sigmap 8.33.0 → 8.35.0

package/gen-context.js

@@ -1644,7 +1644,7 @@ __factories["./src/config/loader"] = function(module, exports) {
     '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs',
     '.py', '.pyw', '.java', '.kt', '.kts', '.go', '.rs', '.cs',
     '.cpp', '.c', '.h', '.hpp', '.cc', '.rb', '.rake', '.php',
-    '.swift', '.dart', '.scala', '.sc', '.vue', '.svelte',
+    '.swift', '.dart', '.scala', '.sc', '.lua', '.vue', '.svelte',
     '.html', '.htm', '.css', '.scss', '.sass', '.less',
     '.yml', '.yaml', '.sh', '.bash', '.zsh', '.fish',
     '.sql', '.graphql', '.gql', '.tf', '.tfvars', '.proto',
@@ -1968,7 +1968,7 @@ __factories["./src/config/tune"] = function(module, exports) {
   const SOURCE_EXTS = new Set([
     '.js', '.mjs', '.cjs', '.jsx', '.ts', '.tsx', '.py', '.rb', '.go', '.rs',
     '.java', '.kt', '.cs', '.cpp', '.c', '.h', '.hpp', '.swift', '.dart',
-    '.scala', '.php', '.gd', '.r', '.R',
+    '.scala', '.php', '.lua', '.gd', '.r', '.R',
   ]);
 
   /** Raw user config file content, or null when absent/unparsable. */
@@ -3128,6 +3128,7 @@ __factories["./src/discovery/language-detector"] = function(module, exports) {
     '.java': 'java', '.kt': 'kotlin', '.cs': 'csharp', '.cpp': 'cpp',
     '.c': 'cpp', '.h': 'cpp', '.hpp': 'cpp', '.swift': 'swift',
     '.dart': 'dart', '.scala': 'scala', '.php': 'php',
+    '.lua': 'lua',
     '.gd': 'gdscript',
     '.r': 'r', '.R': 'r',
   };
@@ -3558,12 +3559,21 @@ __factories["./src/discovery/source-root-registry"] = function(module, exports)
         akka:  { detectionFiles: [], detectionDeps: ['akka'], srcDirs: ['src/main/scala','src'] },
         play:  { detectionFiles: [], detectionDeps: ['play'], srcDirs: ['app','conf'] },
         spark: { detectionFiles: [], detectionDeps: ['spark'],srcDirs: ['src/main/scala'] },
-        zio:   { detectionFiles: [], detectionDeps: ['zio'],  srcDirs: ['src/main/scala'] },
+        zio:   { detectionFiles: [], detectionDeps: ['zio'], srcDirs: ['src/main/scala'] },
       },
       srcDirs:  ['src/main/scala','src'],
       penalties: ['target'],
     },
 
+    lua: {
+      manifestFiles: ['.luarc.json', 'selene.toml', 'stylua.toml'],
+      frameworks: {
+        luarocks: { detectionFiles: ['*.rockspec'], srcDirs: ['src','lua','lib'] },
+      },
+      srcDirs:  ['src','lua','lib'],
+      penalties: ['.luarocks','luarocks_modules'],
+    },
+
     r: {
       manifestFiles: ['DESCRIPTION','renv.lock'],
       frameworks: {
@@ -3797,7 +3807,7 @@ __factories["./src/discovery/source-root-scorer"] = function(module, exports) {
   const CODE_EXTS = new Set([
     '.js','.mjs','.cjs','.ts','.tsx','.jsx',
     '.py','.rb','.go','.rs','.java','.kt',
-    '.cs','.cpp','.c','.h','.swift','.dart','.scala','.php',
+    '.cs','.cpp','.c','.h','.swift','.dart','.scala','.php','.lua',
   ]);
 
   const AUTO_SKIP = new Set([
@@ -5459,8 +5469,13 @@ __factories["./src/extractors/cpp"] = function(module, exports) {
   // Ceilings sit above the default `maxSigsPerFile` so the configured budget
   // governs output rather than a literal buried here, and omissions are disclosed
   // — an undisclosed cap looks like a class that simply has eight methods (#576).
-  const MEMBER_LIMIT = 8;
-  const PER_FILE_LIMIT = 25;
+  // Class bodies are scanned to this many characters. Real classes routinely
+  // run past the old 4KB scan window — truncating there silently hid every
+  // member after ~4000 chars AND anchored class end-lines short (#576). The
+  // ceiling only guards against pathological input (Java parity, #551).
+  const MAX_CLASS_BODY_CHARS = 200000;
+  const MEMBER_LIMIT = 120;
+  const PER_FILE_LIMIT = 200;
 
   /**
    * Extract signatures from C/C++ source code.
@@ -5497,7 +5512,7 @@ __factories["./src/extractors/cpp"] = function(module, exports) {
 
   function extractBlock(src, startIndex) {
     let depth = 1, i = startIndex;
-    const end = Math.min(src.length, startIndex + 4000);
+    const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
     while (i < end && depth > 0) {
       if (src[i] === '{') depth++;
       else if (src[i] === '}') depth--;
@@ -5541,8 +5556,13 @@ __factories["./src/extractors/csharp"] = function(module, exports) {
   // Ceilings sit above the default `maxSigsPerFile` so the configured budget
   // governs output rather than a literal buried here, and omissions are disclosed
   // — an undisclosed cap looks like a class that simply has eight methods (#576).
-  const MEMBER_LIMIT = 8;
-  const PER_FILE_LIMIT = 25;
+  // Class bodies are scanned to this many characters. Real classes routinely
+  // run past the old 4KB scan window — truncating there silently hid every
+  // member after ~4000 chars AND anchored class end-lines short (#576). The
+  // ceiling only guards against pathological input (Java parity, #551).
+  const MAX_CLASS_BODY_CHARS = 200000;
+  const MEMBER_LIMIT = 120;
+  const PER_FILE_LIMIT = 200;
 
   /**
    * Extract signatures from C# source code.
@@ -5577,7 +5597,7 @@ __factories["./src/extractors/csharp"] = function(module, exports) {
 
   function extractBlock(src, startIndex) {
     let depth = 1, i = startIndex;
-    const end = Math.min(src.length, startIndex + 5000);
+    const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
     while (i < end && depth > 0) {
       if (src[i] === '{') depth++;
       else if (src[i] === '}') depth--;
@@ -5622,7 +5642,7 @@ __factories["./src/extractors/css"] = function(module, exports) {
 
   // Ceiling sits above the default `maxSigsPerFile` so the configured budget
   // governs output rather than a literal buried here, and omissions are disclosed (#576).
-  const PER_FILE_LIMIT = 25;
+  const PER_FILE_LIMIT = 200;
 
   /**
    * Extract signatures from CSS/SCSS/SASS/Less source code.
@@ -5703,8 +5723,13 @@ __factories["./src/extractors/dart"] = function(module, exports) {
   // Ceilings sit above the default `maxSigsPerFile` so the configured budget
   // governs output rather than a literal buried here, and omissions are disclosed
   // — an undisclosed cap looks like a class that simply has eight methods (#576).
-  const MEMBER_LIMIT = 8;
-  const PER_FILE_LIMIT = 25;
+  // Class bodies are scanned to this many characters. Real classes routinely
+  // run past the old 4KB scan window — truncating there silently hid every
+  // member after ~4000 chars AND anchored class end-lines short (#576). The
+  // ceiling only guards against pathological input (Java parity, #551).
+  const MAX_CLASS_BODY_CHARS = 200000;
+  const MEMBER_LIMIT = 120;
+  const PER_FILE_LIMIT = 200;
 
   /**
    * Extract signatures from Dart source code.
@@ -5758,7 +5783,7 @@ __factories["./src/extractors/dart"] = function(module, exports) {
 
   function extractBlock(src, startIndex) {
     let depth = 1, i = startIndex;
-    const end = Math.min(src.length, startIndex + 4000);
+    const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
     while (i < end && depth > 0) {
       if (src[i] === '{') depth++;
       else if (src[i] === '}') depth--;
@@ -5882,6 +5907,28 @@ __factories["./src/extractors/deps"] = function(module, exports) {
     return [...deps].slice(0, 5);
   }
 
+  /**
+   * Extract Lua require() module dependencies.
+   * Captures `require "mod"` and `require("mod")`, returning compact module
+   * names as they appear in source.
+   * @param {string} src
+   * @returns {string[]}
+   */
+  function extractLuaDeps(src) {
+    const deps = new Set();
+    const stripped = stripLuaComments(src || '');
+    for (const m of stripped.matchAll(/\brequire\s*(?:\(\s*)?["']([A-Za-z0-9_.\/-]+)["']\s*\)?/g)) {
+      if (m[1]) deps.add(m[1]);
+    }
+    return [...deps].slice(0, 5);
+  }
+
+  function stripLuaComments(src) {
+    return String(src || '')
+      .replace(/--\[\[[\s\S]*?\]\]/g, '')
+      .replace(/--.*$/gm, '');
+  }
+
   /**
    * Build reverse dependency map from forward map.
    * @param {Map<string, string[]>} forwardMap
@@ -5900,7 +5947,7 @@ __factories["./src/extractors/deps"] = function(module, exports) {
     return reverse;
   }
 
-  module.exports = { extractPythonDeps, extractTSDeps, extractRDeps, buildReverseDepMap };
+  module.exports = { extractPythonDeps, extractTSDeps, extractRDeps, extractLuaDeps, buildReverseDepMap };
   
 };
 
@@ -5935,6 +5982,7 @@ __factories["./src/extractors/dispatch"] = function(module, exports) {
     swift: __require('./src/extractors/swift'),
     dart: __require('./src/extractors/dart'),
     scala: __require('./src/extractors/scala'),
+    lua: __require('./src/extractors/lua'),
     gdscript: __require('./src/extractors/gdscript'),
     r: __require('./src/extractors/r'),
     vue_sfc: __require('./src/extractors/vue_sfc'),
@@ -5985,6 +6033,7 @@ __factories["./src/extractors/dispatch"] = function(module, exports) {
     '.swift': 'swift',
     '.dart': 'dart',
     '.scala': 'scala', '.sc': 'scala',
+    '.lua': 'lua',
     '.gd': 'gdscript',
     '.r': 'r', '.R': 'r',
     '.vue': 'vue_sfc',
@@ -6041,7 +6090,7 @@ __factories["./src/extractors/dockerfile"] = function(module, exports) {
 
   // Ceiling sits above the default `maxSigsPerFile` so the configured budget
   // governs output rather than a literal buried here, and omissions are disclosed (#576).
-  const PER_FILE_LIMIT = 25;
+  const PER_FILE_LIMIT = 200;
 
   /**
    * Extract signatures from Dockerfiles.
@@ -6100,10 +6149,10 @@ __factories["./src/extractors/gdscript"] = function(module, exports) {
 
   // Ceiling sits above the default `maxSigsPerFile` so the configured budget
   // governs output rather than a literal buried here, and omissions are disclosed (#576).
-  const PER_FILE_LIMIT = 25;
+  const PER_FILE_LIMIT = 200;
 
   // Ceilings disclose what they drop rather than truncating silently (#576).
-  const MEMBER_LIMIT = 6;
+  const MEMBER_LIMIT = 120;
   const ENUM_LIMIT = 24;
 
   /**
@@ -6273,11 +6322,19 @@ __factories["./src/extractors/generic"] = function(module, exports) {
 __factories["./src/extractors/go"] = function(module, exports) {
   
   const { lineAt, withAnchor } = __require('./src/extractors/line-anchor');
-  const { capWithNotice } = __require('./src/util/truncate');
+  const { capWithNotice, capMembersWithNotice } = __require('./src/util/truncate');
 
   // Ceiling sits above the default `maxSigsPerFile` so the configured budget
   // governs output rather than a literal buried here, and omissions are disclosed (#576).
-  const PER_FILE_LIMIT = 25;
+  // Class bodies are scanned to this many characters. Real classes routinely
+  // run past the old 4KB scan window — truncating there silently hid every
+  // member after ~4000 chars AND anchored class end-lines short (#576). The
+  // ceiling only guards against pathological input (Java parity, #551).
+  const MAX_CLASS_BODY_CHARS = 200000;
+  const PER_FILE_LIMIT = 200;
+
+  // Per-interface member ceiling, disclosed via capMembersWithNotice (#576).
+  const MEMBER_LIMIT = 120;
 
   /**
    * Extract signatures from Go source code.
@@ -6313,7 +6370,7 @@ __factories["./src/extractors/go"] = function(module, exports) {
       const block = extractBlock(stripped, bodyStart);
       sigs.push(hinted(withAnchor(`type ${m[1]} interface`, lineAt(stripped, m.index), lineAt(stripped, bodyStart + block.length)), m[1]));
       for (const meth of extractInterfaceMethods(block)) {
-        sigs.push(withAnchor(`  ${meth.text}`, lineAt(stripped, bodyStart + meth.declIdx), lineAt(stripped, bodyStart + meth.endIdx)));
+        sigs.push(withAnchor(`  ${meth.text}`, lineAt(stripped, bodyStart + (meth.declIdx || 0)), lineAt(stripped, bodyStart + (meth.endIdx || 0))));
       }
     }
 
@@ -6331,7 +6388,7 @@ __factories["./src/extractors/go"] = function(module, exports) {
 
   function extractBlock(src, startIndex) {
     let depth = 1, i = startIndex;
-    const end = Math.min(src.length, startIndex + 2000);
+    const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
     while (i < end && depth > 0) {
       if (src[i] === '{') depth++;
       else if (src[i] === '}') depth--;
@@ -6351,7 +6408,7 @@ __factories["./src/extractors/go"] = function(module, exports) {
         endIdx: m.index + m[0].length,
       });
     }
-    return methods.slice(0, 8);
+    return capMembersWithNotice(methods, MEMBER_LIMIT, 'methods');
   }
 
   function normalizeParams(params) {
@@ -6464,7 +6521,7 @@ __factories["./src/extractors/html"] = function(module, exports) {
 
   // Ceiling sits above the default `maxSigsPerFile` so the configured budget
   // governs output rather than a literal buried here, and omissions are disclosed (#576).
-  const PER_FILE_LIMIT = 25;
+  const PER_FILE_LIMIT = 200;
 
   /**
    * Extract signatures from HTML files.
@@ -6639,6 +6696,10 @@ __factories["./src/extractors/javascript"] = function(module, exports) {
   const { capWithNotice, capMembersWithNotice } = __require('./src/util/truncate');
   const { stripComments, maskCode, readBalanced } = __require('./src/extractors/scan');
 
+  // Class bodies are scanned to this many characters — guard against
+  // pathological input only; the old 4KB window silently hid members (#576).
+  const MAX_CLASS_BODY_CHARS = 200000;
+
   /**
    * Extract signatures from JavaScript source code.
    * Top-level declarations and class members carry a `:start-end` line anchor
@@ -6748,13 +6809,13 @@ __factories["./src/extractors/javascript"] = function(module, exports) {
       const anchored = anchors[i] ? withAnchor(s, anchors[i][0], anchors[i][1]) : s;
       return docHintFor[i] ? `${anchored}  # ${docHintFor[i]}` : anchored;
     });
-    return capWithNotice(withAnchors, 25, 'signatures');
+    return capWithNotice(withAnchors, 200, 'signatures');
   }
 
   function extractBlock(src, startIndex) {
     let depth = 1;
     let i = startIndex;
-    const end = Math.min(src.length, startIndex + 4000);
+    const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
     while (i < end && depth > 0) {
       if (src[i] === '{') depth++;
       else if (src[i] === '}') depth--;
@@ -6789,7 +6850,7 @@ __factories["./src/extractors/javascript"] = function(module, exports) {
       const retStr = formatReturnHint(returnHints.get(m[1]));
       members.push({ text: `${isStatic}${isAsync}${m[1]}(${normalizeParams(params)})${retStr}`, start, end });
     }
-    return capMembersWithNotice(members, 8, 'methods');
+    return capMembersWithNotice(members, 120, 'methods');
   }
 
   function buildReturnHints(src) {
@@ -6863,8 +6924,13 @@ __factories["./src/extractors/kotlin"] = function(module, exports) {
   // Ceilings sit above the default `maxSigsPerFile` so the configured budget
   // governs output rather than a literal buried here, and omissions are disclosed
   // — an undisclosed cap looks like a class that simply has eight methods (#576).
-  const MEMBER_LIMIT = 8;
-  const PER_FILE_LIMIT = 25;
+  // Class bodies are scanned to this many characters. Real classes routinely
+  // run past the old 4KB scan window — truncating there silently hid every
+  // member after ~4000 chars AND anchored class end-lines short (#576). The
+  // ceiling only guards against pathological input (Java parity, #551).
+  const MAX_CLASS_BODY_CHARS = 200000;
+  const MEMBER_LIMIT = 120;
+  const PER_FILE_LIMIT = 200;
 
   /**
    * Extract signatures from Kotlin source code.
@@ -6918,7 +6984,7 @@ __factories["./src/extractors/kotlin"] = function(module, exports) {
 
   function extractBlock(src, startIndex) {
     let depth = 1, i = startIndex;
-    const end = Math.min(src.length, startIndex + 4000);
+    const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
     while (i < end && depth > 0) {
       if (src[i] === '{') depth++;
       else if (src[i] === '}') depth--;
@@ -7012,13 +7078,169 @@ __factories["./src/extractors/line-anchor"] = function(module, exports) {
   
 };
 
+// ── ./src/extractors/lua ──
+__factories["./src/extractors/lua"] = function(module, exports) {
+  
+  const { capWithNotice } = __require('./src/util/truncate');
+
+  // Ceiling discloses what it drops rather than truncating silently (#583).
+  // Collection runs to completion so the marker reports the true overflow —
+  // stopping early made r.js report "+1 more" where 50 were hidden (#584).
+  const PER_FILE_LIMIT = 200;
+
+  /**
+   * Extract signatures from Lua source code.
+   *
+   * Recognised constructs:
+   *   - Global functions: `function name(args)`
+   *   - Module-table functions: `function M.name(args)` / `function M:name(args)`
+   *   - Local functions: `local function name(args)`
+   *   - Assigned functions: `name = function(args)` / `M.name = function(args)`
+   *   - Module imports: `local mod = require("mod")` as compact hints
+   *   - LDoc-style doc comments (`---`) as first-sentence hints
+   *
+   * The extractor is regex-only and zero-dependency, matching SigMap's Tier-3
+   * language extractor style.
+   *
+   * @param {string} src - Raw file content
+   * @returns {string[]} Array of signature strings
+   */
+  function extract(src) {
+    if (!src || typeof src !== 'string') return [];
+    const sigs = [];
+    const hints = collectDocHints(src);
+    const stripped = stripLuaComments(src);
+    const seen = new Set();
+
+    // local foo = require('bar.baz') — useful module-surface hint, capped low.
+    for (const m of stripped.matchAll(/^\s*(?:local\s+)?([A-Za-z_]\w*)\s*=\s*require\s*\(\s*['"]([A-Za-z0-9_.\/-]+)['"]\s*\)/gm)) {
+      pushUnique(sigs, seen, `require ${m[2]} as ${m[1]}`);
+    }
+
+    // local function name(args)
+    for (const m of stripped.matchAll(/^\s*local\s+function\s+([A-Za-z_]\w*)\s*\(([^)]*)\)/gm)) {
+      if (m[1].startsWith('_')) continue;
+      pushUnique(sigs, seen, `local function ${m[1]}(${normalizeParams(m[2])})${applyHint(hints, m[1])}`);
+    }
+
+    // function name(args), function M.name(args), function M:name(args)
+    for (const m of stripped.matchAll(/^\s*function\s+([A-Za-z_]\w*(?:(?:\.|:)[A-Za-z_]\w*)*)\s*\(([^)]*)\)/gm)) {
+      const name = m[1];
+      if (name.startsWith('_')) continue;
+      pushUnique(sigs, seen, `function ${name}(${normalizeParams(m[2])})${applyHint(hints, name)}`);
+    }
+
+    // name = function(args), M.name = function(args), M:name = function(args)
+    for (const m of stripped.matchAll(/^\s*(?:local\s+)?([A-Za-z_]\w*(?:(?:\.|:)[A-Za-z_]\w*)*)\s*=\s*function\s*\(([^)]*)\)/gm)) {
+      const name = m[1];
+      if (name.startsWith('_')) continue;
+      pushUnique(sigs, seen, `${name} = function(${normalizeParams(m[2])})${applyHint(hints, name)}`);
+    }
+
+    return capWithNotice(sigs, PER_FILE_LIMIT, 'signatures');
+  }
+
+  function pushUnique(out, seen, sig) {
+    if (!sig || seen.has(sig)) return;
+    seen.add(sig);
+    out.push(sig);
+  }
+
+  function normalizeParams(params) {
+    return String(params || '')
+      .replace(/--.*$/gm, '')
+      .split(',')
+      .map((p) => p.trim().replace(/\s+/g, ' '))
+      .filter(Boolean)
+      .join(', ');
+  }
+
+  function applyHint(hints, name) {
+    const h = hints.get(name);
+    return h ? `  # ${h}` : '';
+  }
+
+  /**
+   * Attach each contiguous `---` doc block to the next function-like declaration
+   * by its extracted symbol name.
+   */
+  function collectDocHints(src) {
+    const hints = new Map();
+    const lines = src.split('\n');
+    let block = [];
+    for (const line of lines) {
+      const doc = line.match(/^\s*---\s?(.*)$/);
+      if (doc) {
+        block.push(doc[1]);
+      } else if (block.length > 0) {
+        const decl = line.match(/^\s*local\s+function\s+([A-Za-z_]\w*)\s*\(/)
+                  || line.match(/^\s*function\s+([A-Za-z_]\w*(?:(?:\.|:)[A-Za-z_]\w*)*)\s*\(/)
+                  || line.match(/^\s*(?:local\s+)?([A-Za-z_]\w*(?:(?:\.|:)[A-Za-z_]\w*)*)\s*=\s*function\s*\(/);
+        if (decl) {
+          const hint = firstDocSentence(block);
+          if (hint) hints.set(decl[1], hint);
+        }
+        block = [];
+      }
+    }
+    return hints;
+  }
+
+  function firstDocSentence(block) {
+    for (const raw of block) {
+      const line = String(raw || '').trim();
+      if (!line || line.startsWith('@')) continue;
+      return line.replace(/\s+/g, ' ').slice(0, 60).replace(/[.,;:!?]+$/, '').trim();
+    }
+    return '';
+  }
+
+  /** Strip Lua line and long comments while preserving strings enough for regex scans. */
+  function stripLuaComments(src) {
+    const out = src.split('');
+    const blank = (a, b) => { for (let i = a; i < b; i++) if (out[i] !== '\n') out[i] = ' '; };
+    let i = 0;
+    while (i < src.length) {
+      const ch = src[i];
+      if (ch === '"' || ch === "'") {
+        const quote = ch;
+        i++;
+        while (i < src.length) {
+          if (src[i] === '\\') { i += 2; continue; }
+          if (src[i] === quote) { i++; break; }
+          if (src[i] === '\n') break;
+          i++;
+        }
+        continue;
+      }
+      if (src.startsWith('--[[', i)) {
+        const end = src.indexOf(']]', i + 4);
+        blank(i, end === -1 ? src.length : end + 2);
+        i = end === -1 ? src.length : end + 2;
+        continue;
+      }
+      if (src.startsWith('--', i)) {
+        const end = src.indexOf('\n', i + 2);
+        blank(i, end === -1 ? src.length : end);
+        i = end === -1 ? src.length : end;
+        continue;
+      }
+      i++;
+    }
+    return out.join('');
+  }
+
+  module.exports = { extract };
+  
+};
+
 // ── ./src/extractors/markdown ──
 __factories["./src/extractors/markdown"] = function(module, exports) {
   
   const { capWithNotice } = __require('./src/util/truncate');
 
   // Ceiling discloses what it drops rather than truncating silently (#583).
-  const PER_FILE_LIMIT = 40;
+  const PER_FILE_LIMIT = 200;
 
   /**
    * Lightweight markdown technical indexer.
@@ -7199,8 +7421,13 @@ __factories["./src/extractors/php"] = function(module, exports) {
   // Ceilings sit above the default `maxSigsPerFile` so the configured budget
   // governs output rather than a literal buried here, and omissions are disclosed
   // — an undisclosed cap looks like a class that simply has eight methods (#576).
-  const MEMBER_LIMIT = 8;
-  const PER_FILE_LIMIT = 25;
+  // Class bodies are scanned to this many characters. Real classes routinely
+  // run past the old 4KB scan window — truncating there silently hid every
+  // member after ~4000 chars AND anchored class end-lines short (#576). The
+  // ceiling only guards against pathological input (Java parity, #551).
+  const MAX_CLASS_BODY_CHARS = 200000;
+  const MEMBER_LIMIT = 120;
+  const PER_FILE_LIMIT = 200;
 
   /**
    * Extract signatures from PHP source code.
@@ -7258,7 +7485,7 @@ __factories["./src/extractors/php"] = function(module, exports) {
 
   function extractBlock(src, startIndex) {
     let depth = 1, i = startIndex;
-    const end = Math.min(src.length, startIndex + 4000);
+    const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
     while (i < end && depth > 0) {
       if (src[i] === '{') depth++;
       else if (src[i] === '}') depth--;
@@ -7378,7 +7605,7 @@ __factories["./src/extractors/properties"] = function(module, exports) {
   const { capWithNotice } = __require('./src/util/truncate');
 
   // Ceiling discloses what it drops rather than truncating silently (#583).
-  const PER_FILE_LIMIT = 50;
+  const PER_FILE_LIMIT = 200;
 
   /**
    * Extract signatures from .properties configuration files.
@@ -7494,7 +7721,10 @@ __factories["./src/extractors/python"] = function(module, exports) {
 
   // Ceiling sits above the default `maxSigsPerFile` so the configured budget
   // governs output rather than a literal buried here, and omissions are disclosed (#576).
-  const PER_FILE_LIMIT = 30;
+  const PER_FILE_LIMIT = 200;
+
+  // Per-class member ceiling, disclosed via capWithNotice (#576).
+  const MEMBER_LIMIT = 120;
 
   /**
    * 1-based line of the last source line belonging to a top-level (indent 0)
@@ -7650,7 +7880,7 @@ __factories["./src/extractors/python"] = function(module, exports) {
         methods.push(`${asyncKw}def ${m[1]}(${params})${retStr}`);
       }
     }
-    return methods.slice(0, 8);
+    return capWithNotice(methods, MEMBER_LIMIT, 'methods');
   }
 
   function tryExtractDataclassFields(stripped, classIndex) {
@@ -7759,6 +7989,8 @@ __factories["./src/extractors/python"] = function(module, exports) {
 // ── ./src/extractors/python_dataclass ──
 __factories["./src/extractors/python_dataclass"] = function(module, exports) {
   
+  const { capWithNotice } = __require('./src/util/truncate');
+
   /**
    * Extract Python dataclass, Pydantic model, and SQLAlchemy ORM metadata.
    * Focuses on model fields, validation, and relationships.
@@ -7830,7 +8062,7 @@ __factories["./src/extractors/python_dataclass"] = function(module, exports) {
       sigs.push('config-class');
     }
 
-    return Array.from(new Set(sigs)).slice(0, 50);
+    return capWithNotice(Array.from(new Set(sigs)), 200, 'signatures');
   }
 
   module.exports = { extract };
@@ -7844,7 +8076,7 @@ __factories["./src/extractors/r"] = function(module, exports) {
 
   // Ceiling sits above the default `maxSigsPerFile` so the configured budget
   // governs output rather than a literal buried here, and omissions are disclosed (#576).
-  const PER_FILE_LIMIT = 30;
+  const PER_FILE_LIMIT = 200;
 
   /**
    * Extract signatures from R source code.
@@ -8123,7 +8355,7 @@ __factories["./src/extractors/ruby"] = function(module, exports) {
 
   // Ceiling sits above the default `maxSigsPerFile` so the configured budget
   // governs output rather than a literal buried here, and omissions are disclosed (#576).
-  const PER_FILE_LIMIT = 25;
+  const PER_FILE_LIMIT = 200;
 
   /**
    * Extract signatures from Ruby source code.
@@ -8184,11 +8416,19 @@ __factories["./src/extractors/ruby"] = function(module, exports) {
 __factories["./src/extractors/rust"] = function(module, exports) {
   
   const { lineAt, withAnchor } = __require('./src/extractors/line-anchor');
-  const { capWithNotice } = __require('./src/util/truncate');
+  const { capWithNotice, capMembersWithNotice } = __require('./src/util/truncate');
 
   // Ceiling sits above the default `maxSigsPerFile` so the configured budget
   // governs output rather than a literal buried here, and omissions are disclosed (#576).
-  const PER_FILE_LIMIT = 25;
+  // Class bodies are scanned to this many characters. Real classes routinely
+  // run past the old 4KB scan window — truncating there silently hid every
+  // member after ~4000 chars AND anchored class end-lines short (#576). The
+  // ceiling only guards against pathological input (Java parity, #551).
+  const MAX_CLASS_BODY_CHARS = 200000;
+  const PER_FILE_LIMIT = 200;
+
+  // Per-impl member ceiling, disclosed via capMembersWithNotice (#576).
+  const MEMBER_LIMIT = 120;
 
   /**
    * Extract signatures from Rust source code.
@@ -8246,7 +8486,7 @@ __factories["./src/extractors/rust"] = function(module, exports) {
       const block = extractBlock(stripped, bodyStart);
       sigs.push(withAnchor(`impl ${m[1]}`, lineAt(stripped, m.index), lineAt(stripped, bodyStart + block.length)));
       for (const fn of extractMethods(block)) {
-        sigs.push(hinted(withAnchor(`  ${fn.text}`, lineAt(stripped, bodyStart + fn.declIdx), lineAt(stripped, bodyStart + fn.endIdx)), fn.name));
+        sigs.push(hinted(withAnchor(`  ${fn.text}`, lineAt(stripped, bodyStart + (fn.declIdx || 0)), lineAt(stripped, bodyStart + (fn.endIdx || 0))), fn.name));
       }
     }
 
@@ -8263,7 +8503,7 @@ __factories["./src/extractors/rust"] = function(module, exports) {
 
   function extractBlock(src, startIndex) {
     let depth = 1, i = startIndex;
-    const end = Math.min(src.length, startIndex + 5000);
+    const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
     while (i < end && depth > 0) {
       if (src[i] === '{') depth++;
       else if (src[i] === '}') depth--;
@@ -8284,7 +8524,7 @@ __factories["./src/extractors/rust"] = function(module, exports) {
         endIdx: m.index + m[0].length,
       });
     }
-    return methods.slice(0, 8);
+    return capMembersWithNotice(methods, MEMBER_LIMIT, 'methods');
   }
 
   function normalizeParams(params) {
@@ -8336,8 +8576,13 @@ __factories["./src/extractors/scala"] = function(module, exports) {
   // Ceilings sit above the default `maxSigsPerFile` so the configured budget
   // governs output rather than a literal buried here, and omissions are disclosed
   // — an undisclosed cap looks like a class that simply has eight methods (#576).
-  const MEMBER_LIMIT = 8;
-  const PER_FILE_LIMIT = 25;
+  // Class bodies are scanned to this many characters. Real classes routinely
+  // run past the old 4KB scan window — truncating there silently hid every
+  // member after ~4000 chars AND anchored class end-lines short (#576). The
+  // ceiling only guards against pathological input (Java parity, #551).
+  const MAX_CLASS_BODY_CHARS = 200000;
+  const MEMBER_LIMIT = 120;
+  const PER_FILE_LIMIT = 200;
 
   /**
    * Extract signatures from Scala source code.
@@ -8384,7 +8629,7 @@ __factories["./src/extractors/scala"] = function(module, exports) {
 
   function extractBlock(src, startIndex) {
     let depth = 1, i = startIndex;
-    const end = Math.min(src.length, startIndex + 4000);
+    const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
     while (i < end && depth > 0) {
       if (src[i] === '{') depth++;
       else if (src[i] === '}') depth--;
@@ -8529,7 +8774,7 @@ __factories["./src/extractors/shell"] = function(module, exports) {
 
   // Ceiling sits above the default `maxSigsPerFile` so the configured budget
   // governs output rather than a literal buried here, and omissions are disclosed (#576).
-  const PER_FILE_LIMIT = 25;
+  const PER_FILE_LIMIT = 200;
 
   /**
    * Extract signatures from shell scripts (bash, zsh, fish).
@@ -8679,7 +8924,7 @@ __factories["./src/extractors/svelte"] = function(module, exports) {
 
   // Ceiling sits above the default `maxSigsPerFile` so the configured budget
   // governs output rather than a literal buried here, and omissions are disclosed (#576).
-  const PER_FILE_LIMIT = 25;
+  const PER_FILE_LIMIT = 200;
 
   /**
    * Extract signatures from Svelte components.
@@ -8749,8 +8994,13 @@ __factories["./src/extractors/swift"] = function(module, exports) {
   // Ceilings sit above the default `maxSigsPerFile` so the configured budget
   // governs output rather than a literal buried here, and omissions are disclosed
   // — an undisclosed cap looks like a class that simply has eight methods (#576).
-  const MEMBER_LIMIT = 8;
-  const PER_FILE_LIMIT = 25;
+  // Class bodies are scanned to this many characters. Real classes routinely
+  // run past the old 4KB scan window — truncating there silently hid every
+  // member after ~4000 chars AND anchored class end-lines short (#576). The
+  // ceiling only guards against pathological input (Java parity, #551).
+  const MAX_CLASS_BODY_CHARS = 200000;
+  const MEMBER_LIMIT = 120;
+  const PER_FILE_LIMIT = 200;
 
   /**
    * Extract signatures from Swift source code.
@@ -8804,7 +9054,7 @@ __factories["./src/extractors/swift"] = function(module, exports) {
 
   function extractBlock(src, startIndex) {
     let depth = 1, i = startIndex;
-    const end = Math.min(src.length, startIndex + 4000);
+    const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
     while (i < end && depth > 0) {
       if (src[i] === '{') depth++;
       else if (src[i] === '}') depth--;
@@ -8963,7 +9213,7 @@ __factories["./src/extractors/toml"] = function(module, exports) {
   const { capWithNotice } = __require('./src/util/truncate');
 
   // Ceiling discloses what it drops rather than truncating silently (#583).
-  const PER_FILE_LIMIT = 40;
+  const PER_FILE_LIMIT = 200;
 
   /**
    * Extract signatures from TOML configuration files.
@@ -9015,6 +9265,10 @@ __factories["./src/extractors/typescript"] = function(module, exports) {
   const { capWithNotice, capMembersWithNotice } = __require('./src/util/truncate');
   const { stripComments, maskCode, readBalanced } = __require('./src/extractors/scan');
 
+  // Class bodies are scanned to this many characters — guard against
+  // pathological input only; the old 4KB window silently hid members (#576).
+  const MAX_CLASS_BODY_CHARS = 200000;
+
   /**
    * Extract signatures from TypeScript source code.
    * Top-level declarations carry a `:start-end` line anchor (see line-anchor.js);
@@ -9200,13 +9454,13 @@ __factories["./src/extractors/typescript"] = function(module, exports) {
       const anchored = anchors[i] ? withAnchor(s, anchors[i][0], anchors[i][1]) : s;
       return docHintFor[i] ? `${anchored}  # ${docHintFor[i]}` : anchored;
     });
-    return capWithNotice(withAnchors, 35, 'signatures');
+    return capWithNotice(withAnchors, 200, 'signatures');
   }
 
   function extractBlock(src, startIndex) {
     let depth = 1;
     let i = startIndex;
-    const end = Math.min(src.length, startIndex + 4000);
+    const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
     while (i < end && depth > 0) {
       if (src[i] === '{') depth++;
       else if (src[i] === '}') depth--;
@@ -9234,7 +9488,7 @@ __factories["./src/extractors/typescript"] = function(module, exports) {
       const start = m.index + (m[0].length - m[0].replace(/^\s+/, '').length);
       members.push({ text: `${m[1]}(${normalizeParams(block.slice(openIdx + 1, closeIdx))})`, start, end: closeIdx + 1 });
     }
-    return capMembersWithNotice(members, 8, 'members');
+    return capMembersWithNotice(members, 120, 'members');
   }
 
   const _CTRL_KEYWORDS = new Set(['if', 'for', 'while', 'switch', 'do', 'try', 'catch', 'finally', 'else', 'return']);
@@ -9269,7 +9523,7 @@ __factories["./src/extractors/typescript"] = function(module, exports) {
       const retStr = retType ? ` → ${retType}` : '';
       members.push({ text: `${isStatic}${isAsync}${m[1]}(${normalizeParams(params)})${retStr}`, start, end });
     }
-    return capMembersWithNotice(members, 8, 'methods');
+    return capMembersWithNotice(members, 120, 'methods');
   }
 
   function normalizeParams(params) {
@@ -9344,7 +9598,7 @@ __factories["./src/extractors/typescript_react"] = function(module, exports) {
   const { capWithNotice } = __require('./src/util/truncate');
 
   // Ceiling discloses what it drops rather than truncating silently (#583).
-  const PER_FILE_LIMIT = 50;
+  const PER_FILE_LIMIT = 200;
 
   /**
    * Extract React component signatures from .tsx files.
@@ -9410,6 +9664,8 @@ __factories["./src/extractors/typescript_react"] = function(module, exports) {
 // ── ./src/extractors/vue_sfc ──
 __factories["./src/extractors/vue_sfc"] = function(module, exports) {
   
+  const { capWithNotice } = __require('./src/util/truncate');
+
   /**
    * Extract Vue Single-File Component (SFC) signatures from .vue files.
    * Captures component metadata: name, props, emits, slots, composables, lifecycle.
@@ -9503,7 +9759,7 @@ __factories["./src/extractors/vue_sfc"] = function(module, exports) {
       sigs.push(`slot ${s}`);
     }
 
-    return Array.from(new Set(sigs)).slice(0, 50);
+    return capWithNotice(Array.from(new Set(sigs)), 200, 'signatures');
   }
 
   module.exports = { extract };
@@ -9513,6 +9769,8 @@ __factories["./src/extractors/vue_sfc"] = function(module, exports) {
 // ── ./src/extractors/xml ──
 __factories["./src/extractors/xml"] = function(module, exports) {
   
+  const { capWithNotice } = __require('./src/util/truncate');
+
   /**
    * Lightweight XML config extractor.
    * Captures root tags, key config tags, and id/name/class attributes.
@@ -9553,7 +9811,7 @@ __factories["./src/extractors/xml"] = function(module, exports) {
       if (cls) sigs.push(`${tag} -> ${cls[1]}`);
     }
 
-    return Array.from(new Set(sigs)).slice(0, 50);
+    return capWithNotice(Array.from(new Set(sigs)), 200, 'signatures');
   }
 
   module.exports = { extract };
@@ -9567,7 +9825,7 @@ __factories["./src/extractors/yaml"] = function(module, exports) {
 
   // Ceiling sits above the default `maxSigsPerFile` so the configured budget
   // governs output rather than a literal buried here, and omissions are disclosed (#576).
-  const PER_FILE_LIMIT = 25;
+  const PER_FILE_LIMIT = 200;
 
   /**
    * Extract signatures from YAML configuration files.
@@ -11977,6 +12235,8 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
   const JAVA_EXTS = new Set(['.java']);
   const GO_EXTS = new Set(['.go']);
   const RS_EXTS = new Set(['.rs']);
+  const KT_EXTS = new Set(['.kt', '.kts']);
+  const SCALA_EXTS = new Set(['.scala', '.sc']);
 
   // Tokens that look like `name(` calls or definition headers but are language
   // keywords, not user symbols — never treated as a call or a definition.
@@ -12300,6 +12560,81 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
 
   // Pick the masker whose comment/string syntax matches the language.
   // Java and Go share JS syntax (Go raw strings mask like template literals).
+  /**
+   * Body range for a JVM-family member that may use either a brace body or an
+   * expression body (`fun f() = expr` / `def f = expr`), which Java has not.
+   * An expression body runs to the end of its line — enough to capture the calls
+   * it makes, which is all the graph needs.
+   * @returns {{bodyStart:number, bodyEnd:number}|null} null when neither form follows
+   */
+  function jvmBodyRange(masked, from) {
+    let k = from;
+    while (k < masked.length && masked[k] !== '{' && masked[k] !== '=' && masked[k] !== '\n' && masked[k] !== ';') k++;
+    if (masked[k] === '{') return { bodyStart: k, bodyEnd: matchDelim(masked, k, '{', '}') };
+    if (masked[k] === '=') {
+      // `= {` is still a brace body, just written with an assignment.
+      let j = k + 1;
+      while (j < masked.length && /\s/.test(masked[j])) j++;
+      if (masked[j] === '{') return { bodyStart: j, bodyEnd: matchDelim(masked, j, '{', '}') };
+      const eol = masked.indexOf('\n', k);
+      return { bodyStart: k, bodyEnd: eol === -1 ? masked.length : eol };
+    }
+    return null; // abstract member or interface declaration
+  }
+
+  /**
+   * Kotlin `fun` definitions, including extension functions (`fun Foo.bar()`,
+   * recorded as `bar`) and expression bodies.
+   */
+  function ktDefs(masked) {
+    const defs = [];
+    const seen = new Set();
+    const re = /(?:^|\n)[ \t]*((?:(?:public|private|protected|internal|open|override|abstract|final|suspend|inline|operator|infix|tailrec|external|expect|actual|inner|companion)\s+)*)fun\s+(?:<[^>\n]{0,80}>\s*)?(?:[A-Za-z_][\w.<>]*\.)?([A-Za-z_][\w]*)\s*\(/g;
+    let m;
+    while ((m = re.exec(masked)) !== null) {
+      const name = m[2];
+      if (NON_CALL.has(name)) continue;
+      const paren = masked.indexOf('(', m.index + m[0].length - 1);
+      const close = matchDelim(masked, paren, '(', ')');
+      if (close < 0) continue;
+      const range = jvmBodyRange(masked, close + 1);
+      const line = lineAt(masked, m.index + 1);
+      const key = name + ':' + (range ? range.bodyStart : line);
+      if (seen.has(key)) continue;
+      seen.add(key);
+      // An abstract/interface member owns no body: it can receive edges but
+      // never produces them, the same treatment javaDefs gives declarations.
+      defs.push(range ? { name, line, ...range } : { name, line, bodyStart: close, bodyEnd: close });
+    }
+    return defs;
+  }
+
+  /**
+   * Scala `def` definitions. Handles parameterless members (`def foo: Int = 1`),
+   * type parameters, and expression bodies.
+   */
+  function scalaDefs(masked) {
+    const defs = [];
+    const seen = new Set();
+    const re = /(?:^|\n)[ \t]*((?:(?:private|protected|override|implicit|final|lazy|sealed|abstract|inline)(?:\s*\[[^\]\n]{0,60}\])?\s+)*)def\s+([A-Za-z_][\w]*)\s*(?=[\[\(:=])/g;
+    let m;
+    while ((m = re.exec(masked)) !== null) {
+      const name = m[2];
+      if (NON_CALL.has(name)) continue;
+      // Step past an optional type-parameter list, then an optional value list.
+      let k = m.index + m[0].length;
+      if (masked[k] === '[') { const e = matchDelim(masked, k, '[', ']'); if (e < 0) continue; k = e + 1; }
+      while (masked[k] === '(') { const e = matchDelim(masked, k, '(', ')'); if (e < 0) break; k = e + 1; }
+      const range = jvmBodyRange(masked, k);
+      const line = lineAt(masked, m.index + 1);
+      const key = name + ':' + (range ? range.bodyStart : line);
+      if (seen.has(key)) continue;
+      seen.add(key);
+      defs.push(range ? { name, line, ...range } : { name, line, bodyStart: k, bodyEnd: k });
+    }
+    return defs;
+  }
+
   function maskFor(filePath, src) {
     const ext = path.extname(filePath).toLowerCase();
     if (PY_EXTS.has(ext)) return maskPy(src);
@@ -12314,6 +12649,8 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
     if (JAVA_EXTS.has(ext)) return javaDefs(maskJs(src));
     if (GO_EXTS.has(ext)) return goDefs(maskJs(src));
     if (RS_EXTS.has(ext)) return rustDefs(maskRust(src));
+    if (KT_EXTS.has(ext)) return ktDefs(maskJs(src));
+    if (SCALA_EXTS.has(ext)) return scalaDefs(maskJs(src));
     return null; // unsupported language
   }
 
@@ -12403,7 +12740,8 @@ __factories["./src/graph/call-graph"] = function(module, exports) {
       if (e.isDirectory()) _walk(full, excludeSet, out, depth + 1, maxDepth);
       else if (e.isFile()) {
         const ext = path.extname(e.name).toLowerCase();
-        if (JS_EXTS.has(ext) || PY_EXTS.has(ext) || JAVA_EXTS.has(ext) || GO_EXTS.has(ext) || RS_EXTS.has(ext)) out.push(full);
+        if (JS_EXTS.has(ext) || PY_EXTS.has(ext) || JAVA_EXTS.has(ext) || GO_EXTS.has(ext)
+          || RS_EXTS.has(ext) || KT_EXTS.has(ext) || SCALA_EXTS.has(ext)) out.push(full);
       }
     }
   }
@@ -15795,8 +16133,8 @@ __factories["./src/mcp/server"] = function(module, exports) {
    * One JSON object per line on both stdin and stdout.
    *
    * Supported methods:
-   *   initialize        → serverInfo + capabilities
-   *   tools/list        → 19 tool definitions
+   *   initialize        → serverInfo + capabilities + negotiated protocolVersion
+   *   tools/list        → 21 tool definitions
    *   tools/call        → dispatch to handler, return result
    */
 
@@ -15806,10 +16144,22 @@ __factories["./src/mcp/server"] = function(module, exports) {
 
   const SERVER_INFO = {
     name: 'sigmap',
-    version: '8.33.0',
+    version: '8.35.0',
     description: 'SigMap MCP server — code signatures on demand',
   };
 
+  // Protocol revisions this server actually speaks. The tools-only surface —
+  // initialize / tools/list / tools/call plus the initialized/cancelled
+  // notifications — is identical across these revisions, and the
+  // @hasmcp/mcp-spec-test suite passes every applicable 2025-11-25 case against
+  // it. 2026-07-28 is deliberately absent: that revision requires
+  // server/discover, which is not implemented. Newest first: a client offering
+  // a version outside this list is downgraded to [0], never echoed back —
+  // echoing an unspeakable version is itself a spec violation (#544), and it
+  // made the conformance suite believe 2026-07-28 was supported, producing six
+  // phantom server/discover failures on a revision never really offered (#545).
+  const SUPPORTED_PROTOCOL_VERSIONS = ['2025-11-25', '2025-06-18', '2025-03-26', '2024-11-05'];
+
   // ---------------------------------------------------------------------------
   // JSON-RPC helpers
   // ---------------------------------------------------------------------------
@@ -15834,9 +16184,32 @@ __factories["./src/mcp/server"] = function(module, exports) {
       return;
     }
 
+    // server/discover (spec 2026-07-28) — session-less discovery, answerable
+    // before any handshake, so a client can learn the honest version list
+    // instead of offering versions and hoping. The response is a
+    // CacheableResult: deterministic, so the TTL promise of stability holds.
+    // Note supportedVersions does NOT include 2026-07-28 — answering discover
+    // is forward-compatible plumbing, not a claim to serve that revision's
+    // whole surface (per-result envelopes, inline _meta negotiation).
+    if (method === 'server/discover') {
+      respond(id, {
+        resultType: 'complete',
+        cacheScope: 'public',
+        ttlMs: 3600000,
+        supportedVersions: SUPPORTED_PROTOCOL_VERSIONS,
+        capabilities: { tools: {} },
+        serverInfo: SERVER_INFO,
+        instructions: 'SigMap serves code signatures for the working directory. Call query_context or search_signatures to rank and fetch signature blocks instead of reading whole files.',
+      });
+      return;
+    }
+
     if (method === 'initialize') {
+      const offered = params && params.protocolVersion;
       respond(id, {
-        protocolVersion: (params && params.protocolVersion) || '2024-11-05',
+        protocolVersion: SUPPORTED_PROTOCOL_VERSIONS.includes(offered)
+          ? offered
+          : SUPPORTED_PROTOCOL_VERSIONS[0],
         serverInfo: SERVER_INFO,
         capabilities: { tools: {} },
       });
@@ -15844,6 +16217,13 @@ __factories["./src/mcp/server"] = function(module, exports) {
     }
 
     if (method === 'tools/list') {
+      // No pagination: the full list fits one page, so any cursor a client
+      // presents is one this server never issued — reject it (-32602, per the
+      // spec's SHOULD) rather than silently restarting from page one.
+      if (params && params.cursor !== undefined) {
+        respondError(id, -32602, `Invalid cursor: ${String(params.cursor)}`);
+        return;
+      }
       respond(id, { tools: TOOLS });
       return;
     }
@@ -17473,9 +17853,15 @@ __factories["./src/retrieval/ranker"] = function(module, exports) {
       const hop1Files = new Set(); // normalised keys that received a hop1 boost
       const hop1Seeds = [];        // original (un-normalised) paths, for hop-2 lookup
 
-      // Hop 1: direct neighbors of scored files
-      for (const entry of scored) {
-        if (entry.score <= 0) continue;
+      // Hop 1: direct neighbors of scored files. Seeds snapshotted BEFORE the
+      // loop (as the call-graph block below already does) so boosts never
+      // cascade: a file whose only score is a hop-1 boost must not become a seed
+      // itself mid-loop, or the effective seed set — and every boost total —
+      // depends on index insertion order, which git history changes via the
+      // recent-commits hoist. That made gate scores differ between a shallow CI
+      // checkout and a developer clone of the same commit (#596).
+      const hop1SeedEntries = scored.filter((e) => e.score > 0);
+      for (const entry of hop1SeedEntries) {
         const neighbors = _graphGet(graph.forward, path.resolve(cwd, entry.file)) || [];
         for (const neighborAbs of neighbors) {
           const nk = path.normalize(neighborAbs);
@@ -17490,7 +17876,10 @@ __factories["./src/retrieval/ranker"] = function(module, exports) {
         }
       }
 
-      // Hop 2: neighbors of hop1 files (only if they didn't get a direct score)
+      // Hop 2: neighbors of hop1 files (only if they didn't get a direct score).
+      // Eligibility frozen after hop-1 for the same reason: a file whose first
+      // score is a hop-2 boost must not become hop-2-eligible mid-loop (#596).
+      const hop2Eligible = scored.map((e) => e.score > 0);
       for (const hop1Key of hop1Seeds) {
         if (_graphGet(keyToIdx, hop1Key) === undefined) continue; // skip files not in index
         const neighbors = _graphGet(graph.forward, hop1Key) || [];
@@ -17499,7 +17888,7 @@ __factories["./src/retrieval/ranker"] = function(module, exports) {
           if (_isHub(nk) || hubs.has(nk) || hubs.has(nk.toLowerCase())) continue;
           if (hop1Files.has(nk)) continue; // skip already hop1-boosted
           const idx = _graphGet(keyToIdx, nk);
-          if (idx !== undefined && scored[idx].score > 0) {
+          if (idx !== undefined && hop2Eligible[idx]) {
             // Only boost files that have some baseline score (not noise)
             scored[idx].score += GRAPH_BOOST_AMOUNTS.hop2;
             scored[idx].signals.graphBoost = (scored[idx].signals.graphBoost || 0) + GRAPH_BOOST_AMOUNTS.hop2;
@@ -22100,7 +22489,7 @@ function __tryGit(args, opts = {}) {
   catch (_) { return ''; }
 }
 
-const VERSION = '8.33.0';
+const VERSION = '8.35.0';
 const MARKER = '\n\n## Auto-generated signatures\n<!-- Updated by gen-context.js -->\n';
 
 function requireSourceOrBundled(key) {
@@ -22395,7 +22784,20 @@ function estimateTokens(str) {
 }
 
 function isTestFile(filePath) {
-  return /\.(test|spec)\.[a-z]+$/.test(filePath) || /_test\.[a-z]+$/.test(filePath);
+  const p = filePath.replace(/\\/g, '/');
+  // Filename conventions: foo.test.ts / foo.spec.js / foo_test.go / test_foo.py,
+  // plus the PascalCase JVM/C#/Swift family (FooTest.java, FooTests.kt,
+  // FooSpec.scala). The [a-z0-9] guard keeps `contest.java` and `Latest.java`
+  // out; the suffix must be a real case boundary.
+  if (/\.(test|spec)\.[a-z]+$/.test(p) || /_test\.[a-z]+$/.test(p)) return true;
+  if (/(^|\/)test_[^/]+\.[a-z]+$/.test(p)) return true;
+  if (/[a-z0-9](Test|Spec)s?\.(java|kt|kts|scala|groovy|cs|swift)$/.test(p)) return true;
+  // Path-segment conventions (src/test/java/**, tests/, spec/, __tests__/, e2e/)
+  // — the form the entire JVM world uses. Without this, "drop test files first"
+  // ran INVERTED on JVM repos: spring-petclinic's budget kept all 17 src/test/
+  // files while dropping the application entry point, the owner entities and
+  // every owner template (#592).
+  return /(^|\/)(test|tests|spec|specs|__tests__|e2e)(\/|$)/i.test(p);
 }
 
 function isConfigFile(filePath) {
@@ -22414,6 +22816,21 @@ function isMockFile(filePath) {
     /mock\.(ts|js|tsx|jsx)$/.test(p);
 }
 
+// The application entry point is the single most orientation-valuable file in
+// a repo, yet it is often tiny (a main class with 2-3 signatures), so the
+// fewest-sigs tie-break dropped it while keeping bulkier files: petclinic's
+// budget dropped PetClinicApplication.java and an agent asking for the startup
+// entry point could not reach it at all (#592). Deliberately narrow — bare
+// main/app/application names plus the Spring `*Application.java` and C#
+// `Program.cs` conventions. `index.*` is excluded: JS barrel files are hubs,
+// not entry points, and protecting every one would crowd out real code.
+function isEntryPointFile(filePath) {
+  const base = path.basename(filePath.replace(/\\/g, '/'));
+  return /^(main|app|application|__main__)\.[a-z]+$/i.test(base)
+    || /Application\.(java|kt|kts)$/.test(base)
+    || /^Program\.cs$/.test(base);
+}
+
 /**
  * Compute the effective token budget based on repo size and config.
  *
@@ -22469,6 +22886,38 @@ function computeEffectiveMaxTokens(fileEntries, config) {
   return effective;
 }
 
+/**
+ * Delete `.github/context-*.md` split files this run did not write (#555).
+ *
+ * Splits are discovered by filename pattern at read time, not by consulting
+ * the config, so a file left behind by a previous `strategy` — or by a module
+ * since dropped from `srcDirs` — keeps being merged into the retrieval index
+ * and silently steers every query. Observed on a 524-file Java repo: a stale
+ * 376 KB `context-mall-mbg.md` kept generated entities at ranks 1, 3 and 4
+ * while both files implementing the feature fell outside the top 6, even
+ * though `sig-index.json` correctly held zero entries for that module.
+ *
+ * @param {string} cwd
+ * @param {string[]} keep  basenames this run wrote, e.g. ['context-core.md']
+ * @returns {string[]} basenames removed
+ */
+function pruneStaleContextSplits(cwd, keep) {
+  const ghDir = path.join(cwd, '.github');
+  const kept = new Set(keep);
+  const removed = [];
+  let entries;
+  try { entries = fs.readdirSync(ghDir); } catch (_) { return removed; }
+  for (const f of entries) {
+    if (!/^context-[\w.-]+\.md$/.test(f) || kept.has(f)) continue;
+    try { fs.unlinkSync(path.join(ghDir, f)); removed.push(f); } catch (_) { /* best effort */ }
+  }
+  if (removed.length) {
+    console.warn(`[sigmap] pruned ${removed.length} stale context split(s) from a previous `
+      + `strategy/srcDirs: ${removed.join(', ')}`);
+  }
+  return removed;
+}
+
 function applyTokenBudget(fileEntries, maxTokens) {
   // fileEntries: [{ filePath, sigs, mtime }]
   // Per-file rendered overhead: "### <path>", code fences, trailing blank line.
@@ -22501,6 +22950,7 @@ function applyTokenBudget(fileEntries, maxTokens) {
     else if (isMockFile(e.filePath)) { priority = 9;  dropReason = 'budget: mock file'; }
     else if (isTestFile(e.filePath)) { priority = 8;  dropReason = 'budget: test file'; }
     else if (isConfigFile(e.filePath)) { priority = 6; dropReason = 'budget: config file'; }
+    else if (isEntryPointFile(e.filePath)) { priority = 3; dropReason = 'budget: entry point'; }
     else priority = 4;
     const loc = e.content ? e.content.split('\n').length : 1;
     const signalQuality = loc > 0 ? (e.sigs ? e.sigs.length : 0) / loc : 0;
@@ -23276,6 +23726,7 @@ function runPerModuleStrategy(cwd, config, fileEntries, inputTokenTotal) {
   ];
 
   let totalOut = 0;
+  const writtenSplits = [];
   for (const mod of moduleNames) {
     const outName = `context-${mod}.md`;
     const outPath = path.join(cwd, '.github', outName);
@@ -23294,7 +23745,9 @@ function runPerModuleStrategy(cwd, config, fileEntries, inputTokenTotal) {
     console.warn(`[sigmap] per-module: wrote .github/${outName} (~${modTokens} tokens, ${budgeted.length} files)`);
 
     overviewLines.push(`| \`${mod}\` | \`.github/${outName}\` |`);
+    writtenSplits.push(outName);
   }
+  pruneStaleContextSplits(cwd, writtenSplits);
 
   overviewLines.push('');
   overviewLines.push('> Inject the relevant module file into your IDE context window.');
@@ -23333,6 +23786,7 @@ function runHotColdStrategy(cwd, config, fileEntries, recentFiles, inputTokenTot
   const coldContent = coldHeader + formatOutput(coldEntries, cwd, false, config, null);
   ensureDir(coldPath);
   fs.writeFileSync(coldPath, coldContent, 'utf8');
+  pruneStaleContextSplits(cwd, ['context-cold.md']);
   const coldTokens = estimateTokens(coldContent);
 
   console.warn('[sigmap] hot-cold:');
@@ -23657,6 +24111,9 @@ function runGenerate(cwd, config, reportMode, reportJson = false) {
       result = runHotColdStrategy(cwd, configWithBudget, fileEntries, recentFiles, inputTokenTotal);
     } else {
       // 'full' — original behaviour
+      // 'full' writes no split files — anything left from a previous
+      // strategy would still be merged into the index at read time (#555).
+      pruneStaleContextSplits(cwd, []);
       fileEntries = applyTokenBudget(fileEntries, effectiveMaxTokens);
       const droppedCount = beforeCount - fileEntries.length;
       const routingEnabled = !!(config.routing || process.argv.includes('--routing'));