weavatrix 0.2.5 → 0.2.7

package/src/mcp/catalog.mjs

@@ -26,19 +26,38 @@ const PROFILE_CAPS = Object.freeze({
 
 // The files whose mtime the stdio shell watches for hot reload — keep in sync with the imports in
 // loadHotApi below (catalog.mjs itself is last: a change here re-derives the whole table).
-export const HOT_FILES = ['tools-graph.mjs', 'tools-impact.mjs', 'tools-health.mjs', 'tools-source.mjs', 'tools-actions.mjs', 'tools-architecture.mjs', 'tools-history.mjs', 'tools-company.mjs', 'catalog.mjs']
+export const HOT_FILES = ['tools-graph.mjs', 'tools-impact.mjs', 'tools-health.mjs', 'tools-source.mjs', 'tools-context.mjs', 'tools-actions.mjs', 'tools-architecture.mjs', 'tools-history.mjs', 'tools-company.mjs', 'tools-verified-change.mjs', 'catalog.mjs']
 
-function buildTools({tg, ti, th, ts, ta, tar, thi, tc}) {
+function buildTools({tg, ti, th, ts, tb, ta, tar, thi, tc, tv, caps}) {
     const tools = [
         {cap: 'graph', name: 'graph_stats', description: 'Return summary statistics: node count, edge count, communities, versioned edge-provenance/legacy-confidence breakdowns, and graph build time vs repo HEAD (staleness).', inputSchema: {type: 'object', properties: {}}, run: (g, a, ctx) => tg.tGraphStats(g, ctx)},
         {cap: 'graph', name: 'get_node', description: 'Get full details for a specific node by label or ID.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Node label or ID to look up'}}, required: ['label']}, run: (g, a, ctx) => tg.tGetNode(g, a, ctx)},
         {cap: 'graph', name: 'get_neighbors', description: 'Get all direct neighbors of a node with edge details (1 hop, call sites deduped). For transitive impact use get_dependents; for the impact of your current branch changes use change_impact.', inputSchema: {type: 'object', properties: {label: {type: 'string'}, relation_filter: {type: 'string', description: 'Optional: filter by relation type'}}, required: ['label']}, run: (g, a, ctx) => tg.tGetNeighbors(g, a, ctx)},
-        {cap: 'graph', name: 'query_graph', description: 'Explore the graph around a concept (BFS/DFS). Returns a focused, ranked subgraph — the closest, most-connected nodes near the matched seeds, with edges among them — not the full flood; states how many nodes were reached vs shown.', inputSchema: {type: 'object', properties: {question: {type: 'string', description: 'Natural language question or keyword search'}, mode: {type: 'string', enum: ['bfs', 'dfs'], default: 'bfs'}, depth: {type: 'integer', default: 3}, context_filter: {type: 'array', items: {type: 'string'}}, seed_files: {type: 'array', items: {type: 'string'}, maxItems: 12, description: 'Optional exact repo-relative file paths. When resolved, these are the only seeds unless augment_seeds is true'}, augment_seeds: {type: 'boolean', default: false, description: 'With seed_files, also add fuzzy question-derived seeds; false keeps traversal strictly pinned'}, token_budget: {type: 'integer', description: 'Higher budget shows more nodes/edges', default: 2000}}, required: ['question']}, run: (g, a, ctx) => tg.tQueryGraph(g, a, ctx)},
+        {cap: 'graph', name: 'query_graph', description: 'Explore a focused production-first graph around a concept (BFS/DFS). Exact seed files stay pinned; classified paths and unreferenced constant/field leaves are suppressed unless the question or explicit flags request them. Reports policy and suppression instead of silently flooding the result.', inputSchema: {type: 'object', properties: {question: {type: 'string', description: 'Natural language question or keyword search'}, mode: {type: 'string', enum: ['bfs', 'dfs'], default: 'bfs'}, depth: {type: 'integer', default: 3}, context_filter: {type: 'array', items: {type: 'string'}}, seed_files: {type: 'array', items: {type: 'string'}, maxItems: 12, description: 'Optional exact repo-relative file paths. When resolved, these are the only seeds unless augment_seeds is true'}, augment_seeds: {type: 'boolean', default: false, description: 'With seed_files, also add fuzzy question-derived seeds; false keeps traversal strictly pinned'}, include_classified: {type: 'boolean', default: false, description: 'Allow traversal through tests/e2e/generated/mocks/stories/docs/benchmarks/temp and explicitly excluded paths. An explicit class term in the question enables only that class.'}, include_low_signal: {type: 'boolean', default: false, description: 'Include unreferenced constant/field leaf symbols that do not match a query term'}, token_budget: {type: 'integer', description: 'Higher budget shows more nodes/edges', default: 2000}}, required: ['question']}, run: (g, a, ctx) => tg.tQueryGraph(g, a, ctx)},
         {cap: 'graph', name: 'god_nodes', description: 'Rank production-code connectivity hubs by unique call/import/reference neighbors, with class/method ownership reported separately from runtime connectivity. Repeated call sites do not inflate the rank; classified tests, generated/build output and other non-product paths are excluded by default.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', default: 10}, include_classified: {type: 'boolean', default: false, description: 'Include tests/e2e/generated/build output/mocks/stories/docs/benchmarks/temp and paths explicitly excluded by repository classification'}}}, run: (g, a, ctx) => tg.tGodNodes(g, a, ctx)},
         {cap: 'graph', name: 'shortest_path', description: 'Find the shortest path between two concepts in the knowledge graph.', inputSchema: {type: 'object', properties: {source: {type: 'string'}, target: {type: 'string'}, max_hops: {type: 'integer', default: 8}}, required: ['source', 'target']}, run: (g, a) => tg.tShortestPath(g, a)},
         {cap: 'graph', name: 'get_dependents', description: 'Transitive blast-radius of ONE node: everything that calls/imports/inherits it, directly or through intermediaries (reverse edges, ranked by proximity then connectivity). Symbol queries stay symbol-precise by default; set include_container_importers only for a conservative module-wide radius. Use before refactoring; get_neighbors shows only 1 hop, change_impact covers your whole current diff at once.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Node label or ID'}, depth: {type: 'integer', description: 'Max reverse hops, default 3', default: 3}, max_nodes: {type: 'integer', description: 'Max dependents to list, default 40', default: 40}, include_container_importers: {type: 'boolean', description: 'Also seed importers of the symbol containing file (broader, conservative; default false)', default: false}}, required: ['label']}, run: (g, a) => ti.tGetDependents(g, a)},
         {cap: 'graph', name: 'change_impact', description: 'Verdict-first, symbol-aware blast radius. Parses a zero-context git diff, distinguishes additive exports from signature/body/removal risk, and reverse-traverses only exact changed seeds so a new API does not inherit every legacy importer of its file. Measured coverage is used when present; otherwise static test reachability is labelled actualCoverage=NOT_AVAILABLE. Pass `diff` for a not-checked-out PR; `files` without a diff remains a conservative fallback.', inputSchema: {type: 'object', properties: {base: {type: 'string', description: 'Base ref, e.g. origin/main or HEAD~1 (default: first existing of origin/HEAD, origin/main, origin/master, main, master)'}, diff: {type: 'string', maxLength: 2097152, description: 'Optional unified diff (prefer --unified=0) for a PR/change that is not checked out; enables symbol-level classification'}, files: {type: 'array', items: {type: 'string'}, maxItems: 500, description: 'Optional repo-relative changed-file hints. Without diff evidence these are classified conservatively rather than guessed additive'}, depth: {type: 'integer', description: 'Max reverse hops, default 2'}, max_nodes: {type: 'integer', description: 'Max impacted nodes to list, default 40'}}}, run: (g, a, ctx) => ti.tChangeImpact(g, a, ctx)},
         {cap: 'graph', name: 'git_history', description: 'Behavioral architecture evidence from bounded local git history: churn × connectivity hotspots, hidden co-change coupling, and expected test/source coupling. Reads numstat only — never commit messages, authors, or source bodies.', inputSchema: {type: 'object', properties: {months: {type: 'integer', enum: [3, 6, 12], default: 6}, max_commits: {type: 'integer', minimum: 1, maximum: 5000, default: 1000}, min_pair_count: {type: 'integer', minimum: 2, maximum: 100, default: 3}, max_pairs: {type: 'integer', minimum: 1, maximum: 500, default: 100}, top_n: {type: 'integer', minimum: 1, maximum: 50, default: 10}}}, run: (g, a, ctx) => thi.tGitHistory(g, a, ctx)},
+        {
+            cap: 'graph', refreshGraph: true, name: 'verified_change',
+            description: 'Proof-carrying change workflow. Given a natural-language task and current diff/files, returns compact edit contexts, bounded call-argument data-flow, blast radius, graph/architecture/duplicate/API ratchets, affected tests, and one PASS/BLOCKED/UNKNOWN verdict. Package tests run only when explicitly requested and WEAVATRIX_ALLOW_TEST_RUNS=1.',
+            inputSchema: {type: 'object', additionalProperties: false, properties: {
+                task: {type: 'string', minLength: 1, maxLength: 4000}, phase: {type: 'string', enum: ['plan', 'verify'], default: 'plan'},
+                base_ref: {type: 'string', maxLength: 200, default: 'HEAD'}, diff: {type: 'string', maxLength: 2097152}, files: {type: 'array', items: {type: 'string'}, maxItems: 500},
+                precision: {type: 'string', enum: ['auto', 'graph', 'lsp'], default: 'auto'}, max_symbols: {type: 'integer', minimum: 1, maximum: 5, default: 3},
+                impact_depth: {type: 'integer', minimum: 1, maximum: 4, default: 2}, max_impact_nodes: {type: 'integer', minimum: 5, maximum: 120, default: 40},
+                data_flow_depth: {type: 'integer', minimum: 1, maximum: 3, default: 2}, max_data_flow_edges: {type: 'integer', minimum: 1, maximum: 60, default: 30},
+                duplicate_ratchet: {type: 'boolean', default: true},
+                api_contract: {type: 'object', additionalProperties: true, properties: {backend: {type: 'string'}, clients: {type: 'array', items: {type: 'string'}, minItems: 1, maxItems: 20}, method: {type: 'string', enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS']}, path: {type: 'string', maxLength: 2048}, changed_files: {type: 'array', items: {type: 'string'}, maxItems: 500}}, required: ['backend', 'clients']},
+                tests: {type: 'array', maxItems: 5, items: {type: 'object', additionalProperties: false, properties: {script: {type: 'string', maxLength: 120}, args: {type: 'array', maxItems: 40, items: {type: 'string', maxLength: 300}}}, required: ['script']}},
+                run_tests: {type: 'boolean', default: false}, test_timeout_ms: {type: 'integer', minimum: 1000, maximum: 300000, default: 60000},
+            }, required: ['task']},
+            run: (g, a, ctx) => tv.tVerifiedChange(g, a, ctx, {
+                impact: ti.tChangeImpact, context: tb.tContextBundle, inspect: ts.tInspectSymbol,
+                prepareChange: tar.tPrepareChange, verifyArchitecture: tar.tVerifyArchitecture, traceApi: tc.tTraceApiContract,
+            }, {source: caps.has('source'), health: caps.has('health'), crossrepo: caps.has('crossrepo')}),
+        },
         {
             cap: 'crossrepo',
             name: 'trace_api_contract',
@@ -86,11 +105,12 @@ function buildTools({tg, ti, th, ts, ta, tar, thi, tc}) {
         {cap: 'search', name: 'search_code', description: 'Full-text or regex search across the repo source (ripgrep-backed, Node fallback). The graph only stores structure — use this to find literal text/patterns, then get_node/get_neighbors for structure.', inputSchema: {type: 'object', properties: {query: {type: 'string', description: 'text or regex to search for'}, is_regex: {type: 'boolean', default: false}, glob: {type: 'string', description: 'optional path glob, e.g. "*.js" or "src/**"'}, max_results: {type: 'integer', default: 40}}, required: ['query']}, run: (g, a, ctx) => searchCode({repoRoot: ctx.repoRoot, resolveRg}, a)},
           {cap: 'source', name: 'read_source', description: "Read the actual source of a node (by label/ID) or a repo-relative file path — the symbol's lines with context. The graph stores only locations, not source text. For a path read, pass start_line to anchor the window anywhere in the file (otherwise it shows the head).", inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'node label or ID'}, path: {type: 'string', description: 'or a repo-relative file path'}, start_line: {type: 'integer', description: 'anchor line: window = start_line-before .. start_line+after'}, before: {type: 'integer', default: 3}, after: {type: 'integer', default: 40}}}, run: (g, a, ctx) => readSource({repoRoot: ctx.repoRoot, resolveNode, isSymbol}, g, a)},
           {cap: 'source', refreshGraph: true, name: 'inspect_symbol', description: 'Inspect one exact symbol with an on-demand TypeScript/JavaScript LSP reference query, grouped occurrence containers, graph blast radius, complexity facts and bounded local source context. Ambiguous labels fail closed; point queries never replace the broad precision overlay.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Exact node ID or unambiguous symbol label'}, precision: {type: 'string', enum: ['auto', 'graph', 'lsp'], default: 'auto'}, max_references: {type: 'integer', minimum: 1, maximum: 5000, default: 1000}, max_containers: {type: 'integer', minimum: 1, maximum: 50, default: 15}, context_lines: {type: 'integer', minimum: 0, maximum: 40, default: 8}, timeout_ms: {type: 'integer', minimum: 1000, maximum: 60000, default: 30000}}, required: ['label']}, run: (g, a, ctx) => ts.tInspectSymbol(g, a, ctx)},
+          {cap: 'source', refreshGraph: true, name: 'context_bundle', description: 'Return one compact, bounded source bundle for an exact symbol: definition, aggregated inbound/outbound containers, exact re-export sites, on-demand TS/JS reference evidence and a few focused source excerpts. Use before an edit when query_graph would be too broad.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Exact node ID or unambiguous symbol label'}, precision: {type: 'string', enum: ['auto', 'graph', 'lsp'], default: 'auto'}, max_references: {type: 'integer', minimum: 1, maximum: 5000, default: 1000}, max_related: {type: 'integer', minimum: 1, maximum: 30, default: 10}, max_reexports: {type: 'integer', minimum: 1, maximum: 100, default: 20}, max_source_files: {type: 'integer', minimum: 1, maximum: 8, default: 4}, context_lines: {type: 'integer', minimum: 0, maximum: 12, default: 4}, timeout_ms: {type: 'integer', minimum: 1000, maximum: 60000, default: 30000}}, required: ['label']}, run: (g, a, ctx) => tb.tContextBundle(g, a, ctx, ts.tInspectSymbol)},
         {cap: 'health', name: 'find_duplicates', description: "Content-based clone detection over production code (MOSS winnowing over method bodies). Supports high-confidence small clones down to 12 tokens when min_tokens is lowered. Tests, e2e, generated code, mocks, stories, docs, benchmarks and temporary roots are classified separately and excluded by default; opt them in explicitly.", inputSchema: {type: 'object', properties: {min_similarity: {type: 'integer', description: '50-100, default 80 (ignored in semantic mode)'}, min_tokens: {type: 'integer', minimum: 12, maximum: 400, description: 'min fragment size, 12-400; default 50'}, mode: {type: 'string', enum: ['renamed', 'strict', 'semantic'], default: 'renamed'}, include_tests: {type: 'boolean', default: false}, include_classified: {type: 'boolean', default: false, description: 'Include generated/mock/story/docs/benchmark/temp and paths explicitly classified as excluded; tests still require include_tests'}, include_strings: {type: 'boolean', description: 'Also clone-check large multi-line string literals', default: false}, top_n: {type: 'integer', default: 15}}}, run: (g, a, ctx) => th.tFindDuplicates(g, a, ctx)},
         {cap: 'health', name: 'find_dead_code', description: 'Conservative review queue for statically unreferenced files, functions, methods and symbols. Returns confidence, reason, bounded evidence and explicit framework/dynamic/reflection/public-API caveats; never an auto-delete verdict. Tests, generated code, mocks, stories, docs, benchmarks and temporary roots are excluded by default.', inputSchema: {type: 'object', properties: {path: {type: 'string', maxLength: 1024, description: 'Optional repo-relative path prefix'}, kinds: {type: 'array', items: {type: 'string', enum: ['file', 'function', 'method', 'symbol']}, maxItems: 4, uniqueItems: true, description: 'Optional candidate kinds; defaults to all'}, min_confidence: {type: 'string', enum: ['high', 'medium', 'low'], default: 'medium', description: 'Minimum confidence to include. low explicitly includes public/framework/dynamic review candidates'}, include_tests: {type: 'boolean', default: false}, include_classified: {type: 'boolean', default: false, description: 'Include generated/mock/story/docs/benchmark/temp and paths explicitly classified as excluded; tests still require include_tests'}, top_n: {type: 'integer', minimum: 1, maximum: 100, default: 30}}}, run: (g, a, ctx) => th.tFindDeadCode(g, a, ctx)},
         {cap: 'health', name: 'run_audit', description: 'Full internal health audit. With base_ref, builds and audits an immutable Git checkout, derives changed files, and compares stable deterministic finding IDs; debt defaults to genuinely new findings. Supply-chain checks remain explicitly uncomparable across the source-only baseline. changed_files without base_ref is only changed-scope, never a new-debt claim.', inputSchema: {type: 'object', properties: {category: {type: 'string', enum: ['unused', 'structure', 'vulnerability', 'malware'], description: 'Only findings of this category'}, min_severity: {type: 'string', enum: ['critical', 'high', 'medium', 'low', 'info'], description: 'Minimum severity to include'}, max_findings: {type: 'integer', description: 'Max findings to list, default 30'}, include_malware_scan: {type: 'boolean', description: 'Also grep installed packages for malware heuristics (slow)', default: false}, base_ref: {type: 'string', maxLength: 200, description: 'Optional immutable Git baseline (for example HEAD~1 or origin/main). Enables honest new/existing/fixed debt comparison'}, changed_files: {type: 'array', items: {type: 'string'}, minItems: 1, maxItems: 500, description: 'Optional explicit repo-relative scope. Without base_ref this is changed-scope only; when omitted with base_ref, files are derived from the Git diff'}, debt: {type: 'string', enum: ['new', 'existing', 'all'], default: 'new', description: 'Baseline comparison view. Defaults to genuinely new deterministic findings when base_ref is present'}}}, run: (g, a, ctx) => th.tRunAudit(g, a, ctx)},
         {cap: 'health', name: 'coverage_map', description: 'Map a real existing coverage report onto the graph. If no report exists, return clearly labelled static test reachability (a test imports/reaches a source file) with actualCoverage=NOT_AVAILABLE; reachability is never presented as measured coverage.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', description: 'Max risk hotspots to list, default 15'}, path: {type: 'string', description: 'Optional repo-relative path prefix filter, e.g. src/query'}}}, run: (g, a, ctx) => th.tCoverageMap(g, a, ctx)},
-        {cap: 'health', name: 'hot_path_review', description: 'Rank bounded production-symbol hot paths from parser-derived local complexity, inside-loop allocations/copies/scans/sorts/recursion, graph fan-in/fan-out, and measured coverage or clearly labelled static test reachability. Local syntax cost stays separate from graph risk; this is not profiler data or interprocedural Big-O.', inputSchema: {type: 'object', properties: {path: {type: 'string', maxLength: 1024, description: 'Optional repository-relative path prefix'}, top_n: {type: 'integer', minimum: 1, maximum: 100, default: 20}, min_score: {type: 'integer', minimum: 0, maximum: 100, default: 0}, cyclomatic_threshold: {type: 'integer', minimum: 2, maximum: 1000, default: 8}, call_threshold: {type: 'integer', minimum: 1, maximum: 10000, default: 12}, loop_depth_threshold: {type: 'integer', minimum: 1, maximum: 10, default: 2}, time_rank_threshold: {type: 'integer', minimum: 0, maximum: 5, default: 2}, include_tests: {type: 'boolean', default: false}, include_classified: {type: 'boolean', default: false, description: 'Include generated/mock/story/docs/benchmark/temp and explicitly excluded paths; tests still require include_tests'}}}, run: (g, a, ctx) => th.tHotPathReview(g, a, ctx)},
+        {cap: 'health', name: 'hot_path_review', description: 'Rank a focused production-symbol hot-path queue from parser-derived local complexity, inside-loop allocations/copies/scans/sorts/recursion, graph fan-in/fan-out, and measured coverage or clearly labelled static test reachability. The default score gate is 85 with a narrow strong-local fallback; set min_score=0 for the full diagnostic queue. This is not profiler data or interprocedural Big-O.', inputSchema: {type: 'object', properties: {path: {type: 'string', maxLength: 1024, description: 'Optional repository-relative path prefix'}, top_n: {type: 'integer', minimum: 1, maximum: 100, default: 20}, min_score: {type: 'integer', minimum: 0, maximum: 100, default: 85, description: 'Focused default is 85; lower explicitly to broaden, or use 0 for every threshold-matching diagnostic candidate'}, cyclomatic_threshold: {type: 'integer', minimum: 2, maximum: 1000, default: 8}, call_threshold: {type: 'integer', minimum: 1, maximum: 10000, default: 12}, loop_depth_threshold: {type: 'integer', minimum: 1, maximum: 10, default: 2}, time_rank_threshold: {type: 'integer', minimum: 0, maximum: 5, default: 2}, include_tests: {type: 'boolean', default: false}, include_classified: {type: 'boolean', default: false, description: 'Include generated/mock/story/docs/benchmark/temp and explicitly excluded paths; tests still require include_tests'}}}, run: (g, a, ctx) => th.tHotPathReview(g, a, ctx)},
         {cap: 'graph', name: 'list_communities', description: 'List graph communities named by their dominant folder (largest first) with sample files — a readable module overview; feed the list position into get_community.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', description: 'Max communities to list, default 20'}}}, run: (g, a, ctx) => th.tListCommunities(g, a, ctx)},
         {cap: 'graph', name: 'module_map', description: 'Production-first folder architecture map with file/symbol counts and strongest module dependencies, separating runtime, TypeScript type-only and language compile-only coupling.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', description: 'Max modules to list, default 25'}, include_non_product: {type: 'boolean', default: false, description: 'Include tests, fixtures, benchmarks, generated output, docs and other classified non-product files; false by default'}}}, run: (g, a, ctx) => th.tModuleMap(g, a, ctx)},
         {cap: 'source', refreshGraph: true, name: 'list_endpoints', description: 'Inventory of HTTP endpoints defined in the repo (Express/Fastify/Nest/Flask/FastAPI/Go mux/Rust axum and actix-web/Spring MVC and WebFlux): method, composed path, handler, and file:line.', inputSchema: {type: 'object', properties: {max_results: {type: 'integer', description: 'Max endpoints to list, default 100'}}}, run: (g, a, ctx) => th.tListEndpoints(g, a, ctx)},
@@ -133,21 +153,23 @@ function buildTools({tg, ti, th, ts, ta, tar, thi, tc}) {
 // present string (even '') is an explicit selection, so "select nothing" really exposes nothing.
 export async function loadHotApi(version, capsArg) {
     const v = version ? `?v=${version}` : ''
-    const [tg, ti, th, ts, ta, tar, thi, tc] = await Promise.all([
+    const [tg, ti, th, ts, tb, ta, tar, thi, tc, tv] = await Promise.all([
         import(new URL(`./tools-graph.mjs${v}`, import.meta.url).href),
         import(new URL(`./tools-impact.mjs${v}`, import.meta.url).href),
         import(new URL(`./tools-health.mjs${v}`, import.meta.url).href),
         import(new URL(`./tools-source.mjs${v}`, import.meta.url).href),
+        import(new URL(`./tools-context.mjs${v}`, import.meta.url).href),
         import(new URL(`./tools-actions.mjs${v}`, import.meta.url).href),
         import(new URL(`./tools-architecture.mjs${v}`, import.meta.url).href),
         import(new URL(`./tools-history.mjs${v}`, import.meta.url).href),
         import(new URL(`./tools-company.mjs${v}`, import.meta.url).href),
+        import(new URL(`./tools-verified-change.mjs${v}`, import.meta.url).href),
     ])
-    const all = buildTools({tg, ti, th, ts, ta, tar, thi, tc})
     const raw = capsArg == null ? 'offline' : String(capsArg).trim()
     const selected = PROFILE_CAPS[raw] || raw.split(',').map((s) => s.trim()).filter(Boolean)
         .flatMap((cap) => cap === 'online' ? ['advisories', 'hosted'] : [cap])
     const caps = new Set(selected)
+    const all = buildTools({tg, ti, th, ts, tb, ta, tar, thi, tc, tv, caps})
     const tools = all.filter((t) => caps.has(t.cap))
     return {
         tools,

package/src/mcp/graph-context.mjs

@@ -62,6 +62,10 @@ export function loadGraph(path, {repoRoot = null} = {}) {
         edgeTypesV: Number(raw.edgeTypesV) || 0,
         edgeProvenanceV: Number(raw.edgeProvenanceV) || 0,
         barrelResolutionV: Number(raw.barrelResolutionV) || 0,
+        reExportOccurrencesV: Number(raw.reExportOccurrencesV) || 0,
+        symbolSpacesV: Number(raw.symbolSpacesV) || 0,
+        reExportOccurrences: Array.isArray(raw.reExportOccurrences) ? raw.reExportOccurrences : [],
+        jsExportRecords: raw.jsExportRecords && typeof raw.jsExportRecords === 'object' ? raw.jsExportRecords : {},
         extractorSchemaV: Number(raw.extractorSchemaV) || 0,
         extImportsV: Number(raw.extImportsV) || 0,
         complexityV: Number(raw.complexityV) || 0,
@@ -165,7 +169,7 @@ const sourceFileOf = (node) => {
     return normPath(source)
 }
 
-function requestedPathClasses(query) {
+export function requestedPathClasses(query) {
     const words = new Set(wordsOf(query))
     const requested = new Set()
     for (const [category, terms] of Object.entries(CLASS_QUERY_TERMS)) {

package/src/mcp/graph-diff.mjs

@@ -35,7 +35,7 @@ function stableNodeIndex(graph) {
         if (!raw) continue
         const stem = terminalLineSuffix(raw)
         const params = Number.isInteger(node?.complexity?.params) ? node.complexity.params : ''
-        const signature = [stem, node?.symbol_kind || '', node?.exported === true ? 'exported' : '', params].join('\u0000')
+        const signature = [stem, node?.symbol_kind || '', node?.symbol_space || '', node?.exported === true ? 'exported' : '', params].join('\u0000')
         if (!groups.has(signature)) groups.set(signature, [])
         groups.get(signature).push(node)
     }

package/src/mcp/sync-payload.mjs

@@ -180,7 +180,7 @@ function sanitizeNodeV3(value) {
     else delete out.file_type;
     if (sourceFile) out.source_file = sourceFile;
     else delete out.source_file;
-    for (const key of ['symbol_kind', 'member_of', 'visibility']) setIf(out, key, safeToken(value[key], 128));
+    for (const key of ['symbol_kind', 'symbol_space', 'member_of', 'visibility']) setIf(out, key, safeToken(value[key], 128));
     if (out.complexity) {
         for (const key of ['family', 'scope', 'complexityScope', 'confidence']) {
             const safe = safeToken(value.complexity?.[key], 32);

package/src/mcp/tools-actions.mjs

@@ -91,7 +91,9 @@ export async function tOpenRepo(g, args, ctx) {
             savedPrecision = ['lsp', 'off'].includes(saved.graphPrecisionMode) ? saved.graphPrecisionMode : defaultPrecisionMode()
             schemaUpgrade = !Number.isInteger(saved.edgeTypesV) || saved.edgeTypesV < 2
                 || !Number.isInteger(saved.edgeProvenanceV) || saved.edgeProvenanceV < 1
-                || !Number.isInteger(saved.extractorSchemaV) || saved.extractorSchemaV < 4
+                || !Number.isInteger(saved.extractorSchemaV) || saved.extractorSchemaV < 5
+                || !Number.isInteger(saved.reExportOccurrencesV) || saved.reExportOccurrencesV < 1
+                || !Number.isInteger(saved.symbolSpacesV) || saved.symbolSpacesV < 1
             if (savedPrecision === 'lsp') {
                 const overlay = readPrecisionOverlay(graphPath, saved)
                 precisionUpgrade = !overlay || (typeof overlay.semanticInputFingerprint === 'string'

package/src/mcp/tools-context.mjs

@@ -0,0 +1,164 @@
+import {isStructuralRelation} from '../graph/relations.js'
+import {boundedInteger} from '../bounds.js'
+import {isSymbol, labelOf} from './graph-context.mjs'
+import {toolResult} from './tool-result.mjs'
+
+const MAX_LINE_SAMPLES = 5
+
+const fileOf = (g, id) => {
+    const node = g.byId.get(String(id))
+    return String(node?.source_file || (isSymbol(id) ? String(id).split('#')[0] : id))
+}
+
+function aggregateEdges(g, edges, cap) {
+    const groups = new Map()
+    for (const edge of edges || []) {
+        if (isStructuralRelation(edge.relation) || edge.barrelProxy === true) continue
+        const id = String(edge.id)
+        const relation = String(edge.relation || 'references')
+        const key = `${id}\0${relation}`
+        let group = groups.get(key)
+        if (!group) {
+            group = {id, label: labelOf(g, id), file: fileOf(g, id), relation, count: 0, lines: []}
+            groups.set(key, group)
+        }
+        group.count++
+        if (Number.isInteger(edge.line) && group.lines.length < MAX_LINE_SAMPLES && !group.lines.includes(edge.line)) group.lines.push(edge.line)
+        if (edge.typeOnly === true) group.typeOnly = true
+        if (edge.compileOnly === true) group.compileOnly = true
+    }
+    const all = [...groups.values()].sort((left, right) => right.count - left.count
+        || left.file.localeCompare(right.file) || left.id.localeCompare(right.id))
+    return {total: all.length, shown: all.slice(0, cap), capped: all.length > cap}
+}
+
+const sameOrigin = (occurrence, definition) => occurrence.originId === definition.id
+    || (occurrence.originFile === definition.file && occurrence.originName === definition.name)
+
+function exactReExportSites(g, definition, cap) {
+    const occurrences = Array.isArray(g.reExportOccurrences) ? g.reExportOccurrences : []
+    const exposures = new Map()
+    if (definition.exported) exposures.set(definition.file, new Set([definition.name]))
+    const shown = new Map()
+    const add = (occurrence, exported = occurrence.exported) => {
+        const key = `${occurrence.file}\0${occurrence.line}\0${exported}\0${occurrence.kind}`
+        if (shown.has(key)) return false
+        shown.set(key, {
+            file: occurrence.file,
+            line: occurrence.line,
+            kind: occurrence.kind,
+            exported,
+            imported: occurrence.imported,
+            targetFile: occurrence.targetFile,
+            typeOnly: occurrence.typeOnly === true,
+            ...(occurrence.specifier ? {specifier: occurrence.specifier} : {}),
+            ...(occurrence.originFile ? {originFile: occurrence.originFile, originName: occurrence.originName} : {}),
+        })
+        return true
+    }
+    for (let pass = 0; pass <= occurrences.length; pass++) {
+        let changed = false
+        for (const occurrence of occurrences) {
+            if (occurrence.kind === 'star') {
+                const names = exposures.get(occurrence.targetFile)
+                if (!names) continue
+                for (const name of names) {
+                    if (name === 'default') continue
+                    changed = add(occurrence, name) || changed
+                    let exported = exposures.get(occurrence.file)
+                    if (!exported) exposures.set(occurrence.file, (exported = new Set()))
+                    const before = exported.size
+                    exported.add(name)
+                    changed = exported.size !== before || changed
+                }
+                continue
+            }
+            if (!sameOrigin(occurrence, definition)) continue
+            changed = add(occurrence) || changed
+            if (occurrence.kind !== 'namespace') {
+                let exported = exposures.get(occurrence.file)
+                if (!exported) exposures.set(occurrence.file, (exported = new Set()))
+                const before = exported.size
+                exported.add(occurrence.exported)
+                changed = exported.size !== before || changed
+            }
+        }
+        if (!changed) break
+    }
+    const all = [...shown.values()].sort((left, right) => left.file.localeCompare(right.file)
+        || left.line - right.line || left.exported.localeCompare(right.exported))
+    return {total: all.length, shown: all.slice(0, cap), capped: all.length > cap}
+}
+
+function linesForGroups(title, groups) {
+    if (!groups.shown.length) return [`${title}: none`]
+    const lines = [`${title}: ${groups.total} container(s)${groups.capped ? ` (${groups.shown.length} shown)` : ''}`]
+    for (const group of groups.shown) {
+        const sites = group.lines.length ? `:${group.lines.join(',')}` : ''
+        lines.push(`  ${group.count}× ${group.relation}  ${group.label}  [${group.file}${sites}]`)
+    }
+    return lines
+}
+
+function textFor(result) {
+    if (result.status !== 'OK') return result.text || `Context bundle: ${result.status}`
+    const definition = result.definition
+    const lines = [
+        `Context bundle: ${definition.label}  [${definition.id}]`,
+        `Definition: ${definition.file}:${definition.line} (${definition.kind}, ${definition.space} space)`,
+        `Evidence: ${result.evidence.state}; ${result.references.occurrences} exact reference occurrence(s) in ${result.references.files} file(s).`,
+        ...linesForGroups('Inbound', result.inbound),
+        ...linesForGroups('Outbound', result.outbound),
+        `Re-export sites: ${result.reExports.total}${result.reExports.capped ? ` (${result.reExports.shown.length} shown)` : ''}`,
+    ]
+    for (const site of result.reExports.shown) lines.push(`  ${site.file}:${site.line}  ${site.kind} ${site.imported} → ${site.exported}${site.typeOnly ? ' [type]' : ''}`)
+    for (const source of result.source) lines.push('', `${source.role} source (${source.file}:${source.startLine}-${source.endLine}):`, source.text)
+    return lines.join('\n')
+}
+
+export async function tContextBundle(g, args = {}, ctx = {}, inspectSymbol) {
+    if (typeof inspectSymbol !== 'function') throw new Error('context_bundle requires inspect_symbol support')
+    const maxRelated = boundedInteger(args.max_related, 10, 1, 30)
+    const maxReExports = boundedInteger(args.max_reexports, 20, 1, 100)
+    const maxSourceFiles = boundedInteger(args.max_source_files, 4, 1, 8)
+    const inspected = await inspectSymbol(g, {
+        ...args,
+        max_containers: Math.min(maxRelated, boundedInteger(args.max_containers, 10, 1, 30)),
+        context_lines: boundedInteger(args.context_lines, 4, 0, 12),
+    }, ctx)
+    const inspection = inspected?.result
+    if (!inspection || inspection.status !== 'OK') return inspected
+    const definition = {
+        ...inspection.definition,
+        name: String(g.byId.get(inspection.definition.id)?.label || '').replace(/\(\)$/, ''),
+    }
+    const inbound = aggregateEdges(g, g.inn.get(definition.id), maxRelated)
+    const outbound = aggregateEdges(g, g.out.get(definition.id), maxRelated)
+    const reExports = exactReExportSites(g, definition, maxReExports)
+    const source = []
+    if (inspection.source.definition) source.push({role: 'Definition', ...inspection.source.definition})
+    for (const excerpt of inspection.source.callers || []) {
+        if (source.length >= maxSourceFiles) break
+        if (source.some((item) => item.file === excerpt.file && item.focusLine === excerpt.focusLine)) continue
+        source.push({role: 'Caller', ...excerpt})
+    }
+    const result = {
+        status: 'OK', definition, evidence: inspection.evidence,
+        references: {
+            occurrences: inspection.exact.occurrences,
+            files: inspection.exact.files,
+            containers: inspection.exact.containers,
+            capped: inspection.exact.capped,
+        },
+        inbound, outbound, reExports, source,
+    }
+    return toolResult(textFor(result), result, {
+        warnings: inspected.warnings,
+        completeness: {
+            status: inspection.evidence.state === 'EXACT' && !inspection.exact.capped && !inbound.capped && !outbound.capped && !reExports.capped ? 'complete' : 'bounded',
+            relatedLimit: maxRelated,
+            reExportLimit: maxReExports,
+            sourceFileLimit: maxSourceFiles,
+        },
+    })
+}

package/src/mcp/tools-graph.mjs

@@ -3,10 +3,11 @@
 // staleness probe in graph-context. Hot-reloadable (re-imported by catalog.mjs on change).
 import {
     isSymbol, degreeOf, labelOf, connList,
-    resolveNodeInfo, resolveNode, ambiguityNote, findSeeds, resolveSeedFiles, undirectedNeighbors,
+    resolveNodeInfo, resolveNode, ambiguityNote, findSeeds, resolveSeedFiles, undirectedNeighbors, requestedPathClasses,
     graphStaleness, fileStalenessNote,
 } from './graph-context.mjs'
 import {summarizeEdgeProvenance} from '../graph/edge-provenance.js'
+import {createPathClassifier, hasPathClass} from '../path-classification.js'
 
 const compileKind = (edge) => edge?.typeOnly === true ? 'type-only' : edge?.compileOnly === true ? 'compile-only' : null
 
@@ -48,6 +49,8 @@ export function tGraphStats(g, ctx) {
         g.edgeProvenanceV ? `- Edge provenance: v${g.edgeProvenanceV} (${fmt(provenance.counts)}; ${provenance.complete ? 'complete' : `${provenance.counts.UNKNOWN} unclassified`})` : `- Edge provenance: unavailable (rebuild_graph required)`,
         `- Semantic precision: ${precision.state}${precision.provider ? ` via ${precision.provider}${precision.providerVersion ? ` ${precision.providerVersion}` : ''}${precision.typescriptVersion ? ` (TypeScript ${precision.typescriptVersion})` : ''}` : ''}; ${precision.verifiedEdges || 0} EXACT_LSP edge(s), ${precision.queried || 0}/${precision.candidates || 0} bounded target(s) queried${precision.truncated ? ' (partial/truncated)' : ''}${precision.reason ? `; ${precision.reason}` : ''}`,
         g.barrelResolutionV ? `- Barrel resolution: v${g.barrelResolutionV} (semantic tools look through JS/TS re-export facades)` : `- Barrel resolution: unavailable (rebuild_graph required for JS/TS barrel transparency)`,
+        g.reExportOccurrencesV ? `- Re-export occurrences: v${g.reExportOccurrencesV} (${g.reExportOccurrences.length} exact site(s))` : `- Re-export occurrences: unavailable (rebuild_graph required)`,
+        g.symbolSpacesV ? `- TypeScript symbol spaces: v${g.symbolSpacesV} (type/value identities separated)` : `- TypeScript symbol spaces: unavailable (rebuild_graph required)`,
         `- Relations: ${fmt(relCount)}`,
         Object.keys(confCount).length ? `- Legacy confidence: ${fmt(confCount)}` : null,
         `- Communities: ${comm.size} (top by size: ${topComm.map(([c, n]) => `#${c}=${n}`).join(', ')})`,
@@ -163,7 +166,15 @@ export function tGetCommunity(g, {community_id} = {}) {
 // A plain BFS/DFS flood dumps every reached node (thousands on a real graph) at near-zero signal.
 // Instead: traverse to record reach + distance-from-seed, then show only the closest, most-connected
 // slice as a coherent subgraph (edges kept only among shown nodes). Honest about what was trimmed.
-export function tQueryGraph(g, {question, mode = 'bfs', depth = 3, context_filter, seed_files, augment_seeds = false, token_budget = 2000} = {}, toolCtx = {}) {
+const QUERY_NON_PRODUCT = Object.freeze(['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
+const LOW_SIGNAL_SYMBOL_RE = /^(?:const(?:ant)?|variable|property|field|enum_member)$/i
+const querySourceFile = (node) => String(node?.source_file || String(node?.id || '').split('#', 1)[0]).replace(/\\/g, '/').replace(/^\.\//, '').toLowerCase()
+const queryWords = (value) => new Set(String(value || '').replace(/([a-z0-9])([A-Z])/g, '$1 $2').toLowerCase().split(/[^a-z0-9_]+/).filter(Boolean))
+
+export function tQueryGraph(g, {
+    question, mode = 'bfs', depth = 3, context_filter, seed_files, augment_seeds = false,
+    include_classified = false, include_low_signal = false, token_budget = 2000,
+} = {}, toolCtx = {}) {
     const pinned = resolveSeedFiles(g, seed_files)
     // Exact seed files are a control surface, not a hint: by default they disable fuzzy keyword seeds.
     // Callers can opt back into augmentation when they explicitly want both behaviors.
@@ -175,6 +186,32 @@ export function tQueryGraph(g, {question, mode = 'bfs', depth = 3, context_filte
     const maxDepth = Math.max(1, Math.min(6, Number(depth) || 3))
     const ctx = Array.isArray(context_filter) && context_filter.length ? new Set(context_filter.map((c) => String(c).toLowerCase())) : null
     const relOk = (rel) => !ctx || ctx.has(String(rel ?? '').toLowerCase())
+    const requestedClasses = requestedPathClasses(question)
+    const classifier = createPathClassifier(toolCtx.repoRoot || null)
+    const classificationCache = new Map()
+    const pinnedFiles = new Set(pinned.seeds.map(querySourceFile))
+    const classifiedSuppressed = new Set()
+    const pathPolicy = (id) => {
+        const node = g.byId.get(String(id))
+        const file = querySourceFile(node)
+        if (!file || pinnedFiles.has(file) || include_classified === true) return {ok: true}
+        if (!classificationCache.has(file)) classificationCache.set(file, classifier.explain(file, {content: ''}))
+        const info = classificationCache.get(file)
+        const classes = QUERY_NON_PRODUCT.filter((name) => hasPathClass(info, name))
+        if (!classes.length && !info?.excluded) return {ok: true}
+        if (classes.some((name) => requestedClasses.has(name))) return {ok: true}
+        classifiedSuppressed.add(String(id))
+        return {ok: false, bucket: 'classified'}
+    }
+    const questionTerms = queryWords(question)
+    const isLowSignal = (id) => {
+        if (include_low_signal === true || start.includes(String(id))) return false
+        const node = g.byId.get(String(id))
+        if (!node || !isSymbol(node.id) || !LOW_SIGNAL_SYMBOL_RE.test(String(node.symbol_kind || ''))) return false
+        const labelTerms = queryWords(node.label || String(node.id || '').split('#').pop() || '')
+        if ([...questionTerms].some((term) => labelTerms.has(term))) return false
+        return degreeOf(g, id) === 0
+    }
     const charBudget = Math.max(400, (Number(token_budget) || 2000) * 4)
     // node budget scales gently with the token budget; edges follow the surviving nodes.
     const nodeBudget = Math.max(20, Math.min(120, Math.round((Number(token_budget) || 2000) / 40)))
@@ -191,6 +228,7 @@ export function tQueryGraph(g, {question, mode = 'bfs', depth = 3, context_filte
             if (d >= maxDepth) continue
             for (const [nid, rel] of undirectedNeighbors(g, id)) {
                 if (!relOk(rel)) continue
+                if (!pathPolicy(nid).ok) continue
                 if (!seen.has(nid)) stack.push({id: nid, d: d + 1})
             }
         }
@@ -202,6 +240,7 @@ export function tQueryGraph(g, {question, mode = 'bfs', depth = 3, context_filte
             for (const id of frontier)
                 for (const [nid, rel] of undirectedNeighbors(g, id)) {
                     if (!relOk(rel)) continue
+                    if (!pathPolicy(nid).ok) continue
                     if (!depthOf.has(nid)) {
                         depthOf.set(nid, d + 1)
                         next.push(nid)
@@ -211,7 +250,10 @@ export function tQueryGraph(g, {question, mode = 'bfs', depth = 3, context_filte
         }
     }
     // rank reached nodes: seeds first, then by proximity (depth asc), then connectivity (degree desc)
+    const reachedBeforeSignalFilter = depthOf.size
+    const lowSignalSuppressed = [...depthOf.keys()].filter(isLowSignal).length
     const ranked = [...depthOf.entries()]
+        .filter(([id]) => !isLowSignal(id))
         .map(([id, d]) => ({id, d, deg: degreeOf(g, id)}))
         .sort((a, b) => a.d - b.d || b.deg - a.deg)
     const shown = ranked.slice(0, nodeBudget)
@@ -234,7 +276,10 @@ export function tQueryGraph(g, {question, mode = 'bfs', depth = 3, context_filte
         `Query: "${question}" (${mode}, depth ${maxDepth}${ctx ? `, context ${[...ctx].join('/')}` : ''})`,
         `Seeds: ${seeds.map((s) => s.label ?? s.id).join(', ')}`,
         pinned.missing.length ? `Unresolved pinned seed files: ${pinned.missing.join(', ')}` : null,
-        `Reached ${depthOf.size} nodes; showing ${shown.length} closest by proximity + connectivity, ${shownEdges.length} edges among them.`,
+        `Reached ${reachedBeforeSignalFilter} policy-eligible nodes; showing ${shown.length} closest by proximity + connectivity, ${shownEdges.length} edges among them.`,
+        classifiedSuppressed.size ? `Suppressed ${classifiedSuppressed.size} classified/non-product traversal node(s); ask for that class or pass include_classified:true.` : null,
+        lowSignalSuppressed ? `Suppressed ${lowSignalSuppressed} unreferenced constant/field node(s) with no query-term match; pass include_low_signal:true to inspect them.` : null,
+        include_classified === true ? 'Path policy: classified/non-product traversal explicitly enabled.' : `Path policy: production-first${requestedClasses.size ? `; explicit question classes enabled: ${[...requestedClasses].join(', ')}` : ''}.`,
         ``,
         `Nodes:`,
     ]

package/src/mcp/tools-health.mjs

@@ -3,6 +3,7 @@
 import {spawnSync} from 'node:child_process'
 import {degreeOf, rawGraph, effectiveRawGraph} from './graph-context.mjs'
 import {computeDuplicates} from '../analysis/duplicates.js'
+import {analyzeDuplicateGroups} from '../analysis/duplicate-groups.js'
 import {runInternalAudit} from '../analysis/internal-audit.js'
 import {classifyChangeImpact} from '../analysis/change-classification.js'
 import {compareAuditDebt, normalizeAuditScopeFiles, scopeAuditFindings} from '../analysis/audit-debt.js'
@@ -31,26 +32,6 @@ const fragmentEligible = (fragment, {tokMin, skipTests, includeClassified}) => {
     return true
 }
 
-// Group clone pairs into union-find families.
-function groupClones(data, {simMin, tokMin, mode, skipTests, includeClassified}) {
-    const frags = data.frags || []
-    const elig = (i) => fragmentEligible(frags[i], {tokMin, skipTests, includeClassified})
-    const pairs = (data.modes?.[mode] || []).filter(([i, j, s]) => s >= simMin && elig(i) && elig(j))
-    const parent = new Map()
-    const find = (x) => { let r = x; while (parent.has(r) && parent.get(r) !== r) r = parent.get(r); return r }
-    for (const [i, j] of pairs) { if (!parent.has(i)) parent.set(i, i); if (!parent.has(j)) parent.set(j, j); parent.set(find(i), find(j)) }
-    const groups = new Map()
-    for (const [i, j, s] of pairs) {
-        const r = find(i)
-        if (!groups.has(r)) groups.set(r, {members: new Set(), maxSim: 0})
-        const g = groups.get(r); g.members.add(i); g.members.add(j); g.maxSim = Math.max(g.maxSim, s)
-    }
-    return [...groups.values()].map((g) => {
-        const members = [...g.members].sort((a, b) => frags[b].n - frags[a].n)
-        return {members: members.map((i) => frags[i]), maxSim: g.maxSim, tokens: members.reduce((n, i) => n + frags[i].n, 0)}
-    }).sort((a, b) => b.tokens - a.tokens)
-}
-
 export function tFindDuplicates(g, args, ctx) {
     if (!ctx.repoRoot) return 'Duplicate scan needs the repo root (not provided to this server).'
     const simMin = Math.min(100, Math.max(50, Number(args.min_similarity) || 80))
@@ -97,10 +78,10 @@ export function tFindDuplicates(g, args, ctx) {
         })
         return `Found ${candidates.length} actionable same-name pair(s) across files (semantic mode; one closest clone and/or farthest collision per name). Top ${top.length}:\n\n${lines.join('\n\n')}\n\nThese are review candidates, not automatic refactors. Use read_source on both sites before changing code.`
     }
-    const data = computeDuplicates(ctx.repoRoot, ctx.graphPath, {includeStrings, minTokens: tokMin})
-    const groups = groupClones(data, {simMin, tokMin, mode, skipTests, includeClassified})
+    const analysis = analyzeDuplicateGroups(ctx.repoRoot, ctx.graphPath, args)
+    const groups = analysis.groups
     const smallPolicy = tokMin < 30 ? ' Small fragments below 30 tokens require at least 95% similarity and two shared bounded fingerprints.' : ''
-    const suppressed = data.frags.filter((fragment) => !fragmentEligible(fragment, {tokMin, skipTests, includeClassified})).length
+    const suppressed = analysis.suppressed
     const suppressionNote = suppressed && !includeClassified
         ? ` ${suppressed} fragment(s) classified as tests/e2e/generated/mock/story/docs/benchmark/temp or matched by .weavatrix.json exclude were suppressed; pass include_classified:true (and include_tests:true for tests) to inspect them explicitly.`
         : ''
@@ -162,13 +143,15 @@ export function tFindDeadCode(g, args, ctx) {
             : `${candidate.owner ? `${candidate.owner}.` : ''}${candidate.symbol || candidate.id}`
         const where = `${candidate.file}${candidate.line ? `:${candidate.line}` : ''}`
         return [
-            `${index + 1}. [${candidate.confidence}/${candidate.classification}] ${subject} (${where})`,
+            `${index + 1}. [${candidate.confidence}/${candidate.evidenceTier}/${candidate.classification}] ${subject} (${where})`,
             `     evidence: ${candidate.evidence.map((item) => item.fact).join(' ')}`,
             candidate.caveats.length ? `     caution: ${candidate.caveats.join(' ')}` : null,
+            `     remaining: ${candidate.remainingChecks.join(' ')}`,
         ].filter(Boolean).join('\n')
     })
     const text = [
         `Dead-code review: ${shown.length} of ${review.candidates.length} candidate(s) shown (high ${counts.high}, medium ${counts.medium}, low ${counts.low}).`,
+        `Evidence tiers: strong static ${review.totals.byEvidenceTier.strongStatic}, bounded static ${review.totals.byEvidenceTier.boundedStatic}, high uncertainty ${review.totals.byEvidenceTier.highUncertainty}.`,
         `Verdict: REVIEW_REQUIRED. This is static evidence, never permission to auto-delete or bulk-delete.`,
         suppression ? `Suppressed by current filters: ${suppression}.` : null,
         review.suppressed.confidence ? 'Use min_confidence=low only when public/framework/dynamic candidates need explicit review.' : null,
@@ -196,7 +179,10 @@ const SEVERITY_RANK = {critical: 0, high: 1, medium: 2, low: 3, info: 4}
 
 export function formatAuditFinding(f) {
     const where = f.file ? `  (${f.file}${f.symbol ? ` ${f.symbol}` : ''})` : f.package ? `  (pkg ${f.package}${f.version ? `@${f.version}` : ''}${f.manifest ? `; ${f.manifest}` : ''})` : ''
-    return `  [${f.severity}/${f.confidence || '?'}] ${f.rule}: ${f.title}${where}${f.reason ? `\n      reason: ${f.reason}` : ''}${f.cycleRoute ? `\n      route: ${f.cycleRoute}` : ''}${f.fixHint ? `\n      fix: ${f.fixHint}` : ''}`
+    const verification = f.verification?.evidenceModel
+        ? `\n      verification: ${f.verification.evidenceModel}; manifest ${f.verification.manifestDeclaration?.status || 'N/A'}; indexed imports ${f.verification.indexedSourceImports?.status || 'N/A'}; decision ${f.verification.decision || 'REVIEW_REQUIRED'}`
+        : ''
+    return `  [${f.severity}/${f.confidence || '?'}] ${f.rule}: ${f.title}${where}${f.reason ? `\n      reason: ${f.reason}` : ''}${verification}${f.cycleRoute ? `\n      route: ${f.cycleRoute}` : ''}${f.fixHint ? `\n      fix: ${f.fixHint}` : ''}`
 }
 
 const auditFilter = (audit, args, findings = audit.findings) => {
@@ -234,7 +220,7 @@ const formatOrdinaryAudit = (audit, args, findings = audit.findings, heading = n
         heading,
         `Internal audit of ${audit.repo} (${audit.scanned.files} files, ${audit.scanned.symbols} symbols, ${audit.scanned.externalImports} external imports; malware scan: ${audit.scanned.malwareScanMode}).`,
         ...auditConventionLines(audit),
-        `Dependency manifests: ${deps.status || 'UNKNOWN'} — checked ${deps.declared ?? audit.scanned.manifestDeps ?? 0} declared package(s) against ${deps.importRecords ?? audit.scanned.externalImports ?? 0} external import record(s); unused ${deps.unused ?? 'unknown'}, missing ${deps.missing ?? 'unknown'}, duplicate declarations ${deps.duplicateDeclarations ?? 'unknown'}.`,
+        `Dependency manifests: ${deps.status || 'UNKNOWN'} — checked ${deps.declared ?? audit.scanned.manifestDeps ?? 0} declared package(s) against ${deps.importRecords ?? audit.scanned.externalImports ?? 0} external import record(s); unused ${deps.unused ?? 'unknown'}, missing ${deps.missing ?? 'unknown'}, duplicate declarations ${deps.duplicateDeclarations ?? 'unknown'}. npm per-finding manifest/source/config verification: ${deps.perFindingVerification ? 'AVAILABLE' : 'UNAVAILABLE'}.`,
         `Scoped severity: critical ${sev.critical}, high ${sev.high}, medium ${sev.medium}, low ${sev.low}, info ${sev.info}. Scoped categories: unused ${bycat.unused}, structure ${bycat.structure}, vulnerability ${bycat.vulnerability}, malware ${bycat.malware}.`,
         `Repository-level ${auditChecksLine(audit)}`,
         '',
@@ -428,7 +414,7 @@ export async function tRunAudit(g, args, ctx) {
         `Internal audit of ${audit.repo} (${audit.scanned.files} files, ${audit.scanned.symbols} symbols, ${audit.scanned.externalImports} external imports; malware scan: ${audit.scanned.malwareScanMode}).`,
         `Severity: critical ${sev.critical}, high ${sev.high}, medium ${sev.medium}, low ${sev.low}, info ${sev.info}. Categories: unused ${bycat.unused}, structure ${bycat.structure}, vulnerability ${bycat.vulnerability}, malware ${bycat.malware}.`,
         `Structure: ${audit.structureReport?.runtimeCycles ?? audit.structureReport?.cycles ?? 0} runtime cycle(s), ${audit.structureReport?.compileTimeCouplings ?? audit.structureReport?.typeCouplings ?? 0} compile-time coupling group(s), ${audit.structureReport?.orphans ?? 0} orphan(s); import edges: ${audit.structureReport?.runtimeImportEdges ?? audit.structureReport?.importEdges ?? 0} runtime + ${audit.structureReport?.typeOnlyImportEdges ?? 0} type-only + ${audit.structureReport?.compileOnlyImportEdges ?? 0} compile-only. Dead: ${audit.deadReport.deadFiles} file(s), ${audit.deadReport.unusedExports} unused export(s).`,
-        `Dependency manifests: ${deps.status || 'UNKNOWN'} — checked ${deps.declared ?? audit.scanned.manifestDeps ?? 0} declared package(s) against ${deps.importRecords ?? audit.scanned.externalImports ?? 0} external import record(s); unused ${deps.unused ?? 'unknown'}, missing ${deps.missing ?? 'unknown'}, duplicate declarations ${deps.duplicateDeclarations ?? 'unknown'}.`,
+        `Dependency manifests: ${deps.status || 'UNKNOWN'} — checked ${deps.declared ?? audit.scanned.manifestDeps ?? 0} declared package(s) against ${deps.importRecords ?? audit.scanned.externalImports ?? 0} external import record(s); unused ${deps.unused ?? 'unknown'}, missing ${deps.missing ?? 'unknown'}, duplicate declarations ${deps.duplicateDeclarations ?? 'unknown'}. npm per-finding manifest/source/config verification: ${deps.perFindingVerification ? 'AVAILABLE' : 'UNAVAILABLE'}.`,
         ...auditConventionLines(audit),
         `Checks: ${check('OSV', audit.checks?.osv)}; ${check('malware', audit.checks?.malware)}. A NOT_CHECKED/PARTIAL/ERROR check is incomplete or unknown, never a clean zero.`,
         ``,
@@ -540,6 +526,7 @@ export function tHotPathReview(g, args, ctx) {
     const text = [
         `Local hot-path review: ${review.candidateSymbols} candidate(s) from ${review.analyzedSymbols} analyzed symbol(s); showing ${review.hotspots.length}.`,
         `Thresholds: time rank >=${review.thresholds.timeRank}, cyclomatic >=${review.thresholds.cyclomatic}, calls >=${review.thresholds.calls}, loop depth >=${review.thresholds.loopDepth}, score >=${review.thresholds.minScore}.`,
+        `Selection: ${review.selectionPolicy.mode}${review.selectionPolicy.strongLocalFallback ? '; strong local sort/recursion/deep-loop evidence can pass below the blended score gate' : '; strict explicit score gate'}.`,
         coverageLine,
         'Local syntax cost and graph coupling are separate. Scores are review priority, not measured runtime.',
         '',
@@ -557,7 +544,7 @@ export function tHotPathReview(g, args, ctx) {
                 `       ${item.reasons.slice(0, 5).join('; ')}${evidence}`,
             ]
         }) : ['  (none at the selected thresholds)']),
-        review.bounds.truncated ? `... +${review.bounds.totalCandidates - review.bounds.returned} more (raise top_n, min_score, or narrow path).` : null,
+        review.bounds.truncated ? `... +${review.bounds.totalCandidates - review.bounds.returned} more (raise top_n to display more, raise min_score or narrow path to tighten; lower min_score to broaden).` : null,
         '',
         'Caveat: no interprocedural Big-O, recursion-bound, CFG, dead-store or taint-flow claim is made.',
     ].filter((line) => line != null).join('\n')

package/src/mcp/tools-impact-change.mjs

@@ -244,6 +244,7 @@ export function tChangeImpactV2(g, args = {}, ctx = {}) {
         },
         testEvidence: {
             actualCoverage: hasCoverage ? 'AVAILABLE' : 'NOT_AVAILABLE',
+            changedFiles: changed.slice(0, 500).map((file) => ({file, ...testEvidenceFor(file)})),
             staticTestReachability: {
                 kind: staticTests.kind,
                 testFiles: staticTests.testFiles,

package/src/mcp/tools-source.mjs

@@ -1,4 +1,5 @@
 import {readFileSync, statSync} from 'node:fs'
+import {boundedInteger} from '../bounds.js'
 import {resolveRepoPath} from '../repo-path.js'
 import {isStructuralRelation} from '../graph/relations.js'
 import {querySymbolPrecision} from '../precision/symbol-query.js'
@@ -9,11 +10,6 @@ const MAX_EXCERPT_CHARS = 4_000
 const MAX_LOCATION_SAMPLES = 5
 const MAX_GRAPH_OCCURRENCES = 100
 
-const boundedInteger = (value, fallback, minimum, maximum) => {
-    const number = Number(value)
-    return Math.max(minimum, Math.min(maximum, Number.isFinite(number) ? Math.floor(number) : fallback))
-}
-
 const sourceLine = (node) => {
     const match = /L(\d+)/.exec(String(node?.source_location || ''))
     return match ? Number(match[1]) : 1
@@ -25,7 +21,10 @@ function candidateNodes(g, query, limit = 20) {
     const exact = g.byLabel.get(text)
     const nodes = exact?.length ? exact : g.nodes.filter((node) =>
         String(node.id).toLowerCase().includes(text) || String(node.label || '').toLowerCase().includes(text))
-    return nodes.slice(0, limit).map((node) => ({id: String(node.id), label: String(node.label || node.id), file: node.source_file || null}))
+    return nodes.slice(0, limit).map((node) => ({
+        id: String(node.id), label: String(node.label || node.id), file: node.source_file || null,
+        ...(node.symbol_space ? {space: node.symbol_space} : {}),
+    }))
 }
 
 function excerpt(repoRoot, file, focusLine, contextLines) {
@@ -192,6 +191,8 @@ export async function tInspectSymbol(g, args = {}, ctx = {}) {
         id: targetId,
         label: String(node.label || targetId),
         kind: String(node.symbol_kind || 'symbol'),
+        space: String(node.symbol_space || 'value'),
+        exported: node.exported === true,
         file: String(node.source_file || targetId.split('#')[0]),
         line: sourceLine(node),
         ...(node.source_range ? {range: node.source_range} : {}),