectors flagged as fake, find the nearest *real* candidate by Levenshtein
+ * distance so the report can say "Did you mean `loadConfig()` in
+ * src/config/loader.js:42?". Pure, deterministic, offline — no network, no LLM.
+ *
+ * All inputs are passed in (symbol/file/script candidate lists) so this module
+ * stays unit-testable without touching the filesystem or the SigMap index.
+ */
+
+/**
+ * Levenshtein edit distance with an early-exit ceiling.
+ * Returns `max + 1` as soon as the best achievable distance exceeds `max`,
+ * so callers can cheaply reject far-apart strings.
+ */
+function levenshtein(a, b, max = Infinity) {
+  if (a === b) return 0;
+  const al = a.length;
+  const bl = b.length;
+  if (al === 0) return bl;
+  if (bl === 0) return al;
+  if (Math.abs(al - bl) > max) return max + 1;
+
+  let prev = new Array(bl + 1);
+  let curr = new Array(bl + 1);
+  for (let j = 0; j <= bl; j++) prev[j] = j;
+
+  for (let i = 1; i <= al; i++) {
+    curr[0] = i;
+    let rowMin = curr[0];
+    const ca = a.charCodeAt(i - 1);
+    for (let j = 1; j <= bl; j++) {
+      const cost = ca === b.charCodeAt(j - 1) ? 0 : 1;
+      curr[j] = Math.min(prev[j] + 1, curr[j - 1] + 1, prev[j - 1] + cost);
+      if (curr[j] < rowMin) rowMin = curr[j];
+    }
+    if (rowMin > max) return max + 1;
+    const tmp = prev;
+    prev = curr;
+    curr = tmp;
+  }
+  return prev[bl];
+}
+
+/** Bucket a normalized edit distance into a confidence label (plan §5). */
+function suggestionConfidence(distance, targetLen) {
+  const ratio = distance / Math.max(targetLen, 1);
+  if (distance === 0 || ratio <= 0.2) return 'high';
+  if (ratio <= 0.4) return 'medium';
+  return 'low';
+}
+
+/**
+ * Find the nearest candidate name to `target`.
+ *
+ * @param {string} target
+ * @param {Array<string | { name: string, file?: string, line?: number }>} candidates
+ * @param {object} [opts]
+ * @param {number} [opts.maxRatio=0.5]  reject matches farther than ratio·len edits
+ * @param {number} [opts.minLen=3]      skip very short targets (too noisy)
+ * @returns {{ name, file, line, distance, confidence } | null}
+ */
+function closestMatch(target, candidates, opts = {}) {
+  const maxRatio = opts.maxRatio != null ? opts.maxRatio : 0.5;
+  const minLen = opts.minLen != null ? opts.minLen : 3;
+  if (!target || target.length < minLen) return null;
+  if (!candidates || candidates.length === 0) return null;
+
+  const lower = target.toLowerCase();
+  const cap = Math.max(1, Math.ceil(target.length * maxRatio));
+  let best = null;
+
+  for (const c of candidates) {
+    const name = typeof c === 'string' ? c : c && c.name;
+    if (!name || name === target) continue;
+    if (Math.abs(name.length - target.length) > cap) continue;
+    const d = levenshtein(lower, name.toLowerCase(), cap);
+    if (d > cap) continue;
+    if (!best || d < best.distance ||
+        (d === best.distance && name.length < best.name.length)) {
+      best = {
+        name,
+        file: typeof c === 'object' ? c.file : undefined,
+        line: typeof c === 'object' ? c.line : undefined,
+        distance: d,
+      };
+      if (d === 0) break; // case-only difference — can't beat it
+    }
+  }
+
+  if (!best) return null;
+  best.confidence = suggestionConfidence(best.distance, target.length);
+  return best;
+}
+
+/**
+ * Build `[{ name, file, line }]` symbol candidates from a SigMap signature
+ * index (`Map<file, string[]>` whose entries may carry a `:start-end` anchor).
+ */
+function buildSymbolCandidates(sigIndex) {
+  const out = [];
+  const seen = new Set();
+  if (!sigIndex) return out;
+  for (const [file, sigs] of sigIndex) {
+    for (const sig of sigs) {
+      const s = String(sig);
+      const lineM = s.match(/:(\d+)(?:-\d+)?\s*$/);
+      const line = lineM ? parseInt(lineM[1], 10) : null;
+      const cleaned = s.replace(/\s*:\d+(?:-\d+)?\s*$/, '');
+      const m = cleaned.match(/\b(?:async\s+function|function|class|def|interface|type|enum|const|let|var)\s+([A-Za-z_$][\w$]*)/)
+        || cleaned.match(/([A-Za-z_$][\w$]*)\s*\(/)
+        || cleaned.match(/([A-Za-z_$][\w$]*)/);
+      if (!m) continue;
+      const name = m[1];
+      const key = name + '@' + file;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      out.push({ name, file, line });
+    }
+  }
+  return out;
+}
+
+/** Format a suggestion object into a human one-liner for reports/CLI. */
+function formatSuggestion(match, asCall) {
+  if (!match) return null;
+  const sym = asCall ? `${match.name}()` : match.name;
+  let where = '';
+  if (match.file) {
+    where = match.line ? ` in ${match.file}:${match.line}` : ` in ${match.file}`;
   }
+  return `Did you mean \`${sym}\`${where}?`;
+}
+
+module.exports = {
+  levenshtein,
+  closestMatch,
+  buildSymbolCandidates,
+  suggestionConfidence,
+  formatSuggestion,
 };
 
-// ── ./src/workspace/detector ──
-__factories["./src/workspace/detector"] = function(module, exports) {
-  'use strict';
-  const fs   = require('fs');
-  const path = require('path');
-  module.exports = { detectWorkspaces, inferPackage, scopeToPackage };
+};
 
-  function detectWorkspaces(cwd) {
-    const pkgPath = path.join(cwd, 'package.json');
-    if (!fs.existsSync(pkgPath)) return [];
+// ── ./src/format/verify-report ──
+__factories["./src/format/verify-report"] = function(module, exports) {
+'use strict';
 
-    let pkg;
-    try {
-      pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
-    } catch {
-      return [];
-    }
+/**
+ * Hallucination Guard report view (Surface A, v6.15.0).
+ *
+ * Turns the `verify-ai-output --json` result into a standalone, self-contained
+ * HTML report — red/amber/green per issue, with closest-match suggestions
+ * inline. The visual language deliberately mirrors the planned PR-comment
+ * styling so a single screenshot is reusable across docs and CI (plan proof #5).
+ *
+ * Zero dependencies, inline CSS/SVG, no external assets. Also exports a compact
+ * Markdown renderer for CI / PR comments that shares the same structure.
+ */
 
-    const patterns = pkg.workspaces || [];
-    const dirs = [];
+const TYPE_META = {
+  'fake-file': { label: 'Fake file', tone: 'red', icon: '✕' },
+  'fake-test-file': { label: 'Fake test file', tone: 'red', icon: '✕' },
+  'fake-import': { label: 'Fake import', tone: 'red', icon: '✕' },
+  'fake-npm-script': { label: 'Fake npm script', tone: 'red', icon: '✕' },
+  'fake-symbol': { label: 'Fake symbol', tone: 'amber', icon: '!' },
+};
 
-    // Handle both flat array and object with packages field (Yarn v2 format)
-    const patternArray = Array.isArray(patterns) ? patterns : (patterns.packages || []);
+function escapeHtml(value) {
+  return String(value == null ? '' : value)
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;');
+}
 
-    for (const p of patternArray) {
-      const base = p.replace(/\/\*\*?$/, '');
-      const resolved = path.join(cwd, base);
-      if (fs.existsSync(resolved)) {
-        try {
-          for (const entry of fs.readdirSync(resolved, { withFileTypes: true })) {
-            if (entry.isDirectory()) dirs.push(path.join(resolved, entry.name));
-          }
-        } catch (_) {}
-      }
-    }
+function toneFor(issue) {
+  const meta = TYPE_META[issue.type];
+  if (meta) return meta.tone;
+  return issue.confidence === 'high' ? 'red' : 'amber';
+}
 
-    return dirs;
+function labelFor(issue) {
+  return (TYPE_META[issue.type] && TYPE_META[issue.type].label) || issue.type;
+}
+
+/**
+ * Render the verify result to a full HTML document.
+ * @param {{ file?: string, issues: object[], summary: object }} result
+ * @param {object} [opts]
+ * @param {string} [opts.title]
+ * @returns {string} HTML
+ */
+function renderReportHtml(result, opts = {}) {
+  const issues = Array.isArray(result.issues) ? result.issues : [];
+  const summary = result.summary || { total: issues.length, byType: {}, clean: issues.length === 0 };
+  const file = result.file || opts.file || 'AI answer';
+  const title = opts.title || 'SigMap — Hallucination Guard report';
+  const clean = summary.clean || issues.length === 0;
+  const byType = summary.byType || {};
+
+  const chips = Object.keys(TYPE_META)
+    .filter((t) => byType[t])
+    .map((t) => `<span class="chip chip-${TYPE_META[t].tone}">${escapeHtml(TYPE_META[t].label)}: ${byType[t]}</span>`)
+    .join('');
+
+  const banner = clean
+    ? `<div class="banner banner-green"><span class="dot"></span> No hallucinations detected — ${escapeHtml(String(summary.symbolsIndexed || 0))} symbols indexed</div>`
+    : `<div class="banner banner-red"><span class="dot"></span> ${issues.length} issue${issues.length === 1 ? '' : 's'} found in <code>${escapeHtml(file)}</code></div>`;
+
+  const rows = issues.map((issue) => {
+    const tone = toneFor(issue);
+    const sugg = issue.suggestion
+      ? `<div class="suggestion">↳ ${escapeHtml(issue.suggestion)} <span class="conf">heuristic</span></div>`
+      : '';
+    return [
+      `<li class="issue issue-${tone}">`,
+      `  <div class="issue-head">`,
+      `    <span class="badge badge-${tone}">${escapeHtml(labelFor(issue))}</span>`,
+      `    <span class="loc">${escapeHtml(issue.location || ('L' + issue.line))}</span>`,
+      `    <span class="conf conf-${escapeHtml(issue.confidence || 'high')}">${escapeHtml(issue.confidence || 'high')} confidence</span>`,
+      `  </div>`,
+      `  <div class="msg">${escapeHtml(issue.message || issue.value)}</div>`,
+      `  ${sugg}`,
+      `</li>`,
+    ].join('\n');
+  }).join('\n');
+
+  const list = clean
+    ? '<p class="empty">Nothing to report — every file, import, symbol, and script in the answer resolves against the repository.</p>'
+    : `<ul class="issues">${rows}</ul>`;
+
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(title)}</title>
+<style>
+  :root { color-scheme: light dark; }
+  * { box-sizing: border-box; }
+  body { font: 14px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; margin: 0; background: #0d1117; color: #e6edf3; }
+  .wrap { max-width: 880px; margin: 0 auto; padding: 32px 20px 64px; }
+  h1 { font-size: 20px; margin: 0 0 4px; }
+  .sub { color: #8b949e; margin: 0 0 20px; font-size: 13px; }
+  code { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; background: #161b22; padding: 1px 5px; border-radius: 4px; font-size: 12.5px; }
+  .banner { display: flex; align-items: center; gap: 8px; padding: 12px 16px; border-radius: 8px; font-weight: 600; margin-bottom: 16px; }
+  .banner-green { background: rgba(46,160,67,.15); border: 1px solid rgba(46,160,67,.4); color: #3fb950; }
+  .banner-red { background: rgba(248,81,73,.12); border: 1px solid rgba(248,81,73,.4); color: #f85149; }
+  .dot { width: 9px; height: 9px; border-radius: 50%; background: currentColor; }
+  .chips { display: flex; flex-wrap: wrap; gap: 6px; margin-bottom: 20px; }
+  .chip { font-size: 12px; padding: 3px 9px; border-radius: 999px; font-weight: 600; }
+  .chip-red { background: rgba(248,81,73,.15); color: #f85149; }
+  .chip-amber { background: rgba(210,153,34,.18); color: #d29922; }
+  ul.issues { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; gap: 10px; }
+  .issue { border: 1px solid #30363d; border-left-width: 4px; border-radius: 8px; padding: 12px 14px; background: #0f141a; }
+  .issue-red { border-left-color: #f85149; }
+  .issue-amber { border-left-color: #d29922; }
+  .issue-head { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; }
+  .badge { font-size: 11.5px; font-weight: 700; padding: 2px 8px; border-radius: 5px; text-transform: uppercase; letter-spacing: .03em; }
+  .badge-red { background: rgba(248,81,73,.18); color: #f85149; }
+  .badge-amber { background: rgba(210,153,34,.2); color: #d29922; }
+  .loc { font-family: ui-monospace, monospace; color: #8b949e; font-size: 12px; }
+  .conf { font-size: 11px; color: #8b949e; }
+  .conf-high { color: #f85149; }
+  .conf-medium { color: #d29922; }
+  .msg { margin-top: 7px; font-family: ui-monospace, monospace; font-size: 12.5px; color: #e6edf3; }
+  .suggestion { margin-top: 6px; font-size: 12.5px; color: #3fb950; }
+  .suggestion .conf { margin-left: 6px; }
+  .empty { color: #8b949e; }
+  footer { margin-top: 28px; color: #6e7681; font-size: 12px; }
+  a { color: #58a6ff; }
+</style>
+</head>
+<body>
+<div class="wrap">
+  <h1>Hallucination Guard report</h1>
+  <p class="sub">Deterministic verification of an AI answer against the real repository — <code>sigmap verify-ai-output</code></p>
+  ${banner}
+  ${chips ? `<div class="chips">${chips}</div>` : ''}
+  ${list}
+  <footer>Generated by <a href="https://github.com/manojmallick/sigmap">SigMap</a> · offline, no LLM · suggestions are heuristic (closest-match)</footer>
+</div>
+</body>
+</html>
+`;
+}
+
+/** Compact Markdown rendering of the same result (CI / PR comments). */
+function renderReportMarkdown(result) {
+  const issues = Array.isArray(result.issues) ? result.issues : [];
+  const summary = result.summary || {};
+  const file = result.file || 'AI answer';
+  if (summary.clean || issues.length === 0) {
+    return `### ✅ Hallucination Guard — clean\n\nNo fabricated files, imports, symbols, or scripts in \`${file}\`.`;
+  }
+  const lines = [
+    `### ❌ Hallucination Guard — ${issues.length} issue${issues.length === 1 ? '' : 's'} in \`${file}\``,
+    '',
+    '| Type | Location | Detail | Suggestion |',
+    '| --- | --- | --- | --- |',
+  ];
+  for (const i of issues) {
+    const sugg = i.suggestion ? i.suggestion.replace(/\|/g, '\\|') : '—';
+    lines.push(`| ${labelFor(i)} | ${i.location || ('L' + i.line)} | \`${String(i.value).replace(/\|/g, '\\|')}\` | ${sugg} |`);
   }
+  return lines.join('\n');
+}
 
-  // Infer package from query tokens: "add rate limiting to payments" → "packages/payments"
-  function inferPackage(query, workspaceDirs, cwd) {
-    const tokens = query.toLowerCase().split(/\W+/).filter(t => t.length > 2);
+module.exports = { renderReportHtml, renderReportMarkdown, escapeHtml };
 
-    // Find longest matching package name
-    let bestMatch = null;
-    let bestLen = 0;
-    let bestMatchLen = 0;
+};
 
-    for (const dir of workspaceDirs) {
-      const name = path.basename(dir).toLowerCase();
-      for (const token of tokens) {
-        const matchLen = _getMatchLength(name, token);
-        // Only consider matches; use longest match, and break ties by longest package name
-        if (matchLen > 0 && (matchLen > bestLen || (matchLen === bestLen && name.length > bestMatchLen))) {
-          bestMatch = dir;
-          bestLen = matchLen;
-          bestMatchLen = name.length;
-        }
+// ── ./src/verify/hallucination-guard ──
+__factories["./src/verify/hallucination-guard"] = function(module, exports) {
+'use strict';
+
+/**
+ * Hallucination Guard — deterministic core (Reliable MVP, v6.15.0).
+ *
+ * Given the text of an AI answer, flag claims that do not match the repo:
+ *   - fake-file      : a referenced path is not on disk
+ *   - fake-test-file : a referenced *test* path is not on disk (sub-type)
+ *   - fake-import    : a relative import does not resolve; a bare import is
+ *                      absent from package.json deps (builtins allow-listed)
+ *   - fake-symbol    : a called function/class is absent from the symbol index
+ *   - fake-npm-script: `npm run X` where X is not a package.json script
+ *
+ * Each issue carries a `confidence` (detection certainty) and, where a near
+ * match exists, a heuristic `suggestion` ("Did you mean …?"). No network, no
+ * LLM. Reuses SigMap primitives (buildSigIndex) but every external dependency
+ * is injectable via `opts` so the core stays unit-testable.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const parsers = __require('./src/verify/parsers');
+const { closestMatch, buildSymbolCandidates, formatSuggestion } = __require('./src/verify/closest-match');
+
+// A path that looks like a test file (JS/TS spec/test, Python test_/_test, or
+// a tests/__tests__ directory). Used to flag fake-test-file separately.
+const TEST_PATH_RE = /(?:\.(?:test|spec)\.[mc]?[jt]sx?$)|(?:(?:^|\/)__tests__\/)|(?:(?:^|\/)test_[^/]+\.py$)|(?:_test\.py$)|(?:(?:^|\/)tests?\/)/i;
+function isTestPath(p) { return TEST_PATH_RE.test(p); }
+
+const NODE_BUILTINS = new Set([
+  'fs', 'path', 'os', 'util', 'events', 'stream', 'http', 'https', 'crypto',
+  'child_process', 'url', 'querystring', 'assert', 'zlib', 'readline', 'net',
+  'tls', 'dns', 'buffer', 'process', 'vm', 'module', 'console', 'timers',
+  'string_decoder', 'perf_hooks', 'worker_threads', 'cluster', 'dgram', 'v8',
+  'tty', 'repl', 'async_hooks', 'inspector', 'fs/promises', 'path/posix',
+]);
+
+const PY_BUILTINS = new Set([
+  'os', 'sys', 're', 'json', 'math', 'typing', 'collections', 'itertools',
+  'functools', 'datetime', 'pathlib', 'subprocess', 'abc', 'dataclasses',
+  'enum', 'io', 'time', 'random', 'logging', 'argparse', 'unittest', 'asyncio',
+  'copy', 'hashlib', 'threading', 'string', 'csv', 'glob', 'shutil', 'tempfile',
+]);
+
+const LANG_GLOBALS = new Set([
+  // JS
+  'console', 'require', 'module', 'exports', 'process', 'Object', 'Array',
+  'String', 'Number', 'Boolean', 'Math', 'JSON', 'Date', 'Promise', 'Map',
+  'Set', 'WeakMap', 'WeakSet', 'RegExp', 'Error', 'Symbol', 'parseInt',
+  'parseFloat', 'isNaN', 'setTimeout', 'setInterval', 'clearTimeout', 'fetch',
+  'Buffer', 'Function', 'eval', 'encodeURIComponent', 'decodeURIComponent',
+  // Python
+  'print', 'len', 'range', 'str', 'int', 'float', 'dict', 'list', 'tuple',
+  'set', 'bool', 'open', 'enumerate', 'zip', 'map', 'filter', 'sorted',
+  'sum', 'min', 'max', 'abs', 'isinstance', 'super', 'type', 'getattr',
+  'setattr', 'hasattr',
+]);
+
+const REL_EXTS = ['', '.js', '.ts', '.tsx', '.jsx', '.mjs', '.cjs', '.json', '.py', '.r', '.R', '.vue'];
+const REL_INDEX = ['index.js', 'index.ts', 'index.tsx', 'index.jsx', '__init__.py'];
+
+/**
+ * Build the set of known symbol identifiers from the SigMap signature index,
+ * plus `{ name, file, line }` candidates (for closest-match suggestions).
+ */
+function buildSymbolSet(cwd) {
+  const set = new Set();
+  let fileKeys = [];
+  let symbolCandidates = [];
+  try {
+    const { buildSigIndex } = __require('./src/retrieval/ranker');
+    const idx = buildSigIndex(cwd);
+    fileKeys = [...idx.keys()];
+    for (const sigs of idx.values()) {
+      for (const sig of sigs) {
+        const cleaned = String(sig).replace(/\s*:\d+(?:-\d+)?\s*$/, '');
+        const ids = cleaned.match(/[A-Za-z_$][\w$]*/g) || [];
+        for (const id of ids) set.add(id);
+      }
+    }
+    symbolCandidates = buildSymbolCandidates(idx);
+  } catch (_) {}
+  return { set, fileKeys, symbolCandidates };
+}
+
+/** Load declared dependency names from package.json. */
+function loadDeps(cwd) {
+  const deps = new Set();
+  let hasPkg = false;
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
+    hasPkg = true;
+    for (const k of ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']) {
+      if (pkg[k] && typeof pkg[k] === 'object') {
+        for (const name of Object.keys(pkg[k])) deps.add(name);
       }
     }
+  } catch (_) {}
+  return { deps, hasPkg };
+}
 
-    return bestMatch;
+/** Load the set of npm script names declared in package.json. */
+function loadScripts(cwd) {
+  const scripts = new Set();
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
+    if (pkg.scripts && typeof pkg.scripts === 'object') {
+      for (const name of Object.keys(pkg.scripts)) scripts.add(name);
+    }
+  } catch (_) {}
+  return scripts;
+}
+
+/** Default file-existence check: resolve a referenced path against cwd. */
+function defaultFileExists(cwd, ref) {
+  const clean = ref.replace(/^\.\//, '');
+  for (const c of [path.resolve(cwd, clean), path.resolve(cwd, ref)]) {
+    try {
+      if (fs.existsSync(c)) return true;
+    } catch (_) {}
   }
+  return false;
+}
 
-  function _getMatchLength(name, token) {
-    if (name === token) return 1000 + name.length;  // Exact match is best
-    if (name.startsWith(token) && token.length >= 3) return 100 + token.length;
-    if (token.startsWith(name) && name.length >= 3) return name.length;
-    return 0;
+/** Default relative-import resolver: fs candidates + basename match in index. */
+function defaultRelativeResolvable(cwd, mod, fileBasenames) {
+  const base = path.resolve(cwd, mod);
+  for (const e of REL_EXTS) {
+    try {
+      if (fs.existsSync(base + e)) return true;
+    } catch (_) {}
+  }
+  for (const idx of REL_INDEX) {
+    try {
+      if (fs.existsSync(path.join(base, idx))) return true;
+    } catch (_) {}
   }
+  // Fall back to basename match against the indexed file set (the answer's
+  // import is relative to a file we cannot know, so a name match is enough
+  // to avoid false positives).
+  const wantBase = path.basename(mod).replace(/\.[^.]+$/, '').toLowerCase();
+  return fileBasenames.has(wantBase);
+}
 
-  // Return boost multiplier for files inside the inferred package
-  function scopeToPackage(filePath, packageDir) {
-    const normalized = filePath.replace(/\\/g, '/');
-    const normalizedPkg = packageDir.replace(/\\/g, '/');
+/**
+ * Verify an AI answer against the repository.
+ *
+ * Each issue has the shape:
+ *   { type, value, line, location, message, confidence, suggestion }
+ * where `confidence` is the *detection* certainty ('high' for path/dep/script
+ * checks, 'medium' for symbol checks) and `suggestion` is a heuristic
+ * closest-match hint (or null).
+ *
+ * @param {string} answerText
+ * @param {string} cwd
+ * @param {object} [opts]
+ * @param {Set<string>} [opts.symbolSet]      override known symbols
+ * @param {Array}       [opts.symbolCandidates] override { name, file, line } list
+ * @param {Array<string>} [opts.fileCandidates]  override repo file paths (suggestions)
+ * @param {Set<string>} [opts.deps]           override package deps
+ * @param {Set<string>} [opts.scripts]        override package.json script names
+ * @param {boolean}     [opts.hasPkg]         whether a package.json exists
+ * @param {(ref: string) => boolean} [opts.fileExists]          override file check
+ * @param {(mod: string) => boolean} [opts.relativeResolvable]  override rel-import check
+ * @returns {{ issues: object[], summary: object }}
+ */
+function verify(answerText, cwd, opts = {}) {
+  let symbolSet = opts.symbolSet;
+  let fileBasenames = opts.fileBasenames;
+  let symbolCandidates = opts.symbolCandidates || [];
+  let fileCandidates = opts.fileCandidates || [];
+  if (!symbolSet) {
+    const built = buildSymbolSet(cwd);
+    symbolSet = built.set;
+    fileBasenames = new Set(built.fileKeys.map(
+      (k) => path.basename(k).replace(/\.[^.]+$/, '').toLowerCase()
+    ));
+    symbolCandidates = built.symbolCandidates;
+    fileCandidates = built.fileKeys;
+  }
+  if (!fileBasenames) fileBasenames = new Set();
+
+  let deps = opts.deps;
+  let hasPkg = opts.hasPkg;
+  if (!deps) {
+    const loaded = loadDeps(cwd);
+    deps = loaded.deps;
+    if (hasPkg === undefined) hasPkg = loaded.hasPkg;
+  }
+  const scripts = opts.scripts || (hasPkg ? loadScripts(cwd) : new Set());
+
+  const fileExists = opts.fileExists || ((ref) => defaultFileExists(cwd, ref));
+  const relativeResolvable = opts.relativeResolvable
+    || ((mod) => defaultRelativeResolvable(cwd, mod, fileBasenames));
+
+  // Pre-derive basename candidates for file suggestions (compare on basename so
+  // a wrong directory still surfaces the right file).
+  const fileBasenameCandidates = fileCandidates.map((f) => ({ name: path.basename(f), file: f }));
+
+  const issues = [];
+  const dedupe = new Set();
+  const add = (issue) => {
+    const key = `${issue.type}::${issue.value}`;
+    if (dedupe.has(key)) return;
+    dedupe.add(key);
+    if (!('suggestion' in issue)) issue.suggestion = null;
+    issue.location = `L${issue.line}`;
+    issues.push(issue);
+  };
 
-    // Ensure we match the directory boundary, not just a prefix
-    // e.g., packages/payment should not match packages/payment-old
-    if (normalized.startsWith(normalizedPkg)) {
-      const afterPrefix = normalized.slice(normalizedPkg.length);
-      // Check if next char is / or if it's the exact match
-      if (afterPrefix === '' || afterPrefix[0] === '/') {
-        return 0.30;
+  // 1. fake-file / fake-test-file
+  for (const { path: p, line } of parsers.extractFilePaths(answerText)) {
+    if (fileExists(p)) continue;
+    const isTest = isTestPath(p);
+    const match = closestMatch(path.basename(p), fileBasenameCandidates, { minLen: 4 });
+    add({
+      type: isTest ? 'fake-test-file' : 'fake-file',
+      value: p,
+      line,
+      message: `${isTest ? 'Test file' : 'File'} not found on disk: ${p}`,
+      confidence: 'high',
+      suggestion: match ? formatSuggestion(match, false) : null,
+    });
+  }
+
+  // 2. fake-import
+  for (const imp of parsers.extractImports(answerText)) {
+    if (imp.relative) {
+      if (!relativeResolvable(imp.module)) {
+        add({ type: 'fake-import', value: imp.module, line: imp.line, message: `Import does not resolve: ${imp.module}`, confidence: 'high' });
+      }
+      continue;
+    }
+    // Bare module — only verifiable for JS when a package.json exists.
+    const top = imp.module.split('/')[0];
+    if (imp.kind === 'js') {
+      if (!hasPkg) continue;
+      if (NODE_BUILTINS.has(imp.module) || NODE_BUILTINS.has(top)) continue;
+      if (top.startsWith('@')) {
+        const scoped = imp.module.split('/').slice(0, 2).join('/');
+        if (deps.has(scoped) || deps.has(imp.module)) continue;
+      } else if (deps.has(top) || deps.has(imp.module)) {
+        continue;
       }
+      const match = closestMatch(top, [...deps], { minLen: 3 });
+      add({
+        type: 'fake-import',
+        value: imp.module,
+        line: imp.line,
+        message: `Package not in dependencies: ${imp.module}`,
+        confidence: 'high',
+        suggestion: match ? formatSuggestion({ name: match.name }, false) : null,
+      });
+    }
+    // Python bare imports: stdlib is unbounded offline — skip to keep precision.
+  }
+
+  // 3. fake-symbol
+  if (symbolSet.size > 0) {
+    for (const { name, line } of parsers.extractSymbols(answerText)) {
+      if (symbolSet.has(name)) continue;
+      if (LANG_GLOBALS.has(name) || NODE_BUILTINS.has(name) || PY_BUILTINS.has(name)) continue;
+      const match = closestMatch(name, symbolCandidates, { minLen: 4 });
+      add({
+        type: 'fake-symbol',
+        value: name,
+        line,
+        message: `Symbol not found in repo index: ${name}()`,
+        confidence: 'medium',
+        suggestion: match ? formatSuggestion(match, true) : null,
+      });
     }
-    return 0;
   }
-};
 
-/**
- * SigMap — gen-context.js v1.2.0
- * Zero-dependency AI context engine.
- * Runs with: node gen-context.js
- * No npm install required. Node 18+ built-ins only.
- */
+  // 4. fake-npm-script
+  if (hasPkg && scripts.size > 0) {
+    for (const { name, line } of parsers.extractNpmScripts(answerText)) {
+      if (scripts.has(name)) continue;
+      const match = closestMatch(name, [...scripts], { minLen: 2 });
+      add({
+        type: 'fake-npm-script',
+        value: name,
+        line,
+        message: `npm script not in package.json: ${name}`,
+        confidence: 'high',
+        suggestion: match ? formatSuggestion({ name: match.name }, false) : null,
+      });
+    }
+  }
+
+  issues.sort((a, b) => a.line - b.line);
+
+  const byType = {
+    'fake-file': 0, 'fake-test-file': 0, 'fake-import': 0,
+    'fake-symbol': 0, 'fake-npm-script': 0,
+  };
+  for (const i of issues) byType[i.type] = (byType[i.type] || 0) + 1;
+
+  const summary = {
+    total: issues.length,
+    byType,
+    clean: issues.length === 0,
+    symbolsIndexed: symbolSet.size,
+    withSuggestion: issues.filter((i) => i.suggestion).length,
+  };
+
+  return { issues, summary };
+}
+
+module.exports = { verify, buildSymbolSet, loadDeps, loadScripts, isTestPath };
+
+};
 
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const { execSync } = require('child_process');
 
-const VERSION = '6.13.0';
+const VERSION = '6.15.0';
 const MARKER = '\n\n## Auto-generated signatures\n<!-- Updated by gen-context.js -->\n';
 
 function requireSourceOrBundled(key) {
@@ -10737,6 +11783,12 @@ Usage:
   ${cmd} --impact <file>                   Show every file impacted by changing <file>
   ${cmd} --impact <file> --json            Impact as JSON {changed, direct, transitive, tests, routes}
   ${cmd} --impact <file> --depth <n>       BFS depth limit (default 3, 0=unlimited)
+  ${cmd} verify-ai-output <answer.md>      Flag fake files/tests/imports/symbols/npm-scripts in an AI answer
+  ${cmd} verify-ai-output <answer.md> --json    Hallucination report as JSON (exits 1 if issues)
+  ${cmd} verify-ai-output <answer.md> --report  Write a standalone HTML report (red/amber/green)
+  ${cmd} note "<text>"                     Append a note to the cross-session decision log
+  ${cmd} note                              List recent notes (also: note --list <N>)
+  ${cmd} status                            Show repo state — branch, dirty files, index freshness, notes
   ${cmd} --init                            Write example config + .contextignore scaffold
   ${cmd} --help                            Show this message
   ${cmd} --version                         Show version
@@ -11858,6 +12910,191 @@ function main() {
     process.exit(0);
   }
 
+  // `sigmap note "<text>"` — append to the cross-session decision log.
+  // With no text, lists recent notes (also `note --list [N]`).
+  if (args[0] === 'note') {
+    const jsonOut = args.includes('--json');
+    const { addNote, readNotes, formatNotes } = requireSourceOrBundled('./src/session/notes');
+    const listIdx = args.indexOf('--list');
+    // Build positionals, skipping value-taking flags and their values
+    // (e.g. `--cwd <dir>`, `--list <N>`) so they never leak into the note text.
+    const VALUE_FLAGS = new Set(['--cwd', '--list']);
+    const positional = [];
+    for (let i = 1; i < args.length; i++) {
+      const a = args[i];
+      if (a.startsWith('--')) { if (VALUE_FLAGS.has(a)) i++; continue; }
+      positional.push(a);
+    }
+    const wantsList = listIdx !== -1 || positional.length === 0;
+
+    if (wantsList) {
+      const limArg = listIdx !== -1 ? parseInt(args[listIdx + 1], 10) : parseInt(positional[0], 10);
+      const limit = Number.isFinite(limArg) && limArg > 0 ? limArg : 10;
+      const notes = readNotes(cwd, limit);
+      if (jsonOut) {
+        process.stdout.write(JSON.stringify({ notes }) + '\n');
+      } else {
+        console.log(`[sigmap] ${notes.length} recent note${notes.length === 1 ? '' : 's'}`);
+        console.log(formatNotes(notes.slice().reverse()));
+      }
+      process.exit(0);
+    }
+
+    const text = positional.join(' ');
+    let entry;
+    try {
+      entry = addNote(cwd, text);
+    } catch (err) {
+      console.error(`[sigmap] ${err.message}`);
+      process.exit(1);
+    }
+    if (jsonOut) {
+      process.stdout.write(JSON.stringify({ added: entry }) + '\n');
+    } else {
+      console.log(`[sigmap] noted${entry.branch ? ` (${entry.branch})` : ''}: ${entry.text}`);
+    }
+    process.exit(0);
+  }
+
+  // `sigmap status` — environment / repo state at a glance.
+  if (args[0] === 'status') {
+    const jsonOut = args.includes('--json');
+    const gitOpts = { cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] };
+    const st = { branch: null, dirty: 0, lastIndex: null, indexVersion: null, indexFiles: null, changedSinceIndex: null, notes: 0, lastNote: null };
+
+    try { st.branch = execSync('git rev-parse --abbrev-ref HEAD', gitOpts).trim() || null; } catch (_) {}
+    // Fallback for an unborn branch (fresh repo, no commits yet).
+    if (!st.branch || st.branch === 'HEAD') {
+      try { st.branch = execSync('git symbolic-ref --short HEAD', gitOpts).trim() || st.branch; } catch (_) {}
+    }
+    try {
+      const porcelain = execSync('git status --porcelain', gitOpts).trim();
+      st.dirty = porcelain ? porcelain.split('\n').filter(Boolean).length : 0;
+    } catch (_) {}
+
+    try {
+      const { readLog } = requireSourceOrBundled('./src/tracking/logger');
+      const log = readLog(cwd);
+      if (log.length) {
+        const last = log[log.length - 1];
+        st.lastIndex = last.ts || null;
+        st.indexVersion = last.version || null;
+        st.indexFiles = last.fileCount != null ? last.fileCount : null;
+      }
+    } catch (_) {}
+
+    // Index freshness: count tracked files modified after the last index run.
+    if (st.lastIndex) {
+      try {
+        const since = Date.parse(st.lastIndex);
+        const tracked = execSync('git ls-files', gitOpts).split('\n').filter(Boolean);
+        let changed = 0;
+        for (const f of tracked.slice(0, 5000)) {
+          try { if (fs.statSync(path.join(cwd, f)).mtimeMs > since) changed++; } catch (_) {}
+        }
+        st.changedSinceIndex = changed;
+      } catch (_) {}
+    }
+
+    try {
+      const { readNotes } = requireSourceOrBundled('./src/session/notes');
+      const notes = readNotes(cwd);
+      st.notes = notes.length;
+      if (notes.length) st.lastNote = notes[notes.length - 1];
+    } catch (_) {}
+
+    if (jsonOut) {
+      process.stdout.write(JSON.stringify(st) + '\n');
+      process.exit(0);
+    }
+
+    const fmtAgo = (iso) => {
+      if (!iso) return 'never';
+      const ms = Date.now() - Date.parse(iso);
+      if (!Number.isFinite(ms)) return iso;
+      const m = Math.floor(ms / 60000), h = Math.floor(m / 60), d = Math.floor(h / 24);
+      if (d > 0) return `${d}d ago`;
+      if (h > 0) return `${h}h ago`;
+      if (m > 0) return `${m}m ago`;
+      return 'just now';
+    };
+
+    console.log('[sigmap] status');
+    console.log(`  Branch:        ${st.branch || '(not a git repo)'}`);
+    console.log(`  Working tree:  ${st.dirty === 0 ? 'clean' : `${st.dirty} file${st.dirty === 1 ? '' : 's'} changed`}`);
+    if (st.lastIndex) {
+      let fresh = `${fmtAgo(st.lastIndex)} (v${st.indexVersion || '?'}, ${st.indexFiles != null ? st.indexFiles + ' files' : 'n/a'})`;
+      if (st.changedSinceIndex != null && st.changedSinceIndex > 0) fresh += ` — STALE: ${st.changedSinceIndex} file${st.changedSinceIndex === 1 ? '' : 's'} changed since`;
+      console.log(`  Last index:    ${fresh}`);
+    } else {
+      console.log('  Last index:    never — run: sigmap');
+    }
+    if (st.notes > 0) {
+      console.log(`  Notes:         ${st.notes} (latest: ${st.lastNote.text.slice(0, 60)}${st.lastNote.text.length > 60 ? '…' : ''})`);
+    } else {
+      console.log('  Notes:         none — add with: sigmap note "<text>"');
+    }
+    process.exit(0);
+  }
+
+  // `sigmap verify-ai-output <answer.md>` — Hallucination Guard (deterministic core)
+  if (args[0] === 'verify-ai-output') {
+    const target = args[1];
+    const jsonOut = args.includes('--json');
+    const reportIdx = args.indexOf('--report');
+    const reportOut = reportIdx !== -1
+      ? (args[reportIdx + 1] && !args[reportIdx + 1].startsWith('--') ? args[reportIdx + 1] : 'sigmap-verify-report.html')
+      : null;
+    if (!target || target.startsWith('--')) {
+      console.error('[sigmap] Usage: sigmap verify-ai-output <answer.md> [--json] [--report [out.html]]');
+      process.exit(1);
+    }
+    const absTarget = path.resolve(cwd, target);
+    if (!fs.existsSync(absTarget)) {
+      console.error(`[sigmap] file not found: ${target}`);
+      process.exit(1);
+    }
+
+    const answerText = fs.readFileSync(absTarget, 'utf8');
+    const { verify } = requireSourceOrBundled('./src/verify/hallucination-guard');
+    const { issues, summary } = verify(answerText, cwd);
+    const rel = path.relative(cwd, absTarget) || target;
+    const result = { file: rel, issues, summary };
+
+    // Optional HTML report (Surface A) — written alongside any other output.
+    if (reportOut) {
+      const { renderReportHtml } = requireSourceOrBundled('./src/format/verify-report');
+      const outAbs = path.resolve(cwd, reportOut);
+      fs.writeFileSync(outAbs, renderReportHtml(result));
+      if (!jsonOut) console.log(`[sigmap] report written: ${path.relative(cwd, outAbs) || reportOut}`);
+    }
+
+    if (jsonOut) {
+      process.stdout.write(JSON.stringify(result) + '\n');
+      process.exit(summary.total > 0 ? 1 : 0);
+    }
+
+    if (summary.total === 0) {
+      console.log(`[sigmap] ✓ ${rel} — no hallucinations detected (${summary.symbolsIndexed} symbols indexed)`);
+      process.exit(0);
+    }
+
+    const labels = {
+      'fake-file': 'Fake file', 'fake-test-file': 'Fake test file',
+      'fake-import': 'Fake import', 'fake-symbol': 'Fake symbol',
+      'fake-npm-script': 'Fake npm script',
+    };
+    const bt = summary.byType;
+    console.log(`[sigmap] ✗ ${rel} — ${summary.total} issue${summary.total === 1 ? '' : 's'} found`);
+    console.log(`  fake-file: ${bt['fake-file']}  fake-test-file: ${bt['fake-test-file']}  fake-import: ${bt['fake-import']}  fake-symbol: ${bt['fake-symbol']}  fake-npm-script: ${bt['fake-npm-script']}`);
+    console.log('');
+    for (const issue of issues) {
+      console.log(`  L${issue.line}  [${labels[issue.type] || issue.type}]  ${issue.message}`);
+      if (issue.suggestion) console.log(`         ↳ ${issue.suggestion}`);
+    }
+    process.exit(1);
+  }
+
   // Feature 1: `sigmap explain <file>` — why a file is included or excluded
   if (args[0] === 'explain' || args.includes('--explain')) {
     const target = args[0] === 'explain'