weavatrix 0.2.14 → 0.2.15

package/README.md

@@ -392,6 +392,22 @@ metrics are not persisted or transmitted by Weavatrix. If a source checkout's pa
 while an old daemon remains alive, `initialize`, `tools/list`, and tool calls fail loudly with
 `STALE_RUNTIME` until the client reconnects; the opt-out is reserved for deliberate development.
 
+### 0.2.15 self-audit precision patch
+
+- Dependency review now scopes nested manifests correctly, recognizes framework peer packages and
+  package references assembled from bounded dynamic path fragments, and avoids misclassifying
+  dependency-owned source as an unused root declaration.
+- Reachability follows source-owned HTML asset references, so maintained browser entry scripts and
+  styles remain part of the production surface instead of appearing as dead files.
+- Malware heuristics distinguish inert placeholders, comments, documentation URLs, and ordinary
+  Unicode text from executable registry or download behavior while retaining explicit review
+  evidence for actionable patterns.
+- Duplicate review ignores policy-like numeric tables and stable ordered-member declarations where
+  repetition is intentional, and the remaining reverse-reach, Git-output, member-order, path-term,
+  and retrieval logic now uses shared owners instead of drifting copies.
+
+Full patch notes: [docs/releases/v0.2.15.md](docs/releases/v0.2.15.md).
+
 ### 0.2.14 typed flows, honest Health, and architecture bootstrap
 
 - Go call resolution now follows receiver types through parameters, locals, constructor returns,

package/SECURITY.md

@@ -4,8 +4,8 @@
 
 | Version | Supported |
 |---|---|
-| `0.2.14.x` | Yes |
-| `0.2.13` and older | Upgrade to the latest release |
+| `0.2.15.x` | Yes |
+| `0.2.14` and older | Upgrade to the latest release |
 
 Security fixes are provided for the latest published version of Weavatrix. Upgrade before reporting
 an issue that may already be resolved.

package/docs/releases/v0.2.15.md

@@ -0,0 +1,37 @@
+# Weavatrix 0.2.15
+
+0.2.15 is a focused self-audit precision release. It keeps the 38-tool MCP surface and all wire and
+security boundaries stable while removing false-positive dependency, dead-code, malware, and
+duplicate findings discovered by running Weavatrix against its own repository.
+
+## Dependency and reachability precision
+
+- Dependency verification now respects the owning nested manifest before deciding whether an import
+  is missing or a declaration is unused.
+- Framework peer dependencies and bounded package paths assembled from static string fragments are
+  recognized without treating arbitrary runtime values as proof.
+- Source-owned HTML asset references participate in reachability, protecting maintained browser
+  scripts and styles from false dead-file findings.
+
+## Safer review queues
+
+- Malware scanning distinguishes placeholders, comments, documentation URLs, and ordinary Unicode
+  text from executable registry/download behavior. Static heuristic evidence remains review-only and
+  does not claim execution or compromise.
+- Duplicate detection suppresses policy-like numeric tables and stable ordered declarations where
+  repeated structure carries meaning, while preserving clone evidence for executable code.
+- Reverse reachability, Git output parsing, ordered-member comparison, path terminology, task
+  retrieval, and duplicate evidence now share focused owners instead of maintaining divergent copies.
+
+## Compatibility and security
+
+- There are no MCP tool-schema, capability-profile, Hosted payload, sync-consent, or architecture
+  contract changes in this release.
+- The default profile remains offline and local-first. Advisory and Hosted network capabilities
+  remain explicit opt-ins.
+
+## Verification
+
+The release is gated by the full Node suite, six-language fixture benchmark, six-repository semantic
+regression gate, release-manifest verification, packed npm and MCPB stdio checks, and npm audit. The
+exact counts and artifacts are recorded by the immutable GitHub release workflow.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weavatrix",
-  "version": "0.2.14",
+  "version": "0.2.15",
   "type": "module",
   "description": "Local repository intelligence MCP for AI coding agents: reusable architecture graph for fast application understanding, Health, dead code, clones, history, blast radius and architecture safeguards.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
@@ -26,7 +26,7 @@
     "skill",
     "scripts/run-agent-task-benchmark.mjs",
     "docs/agent-task-benchmark.md",
-    "docs/releases/v0.2.14.md",
+    "docs/releases/v0.2.15.md",
     "README.md",
     "SECURITY.md",
     "LICENSE"

package/src/analysis/dep-check.js

@@ -7,7 +7,9 @@
 // script/config-text mention scanning + a config-ecosystem prefix rule, and we NEVER say "safe to
 // auto-remove", only "review".
 import { makeFinding } from "./findings.js";
+import {FRAMEWORK_RUNTIME_PEERS, IMPLICIT_STYLE_COMPILERS} from './dependency/conventions.js'
 import {createScopedDepFindings} from './dependency/scoped-dependencies.js'
+import {createPackageSourceMatcher} from './dependency/source-references.js'
 
 // Packages referenced by config CONVENTION, not imports (eslint extends "airbnb" → eslint-config-airbnb).
 // Flagged only at low confidence when nothing mentions them anywhere.
@@ -21,22 +23,6 @@ const BIN_PKG = {
   "electron-rebuild": "@electron/rebuild", playwright: "@playwright/test",
 };
 
-// Required peers consumed inside a framework/build tool rather than imported by application source.
-// These contracts are package-scope local and deliberately narrow; declaring the provider is required
-// for suppression, so an unrelated app still gets the normal unused-dependency finding.
-const FRAMEWORK_RUNTIME_PEERS = new Map([
-  ["next", ["react-dom"]], ["vinext", ["@vitejs/plugin-react", "@vitejs/plugin-rsc", "react-server-dom-webpack", "vite"]],
-  ["electron-vite", ["vite"]], ["@cloudflare/vite-plugin", ["vite", "wrangler"]],
-]);
-
-// Style preprocessors are compiler inputs rather than JavaScript imports. Their presence is proven by
-// source extensions in the same package scope, so do not report them as unused merely because Vite,
-// webpack, etc. load them internally. Keep this list to exact compiler/package contracts.
-const IMPLICIT_STYLE_COMPILERS = new Map([
-  ["sass", /\.(?:scss|sass)$/i], ["sass-embedded", /\.(?:scss|sass)$/i],
-  ["less", /\.less$/i], ["stylus", /\.styl(?:us)?$/i],
-]);
-
 const isStylesheetSpecifier = (spec) => /\.(?:css|scss|sass|less|styl(?:us)?)(?:[?#].*)?$/i.test(String(spec || ""));
 const escRe = (s) => String(s).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 // word-ish mention: the name not embedded inside a longer identifier/path segment
@@ -47,9 +33,10 @@ const mentioned = (blob, name) => new RegExp(`(^|[^\\w@.-])${escRe(name)}($|[^\\
 //   pkg             — parsed package.json ({} for non-JS repos → no dep findings)
 //   workspacePkgNames — Set of monorepo-local package names (never "missing")
 //   configTexts     — Map<fileName, text> of root config files + CI workflows (mention scanning)
+//   sourceTexts     — Map<fileName, text> for narrow dynamic/package-path literal evidence
 export function computeDepFindings({
   externalImports = [], pkg = {}, workspacePkgNames = new Set(), configTexts = new Map(),
-  aliases = [], scope = "", manifest = "package.json", nonRuntimeRoots = [], sourceFiles = [],
+  sourceTexts = new Map(), aliases = [], scope = "", manifest = "package.json", nonRuntimeRoots = [], sourceFiles = [],
 } = {}) {
   const findings = [];
   const meta = { scope: scope || ".", manifest };
@@ -137,12 +124,13 @@ export function computeDepFindings({
     return false;
   };
   const typesBase = (name) => (name.startsWith("@types/") ? name.slice(7).replace(/^(.+?)__(.+)$/, "@$1/$2") : null); // @types/babel__core → @babel/core
+  const sourceReferenced = createPackageSourceMatcher(sourceTexts);
 
   // ---- unused dependencies (per section; prod vs dev differ in severity/confidence) ----
   for (const [section, deps] of Object.entries(sections)) {
     if (section === "peerDependencies") continue; // peers are consumer-facing contracts, not usage
     for (const name of Object.keys(deps)) {
-      if (name === selfName || usedPackages.has(name) || frameworkRuntime.has(name) || implicitCompilerUsage.has(name)) continue;
+      if (name === selfName || usedPackages.has(name) || frameworkRuntime.has(name) || implicitCompilerUsage.has(name) || sourceReferenced(name)) continue;
       const tb = typesBase(name);
       if (tb) { // @types/x is used iff x is used (or it types the Node builtins)
         if (tb === "node" ? builtinUsed : usedPackages.has(tb) || frameworkRuntime.has(tb) || mentioned(configBlob, tb)) continue;
@@ -159,7 +147,9 @@ export function computeDepFindings({
         title: `Unused ${section === "dependencies" ? "dependency" : section.replace(/ies$/, "y")}: ${name}`,
         reason: "No indexed package import, package-script command, recognized config mention, framework peer contract, or implicit style-compiler input uses this declaration.",
         detail: `"${name}" is declared in ${section}, but no usage was found in the indexed source scope, package scripts, or ${configTexts.size} known config file(s). Dynamic/plugin/config-convention usage is not proven absent — review before removing.`,
+        file: manifest,
         package: name,
+        evidence: [{ file: manifest, line: 0, snippet: `declared in ${section}` }],
         source: "internal",
         actionability: "MANIFEST_REVIEW_REQUIRED",
         autoRemove: false,

package/src/analysis/dependency/conventions.js

@@ -0,0 +1,16 @@
+// Exact package contracts consumed by frameworks/build tools without a source
+// import. Keep them package-scope local; these are not repo-wide allowlists.
+export const FRAMEWORK_RUNTIME_PEERS = new Map([
+    ['next', ['react-dom']],
+    ['vinext', ['@vitejs/plugin-react', '@vitejs/plugin-rsc', 'react-server-dom-webpack', 'vite']],
+    ['electron-vite', ['vite']],
+    ['@cloudflare/vite-plugin', ['vite', 'wrangler']],
+])
+
+// Style preprocessors are compiler inputs proven by source extensions.
+export const IMPLICIT_STYLE_COMPILERS = new Map([
+    ['sass', /\.(?:scss|sass)$/i],
+    ['sass-embedded', /\.(?:scss|sass)$/i],
+    ['less', /\.less$/i],
+    ['stylus', /\.styl(?:us)?$/i],
+])

package/src/analysis/dependency/scoped-dependencies.js

@@ -5,13 +5,14 @@ const ownsFile = (scope, file) => !scope || file === scope || String(file || '')
 export function createScopedDepFindings(computeDepFindings) {
     return function computeScopedDepFindings({
         externalImports = [], packageScopes = [], workspacePkgNames = new Set(), configTexts = new Map(),
-        nonRuntimeRoots = [], sourceFiles = [],
+        sourceTexts = new Map(), nonRuntimeRoots = [], sourceFiles = [],
     } = {}) {
         const scopes = packageScopes.length
             ? packageScopes.map((scope) => ({...scope, root: normalizeScope(scope.root)})).sort((a, b) => b.root.length - a.root.length)
             : [{root: '', manifest: 'package.json', pkg: {}, aliases: []}]
         const importsByScope = new Map(scopes.map((scope) => [scope, []]))
         const sourceFilesByScope = new Map(scopes.map((scope) => [scope, []]))
+        const sourceTextsByScope = new Map(scopes.map((scope) => [scope, new Map()]))
         for (const item of externalImports) {
             const owner = scopes.find((scope) => ownsFile(scope.root, item.file)) || scopes[scopes.length - 1]
             importsByScope.get(owner).push(item)
@@ -20,6 +21,10 @@ export function createScopedDepFindings(computeDepFindings) {
             const owner = scopes.find((scope) => ownsFile(scope.root, file)) || scopes[scopes.length - 1]
             sourceFilesByScope.get(owner).push(file)
         }
+        for (const [file, text] of sourceTexts) {
+            const owner = scopes.find((scope) => ownsFile(scope.root, file)) || scopes[scopes.length - 1]
+            sourceTextsByScope.get(owner).set(file, text)
+        }
         const configOwner = new Map()
         for (const [file] of configTexts) configOwner.set(file, scopes.find((scope) => ownsFile(scope.root, file)) || scopes[scopes.length - 1])
         const findings = [], usedPackages = new Map(), declared = new Set()
@@ -27,7 +32,7 @@ export function createScopedDepFindings(computeDepFindings) {
             const scopeConfig = new Map([...configTexts].filter(([file]) => configOwner.get(file) === scope))
             const result = computeDepFindings({
                 externalImports: importsByScope.get(scope), pkg: scope.pkg || {}, workspacePkgNames,
-                configTexts: scopeConfig, aliases: scope.aliases || [], scope: scope.root,
+                configTexts: scopeConfig, sourceTexts: sourceTextsByScope.get(scope), aliases: scope.aliases || [], scope: scope.root,
                 manifest: scope.manifest || (scope.root ? `${scope.root}/package.json` : 'package.json'),
                 nonRuntimeRoots, sourceFiles: sourceFilesByScope.get(scope),
             })

package/src/analysis/dependency/source-references.js

@@ -0,0 +1,21 @@
+// Dynamic package loaders often construct a node_modules path instead of using
+// import/require, so they never become graph externalImports. Restrict this
+// fallback to executable npm source: manifests merely declare every dependency
+// and must never count as usage evidence.
+const NPM_SOURCE_RE = /\.(?:[cm]?[jt]sx?|vue|svelte)$/i
+const escRe = (value) => String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+const mentioned = (blob, name) => new RegExp(`(^|[^\\w@.-])${escRe(name)}($|[^\\w.-])`).test(blob)
+
+export function createPackageSourceMatcher(sourceTexts = new Map()) {
+    const blob = [...sourceTexts]
+        .filter(([file]) => NPM_SOURCE_RE.test(String(file || '')))
+        .map(([, text]) => String(text || ''))
+        .join('\n')
+    return (name) => {
+        if (mentioned(blob, name)) return true
+        if (!name.startsWith('@') || !name.includes('/')) return false
+        const [namespace, base] = name.split('/', 2)
+        // join(root, "node_modules", "@scope", "package", ...)
+        return new RegExp(`["'\x60]${escRe(namespace)}["'\x60][\\s\\S]{0,96}?["'\x60]${escRe(base)}["'\x60]`).test(blob)
+    }
+}

package/src/analysis/duplicates.tokenize.js

@@ -149,11 +149,17 @@ export function extractLargeStrings(text, { py = false, cs = false, minLines = 6
 
 // one raw token stream; the two modes differ only in identifier canonicalization
 export function tokenize(text) {
-  const raw = text.match(/[A-Za-z_$][\w$]*|\d+(?:\.\d+)?|[^\s\w]/g) || [];
+  const raw = text.match(/[A-Za-z_$][\w$]*|(?:0[xX][\dA-Fa-f_]+|0[bB][01_]+|0[oO][0-7_]+|\d[\d_]*(?:\.\d[\d_]*)?(?:[eE][+-]?\d[\d_]*)?)n?|[^\s\w]/g) || [];
   const strict = [];
   const renamed = [];
   for (const t of raw) {
-    if (/^\d/.test(t)) { strict.push("N"); renamed.push("N"); continue; }
+    if (/^\d/.test(t)) {
+      // Numeric constants are behavior, not renameable identifiers. Preserve
+      // their value so same-shape limit/config tables with different numbers do
+      // not become perfect clones; a small constant edit still leaves the rest
+      // of a genuine copied body highly similar.
+      strict.push(`N:${t}`); renamed.push(`N:${t}`); continue;
+    }
     if (/^[A-Za-z_$]/.test(t) && !KEYWORDS.has(t)) { strict.push(t); renamed.push("I"); continue; }
     strict.push(t); renamed.push(t);
   }
@@ -178,5 +184,9 @@ export function fingerprints(toks) {
     for (let j = i; j < Math.min(i + W, hashes.length); j++) if (hashes[j] < min) min = hashes[j];
     fp.add(min);
   }
+  // Winnowing can skip every changed literal in a repetitive policy table.
+  // Exact numeric anchors keep behavior-defining limits in the similarity
+  // denominator while leaving ordinary copied bodies tolerant of a small edit.
+  for (const token of toks) if (token.startsWith("N:")) fp.add(`numeric:${token}`);
   return fp;
 }

package/src/analysis/internal-audit.reach.js

@@ -98,6 +98,26 @@ export function entryFiles(graph, pkgOrScopes, dynamicTargets = new Set(), { dec
     const f = n.source_file;
     if (ENTRY_FILE.test(f) || isFrameworkEntryFile(f) || /\.d\.[cm]?ts$/i.test(f) || TEST_FILE_RE.test(f) || /\.html?$/i.test(f) || pe.has(f) || /(^|\/)[^/]*\.config\.[a-z]+$/i.test(f)) entries.add(f);
   }
+  // Classic/static HTML pages load scripts, styles and other assets without a
+  // JavaScript import edge. Treat an exact local src/href target as an entry
+  // surface so a deployed asset is not mislabeled orphan/dead.
+  for (const [rawFile, rawText] of sources || []) {
+    const htmlFile = String(rawFile || "").replace(/\\/g, "/");
+    if (!/\.html?$/i.test(htmlFile)) continue;
+    const htmlDir = posix.dirname(htmlFile);
+    const attr = /\b(?:src|href)\s*=\s*["']([^"']+)["']/gi;
+    let match;
+    while ((match = attr.exec(String(rawText || "")))) {
+      const rawTarget = String(match[1] || "").trim().split(/[?#]/, 1)[0];
+      if (!rawTarget || /^(?:[a-z][a-z0-9+.-]*:|\/\/|#)/i.test(rawTarget)) continue;
+      const relative = rawTarget.replace(/^\/+/, "");
+      const candidates = rawTarget.startsWith("/")
+        ? [posix.normalize(posix.join(htmlDir, relative)), posix.normalize(relative)]
+        : [posix.normalize(posix.join(htmlDir, relative))];
+      const target = candidates.find((candidate) => fileSet.has(candidate));
+      if (target) entries.add(target);
+    }
+  }
   for (const evidence of springConventionEntries(sources, fileSet)) {
     entries.add(evidence.file);
     conventionEvidence.push(evidence);

package/src/analysis/internal-audit.run.js

@@ -86,6 +86,7 @@ export async function runInternalAudit(repoPath, {
     packageScopes,
     workspacePkgNames: workspacePkgNames(repoPath, pkg),
     configTexts,
+    sourceTexts: sources,
     nonRuntimeRoots,
     sourceFiles: [...sources.keys()],
   });

package/src/analysis/task-retrieval.js

@@ -1,19 +1,8 @@
-import {createPathClassifier, hasPathClass} from '../path-classification.js'
+import {PATH_CLASS_NAMES, PATH_CLASS_TASK_QUERY_TERMS, createPathClassifier, hasPathClass} from '../path-classification.js'
 
 const words = (value) => new Set(String(value || '').toLowerCase().match(/[\p{L}_$][\p{L}\p{N}_$-]{2,}/gu) || [])
 const fileOf = (node) => String(node?.source_file || (String(node?.id || '').includes('#') ? String(node.id).split('#')[0] : node?.id || '')).replace(/\\/g, '/')
 const isSymbol = (id) => String(id || '').includes('#')
-const NON_PRODUCT_CLASSES = Object.freeze(['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
-const CLASS_TERMS = Object.freeze({
-  test: ['test', 'tests', 'testing', 'spec', 'coverage', 'verify'],
-  e2e: ['e2e', 'playwright', 'cypress'],
-  generated: ['generated', 'autogenerated', 'dist'],
-  mock: ['mock', 'mocks', 'fixture', 'fixtures', 'fake'],
-  story: ['story', 'stories', 'storybook'],
-  docs: ['doc', 'docs', 'documentation', 'readme', 'guide'],
-  benchmark: ['benchmark', 'benchmarks', 'bench'],
-  temp: ['temp', 'temporary', 'tmp'],
-})
 
 const INTENT_TRANSLATIONS = [
   [/авториз|аутентиф|логин|сесси|токен/iu, 'auth authentication login session token'],
@@ -64,7 +53,7 @@ export function retrieveTaskContext(g, {
 } = {}) {
   const expandedTask = expandTaskQuery(task)
   const taskWords = words(expandedTask)
-  const requestedClasses = new Set(Object.entries(CLASS_TERMS)
+  const requestedClasses = new Set(Object.entries(PATH_CLASS_TASK_QUERY_TERMS)
     .filter(([, terms]) => terms.some((term) => taskWords.has(term)))
     .map(([name]) => name))
   if (requestedClasses.has('test')) requestedClasses.add('e2e')
@@ -77,7 +66,7 @@ export function retrieveTaskContext(g, {
     if (!file || changedFiles.has(file) || includeClassified === true) return true
     if (!classificationCache.has(file)) classificationCache.set(file, classifier.explain(file, {content: ''}))
     const info = classificationCache.get(file)
-    const classes = NON_PRODUCT_CLASSES.filter((name) => hasPathClass(info, name))
+    const classes = PATH_CLASS_NAMES.filter((name) => hasPathClass(info, name))
     if (!info?.excluded && !classes.length) return true
     return classes.some((name) => requestedClasses.has(name))
   }

package/src/mcp/evidence/duplicate-member-order.mjs

@@ -0,0 +1,8 @@
+const compareText = (left, right) => String(left).localeCompare(String(right), 'en')
+
+// Snapshot construction and hosted-payload validation must use the same stable
+// member order or equivalent evidence can hash differently across the boundary.
+export function compareDuplicateMember(left, right) {
+    return compareText(left.file, right.file) || left.startLine - right.startLine ||
+        left.endLine - right.endLine || compareText(left.graphNodeId || '', right.graphNodeId || '')
+}

package/src/mcp/evidence-snapshot.duplicates.mjs

@@ -3,6 +3,7 @@ import {computeDuplicates} from '../analysis/duplicates.js'
 import {
     CAPS, STATE, VERDICT, bounded, compareText, graphId, repoRelativePath,
 } from './evidence-snapshot.common.mjs'
+import {compareDuplicateMember} from './evidence/duplicate-member-order.mjs'
 
 const CLONE_MIN_SIMILARITY = 80
 const DIVERGENCE_MAX_SIMILARITY = 45
@@ -51,11 +52,6 @@ function memberIdentity(value) {
     return `${value.file}\0${value.startLine}\0${value.endLine}\0${value.graphNodeId || ''}`
 }
 
-function compareMember(a, b) {
-    return compareText(a.file, b.file) || a.startLine - b.startLine || a.endLine - b.endLine ||
-        compareText(a.graphNodeId || '', b.graphNodeId || '')
-}
-
 function eligibleMembers(fragments) {
     const out = new Map()
     for (let index = 0; index < fragments.length; index++) {
@@ -107,7 +103,7 @@ function cloneGroups(data, membersByIndex) {
             const value = membersByIndex.get(index)
             unique.set(memberIdentity(value), value)
         }
-        const members = [...unique.values()].sort(compareMember)
+        const members = [...unique.values()].sort(compareDuplicateMember)
         if (members.length < 2) continue
         const indexSet = new Set(indices)
         const similarities = links
@@ -141,7 +137,7 @@ function divergenceCandidates(data, membersByIndex) {
             if (!Number.isInteger(left) || !Number.isInteger(right) || left === right || !leftMember || !rightMember ||
                 leftMember.file === rightMember.file || !Number.isFinite(similarity) ||
                 similarity < 0 || similarity > DIVERGENCE_MAX_SIMILARITY) continue
-            const members = [leftMember, rightMember].sort(compareMember)
+            const members = [leftMember, rightMember].sort(compareDuplicateMember)
             pairs.push({
                 similarity: Math.trunc(similarity),
                 totalTokens: members[0].tokens + members[1].tokens,

package/src/mcp/git-output.mjs

@@ -0,0 +1,10 @@
+import {spawnSync} from 'node:child_process'
+import {childProcessEnv} from '../child-env.js'
+
+export function gitLines(repoRoot, args) {
+    const result = spawnSync('git', ['-C', repoRoot, ...args], {
+        encoding: 'utf8', timeout: 8000, env: childProcessEnv(), windowsHide: true,
+    })
+    if (result.status !== 0) return null
+    return String(result.stdout || '').split(/\r?\n/).map((line) => line.trim()).filter(Boolean)
+}

package/src/mcp/graph/context-seeds.mjs

@@ -1,4 +1,4 @@
-import {createPathClassifier, hasPathClass} from '../../path-classification.js'
+import {PATH_CLASS_NAMES, PATH_CLASS_QUERY_TERMS, createPathClassifier, hasPathClass} from '../../path-classification.js'
 import {degreeOf, isSymbol, uniqueConnCount} from './context-core.mjs'
 
 const QUERY_STOP = new Set('a an and are around architecture best code do does exact explain find focus focused for from how identify in inspect inspection is logic me of or path production project repository request requests rest show symbol symbols the through to trace what where which with'.split(' '))
@@ -17,17 +17,6 @@ const TOOL_EXECUTION_TERMS = QUERY_INTENTS.find(([id]) => id === 'tool-execution
 const TOOL_EXECUTION_TRIGGERS = new Set(['tool', 'tools', 'tooling', 'mcp'])
 const wordsOf = (value) => String(value ?? '').replace(/([a-z0-9])([A-Z])/g, '$1 $2').toLowerCase().split(/[^a-z0-9_]+/).filter(Boolean)
 const normPath = (value) => String(value ?? '').replace(/\\/g, '/').replace(/^\.\//, '').toLowerCase()
-const NON_PRODUCT_CLASSES = Object.freeze(['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
-const CLASS_QUERY_TERMS = Object.freeze({
-    test: ['test', 'tests', 'testing', 'unit'],
-    e2e: ['e2e', 'playwright', 'cypress'],
-    generated: ['generated', 'autogenerated', 'dist'],
-    mock: ['mock', 'mocks', 'fixture', 'fixtures', 'fake'],
-    story: ['story', 'stories', 'storybook'],
-    docs: ['doc', 'docs', 'documentation', 'readme', 'guide'],
-    benchmark: ['benchmark', 'benchmarks', 'bench'],
-    temp: ['temp', 'temporary', 'tmp'],
-})
 const CODE_FILE_RE = /\.(?:[cm]?[jt]sx?|py|go|java|rs|kt|kts|cs|rb|php)$/i
 const DATA_OR_PROSE_RE = /\.(?:json|ya?ml|toml|ini|md|mdx|rst|adoc|html?|css|scss|less|svg)$/i
 const LANGUAGE_EXTENSIONS = Object.freeze({
@@ -56,7 +45,7 @@ const matchesLanguage = (node, extensions) => {
 
 export function requestedPathClasses(query) {
     const words = new Set(wordsOf(query)), requested = new Set()
-    for (const [category, terms] of Object.entries(CLASS_QUERY_TERMS)) if (terms.some((term) => words.has(term))) requested.add(category)
+    for (const [category, terms] of Object.entries(PATH_CLASS_QUERY_TERMS)) if (terms.some((term) => words.has(term))) requested.add(category)
     if (requested.has('test')) requested.add('e2e')
     if (requested.has('e2e')) requested.add('test')
     return requested
@@ -67,7 +56,7 @@ function isQueryEligible(node, requestedClasses, classificationCache, classifier
     if (!source) return true
     if (!classificationCache.has(source)) classificationCache.set(source, classifier.explain(source, {content: ''}))
     const info = classificationCache.get(source)
-    const classified = NON_PRODUCT_CLASSES.filter((category) => hasPathClass(info, category))
+    const classified = PATH_CLASS_NAMES.filter((category) => hasPathClass(info, category))
     return classified.length === 0 || classified.some((category) => requestedClasses.has(category))
 }
 

package/src/mcp/graph/reverse-reach.mjs

@@ -0,0 +1,42 @@
+import {isStructuralRelation} from '../../graph/relations.js'
+
+// Shared reverse dependency walk for get_dependents and change_impact. Keep one
+// representation so runtime/compile-time depth and edge provenance cannot drift
+// between the two public tools.
+export function reverseReach(g, seeds, maxDepth) {
+    const states = new Map([...seeds].map((id) => [String(id), {
+        runtimeDepth: 0, runtimeRelation: null, runtimeProvenance: null,
+        compileDepth: null, compileRelation: null, compileProvenance: null,
+    }]))
+    const frontier = [...seeds].map((id) => ({id: String(id), depth: 0, compileOnly: false}))
+    for (let cursor = 0; cursor < frontier.length; cursor++) {
+        const current = frontier[cursor]
+        if (current.depth >= maxDepth) continue
+        for (const edge of g.inn.get(current.id) || []) {
+            if (isStructuralRelation(edge.relation) || edge.barrelProxy === true) continue
+            const id = String(edge.id)
+            const compileOnly = current.compileOnly || edge.typeOnly === true || edge.compileOnly === true
+            const depth = current.depth + 1
+            const entry = states.get(id) || {
+                runtimeDepth: null, runtimeRelation: null, runtimeProvenance: null,
+                compileDepth: null, compileRelation: null, compileProvenance: null,
+            }
+            const depthKey = compileOnly ? 'compileDepth' : 'runtimeDepth'
+            const relationKey = compileOnly ? 'compileRelation' : 'runtimeRelation'
+            const provenanceKey = compileOnly ? 'compileProvenance' : 'runtimeProvenance'
+            if (entry[depthKey] != null && entry[depthKey] <= depth) continue
+            entry[depthKey] = depth
+            entry[relationKey] = edge.relation || 'rel'
+            entry[provenanceKey] = edge.provenance || 'UNKNOWN'
+            states.set(id, entry)
+            frontier.push({id, depth, compileOnly})
+        }
+    }
+    return new Map([...states].map(([id, entry]) => [id, {
+        ...entry,
+        depth: entry.runtimeDepth ?? entry.compileDepth ?? 0,
+        compileOnly: entry.runtimeDepth == null,
+        relation: entry.runtimeDepth != null ? entry.runtimeRelation : entry.compileRelation,
+        provenance: entry.runtimeDepth != null ? entry.runtimeProvenance : entry.compileProvenance,
+    }]))
+}

package/src/mcp/sync/evidence-duplicates.mjs

@@ -2,6 +2,7 @@ import {
     CAPS, DUPLICATE_THRESHOLDS, bool, compare, count, graphId, int, list,
     path, reasons, state, text, verdict,
 } from './evidence-common.mjs'
+import {compareDuplicateMember} from '../evidence/duplicate-member-order.mjs'
 
 function duplicateEvidenceId(value) {
     const id = text(value, 64)
@@ -19,10 +20,6 @@ function duplicateMember(value) {
     return out
 }
 
-function compareDuplicateMember(a, b) {
-    return compare(a.file, b.file) || a.startLine - b.startLine || a.endLine - b.endLine || compare(a.graphNodeId || '', b.graphNodeId || '')
-}
-
 function duplicateMembers(values, cap = CAPS.duplicateMembers) {
     const raw = Array.isArray(values) ? values : []
     const unique = new Map()

package/src/mcp/tools-impact-change.mjs

@@ -5,16 +5,11 @@ import {childProcessEnv} from '../child-env.js'
 import {classifyChangeImpact} from '../analysis/change-classification.js'
 import {readCoverageForRepo} from '../analysis/coverage-reports.js'
 import {computeStaticTestReachability} from '../analysis/static-test-reachability.js'
-import {isStructuralRelation} from '../graph/relations.js'
 import {degreeOf, labelOf, rawGraph} from './graph-context.mjs'
+import {reverseReach} from './graph/reverse-reach.mjs'
+import {gitLines} from './git-output.mjs'
 import {toolResult} from './tool-result.mjs'
 
-function gitLines(repoRoot, args) {
-    const result = spawnSync('git', ['-C', repoRoot, ...args], {encoding: 'utf8', timeout: 8000, env: childProcessEnv()})
-    if (result.status !== 0) return null
-    return String(result.stdout || '').split(/\r?\n/).map((line) => line.trim()).filter(Boolean)
-}
-
 function gitValue(repoRoot, args) {
     const result = spawnSync('git', ['-C', repoRoot, ...args], {encoding: 'utf8', timeout: 8000, env: childProcessEnv()})
     if (result.status !== 0) return null
@@ -30,37 +25,6 @@ function resolveImpactBase(repoRoot, requested) {
     return null
 }
 
-function reverseReach(g, seeds, maxDepth) {
-    const states = new Map([...seeds].map((id) => [String(id), {
-        runtimeDepth: 0, runtimeRelation: null, compileDepth: null, compileRelation: null,
-    }]))
-    const frontier = [...seeds].map((id) => ({id: String(id), depth: 0, compileOnly: false}))
-    for (let cursor = 0; cursor < frontier.length; cursor++) {
-        const current = frontier[cursor]
-        if (current.depth >= maxDepth) continue
-        for (const edge of g.inn.get(current.id) || []) {
-            if (isStructuralRelation(edge.relation) || edge.barrelProxy === true) continue
-            const id = String(edge.id)
-            const compileOnly = current.compileOnly || edge.typeOnly === true || edge.compileOnly === true
-            const depth = current.depth + 1
-            const entry = states.get(id) || {runtimeDepth: null, runtimeRelation: null, compileDepth: null, compileRelation: null}
-            const depthKey = compileOnly ? 'compileDepth' : 'runtimeDepth'
-            const relationKey = compileOnly ? 'compileRelation' : 'runtimeRelation'
-            if (entry[depthKey] != null && entry[depthKey] <= depth) continue
-            entry[depthKey] = depth
-            entry[relationKey] = edge.relation || 'rel'
-            states.set(id, entry)
-            frontier.push({id, depth, compileOnly})
-        }
-    }
-    return new Map([...states].map(([id, entry]) => [id, {
-        ...entry,
-        depth: entry.runtimeDepth ?? entry.compileDepth ?? 0,
-        compileOnly: entry.runtimeDepth == null,
-        relation: entry.runtimeDepth != null ? entry.runtimeRelation : entry.compileRelation,
-    }]))
-}
-
 const impactKind = (entry) => entry?.runtimeDepth != null
     ? (entry.compileDepth != null ? `runtime + compile-time(d${entry.compileDepth})` : 'runtime')
     : 'compile-time'

package/src/mcp/tools-impact.mjs

@@ -9,46 +9,11 @@ import {
     rawGraph, prevGraphPathFor, edgeEndpoint, diffGraphs, formatGraphDiff,
 } from './graph-context.mjs'
 import {readCoverageForRepo} from '../analysis/coverage-reports.js'
-import {isStructuralRelation} from '../graph/relations.js'
+import {reverseReach} from './graph/reverse-reach.mjs'
+import {gitLines} from './git-output.mjs'
 import {tChangeImpactV2} from './tools-impact-change.mjs'
 import {buildGraphAtGitRef} from '../analysis/git-ref-graph.js'
 
-function reverseReach(g, seeds, maxDepth) {
-    const states = new Map([...seeds].map((id) => [String(id), {
-        runtimeDepth: 0, runtimeRelation: null, compileDepth: null, compileRelation: null,
-    }]))
-    const frontier = [...seeds].map((id) => ({id: String(id), depth: 0, compileOnly: false}))
-    for (let cursor = 0; cursor < frontier.length; cursor++) {
-        const current = frontier[cursor]
-        if (current.depth >= maxDepth) continue
-        for (const e of g.inn.get(current.id) || []) {
-            if (isStructuralRelation(e.relation) || e.barrelProxy === true) continue
-            const id = String(e.id)
-            const compileOnly = current.compileOnly || e.typeOnly === true || e.compileOnly === true
-            const depth = current.depth + 1
-            const entry = states.get(id) || {
-                runtimeDepth: null, runtimeRelation: null, compileDepth: null, compileRelation: null,
-            }
-            const depthKey = compileOnly ? 'compileDepth' : 'runtimeDepth'
-            const relationKey = compileOnly ? 'compileRelation' : 'runtimeRelation'
-            const provenanceKey = compileOnly ? 'compileProvenance' : 'runtimeProvenance'
-            if (entry[depthKey] != null && entry[depthKey] <= depth) continue
-            entry[depthKey] = depth
-            entry[relationKey] = e.relation || 'rel'
-            entry[provenanceKey] = e.provenance || 'UNKNOWN'
-            states.set(id, entry)
-            frontier.push({id, depth, compileOnly})
-        }
-    }
-    return new Map([...states].map(([id, entry]) => [id, {
-        ...entry,
-        depth: entry.runtimeDepth ?? entry.compileDepth ?? 0,
-        compileOnly: entry.runtimeDepth == null,
-        relation: entry.runtimeDepth != null ? entry.runtimeRelation : entry.compileRelation,
-        provenance: entry.runtimeDepth != null ? entry.runtimeProvenance : entry.compileProvenance,
-    }]))
-}
-
 const impactKind = (entry) => {
     if (entry?.runtimeDepth != null) {
         return entry.compileDepth != null ? `runtime + compile-time(d${entry.compileDepth})` : 'runtime'
@@ -141,12 +106,6 @@ export async function tGraphDiff(g, args, ctx) {
 }
 
 // ---- change impact -------------------------------------------------------------------------------
-function gitLines(repoRoot, args) {
-    const res = spawnSync('git', ['-C', repoRoot, ...args], {encoding: 'utf8', timeout: 8000, env: childProcessEnv()})
-    if (res.status !== 0) return null
-    return String(res.stdout || '').split(/\r?\n/).map((s) => s.trim()).filter(Boolean)
-}
-
 function resolveImpactBase(repoRoot, requested) {
     const candidates = requested ? [requested] : ['origin/HEAD', 'origin/main', 'origin/master', 'main', 'master']
     for (const ref of candidates) {

package/src/path-classification.js

@@ -5,6 +5,20 @@ import { openSync, closeSync, readSync, readFileSync, statSync } from "node:fs";
 import { createRepoBoundary } from "./repo-path.js";
 
 export const PATH_CLASS_NAMES = Object.freeze(["test", "e2e", "generated", "mock", "story", "docs", "benchmark", "temp"]);
+export const PATH_CLASS_QUERY_TERMS = Object.freeze({
+  test: Object.freeze(["test", "tests", "testing", "unit"]),
+  e2e: Object.freeze(["e2e", "playwright", "cypress"]),
+  generated: Object.freeze(["generated", "autogenerated", "dist"]),
+  mock: Object.freeze(["mock", "mocks", "fixture", "fixtures", "fake"]),
+  story: Object.freeze(["story", "stories", "storybook"]),
+  docs: Object.freeze(["doc", "docs", "documentation", "readme", "guide"]),
+  benchmark: Object.freeze(["benchmark", "benchmarks", "bench"]),
+  temp: Object.freeze(["temp", "temporary", "tmp"]),
+});
+export const PATH_CLASS_TASK_QUERY_TERMS = Object.freeze({
+  ...PATH_CLASS_QUERY_TERMS,
+  test: Object.freeze([...PATH_CLASS_QUERY_TERMS.test, "spec", "coverage", "verify"]),
+});
 const PATH_CLASS_SET = new Set(PATH_CLASS_NAMES);
 const MAX_CONFIG_BYTES = 64 * 1024;
 const MAX_RULES_PER_CLASS = 64;

package/src/security/malware-heuristics.sweep.js

@@ -74,7 +74,7 @@ export async function rgSweep(rg, contentRoots, timeoutMs) {
         const lineText = String(obj.data?.lines?.text || "");
         const subText = String(obj.data?.submatches?.[0]?.match?.text || "");
         for (const at of matchRuleOffsets(rule, lineText, subText)) {
-          const text = (lineText ? lineText.slice(Math.max(0, at - 60), at + 180) : subText).trim().slice(0, 240);
+          const text = (lineText ? lineText.slice(Math.max(0, at - 160), at + 180) : subText).trim().slice(0, 340);
           hits.push({ pkg, file, line: obj.data?.line_number || 0, text, rule });
         }
       }

package/src/security/registry-sig.classify.js

@@ -88,6 +88,7 @@ const BENIGN_URL_HOSTS = [
   "apache.org", "opensource.org", "gnu.org", "creativecommons.org", "choosealicense.com",
   "mozilla.org", "nodejs.org", "npmjs.com", "npmjs.org", "yarnpkg.com", "python.org", "pypi.org",
   "golang.org", "go.dev", "godoc.org", "readthedocs.io", "readthedocs.org", "editorconfig.org",
+  "aka.ms", "example.com", "example.org", "example.net",
 ];
 const DOC_URL_PATH_RE = /\/(docs?|documentation|wiki|issues?|pull|blob|tree|releases|licenses?|rfc\d*|help|manual|guide|spec|schemas?)([/#?.]|$)/i;
 const URL_TOKEN_RE = /https?:\/\/[^\s'"`)\\<>]+/gi;
@@ -109,7 +110,7 @@ export function isBenignUrlContext(text) {
   const s = String(text || "");
   const urls = [...s.matchAll(URL_TOKEN_RE)];
   if (!urls.length) return false;
-  if (COMMENT_MARKER_RE.test(s.slice(Math.max(0, urls[0].index - 80), urls[0].index))) return true;
+  if (COMMENT_MARKER_RE.test(s.slice(0, urls[0].index))) return true;
   return urls.every((m) => {
     const pre = s.slice(Math.max(0, m.index - 80), m.index);
     const post = s.slice(m.index + m[0].length, m.index + m[0].length + 48);

package/src/security/registry-sig.rules.js

@@ -14,7 +14,7 @@ export const MALWARE_ALLOWLIST = new Set([
 // webhook.site / oast.* / canarytokens / dnslog.cn: Shai-Hulud-era exfil + OOB-callback services.
 const EXFIL_HOSTS = "discord(app)?\\.com/api/webhooks|hooks\\.slack\\.com/services|api\\.telegram\\.org/bot|pastebin\\.com/raw|burpcollaborator|oastify\\.com|oast\\.(pro|live|fun|me|site|online)|interact\\.sh|pipedream\\.net|requestbin|webhook\\.site|canarytokens\\.(com|org)|dnslog\\.cn";
 // external URL that is NOT an exfil endpoint (owned by exfil-url) and NOT a raw IP (owned by exfil-ip)
-const PLAIN_EXTERNAL_URL = `https?://(?!(${EXFIL_HOSTS})|[0-9]{1,3}\\.|localhost\\b|127\\.|0\\.0\\.0\\.0|10\\.|192\\.168\\.|169\\.254\\.|172\\.(1[6-9]|2\\d|3[01])\\.)[^'"\`\\s)\\\\]+`;
+const PLAIN_EXTERNAL_URL = `https?://(?!(${EXFIL_HOSTS})|[0-9]{1,3}\\.|localhost\\b|127\\.|0\\.0\\.0\\.0|10\\.|192\\.168\\.|169\\.254\\.|172\\.(1[6-9]|2\\d|3[01])\\.)[a-z0-9][^'"\`\\s)\\\\]+`;
 
 // ---- content rules (scanned over node_modules file text; `pattern` is ripgrep-safe ERE, `re` is the
 // JS validator used both to classify rg hits and by the no-rg fallback) ----
@@ -181,8 +181,8 @@ export const CONTENT_RULES = [
     severity: "low", // minified/legit code look-alikes — only escalates with a second signal
     nearZeroFp: false,
     noisy: true,
-    pattern: "eval\\(atob\\(|eval\\(Buffer\\.from\\(|_0x[a-f0-9]{4}",
-    re: /eval\(atob\(|eval\(Buffer\.from\([^)]*base64|_0x[a-f0-9]{4,}/,
+    pattern: "eval\\(atob\\(|eval\\(Buffer\\.from\\(|\\b_0x[a-f0-9]{4,}\\b",
+    re: /eval\(atob\(|eval\(Buffer\.from\([^)]*base64|\b_0x[a-f0-9]{4,}\b/,
     what: "obfuscation marker (eval-of-decoded payload / string-array obfuscator)",
   },
 ];

package/docs/releases/v0.2.14.md

@@ -1,93 +0,0 @@
-# Weavatrix 0.2.14
-
-0.2.14 is a trust and maintainability release found by dogfooding the MCP on a Go BGP service and a
-Java event-driven application. It keeps the 38-tool surface and the local-first/Hosted wire boundary,
-while closing false dead-code, false clean-health, noisy flow, weak architecture-bootstrap, and stale
-daemon failure modes.
-
-## Go receiver-aware call flow
-
-- Go call resolution now carries receiver types from function parameters, explicit and inferred
-  locals, constructor return types (including the first value of `value, err := pkg.New()`), imported
-  package types, and struct fields.
-- Calls such as `bgpSpeaker.RemoveMitigator(update)` resolve to
-  `(*Speaker).RemoveMitigator` instead of leaving the method falsely test-only.
-- Unknown or ambiguous same-name receivers still fail closed rather than inventing a call edge.
-
-## Focused generic flows
-
-- `query_graph` accepts exact `seed_symbols`, a `relation_filter`, and
-  `flow_direction: forward|backward|both`. The same bounded graph can now trace Kafka listeners,
-  queues, workers, cron jobs, CLI entry points, and other event/data flows without one tool per
-  framework.
-- Exact seeds remain exclusive unless `augment_seeds:true` is requested. CamelCase identifiers such
-  as `FlowSpec` no longer opt tests into production traversal merely because they contain `spec`.
-- `context_bundle` ranks production callers before classified test callers and uses diverse,
-  non-overlapping excerpts around decisive call sites.
-
-## Honest Health and endpoint state
-
-- `run_audit` returns an explicit capability matrix for structure, dependencies, runtime correctness,
-  concurrency, advisories, malware scanning, and measured coverage. Each row has independent status
-  and completeness.
-- Maven and Gradle manifests are detected and inventoried, but unsupported import-to-artifact
-  verification returns `NOT_SUPPORTED`/`PARTIAL` instead of a misleading complete zero.
-- Conservative source checks can flag selected Go fixed-index slice/discriminator hazards and Java
-  interruption/retry candidates, including conditional `while` and `do/while` loops with failure plus
-  wait behavior but no visible attempt/deadline/cancellation policy. The result explicitly does not
-  claim compiler, runtime, CFG, race, or full concurrency proof.
-- Ordinary Go grouped imports (`import (...)`) no longer trigger the JavaScript dynamic-import caveat;
-  real Go reflection evidence remains visible independently.
-- Spring endpoint inventory includes conditional activation evidence and whether a controller is
-  inactive by default.
-
-## Safe target-architecture bootstrap
-
-- The starter discovers adaptive Maven/Gradle source roots and nested monorepo product territories
-  instead of grouping an entire Java application under its first directory. Oversized Java package
-  branches split recursively at real child packages, while a large flat package remains an honest
-  size hotspot instead of being divided into invented components.
-- Observed dependency directions are proposed separately as `OBSERVED_NOT_ENFORCED`; inventory is not
-  silently promoted to intended architecture.
-- Only universal starter guards (`runtimeCycles=0`, `maxFileLoc=300`) are active. Generic function,
-  complexity, cohesion, and boundary thresholds are returned as `CANDIDATE_NOT_ENFORCED` so a first
-  preview does not manufacture hundreds of policy violations.
-- `maxFileLoc` now reads physical file LOC stored on file nodes, not the last declaration's end line;
-  older graphs rebuild before this budget can report a pass.
-- `get_architecture_contract action=preview` returns the materialized candidate, verification, exact
-  file content/hash, and a short-lived token without writing. `action=approve` rechecks repository and
-  graph identity, then creates only a missing `.weavatrix/architecture.json` with the exact reviewed
-  content. Existing policy is never overwritten.
-- `baseline_mode=accept-current` is an explicit owner action for ratcheting accepted current debt; the
-  default records no baseline findings.
-
-## Runtime and codebase integrity
-
-- The MCP compares its running version with the package version on disk. A mismatch blocks
-  `initialize`, `tools/list`, and tool calls with `STALE_RUNTIME` until the client reconnects. The
-  environment override is reserved for deliberate source development.
-- Large MCP, graph, analysis, precision, and test modules were split into owner-focused folders with
-  stable hot-reload facades. The watcher and cache-busting chain include the new graph, Health,
-  action, and architecture owner modules, so supported tool edits still go live without reconnecting.
-- The public page keeps the same design and continuous canvas graph animation while CSS and animation
-  code move into focused assets. A release test enforces a physical 300-line ceiling for
-  JavaScript/TypeScript under `src`, `bin`, `scripts`, and `test`, plus site HTML/CSS/JavaScript.
-- The 38-tool catalog and profile counts remain unchanged: 31 pinned, 34 offline, 35 OSV, and 38
-  hosted/full.
-
-## Compatibility and security
-
-- Hosted payload v2/v3, `preview_sync` confirmation, and architecture-contract transport are
-  unchanged. This release does not modify the separate Hosted frontend/backend application.
-- Local architecture approval writes only inside the active repository boundary, uses an exclusive
-  create, expires and consumes tokens, rejects repository/graph drift, and refuses an existing target.
-- Source bodies, snippets, absolute paths, credentials, environment values, and Git remotes remain
-  excluded from Hosted sync payloads.
-
-## Verification
-
-The release is gated by the full Node suite (538 tests: 535 passed and three platform skips), the
-six-language fixture benchmark, a 6/6 real-repository semantic-regression gate, zero npm audit
-vulnerabilities, packed npm and MCPB stdio checks, plus direct Go and Java dogfooding. Cold timings
-vary with machine load and repository snapshots; the public README keeps a dated representative
-run instead of presenting one release machine's timing as a universal result.