weavatrix 0.2.7 → 0.2.8

package/README.md

@@ -216,6 +216,25 @@ disclosed instead of silently guessed; and the server **hot-reloads its watched
 modules and catalog** when those files change — other MCP helpers and analysis engines require a
 reconnect.
 
+### 0.2.8 trust and precision patch
+
+- Dead-code review no longer labels a declaration `test-only` when it has a same-file production
+  use. Revision-bound positive evidence from an exact `inspect_symbol` point query also removes that
+  declaration from later dead-code candidates instead of remaining isolated in its cache.
+- Python dependency checks discover nested `requirements*.txt`, `requirements/*.txt`,
+  `pyproject.toml`, and `Pipfile` manifests and assign imports to their nearest manifest scope.
+  A root `test.py` is classified consistently as test code.
+- Endpoint extraction masks commented-out routes without shifting source offsets and rejects
+  primitive path-to-name maps such as `{'/.codex': 'claude'}` while retaining real route tables.
+- Rust symbols now expose concrete kinds, owner types, visibility/export state, selection ranges and
+  structural owner/member edges. This is parser evidence; Rust semantic/LSP precision remains
+  explicitly unavailable.
+- Natural-language retrieval honors explicit Rust, Python, TypeScript, JavaScript, Go, Java, and C#
+  intent in mixed repositories. Compact `verified_change` text now includes decisive exact reference
+  counts and bounded inbound caller names for every selected edit symbol.
+
+Full patch notes: [docs/releases/v0.2.8.md](docs/releases/v0.2.8.md).
+
 ### 0.2.7 verified-change workflow
 
 - New `verified_change` composes task retrieval, exact symbol context, change impact, immutable Git

package/docs/releases/v0.2.8.md

@@ -0,0 +1,82 @@
+# Weavatrix 0.2.8
+
+## Trust before surface area
+
+0.2.8 is a correctness release. It does not add another MCP tool. It fixes false positives and
+evidence hand-off failures found while running 0.2.7 against current JavaScript, TypeScript, Python,
+and Rust repositories.
+
+## Dead-code liveness
+
+- A production declaration is no longer classified as `test-only` merely because the same identifier
+  appears in tests. Same-file occurrences beyond the indexed declaration count as conservative
+  production-use evidence.
+- Exact positive point-query results are now revision/config fingerprint checked and consumed by
+  `find_dead_code`. If `inspect_symbol` found a reference, the symbol cannot remain in the dead queue.
+- Complete exact zero-reference point results can still raise internal candidates to strong static
+  evidence. Partial, stale, malformed, or configuration-drifted cache entries fail closed.
+
+These remain review candidates. Static absence never authorizes automatic deletion.
+
+## Python manifest ownership
+
+Python dependency collection now discovers nested `requirements*.txt`, `requirements/*.txt`,
+`pyproject.toml`, and `Pipfile` manifests. Each import is judged against its nearest ancestor Python
+manifest. A nested service therefore sees its own declared dependencies, while unrelated sibling code
+cannot inherit them accidentally.
+
+The conventional root filename `test.py` is now classified as test code by both path classification
+and dependency severity logic.
+
+## Endpoint false-positive guards
+
+Endpoint extraction masks line and block comments while preserving source offsets. Commented-out
+Express/Hono/Go/Rust/Java-style routes no longer enter the inventory.
+
+Direct object routes also require an executable handler value. Primitive path maps such as
+`{'/.codex': 'claude'}` are configuration data, not `ANY /.codex` endpoints.
+
+## Rust graph metadata
+
+Rust functions, methods, structs, enums, traits, types, modules, constants, statics, macros, and unions
+now carry concrete `symbol_kind` values. Impl/trait functions retain `member_of`, visibility, selection
+ranges and structural owner/member edges; public module declarations retain exported state.
+
+This improves graph navigation and dead-code classification but remains tree-sitter parser evidence.
+0.2.8 does not bundle rust-analyzer and does not claim exact Rust references.
+
+## Mixed-language retrieval and compact proof
+
+`query_graph` and workflows that reuse its seed ranking constrain explicit Rust, Python, TypeScript,
+JavaScript, Go, Java, or C# questions to matching source extensions. Multiple explicitly named
+languages form a union; exact `seed_files` continue to be the strongest pinning mechanism.
+
+Compact `verified_change` output now lists each selected symbol's exact/bounded reference occurrence
+count, referenced-file count, inbound-container count, and up to three inbound names. The short form
+therefore cannot hide that a supposedly unused symbol has a known caller.
+
+## Scope and remaining competitor gaps
+
+The local engine still has no vector embedding search, runtime trace ingestion, clone-to-ADR layer,
+Python/Rust/Java LSP integration, whole-program CFG, value propagation, or taint engine. Those are
+separate precision projects, not claims attached to this patch release. Independent end-to-end
+competitor scores also remain missing until collected under the blind benchmark protocol.
+
+## Verification
+
+- Full Node test suite: 487 tests, 484 passed, 3 platform skips, 0 failed.
+- Deterministic language/cross-repository/lifecycle benchmark: `PASS`.
+- Real pinned corpus: 6 of 6 repositories `PASS` across TypeScript, JavaScript, Python, Go, Java,
+  and Rust.
+- Agent routing microbenchmark: 3 of 3 expected symbols, 0 false positives. Independent competitor
+  comparison remains `INCOMPLETE` because no blind same-task result was supplied.
+- npm package dry-run succeeds for `weavatrix@0.2.8`; the portable MCPB validates, initializes its
+  staged TypeScript precision provider, passes the repository-plugin execution guard, and packs.
+- Direct dogfood checks confirm the original regressions: local `USER_HEADER` is not dead/test-only;
+  nested `autobot/requirements.txt` covers `slack_bolt`; commented `DELETE /:id` and primitive
+  `ANY /.codex` are absent; explicit Rust retrieval returns only `.rs` seeds.
+
+## Tool catalog
+
+0.2.8 exposes the same 36 MCP tools as 0.2.7. The default offline profile exposes 33; pinned exposes
+30. Network tools remain absent from offline and pinned profiles.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weavatrix",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "type": "module",
   "description": "Weavatrix — code graph & blast-radius MCP server for AI coding agents: change impact, transitive dependents, health audit, duplicate detection, and coverage mapping over any local repository.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
@@ -26,7 +26,7 @@
     "skill",
     "scripts/run-agent-task-benchmark.mjs",
     "docs/agent-task-benchmark.md",
-    "docs/releases/v0.2.7.md",
+    "docs/releases/v0.2.8.md",
     "README.md",
     "SECURITY.md",
     "LICENSE"

package/src/analysis/dead-check.js

@@ -126,14 +126,29 @@ export function computeDead(graph, sources, { entrySet = new Set() } = {}) {
 
   const symbolNames = new Set([...symById.values()].map((node) => bareName(node.label)).filter(Boolean));
   const occurrenceFiles = new Map();
+  const occurrenceCounts = new Map();
   for (const [file, text] of sources) for (const match of String(text || "").matchAll(IDENT_RE)) {
     const name = match[0];
     if (!symbolNames.has(name)) continue;
     const files = occurrenceFiles.get(name) || new Set();
     files.add(file);
     occurrenceFiles.set(name, files);
+    const counts = occurrenceCounts.get(name) || new Map();
+    counts.set(file, (counts.get(file) || 0) + 1);
+    occurrenceCounts.set(name, counts);
   }
 
+  const declarationCounts = new Map();
+  for (const node of symById.values()) {
+    const name = bareName(node.label);
+    if (!name) continue;
+    const key = `${node.source_file}\0${name}`;
+    declarationCounts.set(key, (declarationCounts.get(key) || 0) + 1);
+  }
+  const exactReferenceIds = new Set(graph.precisionReferenceSymbols || []);
+  const exactProductionReferenceIds = new Set(graph.precisionProductionReferenceSymbols || []);
+  const exactTestReferenceIds = new Set(graph.precisionTestReferenceSymbols || []);
+
   // decorated defs (@app.route/@app.event/@pytest.fixture…) are entered by the framework: trust the
   // builder's flag when present, else walk the source line(s) above the definition (graph-builder graphs).
   const lineCache = new Map();
@@ -155,6 +170,7 @@ export function computeDead(graph, sources, { entrySet = new Set() } = {}) {
 
   const isReferenced = (n) => {
     if (inbound.has(n.id)) return true;                          // a real graph edge targets it
+    if (exactReferenceIds.has(String(n.id))) return true;        // revision-bound point-query evidence found a caller
     const name = bareName(n.label);
     if (!name || !/^[A-Za-z_$]/.test(name)) return true;         // selectors/odd labels → don't flag
     if (/^__\w+__$/.test(name)) return true;                     // dunders are invoked implicitly (with/str/==/iter…), never spelled
@@ -182,8 +198,14 @@ export function computeDead(graph, sources, { entrySet = new Set() } = {}) {
     const name = bareName(n.label);
     const occurrenceSet = occurrenceFiles.get(name) || new Set();
     const externalOccurrences = [...occurrenceSet].filter((file) => file !== n.source_file);
+    const localOccurrences = occurrenceCounts.get(name)?.get(n.source_file) || 0;
+    const localDeclarations = declarationCounts.get(`${n.source_file}\0${name}`) || 0;
+    const hasLocalProductionUse = localOccurrences > localDeclarations;
     const lexicalTestOnly = externalOccurrences.length > 0 && externalOccurrences.every((file) => isTestFile(file));
-    if (hasProductionInbound || (!hasTestInbound && !lexicalTestOnly)) continue;
+    const hasExactProductionInbound = exactProductionReferenceIds.has(String(n.id));
+    const hasExactTestInbound = exactTestReferenceIds.has(String(n.id));
+    if (hasProductionInbound || hasExactProductionInbound || hasLocalProductionUse
+      || (!hasTestInbound && !hasExactTestInbound && !lexicalTestOnly)) continue;
     testOnlySymbols.push({
       id: n.id,
       file: n.source_file,
@@ -191,7 +213,7 @@ export function computeDead(graph, sources, { entrySet = new Set() } = {}) {
       test: false,
       reason: "referenced only from test/e2e code; no production consumer was found",
       testConsumerFiles: [...new Set(sourceFiles.filter((file) => file && isTestFile(file)))].sort(),
-      evidence: hasTestInbound ? "graph" : "lexical",
+      evidence: hasTestInbound ? "graph" : hasExactTestInbound ? "exact-semantic" : "lexical",
       publicApi: n.exported === true || ["public", "protected"].includes(String(n.visibility || "").toLowerCase()),
     });
   }

package/src/analysis/dep-check-ecosystems.js

@@ -1,6 +1,6 @@
 import { makeFinding } from "./findings.js";
 
-const TEST_PATH_RE = /(^|[/\\])(test|tests|__tests__|spec|e2e|__mocks__)([/\\]|$)|[._-](test|spec)\.[a-z0-9]+$|_test\.go$/i;
+const TEST_PATH_RE = /(^|[/\\])(test|tests|__tests__|spec|e2e|__mocks__)([/\\]|$)|[._-](test|spec)\.[a-z0-9]+$|_test\.go$|(^|[/\\])test(?:_[^/\\]*)?\.py$/i;
 const escRe = (s) => String(s).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 const mentioned = (blob, name) => new RegExp(`(^|[^\\w@.-])${escRe(name)}($|[^\\w.-])`).test(blob);
 
@@ -79,7 +79,7 @@ const PY_TOOL_DISTS = new Set(("pytest tox nox black ruff flake8 pylint mypy pyr
   "pip-tools uv virtualenv pipenv gunicorn uwsgi supervisor ipython jupyter jupyterlab notebook ipykernel codecov autopep8 yapf commitizen detect-secrets safety pip-audit hatchling flit flit-core pdm").split(" "));
 const pyNorm = (n) => String(n || "").toLowerCase().replace(/[-_.]+/g, "-");
 
-export function computePyDepFindings({
+function computePyDepFindingsFlat({
   externalImports = [], pyManifest = null, configTexts = new Map(),
   managedDependencies = [], ignoredDependencies = [], nonRuntimeRoots = [],
 } = {}) {
@@ -161,3 +161,42 @@ export function computePyDepFindings({
   }
   return { findings, declared, managed };
 }
+
+const normPyScope = (root) => String(root || "").replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+|\/+$/g, "");
+const pyScopeOwns = (root, file) => !root || file === root || String(file || "").replace(/\\/g, "/").startsWith(`${root}/`);
+
+export function computePyDepFindings(options = {}) {
+  const scopes = Array.isArray(options.pyManifest?.scopes) ? options.pyManifest.scopes : [];
+  if (!scopes.length) return computePyDepFindingsFlat(options);
+  const normalized = scopes.map((scope) => ({ ...scope, root: normPyScope(scope.root) }))
+    .sort((left, right) => right.root.length - left.root.length);
+  if (!normalized.some((scope) => !scope.root)) normalized.push({ root: "", present: false, deps: [], manifests: [] });
+  const importsByScope = new Map(normalized.map((scope) => [scope, []]));
+  const configByScope = new Map(normalized.map((scope) => [scope, new Map()]));
+  for (const entry of options.externalImports || []) {
+    const owner = normalized.find((scope) => pyScopeOwns(scope.root, entry.file)) || normalized.at(-1);
+    importsByScope.get(owner).push(entry);
+  }
+  for (const [file, text] of options.configTexts || new Map()) {
+    const owner = normalized.find((scope) => pyScopeOwns(scope.root, file)) || normalized.at(-1);
+    configByScope.get(owner).set(file, text);
+  }
+  const findings = [];
+  const declared = new Set();
+  const managed = new Set();
+  for (const scope of normalized) {
+    const result = computePyDepFindingsFlat({
+      ...options,
+      externalImports: importsByScope.get(scope),
+      configTexts: configByScope.get(scope),
+      pyManifest: {present: scope.present, deps: scope.deps || []},
+    });
+    findings.push(...result.findings.map((finding) => ({
+      ...finding,
+      ...(scope.manifests?.length ? {manifest: scope.manifests[0]} : {}),
+    })));
+    for (const name of result.declared) declared.add(`${scope.root || "."}:${name}`);
+    for (const name of result.managed) managed.add(name);
+  }
+  return { findings, declared, managed };
+}

package/src/analysis/endpoints.js

@@ -27,6 +27,38 @@ function lineAt(text, index) {
   return line;
 }
 
+// Regex extractors must never see commented-out routes. Preserve string literals and every source
+// offset, but replace comment bodies with spaces so endpoint line numbers still refer to the original
+// file. Python `#` comments are enabled only for .py files; Rust attributes such as #[get] stay intact.
+function maskComments(text, { hashComments = false } = {}) {
+  const chars = String(text || "").split("");
+  let quote = "", escaped = false, lineComment = false, blockComment = false;
+  for (let i = 0; i < chars.length; i++) {
+    const ch = chars[i], next = chars[i + 1];
+    if (lineComment) {
+      if (ch === "\n" || ch === "\r") lineComment = false;
+      else chars[i] = " ";
+      continue;
+    }
+    if (blockComment) {
+      if (ch === "*" && next === "/") { chars[i] = chars[i + 1] = " "; i++; blockComment = false; }
+      else if (ch !== "\n" && ch !== "\r") chars[i] = " ";
+      continue;
+    }
+    if (quote) {
+      if (escaped) escaped = false;
+      else if (ch === "\\") escaped = true;
+      else if (ch === quote) quote = "";
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") { quote = ch; continue; }
+    if (ch === "/" && next === "/") { chars[i] = chars[i + 1] = " "; i++; lineComment = true; continue; }
+    if (ch === "/" && next === "*") { chars[i] = chars[i + 1] = " "; i++; blockComment = true; continue; }
+    if (hashComments && ch === "#") { chars[i] = " "; lineComment = true; }
+  }
+  return chars.join("");
+}
+
 // best-effort bare handler name from a value expression: the LAST identifier, unwrapping wrappers like
 // executionRoute(queryHandlers.executeQuery) → executeQuery, asyncHandler(fn) → fn, a.b.c → c.
 // An INLINE handler (arrow / function literal) has no named method to join to, so it returns "" (the
@@ -75,6 +107,7 @@ export function extractEndpointsFromText(text, file) {
   const py = /\.py$/i.test(file);
   const rust = /\.rs$/i.test(file);
   const java = /\.java$/i.test(file);
+  const scanText = maskComments(text, { hashComments: py });
   const add = (method, path, expr, idx) => {
     const p = cleanPath(path);
     if (!looksLikePath(p)) return;
@@ -90,13 +123,13 @@ export function extractEndpointsFromText(text, file) {
     const seen = new Set();
     const direct = /\bexport\s+(?:(?:async|declare)\s+)*(?:function\s+|(?:const|let|var)\s+)(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\b/g;
     let nm;
-    while ((nm = direct.exec(text))) {
+    while ((nm = direct.exec(scanText))) {
       const method = nm[1].toUpperCase();
       if (!seen.has(method)) { seen.add(method); add(method, nextPath, method, nm.index); }
     }
     const lists = /\bexport\s*\{([^}]+)\}/g;
     let lm;
-    while ((lm = lists.exec(text))) {
+    while ((lm = lists.exec(scanText))) {
       for (const item of lm[1].split(",")) {
         const mm = /^\s*([A-Za-z_$][\w$]*)(?:\s+as\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS))?\s*$/.exec(item);
         if (!mm) continue;
@@ -108,9 +141,9 @@ export function extractEndpointsFromText(text, file) {
     }
   }
 
-  if (rust) extractRustEndpoints(text, add);
+  if (rust) extractRustEndpoints(scanText, add);
   if (java) {
-    out.push(...extractSpringEndpoints(text, file));
+    out.push(...extractSpringEndpoints(scanText, file));
     return out; // generic JS-style method calls would turn Java HTTP clients into fake server routes
   }
 
@@ -118,14 +151,14 @@ export function extractEndpointsFromText(text, file) {
   // find each  "…": {  or  "…": expr,  where the key looks like a path
   const objKeyRe = /(["'`])(\/[^"'`]*)\1\s*:\s*(\{)?/g;
   let m;
-  while ((m = objKeyRe.exec(text))) {
+  while ((m = objKeyRe.exec(scanText))) {
     const path = m[2], keyIdx = m.index;
     if (m[3]) {
       // object of METHOD: handler — scan to the matching close brace (routes objects are shallow)
       let i = objKeyRe.lastIndex, depth = 1;
       const start = i;
-      while (i < text.length && depth > 0) { const c = text[i]; if (c === "{") depth++; else if (c === "}") depth--; i++; }
-      const body = text.slice(start, i - 1);
+      while (i < scanText.length && depth > 0) { const c = scanText[i]; if (c === "{") depth++; else if (c === "}") depth--; i++; }
+      const body = scanText.slice(start, i - 1);
       objKeyRe.lastIndex = i;
       if (OPENAPI_BLOCK.test(body)) continue; // documentation, not a route table
       const methodRe = /\b(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\b\s*:\s*([^,\n}]+)/gi;
@@ -133,9 +166,10 @@ export function extractEndpointsFromText(text, file) {
       while ((mm = methodRe.exec(body))) add(mm[1], path, mm[2], keyIdx);
     } else {
       // "/path": handlerExpr — a direct handler (any method); grab up to the next , or }
-      const tail = text.slice(objKeyRe.lastIndex, objKeyRe.lastIndex + 200);
+      const tail = scanText.slice(objKeyRe.lastIndex, objKeyRe.lastIndex + 200);
       const em = /^([^,\n}]+)/.exec(tail);
-      if (em && !/^\s*\{/.test(em[1])) add("ANY", path, em[1], keyIdx);
+      // A string/number/array value is an ordinary path/name lookup, not an executable handler.
+      if (em && !/^\s*(?:\{|["'`\[]|[-+]?\d|true\b|false\b|null\b|undefined\b)/i.test(em[1])) add("ANY", path, em[1], keyIdx);
     }
   }
 
@@ -146,7 +180,7 @@ export function extractEndpointsFromText(text, file) {
   // FRONTEND code, not server routes. A server route also REQUIRES a handler arg (an identifier/function),
   // so a bare `client.get("/x")` or one whose 2nd arg is a config object literal `{…}` is skipped.
   const callRe = /(?<!@)\b([\w$]+)\s*\.\s*(get|post|put|patch|delete|head|options|all)\s*\(\s*(["'`])(\/[^"'`]*)\3\s*(?:,\s*([\s\S]{0,160}?))?\)/gi;
-  while ((m = callRe.exec(text))) {
+  while ((m = callRe.exec(scanText))) {
     const caller = m[1], arg2 = String(m[5] || "").trim();
     if (HTTP_CLIENT_CALLER.test(caller)) continue;          // axios/http/fetch/apiClient… → a client request
     if (!arg2 || arg2[0] === "{") continue;                 // no handler, or a config object → not a route def
@@ -155,14 +189,14 @@ export function extractEndpointsFromText(text, file) {
 
   // ---- Go net/http: mux.HandleFunc("/path", handler) / http.Handle("/path", h) ------------------
   const goRe = /\.\s*(?:HandleFunc|Handle)\s*\(\s*(["'`])(\/[^"'`]*)\1\s*,\s*([\s\S]{0,120}?)\)/g;
-  while ((m = goRe.exec(text))) add("ANY", m[2], m[3], m.index);
+  while ((m = goRe.exec(scanText))) add("ANY", m[2], m[3], m.index);
 
   // ---- decorators: @app.get("/path") / @router.post("/path") / @Get("/path") -------------------
   if (py || /\.(ts|js|tsx|jsx|cjs|mjs)$/i.test(file)) {
     const decoRe = /@[\w$]*\.?\s*(get|post|put|patch|delete|head|options)\s*\(\s*(["'`])(\/[^"'`]*)\2/gi;
-    while ((m = decoRe.exec(text))) {
+    while ((m = decoRe.exec(scanText))) {
       // the handler is the def/function on a following line — best-effort: next def name
-      const after = text.slice(decoRe.lastIndex, decoRe.lastIndex + 200);
+      const after = scanText.slice(decoRe.lastIndex, decoRe.lastIndex + 200);
       const fn = /\b(?:def|async\s+def|function|const|export\s+function)\s+([A-Za-z_$][\w$]*)/.exec(after);
       add(m[1], m[3], fn ? fn[1] : "", m.index);
     }

package/src/analysis/internal-audit.collect.js

@@ -3,7 +3,7 @@
 import { readFileSync, readdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { spawnSync } from "node:child_process";
-import { parseRequirementsNames, parsePyprojectDeps, parsePipfileDeps } from "./manifests.js";
+import { parseRequirementsNames, parsePyprojectDeps, parsePipfileDeps, pep503 } from "./manifests.js";
 import { createRepoBoundary } from "../repo-path.js";
 import { childProcessEnv } from "../child-env.js";
 import { filterWeavatrixIgnored } from "../path-ignore.js";
@@ -254,28 +254,61 @@ export function workspacePkgNames(repoRoot, pkg) {
 
 export const TEST_FILE_RE = /(^|[/])(test|tests|__tests__|spec|e2e|__mocks__)([/]|$)|[._-](test|spec)\.[a-z0-9]+$/i;
 
-// Python declared deps: root requirements*.txt/.in + requirements/ dir + pyproject.toml + Pipfile.
+// Python declared deps are owned by the nearest manifest root, matching nested service/monorepo
+// layouts. `requirements/*.txt` belongs to the directory above `requirements`; a colocated
+// requirements.txt, pyproject.toml or Pipfile owns its own directory.
 // present=false (no manifest at all) softens missing-dep findings instead of suppressing them.
 export function collectPyManifest(repoRoot) {
-  const deps = [];
-  let present = false;
-  let names = [];
   const boundary = createRepoBoundary(repoRoot);
-  try { names = readdirSync(boundary.root).filter((n) => /^requirements[\w.-]*\.(txt|in)$/i.test(n)); } catch { /* unreadable root */ }
-  try {
-    const requirements = boundary.resolve("requirements");
-    if (requirements.ok) names.push(...readdirSync(requirements.path).filter((n) => /\.(txt|in)$/i.test(n)).map((n) => `requirements/${n}`));
-  } catch { /* no requirements dir */ }
-  for (const n of names) {
-    const t = readRepoText(boundary, n);
+  const scopes = new Map();
+  const scopeFor = (root) => {
+    const normalized = normRoot(root);
+    if (!scopes.has(normalized)) scopes.set(normalized, { root: normalized, present: false, deps: [], manifests: [] });
+    return scopes.get(normalized);
+  };
+  const addManifest = (root, manifest, parsedDeps, present = true) => {
+    if (!present) return;
+    const scope = scopeFor(root);
+    scope.present = true;
+    scope.manifests.push(manifest);
+    scope.deps.push(...parsedDeps.map((dep) => ({ ...dep, manifest })));
+  };
+  const files = listRepoFiles(repoRoot);
+  for (const file of files.filter((name) => /(^|\/)requirements[\w.-]*\.(?:txt|in)$/i.test(name)
+    || /(^|\/)requirements\/[^/]+\.(?:txt|in)$/i.test(name))) {
+    const t = readRepoText(boundary, file);
     if (t == null) continue;
-    present = true;
-    const dev = /dev|test|lint|doc|ci/i.test(n.replace(/^requirements[/\\]?/i, ""));
-    for (const d of parseRequirementsNames(t)) deps.push({ ...d, dev });
+    const parent = normRoot(dirname(file));
+    const root = /(^|\/)requirements$/i.test(parent) ? normRoot(dirname(parent)) : parent;
+    const dev = /dev|test|lint|doc|ci/i.test(file.slice(file.lastIndexOf("/") + 1));
+    addManifest(root, file, parseRequirementsNames(t).map((dep) => ({ ...dep, dev })));
   }
-  const pp = readRepoText(boundary, "pyproject.toml");
-  if (pp != null) { const r = parsePyprojectDeps(pp); if (r.present) { present = true; deps.push(...r.deps); } }
-  const pf = readRepoText(boundary, "Pipfile");
-  if (pf != null) { const r = parsePipfileDeps(pf); if (r.present) { present = true; deps.push(...r.deps); } }
-  return { present, deps };
+  for (const file of files.filter((name) => /(^|\/)pyproject\.toml$/i.test(name))) {
+    const parsed = parsePyprojectDeps(readRepoText(boundary, file));
+    addManifest(dirname(file), file, parsed.deps, parsed.present);
+  }
+  for (const file of files.filter((name) => /(^|\/)Pipfile$/i.test(name))) {
+    const parsed = parsePipfileDeps(readRepoText(boundary, file));
+    addManifest(dirname(file), file, parsed.deps, parsed.present);
+  }
+  const normalizedScopes = [...scopes.values()]
+    .map((scope) => {
+      const seen = new Set();
+      return {
+        ...scope,
+        manifests: [...new Set(scope.manifests)].sort(),
+        deps: scope.deps.filter((dep) => {
+          const key = pep503(dep.name);
+          if (!key || seen.has(key)) return false;
+          seen.add(key);
+          return true;
+        }),
+      };
+    })
+    .sort((left, right) => right.root.length - left.root.length || left.root.localeCompare(right.root));
+  return {
+    present: normalizedScopes.some((scope) => scope.present),
+    deps: normalizedScopes.flatMap((scope) => scope.deps),
+    scopes: normalizedScopes,
+  };
 }

package/src/graph/builder/lang-rust.js

@@ -4,23 +4,43 @@
 // `crate/self/super` paths resolve to repo-local .rs or */mod.rs files. External crates deliberately stay out
 // of this adapter; Cargo dependency analysis owns them.
 const SYMS_CORE = `
-  (function_item name: (identifier) @method)
-  (struct_item name: (type_identifier) @class)
-  (enum_item name: (type_identifier) @class)
-  (trait_item name: (type_identifier) @class)
-  (type_item name: (type_identifier) @class)
-  (mod_item name: (identifier) @class)
-  (const_item name: (identifier) @field)
-  (static_item name: (identifier) @field)`;
+  (function_item name: (identifier) @function)
+  (struct_item name: (type_identifier) @struct)
+  (enum_item name: (type_identifier) @enum)
+  (trait_item name: (type_identifier) @trait)
+  (type_item name: (type_identifier) @type)
+  (mod_item name: (identifier) @module)
+  (const_item name: (identifier) @constant)
+  (static_item name: (identifier) @static)`;
 // Grammar-version-dependent node types, compiled SEPARATELY (one unknown type voids its whole query).
 const SYMS_OPTIONAL = [
-  `(macro_definition name: (identifier) @method)`,
-  `(union_item name: (type_identifier) @class)`,
+  `(function_signature_item name: (identifier) @function)`,
+  `(macro_definition name: (identifier) @macro)`,
+  `(union_item name: (type_identifier) @union)`,
 ];
 
 const cleanSegment = (part) => String(part || "").trim().replace(/^r#/, "");
 const pathParts = (node) => String(node?.text || "").split("::").map(cleanSegment).filter(Boolean);
 const under = (node, type) => { for (let p = node?.parent; p; p = p.parent) if (p.type === type) return true; return false; };
+const ancestor = (node, types) => {
+  for (let parent = node?.parent; parent; parent = parent.parent) if (types.has(parent.type)) return parent;
+  return null;
+};
+const memberOwners = new Set(["impl_item", "trait_item"]);
+const publicVisibility = (declaration, owner) => {
+  if (owner?.type === "trait_item") return "public";
+  const source = String(declaration?.text || "").trimStart();
+  if (/^pub\s/.test(source)) return "public";
+  if (/^pub\s*\(/.test(source)) return "protected";
+  return "private";
+};
+const ownerName = (owner, field) => {
+  if (!owner) return "";
+  if (owner.type === "trait_item") return field(owner, "name")?.text || "";
+  const type = field(owner, "type")?.text || "";
+  const withoutGenerics = type.replace(/<[^<>]*>/g, "");
+  return (withoutGenerics.match(/[A-Za-z_]\w*/g) || []).at(-1) || "";
+};
 
 function pathAttribute(modNode) {
   for (let prev = modNode?.previousNamedSibling; prev?.type === "attribute_item"; prev = prev.previousNamedSibling) {
@@ -93,12 +113,29 @@ export default {
   ],
 
   pass1(ctx) {
-    const { grammar, tree, fileRel, caps, addSym, addImportEdge, imports, resolveRustMod, resolveRustPath } = ctx;
+    const { grammar, tree, fileRel, caps, field, addSym, addImportEdge, imports, resolveRustMod, resolveRustPath, links, nameToId } = ctx;
+    const owned = [];
     for (const src of [SYMS_CORE, ...SYMS_OPTIONAL]) {
       for (const cap of caps(grammar, src, tree.rootNode)) {
-        addSym(cap.node.text, cap.node.startPosition.row + 1, cap.name === "method", { sourceNode: cap.node.parent });
+        const declaration = cap.node.parent;
+        const owner = cap.name === "function" ? ancestor(cap.node, memberOwners) : null;
+        const memberOf = ownerName(owner, field);
+        const symbolKind = cap.name === "function" ? (memberOf ? "method" : "function") : cap.name;
+        const visibility = publicVisibility(declaration, owner);
+        const id = addSym(cap.node.text, cap.node.startPosition.row + 1, cap.name === "function", {
+          sourceNode: declaration,
+          selectionNode: cap.node,
+          symbolKind,
+          ...(memberOf ? { memberOf, visibility } : { moduleDeclaration: true }),
+          ...(!memberOf && visibility === "public" ? { exported: true } : {}),
+        });
+        if (id && memberOf) owned.push({owner: memberOf, id});
       }
     }
+    for (const member of owned) {
+      const ownerId = nameToId.get(member.owner);
+      if (ownerId && ownerId !== member.id) links.push({source: ownerId, target: member.id, relation: "method", confidence: "EXTRACTED"});
+    }
 
     // File dependency edges are intentionally unique per source/target/relation. A qualified path can be
     // nested in another qualified path and often repeats an existing `mod`/`use`; counting occurrences would

package/src/mcp/graph-context.mjs

@@ -163,6 +163,30 @@ const CLASS_QUERY_TERMS = Object.freeze({
 })
 const CODE_FILE_RE = /\.(?:[cm]?[jt]sx?|py|go|java|rs|kt|kts|cs|rb|php)$/i
 const DATA_OR_PROSE_RE = /\.(?:json|ya?ml|toml|ini|md|mdx|rst|adoc|html?|css|scss|less|svg)$/i
+const LANGUAGE_EXTENSIONS = Object.freeze({
+    rust: ['rs'], python: ['py', 'pyi'], typescript: ['ts', 'tsx', 'mts', 'cts'],
+    javascript: ['js', 'jsx', 'mjs', 'cjs'], go: ['go'], java: ['java'], csharp: ['cs'],
+})
+
+function requestedLanguages(query) {
+    const raw = String(query || '')
+    const words = new Set(wordsOf(query))
+    const requested = new Set()
+    if (words.has('rust')) requested.add('rust')
+    if (words.has('python') || words.has('py')) requested.add('python')
+    if (words.has('typescript') || words.has('ts') || /typescript/i.test(raw)) requested.add('typescript')
+    if (words.has('javascript') || words.has('js') || words.has('nodejs') || /javascript|node\.?js/i.test(raw)) requested.add('javascript')
+    if (words.has('golang') || /(?:^|[^A-Za-z])Go(?:[^A-Za-z]|$)/.test(raw)) requested.add('go')
+    if (words.has('java')) requested.add('java')
+    if (words.has('csharp') || words.has('dotnet') || /csharp|(?:^|[^A-Za-z])C#(?:[^A-Za-z]|$)/i.test(raw)) requested.add('csharp')
+    return new Set([...requested].flatMap((language) => LANGUAGE_EXTENSIONS[language]))
+}
+
+const matchesLanguage = (node, extensions) => {
+    if (!extensions.size) return true
+    const match = /\.([^.\/]+)$/.exec(sourceFileOf(node))
+    return !!match && extensions.has(match[1].toLowerCase())
+}
 
 const sourceFileOf = (node) => {
     const source = node?.source_file || String(node?.id ?? '').split('#', 1)[0]
@@ -266,6 +290,14 @@ function conceptScore(g, node, concept, queryContext) {
         else if (words.has(term)) match = Math.max(match, primary ? 36 : 25)
         else if (term.length >= 4 && term !== 'tool' && term !== 'tools' && (id.includes(term) || label.includes(term))) match = Math.max(match, primary ? 12 : 7)
     })
+    const extension = (/\.([^.\/]+)$/.exec(source) || [])[1] || ''
+    const languageConcept = {
+        rust: ['rs'], python: ['py', 'pyi'], py: ['py', 'pyi'],
+        typescript: ['ts', 'tsx', 'mts', 'cts'], ts: ['ts', 'tsx', 'mts', 'cts'],
+        javascript: ['js', 'jsx', 'mjs', 'cjs'], js: ['js', 'jsx', 'mjs', 'cjs'], nodejs: ['js', 'jsx', 'mjs', 'cjs'],
+        golang: ['go'], go: ['go'], java: ['java'], csharp: ['cs'], dotnet: ['cs'],
+    }[concept.raw]
+    if (languageConcept?.includes(extension) && queryContext.languageExtensions.has(extension)) match = Math.max(match, 58)
     const fileNode = !isSymbol(node.id)
     const depth = source ? source.split('/').length : 9
     if (concept.id === 'bootstrap') match = Math.max(match, entrypointSignal(g, node, source, stem))
@@ -288,13 +320,16 @@ export function findSeeds(g, query, limit = 8, {repoRoot = null} = {}) {
     const concepts = queryConcepts(query)
     if (!concepts.length || limit <= 0) return []
     const requestedClasses = requestedPathClasses(query)
+    const languageExtensions = requestedLanguages(query)
     const queryContext = {
         runtimeIntent: concepts.some((concept) => concept.id === 'bootstrap' || concept.id === 'tool-execution'),
         maintenanceIntent: wordsOf(query).some((word) => ['script', 'scripts', 'build', 'release', 'publish', 'packaging'].includes(word)),
+        languageExtensions,
     }
     const classifier = createPathClassifier(repoRoot)
     const classificationCache = new Map()
-    const rows = g.nodes.filter((node) => isQueryEligible(node, requestedClasses, classificationCache, classifier)).map((node) => {
+    const rows = g.nodes.filter((node) => matchesLanguage(node, languageExtensions)
+        && isQueryEligible(node, requestedClasses, classificationCache, classifier)).map((node) => {
         const scores = concepts.map((concept) => conceptScore(g, node, concept, queryContext))
         return {node, scores, total: Math.max(...scores) + scores.reduce((sum, score) => sum + score, 0) / 10}
     })

package/src/mcp/tools-health.mjs

@@ -22,6 +22,7 @@ import {toolResult} from './tool-result.mjs'
 import {createPathClassifier, hasPathClass} from '../path-classification.js'
 import {createRepoBoundary} from '../repo-path.js'
 import {filterGraphForMode} from '../graph/graph-filter.js'
+import {readCachedSymbolPrecisionEvidence} from '../precision/symbol-query.js'
 
 const NON_PRODUCT_DUPLICATE_CLASSES = new Set(['generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
 const fragmentEligible = (fragment, {tokMin, skipTests, includeClassified}) => {
@@ -101,7 +102,27 @@ export function tFindDuplicates(g, args, ctx) {
 // candidates. It never returns an automatic-delete verdict.
 export function tFindDeadCode(g, args, ctx) {
     if (!ctx.repoRoot) return 'Dead-code review needs the repo root (not provided to this server).'
-    const graph = effectiveRawGraph(ctx)
+    const effectiveGraph = effectiveRawGraph(ctx)
+    const pointEvidence = readCachedSymbolPrecisionEvidence({repoRoot: ctx.repoRoot, graphPath: ctx.graphPath, graph: effectiveGraph})
+    const graph = {
+        ...effectiveGraph,
+        precisionReferenceSymbols: [...new Set([
+            ...(effectiveGraph.precisionReferenceSymbols || []),
+            ...pointEvidence.referenceSymbols,
+        ])],
+        precisionProductionReferenceSymbols: [...new Set([
+            ...(effectiveGraph.precisionProductionReferenceSymbols || []),
+            ...pointEvidence.productionReferenceSymbols,
+        ])],
+        precisionTestReferenceSymbols: [...new Set([
+            ...(effectiveGraph.precisionTestReferenceSymbols || []),
+            ...pointEvidence.testReferenceSymbols,
+        ])],
+        precisionNoReferenceSymbols: [...new Set([
+            ...(effectiveGraph.precisionNoReferenceSymbols || []),
+            ...pointEvidence.noReferenceSymbols,
+        ])],
+    }
     const boundary = createRepoBoundary(ctx.repoRoot)
     const pkg = readRepoJson(boundary, 'package.json') || {}
     const rules = readRepoJson(boundary, '.weavatrix-deps.json') || {}

package/src/mcp/tools-verified-change.mjs

@@ -62,6 +62,21 @@ function architectureState(result) {
   return result.verification.new?.length || String(result.verification.status).toUpperCase() === 'FAIL' ? 'BLOCKED' : 'PASS'
 }
 
+function exactUsageLines(contexts, g) {
+  if (!contexts.length) return []
+  return contexts.map((context) => {
+    const node = g.byId.get(String(context.symbol || context.definition?.id || ''))
+    const label = String(context.definition?.label || node?.label || context.symbol || 'symbol')
+    if (context.status !== 'OK') return `Exact usage: ${label} — unavailable (${context.status || 'UNKNOWN'}).`
+    const exact = context.evidence?.state === 'EXACT'
+    const occurrences = Number(context.references?.occurrences) || 0
+    const files = Number(context.references?.files) || 0
+    const inbound = Array.isArray(context.inbound?.shown) ? context.inbound.shown.slice(0, 3) : []
+    const callers = inbound.map((item) => `${item.label || item.id}${item.file ? ` [${item.file}]` : ''}`).join(', ')
+    return `${exact ? 'Exact usage' : 'Bounded usage'}: ${label} — ${occurrences} reference occurrence(s)${files ? ` in ${files} file(s)` : ''}; ${Number(context.inbound?.total) || 0} inbound container(s)${callers ? `: ${callers}` : ''}.`
+  })
+}
+
 function decide({phase, impact, graph, architecture, duplicates, api, tests, suggestedTests, testCoverageState}) {
   if (phase === 'plan') return tests.state === 'BLOCKED'
     ? {verdict: 'BLOCKED', blockers: [`targeted test plan was rejected: ${tests.reason || 'invalid request'}`], unknowns: []}
@@ -162,6 +177,7 @@ export async function tVerifiedChange(g, args = {}, ctx = {}, tools = {}, permis
     `${decision.verdict} — verified_change ${phase}`, `Task: ${String(args.task).slice(0, 500)}`,
     `Change: ${changedFiles.length} file(s), ${impact.seeds?.ids?.length || 0} exact seed(s), blast radius ${impact.blastRadius?.impacted || 0}.`,
     `Edit context: ${retrieval.selected.length} symbol(s); ${contexts.length} exact bundle(s); data-flow ${dataFlow.status} (${dataFlow.edges.length} call edge(s)).`,
+    ...exactUsageLines(contexts, g),
     `Ratchets: graph ${graph.state}; architecture ${architecture.state}; duplicates ${duplicates.state}; API ${api.state}; tests ${testProof.state}.`,
     ...decision.blockers.map((item) => `BLOCKER: ${item}`), ...decision.unknowns.map((item) => `UNKNOWN: ${item}`),
   ].join('\n')

package/src/path-classification.js

@@ -46,7 +46,7 @@ const DEFAULT_RULES = [
   {
     category: "test",
     pattern: "test/spec roots and conventional test filenames",
-    regex: /(^|\/)(?:__tests?__|tests?|spec)(\/|$)|\.(?:test|itest|spec)\.[^.\/]+$|_test\.go$|(^|\/)test_[^/]*\.py$/i,
+    regex: /(^|\/)(?:__tests?__|tests?|spec)(\/|$)|\.(?:test|itest|spec)\.[^.\/]+$|_test\.go$|(^|\/)test(?:_[^/]*)?\.py$/i,
   },
   {
     category: "generated",

package/src/precision/symbol-query.js

@@ -7,6 +7,7 @@ import {
     precisionOverlayMatches,
     precisionSemanticInputsMatch,
 } from './lsp-overlay.js'
+import {createPathClassifier, hasPathClass} from '../path-classification.js'
 
 export const SYMBOL_PRECISION_CACHE_V = 1
 export const SYMBOL_PRECISION_CACHE_FILE = 'precision-symbols.json'
@@ -79,6 +80,56 @@ function cacheable(overlay) {
         && overlay?.reason === 'semantic precision stopped at a configured safety limit'
 }
 
+// Point-query results intentionally live outside the broad precision overlay. Health tools still
+// need to consume revision-bound positive evidence: once an exact query found a reference, the
+// same symbol must not remain in a dead-code queue. This reader is synchronous and fail-closed;
+// stale, malformed, incomplete no-reference, or semantically changed entries contribute nothing.
+export function readCachedSymbolPrecisionEvidence({repoRoot, graphPath, graph} = {}) {
+    const empty = {referenceSymbols: [], productionReferenceSymbols: [], testReferenceSymbols: [], noReferenceSymbols: []}
+    if (!repoRoot || !graphPath || !graph) return empty
+    const precisionGraph = graph.graphPrecisionMode === 'off' ? {...graph, graphPrecisionMode: 'lsp'} : graph
+    const nodesById = new Map((precisionGraph.nodes || []).map((node) => [String(node.id), node]))
+    const classifier = createPathClassifier(repoRoot)
+    const referenced = new Set()
+    const production = new Set()
+    const tests = new Set()
+    const noReference = new Set()
+    const semanticMatches = new Map()
+    for (const entry of readCache(symbolPrecisionCachePath(graphPath)).entries) {
+        const overlay = entry?.overlay
+        if (!overlay || !precisionOverlayMatches(overlay, precisionGraph, {request: overlay.request})) continue
+        const fingerprint = String(overlay.semanticInputFingerprint || '')
+        if (!semanticMatches.has(fingerprint)) semanticMatches.set(
+            fingerprint,
+            precisionSemanticInputsMatch(overlay, repoRoot, precisionGraph),
+        )
+        if (!semanticMatches.get(fingerprint)) continue
+        const targetId = String(entry.targetId || '')
+        if (!nodesById.has(targetId)) continue
+        const locations = Array.isArray(overlay.locations)
+            ? overlay.locations.filter((location) => String(location?.target || '') === targetId)
+            : []
+        if (locations.length) {
+            referenced.add(targetId)
+            for (const location of locations) {
+                const file = String(location?.file || nodesById.get(String(location?.source || ''))?.source_file || '')
+                if (!file) continue
+                const info = classifier.explain(file, {content: ''})
+                if (hasPathClass(info, 'test', 'e2e')) tests.add(targetId)
+                else production.add(targetId)
+            }
+        }
+        if (overlay.state === 'COMPLETE' && Array.isArray(overlay.noReferenceSymbols)
+            && overlay.noReferenceSymbols.some((id) => String(id) === targetId)) noReference.add(targetId)
+    }
+    return {
+        referenceSymbols: [...referenced],
+        productionReferenceSymbols: [...production],
+        testReferenceSymbols: [...tests],
+        noReferenceSymbols: [...noReference],
+    }
+}
+
 export async function querySymbolPrecision({
     repoRoot,
     graphPath,

package/docs/releases/v0.2.7.md

@@ -1,93 +0,0 @@
-# Weavatrix 0.2.7
-
-## Proof-carrying changes
-
-`verified_change` is a new high-level MCP workflow for planning and verifying a code change. It
-accepts a natural-language task, an optional unified diff or changed-file hints, and an immutable Git
-baseline. Its stable result is one of:
-
-- `PASS`: every applicable enabled proof completed and no ratchet failed;
-- `BLOCKED`: a test failed, a new duplicate intersects changed code, a runtime cycle appeared, an
-  architecture ratchet failed, or bounded API evidence found an HTTP method mismatch;
-- `UNKNOWN`: required evidence is missing, partial, disabled, or not configured.
-
-The structured result contains intent-expanded task retrieval combined with exact changed-symbol
-seeds, up to five compact LSP/graph edit contexts, symbol-aware blast radius, affected-test paths,
-bounded JS/TS call-argument-to-parameter evidence, Git graph drift, architecture verification, a
-new-duplicate baseline comparison, and optional cross-repository HTTP contract evidence.
-
-The workflow respects the existing capability boundary. Exact source/LSP context requires `source`,
-duplicate comparison and architecture verification require `health`, and API tracing requires
-`crossrepo`. A narrow custom profile is never silently bypassed.
-
-## Safe targeted tests
-
-The workflow does not accept shell commands. It can execute at most five existing `package.json`
-scripts whose names match the test/check/verify allowlist. Execution requires both
-`run_tests:true` on the tool call and `WEAVATRIX_ALLOW_TEST_RUNS=1` in the server environment. The
-default remains read-only and returns the test plan or `UNKNOWN` when runtime evidence was requested
-but not authorized.
-
-## Malware scanner correction
-
-The npm content sweep now starts at actual installed package roots instead of the entire
-`node_modules` container. Hidden package-manager caches and hosted release snapshots are therefore
-not attributed as dependencies and cannot make Weavatrix flag its own malware-signature source.
-
-Heuristic remediation no longer says to treat a package as compromised or rotate all reachable
-secrets. It asks the operator to quarantine and inspect the package, verify origin and lockfile
-integrity, and rotate secrets only after execution or credential exposure is confirmed.
-
-Static heuristic findings now have a hard `high` severity ceiling. They expose
-`confirmedExecution:false` plus explicit runtime/origin/lockfile/exposure verification states;
-`critical` is reserved for independently confirmed malicious advisories or runtime evidence.
-
-Package-lock install-script drift now compares only `preinstall`, `install`, and `postinstall`.
-Development/publication hooks such as `prepare` no longer create false high-severity drift findings.
-
-## Signal-quality corrections
-
-- `query_graph` applies production-first path classification to the traversal, not only seed
-  selection. Tests, generated code, fixtures, docs, benchmarks and excluded paths require an
-  explicit question class or `include_classified:true`. Exact non-product seed files remain usable.
-- `verified_change` task retrieval uses the same production-first policy while always retaining
-  exact changed symbols. The bundled routing microbenchmark moved from one test-symbol false
-  positive (`0.25`) to zero (`0`) without losing any of its three expected production targets.
-- Unreferenced constant/field leaves that do not match the query are hidden by default; use
-  `include_low_signal:true` for diagnostic expansion.
-- `hot_path_review` now defaults to a focused score gate of 85 plus a narrow strong-local fallback.
-  On the 0.2.7 source tree this reduced the default queue from 717 diagnostic candidates to 116 of
-  1,043 analyzed symbols; `min_score:0` restores the full diagnostic set.
-- `find_dead_code` adds `STRONG_STATIC_EVIDENCE`, `BOUNDED_STATIC_EVIDENCE`, and
-  `HIGH_UNCERTAINTY` tiers, structured completed/remaining checks, and `autoDelete:false` on every
-  candidate. Strong static evidence means exact zero LSP references, not permission to delete.
-- npm unused/missing/duplicate dependency findings now carry manifest section, indexed-source,
-  script/config, package-scope and unresolved dynamic/plugin verification state. Unused dependencies
-  remain `REVIEW_REQUIRED`; missing dependencies retain the exact importing-file evidence.
-
-## Benchmark contract
-
-`npm run benchmark:agent` runs a deterministic task-to-symbol routing microbenchmark and reports task
-success, false-positive rate, estimated output tokens, and duration. This is intentionally labelled
-as a routing microbenchmark, not an autonomous end-to-end change benchmark.
-
-Independent Codebase Memory and Serena results may be supplied with
-`--independent-results <json>` using the blind evaluator contract in
-[`docs/agent-task-benchmark.md`](../agent-task-benchmark.md). Without same-task results for all three
-systems, comparison status is `INCOMPLETE`; `npm run benchmark:agent:release` fails closed. The
-repository does not manufacture competitor scores.
-
-## Scope and limitations
-
-- The interprocedural evidence maps call arguments to declared callee parameters for bounded JS/TS
-  graph call edges. It is not a CFG, value-propagation engine, or taint analysis.
-- An absent architecture contract produces `UNKNOWN`; provisional budgets are guidance, not policy.
-- A static path to a test is not proof that the test executed. A `PASS` that depends on runtime
-  behavior requires explicitly authorized test execution.
-- API proof is optional and registry-scoped. No client match is `UNKNOWN`, never proof of no external
-  consumers.
-
-## Tool catalog
-
-0.2.7 exposes 36 MCP tools. The default offline profile exposes 33; pinned exposes 30. Network tools
-remain absent from the offline and pinned profiles.