sigmap 8.33.0 → 8.35.0

package/src/extractors/properties.js

@@ -3,7 +3,7 @@
 const { capWithNotice } = require('../util/truncate');
 
 // Ceiling discloses what it drops rather than truncating silently (#583).
-const PER_FILE_LIMIT = 50;
+const PER_FILE_LIMIT = 200;
 
 /**
  * Extract signatures from .properties configuration files.

package/src/extractors/python.js

@@ -6,7 +6,10 @@ const { capWithNotice } = require('../util/truncate');
 
 // Ceiling sits above the default `maxSigsPerFile` so the configured budget
 // governs output rather than a literal buried here, and omissions are disclosed (#576).
-const PER_FILE_LIMIT = 30;
+const PER_FILE_LIMIT = 200;
+
+// Per-class member ceiling, disclosed via capWithNotice (#576).
+const MEMBER_LIMIT = 120;
 
 /**
  * 1-based line of the last source line belonging to a top-level (indent 0)
@@ -162,7 +165,7 @@ function extractClassMethods(stripped, startIndex) {
       methods.push(`${asyncKw}def ${m[1]}(${params})${retStr}`);
     }
   }
-  return methods.slice(0, 8);
+  return capWithNotice(methods, MEMBER_LIMIT, 'methods');
 }
 
 function tryExtractDataclassFields(stripped, classIndex) {

package/src/extractors/python_dataclass.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { capWithNotice } = require('../util/truncate');
+
 /**
  * Extract Python dataclass, Pydantic model, and SQLAlchemy ORM metadata.
  * Focuses on model fields, validation, and relationships.
@@ -71,7 +73,7 @@ function extract(src) {
     sigs.push('config-class');
   }
 
-  return Array.from(new Set(sigs)).slice(0, 50);
+  return capWithNotice(Array.from(new Set(sigs)), 200, 'signatures');
 }
 
 module.exports = { extract };

package/src/extractors/r.js

@@ -4,7 +4,7 @@ const { capWithNotice } = require('../util/truncate');
 
 // Ceiling sits above the default `maxSigsPerFile` so the configured budget
 // governs output rather than a literal buried here, and omissions are disclosed (#576).
-const PER_FILE_LIMIT = 30;
+const PER_FILE_LIMIT = 200;
 
 /**
  * Extract signatures from R source code.

package/src/extractors/ruby.js

@@ -4,7 +4,7 @@ const { capWithNotice } = require('../util/truncate');
 
 // Ceiling sits above the default `maxSigsPerFile` so the configured budget
 // governs output rather than a literal buried here, and omissions are disclosed (#576).
-const PER_FILE_LIMIT = 25;
+const PER_FILE_LIMIT = 200;
 
 /**
  * Extract signatures from Ruby source code.

package/src/extractors/rust.js

@@ -1,11 +1,19 @@
 'use strict';
 
 const { lineAt, withAnchor } = require('./line-anchor');
-const { capWithNotice } = require('../util/truncate');
+const { capWithNotice, capMembersWithNotice } = require('../util/truncate');
 
 // Ceiling sits above the default `maxSigsPerFile` so the configured budget
 // governs output rather than a literal buried here, and omissions are disclosed (#576).
-const PER_FILE_LIMIT = 25;
+// Class bodies are scanned to this many characters. Real classes routinely
+// run past the old 4KB scan window — truncating there silently hid every
+// member after ~4000 chars AND anchored class end-lines short (#576). The
+// ceiling only guards against pathological input (Java parity, #551).
+const MAX_CLASS_BODY_CHARS = 200000;
+const PER_FILE_LIMIT = 200;
+
+// Per-impl member ceiling, disclosed via capMembersWithNotice (#576).
+const MEMBER_LIMIT = 120;
 
 /**
  * Extract signatures from Rust source code.
@@ -63,7 +71,7 @@ function extract(src) {
     const block = extractBlock(stripped, bodyStart);
     sigs.push(withAnchor(`impl ${m[1]}`, lineAt(stripped, m.index), lineAt(stripped, bodyStart + block.length)));
     for (const fn of extractMethods(block)) {
-      sigs.push(hinted(withAnchor(`  ${fn.text}`, lineAt(stripped, bodyStart + fn.declIdx), lineAt(stripped, bodyStart + fn.endIdx)), fn.name));
+      sigs.push(hinted(withAnchor(`  ${fn.text}`, lineAt(stripped, bodyStart + (fn.declIdx || 0)), lineAt(stripped, bodyStart + (fn.endIdx || 0))), fn.name));
     }
   }
 
@@ -80,7 +88,7 @@ function extract(src) {
 
 function extractBlock(src, startIndex) {
   let depth = 1, i = startIndex;
-  const end = Math.min(src.length, startIndex + 5000);
+  const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
   while (i < end && depth > 0) {
     if (src[i] === '{') depth++;
     else if (src[i] === '}') depth--;
@@ -101,7 +109,7 @@ function extractMethods(block) {
       endIdx: m.index + m[0].length,
     });
   }
-  return methods.slice(0, 8);
+  return capMembersWithNotice(methods, MEMBER_LIMIT, 'methods');
 }
 
 function normalizeParams(params) {

package/src/extractors/scala.js

@@ -6,8 +6,13 @@ const { capWithNotice, capMembersWithNotice } = require('../util/truncate');
 // Ceilings sit above the default `maxSigsPerFile` so the configured budget
 // governs output rather than a literal buried here, and omissions are disclosed
 // — an undisclosed cap looks like a class that simply has eight methods (#576).
-const MEMBER_LIMIT = 8;
-const PER_FILE_LIMIT = 25;
+// Class bodies are scanned to this many characters. Real classes routinely
+// run past the old 4KB scan window — truncating there silently hid every
+// member after ~4000 chars AND anchored class end-lines short (#576). The
+// ceiling only guards against pathological input (Java parity, #551).
+const MAX_CLASS_BODY_CHARS = 200000;
+const MEMBER_LIMIT = 120;
+const PER_FILE_LIMIT = 200;
 
 /**
  * Extract signatures from Scala source code.
@@ -54,7 +59,7 @@ function extract(src) {
 
 function extractBlock(src, startIndex) {
   let depth = 1, i = startIndex;
-  const end = Math.min(src.length, startIndex + 4000);
+  const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
   while (i < end && depth > 0) {
     if (src[i] === '{') depth++;
     else if (src[i] === '}') depth--;

package/src/extractors/shell.js

@@ -4,7 +4,7 @@ const { capWithNotice } = require('../util/truncate');
 
 // Ceiling sits above the default `maxSigsPerFile` so the configured budget
 // governs output rather than a literal buried here, and omissions are disclosed (#576).
-const PER_FILE_LIMIT = 25;
+const PER_FILE_LIMIT = 200;
 
 /**
  * Extract signatures from shell scripts (bash, zsh, fish).

package/src/extractors/svelte.js

@@ -4,7 +4,7 @@ const { capWithNotice } = require('../util/truncate');
 
 // Ceiling sits above the default `maxSigsPerFile` so the configured budget
 // governs output rather than a literal buried here, and omissions are disclosed (#576).
-const PER_FILE_LIMIT = 25;
+const PER_FILE_LIMIT = 200;
 
 /**
  * Extract signatures from Svelte components.

package/src/extractors/swift.js

@@ -6,8 +6,13 @@ const { capWithNotice, capMembersWithNotice } = require('../util/truncate');
 // Ceilings sit above the default `maxSigsPerFile` so the configured budget
 // governs output rather than a literal buried here, and omissions are disclosed
 // — an undisclosed cap looks like a class that simply has eight methods (#576).
-const MEMBER_LIMIT = 8;
-const PER_FILE_LIMIT = 25;
+// Class bodies are scanned to this many characters. Real classes routinely
+// run past the old 4KB scan window — truncating there silently hid every
+// member after ~4000 chars AND anchored class end-lines short (#576). The
+// ceiling only guards against pathological input (Java parity, #551).
+const MAX_CLASS_BODY_CHARS = 200000;
+const MEMBER_LIMIT = 120;
+const PER_FILE_LIMIT = 200;
 
 /**
  * Extract signatures from Swift source code.
@@ -61,7 +66,7 @@ function extract(src) {
 
 function extractBlock(src, startIndex) {
   let depth = 1, i = startIndex;
-  const end = Math.min(src.length, startIndex + 4000);
+  const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
   while (i < end && depth > 0) {
     if (src[i] === '{') depth++;
     else if (src[i] === '}') depth--;

package/src/extractors/toml.js

@@ -3,7 +3,7 @@
 const { capWithNotice } = require('../util/truncate');
 
 // Ceiling discloses what it drops rather than truncating silently (#583).
-const PER_FILE_LIMIT = 40;
+const PER_FILE_LIMIT = 200;
 
 /**
  * Extract signatures from TOML configuration files.

package/src/extractors/typescript.js

@@ -4,6 +4,10 @@ const { lineAt, withAnchor } = require('./line-anchor');
 const { capWithNotice, capMembersWithNotice } = require('../util/truncate');
 const { stripComments, maskCode, readBalanced } = require('./scan');
 
+// Class bodies are scanned to this many characters — guard against
+// pathological input only; the old 4KB window silently hid members (#576).
+const MAX_CLASS_BODY_CHARS = 200000;
+
 /**
  * Extract signatures from TypeScript source code.
  * Top-level declarations carry a `:start-end` line anchor (see line-anchor.js);
@@ -189,13 +193,13 @@ function extract(src) {
     const anchored = anchors[i] ? withAnchor(s, anchors[i][0], anchors[i][1]) : s;
     return docHintFor[i] ? `${anchored}  # ${docHintFor[i]}` : anchored;
   });
-  return capWithNotice(withAnchors, 35, 'signatures');
+  return capWithNotice(withAnchors, 200, 'signatures');
 }
 
 function extractBlock(src, startIndex) {
   let depth = 1;
   let i = startIndex;
-  const end = Math.min(src.length, startIndex + 4000);
+  const end = Math.min(src.length, startIndex + MAX_CLASS_BODY_CHARS);
   while (i < end && depth > 0) {
     if (src[i] === '{') depth++;
     else if (src[i] === '}') depth--;
@@ -223,7 +227,7 @@ function extractInterfaceMembers(block) {
     const start = m.index + (m[0].length - m[0].replace(/^\s+/, '').length);
     members.push({ text: `${m[1]}(${normalizeParams(block.slice(openIdx + 1, closeIdx))})`, start, end: closeIdx + 1 });
   }
-  return capMembersWithNotice(members, 8, 'members');
+  return capMembersWithNotice(members, 120, 'members');
 }
 
 const _CTRL_KEYWORDS = new Set(['if', 'for', 'while', 'switch', 'do', 'try', 'catch', 'finally', 'else', 'return']);
@@ -258,7 +262,7 @@ function extractClassMembers(block, maskedBlock) {
     const retStr = retType ? ` → ${retType}` : '';
     members.push({ text: `${isStatic}${isAsync}${m[1]}(${normalizeParams(params)})${retStr}`, start, end });
   }
-  return capMembersWithNotice(members, 8, 'methods');
+  return capMembersWithNotice(members, 120, 'methods');
 }
 
 function normalizeParams(params) {

package/src/extractors/typescript_react.js

@@ -3,7 +3,7 @@
 const { capWithNotice } = require('../util/truncate');
 
 // Ceiling discloses what it drops rather than truncating silently (#583).
-const PER_FILE_LIMIT = 50;
+const PER_FILE_LIMIT = 200;
 
 /**
  * Extract React component signatures from .tsx files.

package/src/extractors/vue_sfc.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { capWithNotice } = require('../util/truncate');
+
 /**
  * Extract Vue Single-File Component (SFC) signatures from .vue files.
  * Captures component metadata: name, props, emits, slots, composables, lifecycle.
@@ -93,7 +95,7 @@ function extract(src) {
     sigs.push(`slot ${s}`);
   }
 
-  return Array.from(new Set(sigs)).slice(0, 50);
+  return capWithNotice(Array.from(new Set(sigs)), 200, 'signatures');
 }
 
 module.exports = { extract };

package/src/extractors/xml.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { capWithNotice } = require('../util/truncate');
+
 /**
  * Lightweight XML config extractor.
  * Captures root tags, key config tags, and id/name/class attributes.
@@ -40,7 +42,7 @@ function extract(src) {
     if (cls) sigs.push(`${tag} -> ${cls[1]}`);
   }
 
-  return Array.from(new Set(sigs)).slice(0, 50);
+  return capWithNotice(Array.from(new Set(sigs)), 200, 'signatures');
 }
 
 module.exports = { extract };

package/src/extractors/yaml.js

@@ -4,7 +4,7 @@ const { capWithNotice } = require('../util/truncate');
 
 // Ceiling sits above the default `maxSigsPerFile` so the configured budget
 // governs output rather than a literal buried here, and omissions are disclosed (#576).
-const PER_FILE_LIMIT = 25;
+const PER_FILE_LIMIT = 200;
 
 /**
  * Extract signatures from YAML configuration files.

package/src/graph/call-graph.js

@@ -26,6 +26,8 @@ const PY_EXTS = new Set(['.py', '.pyw']);
 const JAVA_EXTS = new Set(['.java']);
 const GO_EXTS = new Set(['.go']);
 const RS_EXTS = new Set(['.rs']);
+const KT_EXTS = new Set(['.kt', '.kts']);
+const SCALA_EXTS = new Set(['.scala', '.sc']);
 
 // Tokens that look like `name(` calls or definition headers but are language
 // keywords, not user symbols — never treated as a call or a definition.
@@ -349,6 +351,81 @@ function rustDefs(masked) {
 
 // Pick the masker whose comment/string syntax matches the language.
 // Java and Go share JS syntax (Go raw strings mask like template literals).
+/**
+ * Body range for a JVM-family member that may use either a brace body or an
+ * expression body (`fun f() = expr` / `def f = expr`), which Java has not.
+ * An expression body runs to the end of its line — enough to capture the calls
+ * it makes, which is all the graph needs.
+ * @returns {{bodyStart:number, bodyEnd:number}|null} null when neither form follows
+ */
+function jvmBodyRange(masked, from) {
+  let k = from;
+  while (k < masked.length && masked[k] !== '{' && masked[k] !== '=' && masked[k] !== '\n' && masked[k] !== ';') k++;
+  if (masked[k] === '{') return { bodyStart: k, bodyEnd: matchDelim(masked, k, '{', '}') };
+  if (masked[k] === '=') {
+    // `= {` is still a brace body, just written with an assignment.
+    let j = k + 1;
+    while (j < masked.length && /\s/.test(masked[j])) j++;
+    if (masked[j] === '{') return { bodyStart: j, bodyEnd: matchDelim(masked, j, '{', '}') };
+    const eol = masked.indexOf('\n', k);
+    return { bodyStart: k, bodyEnd: eol === -1 ? masked.length : eol };
+  }
+  return null; // abstract member or interface declaration
+}
+
+/**
+ * Kotlin `fun` definitions, including extension functions (`fun Foo.bar()`,
+ * recorded as `bar`) and expression bodies.
+ */
+function ktDefs(masked) {
+  const defs = [];
+  const seen = new Set();
+  const re = /(?:^|\n)[ \t]*((?:(?:public|private|protected|internal|open|override|abstract|final|suspend|inline|operator|infix|tailrec|external|expect|actual|inner|companion)\s+)*)fun\s+(?:<[^>\n]{0,80}>\s*)?(?:[A-Za-z_][\w.<>]*\.)?([A-Za-z_][\w]*)\s*\(/g;
+  let m;
+  while ((m = re.exec(masked)) !== null) {
+    const name = m[2];
+    if (NON_CALL.has(name)) continue;
+    const paren = masked.indexOf('(', m.index + m[0].length - 1);
+    const close = matchDelim(masked, paren, '(', ')');
+    if (close < 0) continue;
+    const range = jvmBodyRange(masked, close + 1);
+    const line = lineAt(masked, m.index + 1);
+    const key = name + ':' + (range ? range.bodyStart : line);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    // An abstract/interface member owns no body: it can receive edges but
+    // never produces them, the same treatment javaDefs gives declarations.
+    defs.push(range ? { name, line, ...range } : { name, line, bodyStart: close, bodyEnd: close });
+  }
+  return defs;
+}
+
+/**
+ * Scala `def` definitions. Handles parameterless members (`def foo: Int = 1`),
+ * type parameters, and expression bodies.
+ */
+function scalaDefs(masked) {
+  const defs = [];
+  const seen = new Set();
+  const re = /(?:^|\n)[ \t]*((?:(?:private|protected|override|implicit|final|lazy|sealed|abstract|inline)(?:\s*\[[^\]\n]{0,60}\])?\s+)*)def\s+([A-Za-z_][\w]*)\s*(?=[\[\(:=])/g;
+  let m;
+  while ((m = re.exec(masked)) !== null) {
+    const name = m[2];
+    if (NON_CALL.has(name)) continue;
+    // Step past an optional type-parameter list, then an optional value list.
+    let k = m.index + m[0].length;
+    if (masked[k] === '[') { const e = matchDelim(masked, k, '[', ']'); if (e < 0) continue; k = e + 1; }
+    while (masked[k] === '(') { const e = matchDelim(masked, k, '(', ')'); if (e < 0) break; k = e + 1; }
+    const range = jvmBodyRange(masked, k);
+    const line = lineAt(masked, m.index + 1);
+    const key = name + ':' + (range ? range.bodyStart : line);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    defs.push(range ? { name, line, ...range } : { name, line, bodyStart: k, bodyEnd: k });
+  }
+  return defs;
+}
+
 function maskFor(filePath, src) {
   const ext = path.extname(filePath).toLowerCase();
   if (PY_EXTS.has(ext)) return maskPy(src);
@@ -363,6 +440,8 @@ function extractDefs(filePath, src) {
   if (JAVA_EXTS.has(ext)) return javaDefs(maskJs(src));
   if (GO_EXTS.has(ext)) return goDefs(maskJs(src));
   if (RS_EXTS.has(ext)) return rustDefs(maskRust(src));
+  if (KT_EXTS.has(ext)) return ktDefs(maskJs(src));
+  if (SCALA_EXTS.has(ext)) return scalaDefs(maskJs(src));
   return null; // unsupported language
 }
 
@@ -452,7 +531,8 @@ function _walk(dir, excludeSet, out, depth, maxDepth) {
     if (e.isDirectory()) _walk(full, excludeSet, out, depth + 1, maxDepth);
     else if (e.isFile()) {
       const ext = path.extname(e.name).toLowerCase();
-      if (JS_EXTS.has(ext) || PY_EXTS.has(ext) || JAVA_EXTS.has(ext) || GO_EXTS.has(ext) || RS_EXTS.has(ext)) out.push(full);
+      if (JS_EXTS.has(ext) || PY_EXTS.has(ext) || JAVA_EXTS.has(ext) || GO_EXTS.has(ext)
+        || RS_EXTS.has(ext) || KT_EXTS.has(ext) || SCALA_EXTS.has(ext)) out.push(full);
     }
   }
 }

package/src/mcp/server.js

@@ -7,8 +7,8 @@
  * One JSON object per line on both stdin and stdout.
  *
  * Supported methods:
- *   initialize        → serverInfo + capabilities
- *   tools/list        → 19 tool definitions
+ *   initialize        → serverInfo + capabilities + negotiated protocolVersion
+ *   tools/list        → 21 tool definitions
  *   tools/call        → dispatch to handler, return result
  */
 
@@ -18,10 +18,22 @@ const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, exp
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '8.33.0',
+  version: '8.35.0',
   description: 'SigMap MCP server — code signatures on demand',
 };
 
+// Protocol revisions this server actually speaks. The tools-only surface —
+// initialize / tools/list / tools/call plus the initialized/cancelled
+// notifications — is identical across these revisions, and the
+// @hasmcp/mcp-spec-test suite passes every applicable 2025-11-25 case against
+// it. 2026-07-28 is deliberately absent: that revision requires
+// server/discover, which is not implemented. Newest first: a client offering
+// a version outside this list is downgraded to [0], never echoed back —
+// echoing an unspeakable version is itself a spec violation (#544), and it
+// made the conformance suite believe 2026-07-28 was supported, producing six
+// phantom server/discover failures on a revision never really offered (#545).
+const SUPPORTED_PROTOCOL_VERSIONS = ['2025-11-25', '2025-06-18', '2025-03-26', '2024-11-05'];
+
 // ---------------------------------------------------------------------------
 // JSON-RPC helpers
 // ---------------------------------------------------------------------------
@@ -46,9 +58,32 @@ function dispatch(msg, cwd) {
     return;
   }
 
+  // server/discover (spec 2026-07-28) — session-less discovery, answerable
+  // before any handshake, so a client can learn the honest version list
+  // instead of offering versions and hoping. The response is a
+  // CacheableResult: deterministic, so the TTL promise of stability holds.
+  // Note supportedVersions does NOT include 2026-07-28 — answering discover
+  // is forward-compatible plumbing, not a claim to serve that revision's
+  // whole surface (per-result envelopes, inline _meta negotiation).
+  if (method === 'server/discover') {
+    respond(id, {
+      resultType: 'complete',
+      cacheScope: 'public',
+      ttlMs: 3600000,
+      supportedVersions: SUPPORTED_PROTOCOL_VERSIONS,
+      capabilities: { tools: {} },
+      serverInfo: SERVER_INFO,
+      instructions: 'SigMap serves code signatures for the working directory. Call query_context or search_signatures to rank and fetch signature blocks instead of reading whole files.',
+    });
+    return;
+  }
+
   if (method === 'initialize') {
+    const offered = params && params.protocolVersion;
     respond(id, {
-      protocolVersion: (params && params.protocolVersion) || '2024-11-05',
+      protocolVersion: SUPPORTED_PROTOCOL_VERSIONS.includes(offered)
+        ? offered
+        : SUPPORTED_PROTOCOL_VERSIONS[0],
       serverInfo: SERVER_INFO,
       capabilities: { tools: {} },
     });
@@ -56,6 +91,13 @@ function dispatch(msg, cwd) {
   }
 
   if (method === 'tools/list') {
+    // No pagination: the full list fits one page, so any cursor a client
+    // presents is one this server never issued — reject it (-32602, per the
+    // spec's SHOULD) rather than silently restarting from page one.
+    if (params && params.cursor !== undefined) {
+      respondError(id, -32602, `Invalid cursor: ${String(params.cursor)}`);
+      return;
+    }
     respond(id, { tools: TOOLS });
     return;
   }

package/src/retrieval/ranker.js

@@ -376,9 +376,15 @@ function rank(query, sigIndex, opts) {
     const hop1Files = new Set(); // normalised keys that received a hop1 boost
     const hop1Seeds = [];        // original (un-normalised) paths, for hop-2 lookup
 
-    // Hop 1: direct neighbors of scored files
-    for (const entry of scored) {
-      if (entry.score <= 0) continue;
+    // Hop 1: direct neighbors of scored files. Seeds snapshotted BEFORE the
+    // loop (as the call-graph block below already does) so boosts never
+    // cascade: a file whose only score is a hop-1 boost must not become a seed
+    // itself mid-loop, or the effective seed set — and every boost total —
+    // depends on index insertion order, which git history changes via the
+    // recent-commits hoist. That made gate scores differ between a shallow CI
+    // checkout and a developer clone of the same commit (#596).
+    const hop1SeedEntries = scored.filter((e) => e.score > 0);
+    for (const entry of hop1SeedEntries) {
       const neighbors = _graphGet(graph.forward, path.resolve(cwd, entry.file)) || [];
       for (const neighborAbs of neighbors) {
         const nk = path.normalize(neighborAbs);
@@ -393,7 +399,10 @@ function rank(query, sigIndex, opts) {
       }
     }
 
-    // Hop 2: neighbors of hop1 files (only if they didn't get a direct score)
+    // Hop 2: neighbors of hop1 files (only if they didn't get a direct score).
+    // Eligibility frozen after hop-1 for the same reason: a file whose first
+    // score is a hop-2 boost must not become hop-2-eligible mid-loop (#596).
+    const hop2Eligible = scored.map((e) => e.score > 0);
     for (const hop1Key of hop1Seeds) {
       if (_graphGet(keyToIdx, hop1Key) === undefined) continue; // skip files not in index
       const neighbors = _graphGet(graph.forward, hop1Key) || [];
@@ -402,7 +411,7 @@ function rank(query, sigIndex, opts) {
         if (_isHub(nk) || hubs.has(nk) || hubs.has(nk.toLowerCase())) continue;
         if (hop1Files.has(nk)) continue; // skip already hop1-boosted
         const idx = _graphGet(keyToIdx, nk);
-        if (idx !== undefined && scored[idx].score > 0) {
+        if (idx !== undefined && hop2Eligible[idx]) {
           // Only boost files that have some baseline score (not noise)
           scored[idx].score += GRAPH_BOOST_AMOUNTS.hop2;
           scored[idx].signals.graphBoost = (scored[idx].signals.graphBoost || 0) + GRAPH_BOOST_AMOUNTS.hop2;