weavatrix 0.3.11 → 0.3.13

package/README.md

@@ -12,9 +12,12 @@ questions. **34 network-free tools. No repository data leaves your machine.**
 - Source: [github.com/sergii-ziborov/weavatrix](https://github.com/sergii-ziborov/weavatrix)
 - npm: [`weavatrix`](https://www.npmjs.com/package/weavatrix) — `npx -y weavatrix <repoRoot>`
 
-This package is the complete offline engine under the MIT license and initiates no outbound HTTP.
-Every network capability lives in the separately versioned `weavatrix-online` superset, which depends
-on this core through a supported extension API. The split is documented in
+This package is the complete offline engine under the MIT license: it reads and analyzes your code,
+initiates no outbound HTTP, and never edits your source. It is the read-only base of a layered stack —
+add [`weavatrix-refactor`](https://github.com/sergii-ziborov/weavatrix-refactor) (Apache-2.0) to apply
+hash-verified, reversible edits, or [`weavatrix-online`](https://github.com/sergii-ziborov/weavatrix-online)
+for authorized Cloud or self-hosted sync. Each is an optional superset that depends on this core through
+a supported extension API; the offline/online split is documented in
 [docs/adr/0001-v0.3-offline-online-split.md](docs/adr/0001-v0.3-offline-online-split.md).
 
 ## Install
@@ -125,7 +128,9 @@ The 34 methods project the same reusable graph into the smallest view a task nee
 - **build** — `rebuild_graph` (reports the structural delta, keeps the prior state as `graph.prev.json`).
 - **retarget** *(in `offline`, absent from `pinned`)* — `open_repo`, `list_known_repos`.
 - **crossrepo** *(in `offline`, absent from `pinned`)* — `trace_api_contract` (joins routes to client
-  call-sites across registered local graphs; reads no source).
+  call-sites across registered local graphs; reads no source). Results are compact and paginated by
+  default (`page_size`, opaque `cursor`, and bounded `per_item_limit` samples); `response_detail="full"`
+  is an explicit opt-in and remains paginated.
 
 Every finding is review evidence, never an auto-delete verdict: `find_dead_code` /
 `run_audit category=unused` always return `REVIEW_REQUIRED` with `autoDelete:false`. Typecheck, tests

package/docs/releases/v0.3.12.md

@@ -0,0 +1,44 @@
+# Weavatrix 0.3.12
+
+0.3.12 makes the read-only core the provably-pure base of a layered stack. The
+core stays exactly what it was for its users — the same 34 offline analysis tools
+— but it now exposes a small read-only analysis surface for the packages built on
+top of it, and machine gates prove it can neither modify code nor reach anything
+external. Rust cross-crate call resolution and a `query_graph` seeding fix round
+out the release.
+
+## The read-only base of the stack
+
+Weavatrix now anchors a stack of growing responsibility:
+`weavatrix-online ⊃ weavatrix-refactor ⊃ weavatrix`. You install one package and
+get everything below it. This release adds only what the base owes the layers
+above; it registers no new tools and changes no existing tool.
+
+- New `weavatrix/analysis-kit` export: a narrow, read-only surface (graph
+  identity, cycle detection, architecture verification, the bundled tree-sitter
+  grammars, the read-only TypeScript language-server client, dead-code signals)
+  that upper-layer packages compose. Nothing here writes, applies, or describes
+  an edit.
+- Two release gates make the base's guarantees machine-checked, alongside the
+  existing ADR 0001 no-network gate: the core source contains **no edit-plan,
+  applier, or refactoring-builder marker**, and **no literal URL** at all. A
+  vulnerability finding references the advisory id rather than an external link;
+  the URL-matching malware heuristics are matchers over scanned code, not links
+  the core follows. Installing the base alone can neither modify your code nor
+  reach the network.
+
+## Rust cross-crate call resolution
+
+Rust call edges now resolve across crates, inline-test coverage is reported
+honestly, and same-crate call noise is reduced — cross-crate `references` edges
+land where a caller reaches a definition in another crate.
+
+## query_graph seeding
+
+A `query_graph` question that reduced entirely to stop words (a bare
+`architecture`), or inferred a language absent from the repository (`contract`
+inferring Solidity where there are no `.sol` files), previously returned a
+misleading "No nodes matched". Both now fall back only when they would otherwise
+return nothing: the stop filter relaxes when every token is a stop word, and a
+requested language that matches zero nodes is dropped. Queries that already
+worked are unchanged.

package/docs/releases/v0.3.13.md

@@ -0,0 +1,34 @@
+# Weavatrix 0.3.13
+
+0.3.13 fixes two misleading verification and graph-path signals found while
+dogfooding a real duplicate-removal refactor. It also bounds cross-repository
+contract responses with revision-bound pagination.
+
+## Honest refactor verification
+
+- `verified_change` no longer reports an enabled duplicate ratchet as
+  `SKIPPED: duplicate ratchet disabled` during the planning phase. An enabled
+  plan now reports `PLANNED`, `enabled: true`, and states that the ratchet runs
+  during `phase="verify"`. An explicit `duplicate_ratchet: false` remains the
+  only disabled state.
+- `shortest_path` remains an undirected connectivity query, but every rendered
+  hop now preserves the stored graph-edge direction. Reverse traversal renders
+  `<--imports--` or `<--calls--` instead of inventing a forward dependency.
+  Repeated and generic file names are widened in both the header and hop lines.
+
+## Bounded cross-repository contract evidence
+
+- `trace_api_contract` response schema v4 returns compact, paginated evidence
+  by default. `page_size`, `per_item_limit`, and a revision/filter-bound opaque
+  `cursor` keep responses bounded; `response_detail="full"` remains an explicit
+  opt-in and is still paginated.
+- Invalid, stale, or cross-query cursors fail closed with `INVALID_CURSOR`.
+- Repository graph reconciliation now reuses a persisted fresh graph before
+  invoking a rebuild, while stale or failed refreshes retain their explicit
+  completeness status.
+
+## Layer compatibility
+
+The read-only core keeps its 34-tool surface and `weavatrix.edit-plan.v1`
+contract unchanged. `weavatrix-refactor` 0.1.1 and `weavatrix-online` 0.2.0
+are the paired upper-layer releases for this core version.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weavatrix",
-  "version": "0.3.11",
+  "version": "0.3.13",
   "type": "module",
   "description": "Local repository intelligence MCP for AI coding agents: an always-fresh architecture graph with production-first evidence — blast radius, dead code, endpoints, clones, history, Health and architecture safeguards, with honestly labeled precision.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
@@ -24,6 +24,7 @@
     "./mcp-runtime": "./src/mcp-runtime.mjs",
     "./extension-api": "./src/mcp/extension-api.mjs",
     "./extension/local-services": "./src/extension/local-services.mjs",
+    "./analysis-kit": "./src/analysis-kit.mjs",
     "./package.json": "./package.json"
   },
   "files": [
@@ -45,6 +46,8 @@
     "docs/releases/v0.3.9.md",
     "docs/releases/v0.3.10.md",
     "docs/releases/v0.3.11.md",
+    "docs/releases/v0.3.12.md",
+    "docs/releases/v0.3.13.md",
     "docs/releases/v0.2.19.md",
     "README.md",
     "SECURITY.md",

package/src/analysis/cargo-manifests.js

@@ -19,6 +19,13 @@ export function parseCargoToml(text) {
   for (const raw of source.split(/\r?\n/)) {
     const line = raw.replace(/(^|\s)#.*$/, "").trim();
     if (!line) continue;
+    // Array-of-tables headers ([[bin]], [[example]], [[test]], [[bench]]) are neither the [package]
+    // table nor a dependency table. Recognise them so their `name =`/`path =` keys are not mis-read:
+    // a [[bin]] renamed to a crate ([[bin]] name = "foo") would otherwise overwrite the package name and
+    // make every foo:: import look like a self-reference, and a [[bin]] after [dependencies] would leak
+    // phantom "name"/"path" dependencies.
+    const arrayHeader = /^\[\[([^\]]+)]]$/.exec(line);
+    if (arrayHeader) { section = arrayHeader[1].trim(); continue; }
     const header = /^\[([^\]]+)]$/.exec(line);
     if (header) { section = header[1].trim(); workspace ||= section === "workspace"; continue; }
     const kv = /^([A-Za-z0-9_-]+)\s*=\s*(.+)$/.exec(line);

package/src/analysis/duplicates.compute.js

@@ -111,7 +111,7 @@ function symbolRanges(graph) {
     if (!line) continue;
     let arr = byFile.get(n.source_file);
     if (!arr) byFile.set(n.source_file, (arr = []));
-    arr.push({ id: n.id, label: n.label || n.id, line, symbolKind: n.symbol_kind || "" });
+    arr.push({ id: n.id, label: n.label || n.id, line, symbolKind: n.symbol_kind || "", testSurface: n.test_surface === true });
   }
   for (const arr of byFile.values()) arr.sort((a, b) => a.line - b.line);
   return byFile;
@@ -184,6 +184,10 @@ export function computeDuplicates(repoPath, graphJsonPath, opts = {}) {
         id: syms[i].id, label: syms[i].label, file, start, end,
         n: toks.strict.length, declarative,
         ...classificationFields(pathInfo),
+        // Inline test surfaces (Rust `#[cfg(test)] mod tests`, `#[test]` fns) live in production files, so a
+        // path check alone misses them; the graph already flags the symbol. OR it in so skip-tests suppresses
+        // them by default and two #[test] fns are never reported as a production clone.
+        test: hasPathClass(pathInfo, "test", "e2e") || syms[i].testSurface === true,
         fp: { strict: fingerprints(toks.strict), renamed: fingerprints(toks.renamed) },
       });
     }

package/src/analysis/hot-path-review.js

@@ -36,7 +36,7 @@ function coverageForRange(record, startLine, endLine) {
     return total ? covered / total : Number.isFinite(record.pct) ? record.pct : null
 }
 
-function graphRiskBySymbol(graph, symbolIds) {
+function graphRiskBySymbol(graph, symbolIds, testCallerIds) {
     const state = new Map([...symbolIds].map((id) => [id, {
         incoming: 0, outgoing: 0, callers: new Set(), callees: new Set(),
     }]))
@@ -50,7 +50,10 @@ function graphRiskBySymbol(graph, symbolIds) {
             item.outgoing++
             item.callees.add(target)
         }
-        if (state.has(target)) {
+        // A test caller (inline #[cfg(test)] symbol or a test-path file) must not inflate a production
+        // symbol's fan-in — the same reason test symbols are excluded as candidates. Skipped only for the
+        // incoming/coupling side; unless the caller opted tests in (testCallerIds is then null).
+        if (state.has(target) && !(testCallerIds && testCallerIds.has(source))) {
             const item = state.get(target)
             item.incoming++
             item.callers.add(source)
@@ -135,7 +138,26 @@ export function computeHotPathReview(graph, options = {}) {
         eligible.push({node, complexity, file, classification: test ? 'test' : classified ? 'classified' : 'production'})
     }
 
-    const riskById = graphRiskBySymbol(graph, new Set(eligible.map(({node}) => String(node.id))))
+    // Test callers (inline test_surface symbols and test-path files) that must not count toward a
+    // production symbol's fan-in. Built over ALL nodes because a caller may sit outside the review scope.
+    const testCallerIds = options.includeTests === true ? null : (() => {
+        const ids = new Set()
+        const classifyCache = new Map()
+        for (const node of graph?.nodes || []) {
+            const id = String(node?.id || '')
+            if (!id.includes('#')) continue
+            let isTest = node?.test_surface === true
+            const file = normalize(node?.source_file)
+            if (!isTest && file) {
+                let info = classifyCache.get(file)
+                if (info === undefined) classifyCache.set(file, (info = classifier.explain(file)))
+                isTest = hasPathClass(info, 'test', 'e2e')
+            }
+            if (isTest) ids.add(id)
+        }
+        return ids
+    })()
+    const riskById = graphRiskBySymbol(graph, new Set(eligible.map(({node}) => String(node.id))), testCallerIds)
     const candidates = []
     for (const entry of eligible) {
         const {node, complexity, file} = entry

package/src/analysis/internal-audit/supply-chain.js

@@ -74,7 +74,7 @@ export async function runSupplyChainChecks(repoPath, {
           version: hit.pkg.version,
           reachability,
           evidence: [
-            { file: hit.adv.url, line: 0, snippet: `installed via ${hit.pkg.source}${hit.pkg.dev ? " (dev)" : ""}` },
+            { file: hit.adv.id, line: 0, snippet: `installed via ${hit.pkg.source}${hit.pkg.dev ? " (dev)" : ""}` },
             ...reachability.evidence.slice(0, 5).map((item) => ({ file: item.file, line: item.line, snippet: `${item.typeOnly ? "type-only " : ""}${item.kind}` })),
           ],
           source: "osv",

package/src/analysis/manifests.js

@@ -107,7 +107,10 @@ export function parsePipfileDeps(text) {
   let present = false;
   for (const raw of String(text || "").split(/\r?\n/)) {
     const line = raw.replace(/(^|\s)#.*$/, "").trim();
-    const sec = line.match(/^\[([^\]]+)\]$/);
+    // Match single [section] and array-of-tables [[section]] headers alike. Without the [[...]] case a
+    // `[[source]]` table following [packages] would leave section === "packages" and its name/url/verify_ssl
+    // keys would leak as phantom dependencies (the same blind spot fixed in the Cargo.toml parser).
+    const sec = line.match(/^\[+([^\]]+)\]+$/);
     if (sec) { section = sec[1].trim().toLowerCase(); continue; }
     if (section !== "packages" && section !== "dev-packages") continue;
     const kv = line.match(/^["']?([A-Za-z0-9][\w.-]*)["']?\s*=/);

package/src/analysis/static-test-reachability.js

@@ -37,6 +37,13 @@ export function computeStaticTestReachability(graph, {
     if (!classificationCache.has(normalized)) classificationCache.set(normalized, classifier.explain(normalized, { content: "" }));
     return classificationCache.get(normalized);
   };
+  // Files that carry inline test surfaces (Rust `#[cfg(test)]` modules / `#[test]` fns live inside the
+  // production file, so path classification alone never sees them). The graph flags these per symbol.
+  // These files are NOT seeded as whole-file BFS sources: at file granularity we cannot tell an inline
+  // test's out-edge from a same-file production call, so seeding the file would propagate its PRODUCTION
+  // call chains as if a test reached them. They are self-covered at distance 0 instead (an honest,
+  // conservative signal: "this file has its own tests"), never over-claiming reach to other files.
+  const testSurfaceFiles = new Set();
   const isTest = (file) => hasPathClass(classify(file), "test", "e2e");
   const isProduct = (file) => {
     const info = classify(file);
@@ -50,6 +57,7 @@ export function computeStaticTestReachability(graph, {
     if (!file) continue;
     idToFile.set(String(node.id), file);
     files.add(file);
+    if (node?.test_surface === true) testSurfaceFiles.add(file);
   }
 
   // Collapse symbol/file edges to directed file dependencies. Multiple symbol edges retain the best
@@ -73,6 +81,13 @@ export function computeStaticTestReachability(graph, {
   const productFiles = [...files].filter(isProduct).filter((file) => pathInScope(file, scope)).sort((a, b) => a.localeCompare(b));
   const productSet = new Set(productFiles);
   const nearest = new Map();
+  // A production file that carries its own inline tests is self-covered at distance 0: its tests exercise
+  // its own production symbols. This is the honest floor that fixes a false "0 reachable" for repos whose
+  // tests are all inline (Rust); it never asserts reach to OTHER files, so it cannot over-claim.
+  const inlineCovered = productFiles.filter((file) => testSurfaceFiles.has(file));
+  for (const file of inlineCovered) {
+    nearest.set(file, [{ test: file, distance: 0, score: 3, confidence: confidenceLabel(3), path: [file] }]);
+  }
   const queue = tests.map((test) => ({ file: test, test, distance: 0, score: 3, path: [test] }));
   const seen = new Map(tests.map((test) => [`${test}\0${test}`, 0]));
   let cursor = 0;
@@ -115,8 +130,10 @@ export function computeStaticTestReachability(graph, {
   return {
     kind: "staticTestReachability",
     actualCoverage: "NOT_AVAILABLE",
-    testFiles: tests.length,
-    totalTestFiles: allTests.length,
+    // Inline-test files self-cover rather than seed the traversal, but they ARE test-bearing files, so
+    // the reported counts include them — otherwise a Rust repo would read "0 test files" beside real reach.
+    testFiles: tests.length + inlineCovered.length,
+    totalTestFiles: allTests.length + inlineCovered.length,
     productFiles: productFiles.length,
     reachableFiles: reachable.length,
     unreachableFiles: unreachable.length,

package/src/analysis-kit.mjs

@@ -0,0 +1,17 @@
+// Read-only analysis primitives the weavatrix-refactor package composes into refactoring
+// plan producers. Everything exported here is PURE READ: graph identity helpers, cycle
+// detection, architecture verification, the bundled tree-sitter grammars, the read-only
+// TypeScript language-server client, and dead-code risk signals. None of it writes, applies,
+// or references applying a change — the core catalog and the release gate keep the core
+// provably free of any source-write or edit-plan path. The refactoring engines live in
+// weavatrix-refactor and import this surface.
+
+export {graphEndpointId, fileOfId} from './graph/node-id.js'
+export {Parser, Query, EXT_LANG, ensureParser} from './graph/internal-builder.langs.js'
+export {querySymbolPrecision} from './precision/symbol-query.js'
+export {createTypeScriptLspClient} from './precision/typescript-provider/client.js'
+export {verifyArchitecture} from './analysis/architecture/contract-verification.js'
+export {normalizeArchitectureContract} from './analysis/architecture-contract.js'
+export {buildFileImportGraph, findSccs} from './analysis/structure/dependency-graph.js'
+export {isFrameworkEntryFile} from './analysis/dead-check.js'
+export {hasDynamicCode, REFLECTION_CODE_RE} from './analysis/dead-code-review/policy.js'

package/src/graph/builder/lang-rust-calls.js

@@ -0,0 +1,63 @@
+// Rust scoped-call resolution (`Path::method()`), split from lang-rust.js. Resolved with the full
+// qualifier in hand so an external associated function (`OpenOptions::new()`, `Vec::from()`) never binds
+// its bare final name to an unrelated same-named function in the directory. Only heads with real evidence
+// produce an edge: crate/self/super anchors, `use`-bound names (including sibling-crate modules),
+// fully-qualified sibling crates, and local types whose exact impl method is indexed. A std/external
+// type head is left unresolved on purpose.
+
+// Symbol kinds that can own an associated function via `Type::method`.
+const TYPE_KINDS = new Set(["struct", "enum", "trait", "type", "union"]);
+
+// `pathParts` and `inlineAncestors` stay owned by lang-rust.js (pass 1 uses them too) and are passed in,
+// so this module never imports back from lang-rust.js.
+export function rustScopedCalls(ctx, { pathParts, inlineAncestors }) {
+  const { grammar, tree, fileRel, caps, enclosing, links, nodeById, importedLocals,
+          dirSymbols, resolveNamedSymbol, resolveRustMethod, resolveRustPath, resolveRustCratePath } = ctx;
+  const dir = fileRel.includes("/") ? fileRel.slice(0, fileRel.lastIndexOf("/")) : "";
+  const localSyms = dirSymbols?.get(dir);
+  const emitCall = (node, target) => {
+    const caller = enclosing(fileRel, node.startPosition.row + 1);
+    if (caller && target && target !== caller.id) {
+      links.push({ source: caller.id, target, relation: "calls", confidence: "INFERRED", line: node.startPosition.row + 1 });
+    }
+  };
+  for (const cap of caps(grammar, `(call_expression function: (scoped_identifier) @path)`, tree.rootNode)) {
+    const node = cap.node;
+    const segments = pathParts(node);
+    if (segments.length < 2) continue;
+    const head = segments[0];
+    const method = segments.at(-1);
+
+    if (["crate", "self", "super"].includes(head)) {
+      const resolved = resolveRustPath(fileRel, segments, { inlineModules: inlineAncestors(node), unqualified: false });
+      if (resolved) emitCall(node, resolveNamedSymbol(resolved.targetFile, method, "value"));
+      continue;
+    }
+
+    const bound = importedLocals?.get(fileRel)?.get(head);
+    if (bound?.targetFile) {
+      emitCall(node, resolveNamedSymbol(bound.targetFile, method, "value"));
+      continue;
+    }
+
+    const crateResolved = resolveRustCratePath ? resolveRustCratePath(head, segments.slice(1, -1)) : null;
+    if (crateResolved) {
+      emitCall(node, resolveNamedSymbol(crateResolved.targetFile, method, "value"));
+      continue;
+    }
+
+    // Local type's associated function: resolve the exact impl member. Nothing else (enum-variant
+    // construction, external types) has an indexed target, so it produces no edge.
+    const headId = localSyms?.get(head);
+    if (headId && TYPE_KINDS.has(nodeById.get(headId)?.symbol_kind)) {
+      emitCall(node, resolveRustMethod(dir, head, method));
+      continue;
+    }
+
+    // Head is a locally-declared outlined module used without `use` (`mod utils; utils::init()`), the
+    // dominant flat-file idiom. resolveRustPath matches only a REAL repo module file, so an external type
+    // head (OpenOptions, Vec) resolves to null and still produces no edge — no dir-scope mis-binding.
+    const modResolved = resolveRustPath?.(fileRel, segments.slice(0, -1), { inlineModules: inlineAncestors(node), unqualified: true });
+    if (modResolved) emitCall(node, resolveNamedSymbol(modResolved.targetFile, method, "value"));
+  }
+}

package/src/graph/builder/lang-rust.js

@@ -3,6 +3,8 @@
 // File dependencies follow Rust's module tree: outlined `mod`, `use` trees, public re-exports, and anchored
 // `crate/self/super` paths resolve to repo-local .rs or */mod.rs files. External crates deliberately stay out
 // of this adapter; Cargo dependency analysis owns them.
+import { rustScopedCalls } from "./lang-rust-calls.js";
+
 const SYMS_CORE = `
   (function_item name: (identifier) @function)
   (struct_item name: (type_identifier) @struct)
@@ -141,17 +143,19 @@ export default {
   grammars: ["rust"],
   exts: { ".rs": "rust" },
   isWeb: false,
+  // Bare `foo()` and method `x.foo()` calls resolve by name in the generic pass-2 loop. Scoped
+  // `Path::foo()` calls are handled in pass2() below with the full qualifier in hand, so an external
+  // `OpenOptions::new()` cannot bind its bare `new` to an unrelated same-named function in the folder.
   calls: `
     (call_expression function: (identifier) @callee)
-    (call_expression function: (field_expression field: (field_identifier) @callee))
-    (call_expression function: (scoped_identifier name: (identifier) @callee))`,
+    (call_expression function: (field_expression field: (field_identifier) @callee))`,
   heritage: [
     `(impl_item trait: (type_identifier) @super)`,
     `(impl_item trait: (generic_type type: (type_identifier) @super))`,
   ],
 
   pass1(ctx) {
-    const { grammar, tree, fileRel, caps, field, addSym, addImportEdge, addExternalImport, imports, resolveRustMod, resolveRustPath, links, nameToId } = ctx;
+    const { grammar, tree, fileRel, caps, field, addSym, addImportEdge, addExternalImport, imports, resolveRustMod, resolveRustPath, resolveRustCratePath, links, nameToId } = ctx;
     const owned = [];
     for (const src of [SYMS_CORE, ...SYMS_OPTIONAL]) {
       for (const cap of caps(grammar, src, tree.rootNode)) {
@@ -224,9 +228,16 @@ export default {
         // A `use` alias or imported item name shadows any same-named crate for the rest of this file. The
         // crate's OWN root name (e.g. `use anyhow::{self}`) is excluded so it still counts as a dependency.
         if (leaf.local && leaf.local !== "_" && cleanSegment(leaf.local) !== cleanSegment(leaf.segments[0])) localBindings.add(cleanSegment(leaf.local));
-        const resolved = resolveRustPath(fileRel, leaf.segments, { inlineModules: ancestors, unqualified: true });
+        const crate = cleanSegment(leaf.segments[0]);
+        let resolved = resolveRustPath(fileRel, leaf.segments, { inlineModules: ancestors, unqualified: true });
+        // A head that is not a local module may be a sibling workspace crate (`use radiochron::wlan`):
+        // resolve it INTO that crate so its items bind here and cross-crate calls resolve in pass 2. It is
+        // still recorded as a dependency import so the sibling crate is not flagged an unused Cargo dep.
+        if (!resolved && resolveRustCratePath && isExternalCrate(crate, localBindings)) {
+          resolved = resolveRustCratePath(crate, leaf.segments.slice(1));
+          if (resolved) addExternalImport({ spec: leaf.segments.join("::"), pkg: crate.replace(/_/g, "-"), builtin: false, ecosystem: "crates.io", kind: "rust-use", line: use.startPosition.row + 1 });
+        }
         if (!resolved) {
-          const crate = cleanSegment(leaf.segments[0]);
           if (isExternalCrate(crate, localBindings)) {
             addExternalImport({ spec: leaf.segments.join("::"), pkg: crate.replace(/_/g, "-"), builtin: false, ecosystem: "crates.io", kind: "rust-use", line: use.startPosition.row + 1 });
           }
@@ -250,7 +261,16 @@ export default {
       const segments = pathParts(node);
       if (!["crate", "self", "super"].includes(segments[0])) {
         const crate = cleanSegment(segments[0]);
-        if (isExternalCrate(crate, localBindings)) {
+        // A fully-qualified sibling-crate path (`radiochron::events::recent`) is a real cross-crate
+        // dependency: emit the file edge AND record the dependency import so the sibling crate still
+        // counts as used, rather than being logged as an external crates.io crate.
+        const crateResolved = resolveRustCratePath && isExternalCrate(crate, localBindings)
+          ? resolveRustCratePath(crate, segments.slice(1))
+          : null;
+        if (crateResolved) {
+          emit(crateResolved.targetFile, { line: node.startPosition.row + 1, specifier: node.text });
+          addExternalImport({ spec: segments.join("::"), pkg: crate.replace(/_/g, "-"), builtin: false, ecosystem: "crates.io", kind: "rust-path", line: node.startPosition.row + 1 });
+        } else if (isExternalCrate(crate, localBindings)) {
           addExternalImport({ spec: segments.join("::"), pkg: crate.replace(/_/g, "-"), builtin: false, ecosystem: "crates.io", kind: "rust-path", line: node.startPosition.row + 1 });
         }
         continue;
@@ -271,4 +291,9 @@ export default {
       }
     }
   },
+
+  // Scoped `Path::method()` calls are resolved in lang-rust-calls.js with the full qualifier in hand.
+  pass2(ctx) {
+    rustScopedCalls(ctx, { pathParts, inlineAncestors });
+  },
 };

package/src/graph/builder/pass2-resolution.js

@@ -1,5 +1,8 @@
 export function createPass2Resolution({symIdsByFileName, nodeById, importedLocals, symByFileName}) {
     const dirSymbols = new Map(), dirMethods = new Map(), dirMethodsByName = new Map(), dirTypes = new Map()
+    // Rust associated functions / methods indexed by their owning type, per directory: `Type::method`
+    // resolves to the exact impl member instead of any same-named function in the directory.
+    const rustMethods = new Map() // dir -> Map(typeName -> Map(methodName -> id))
     // .sol shares dir scope because Solidity's project namespace is flat: `import "./Base.sol"` names no
     // symbols yet pulls every declaration into scope, so same-dir name resolution is the honest static proxy.
     const sharesDirScope = (file) => file.endsWith('.go') || file.endsWith('.cs') || file.endsWith('.rs') || file.endsWith('.sol')
@@ -24,6 +27,13 @@ export function createPass2Resolution({symIdsByFileName, nodeById, importedLocal
                 continue
             }
             if (!symbols.has(name)) symbols.set(name, id)
+            if (file.endsWith('.rs') && node?.member_of) {
+                let byType = rustMethods.get(dir)
+                if (!byType) rustMethods.set(dir, (byType = new Map()))
+                let methods = byType.get(node.member_of)
+                if (!methods) byType.set(node.member_of, (methods = new Map()))
+                if (!methods.has(name)) methods.set(name, id)
+            }
             if (file.endsWith('.go') && node?.symbol_space === 'type') {
                 let types = dirTypes.get(dir)
                 if (!types) dirTypes.set(dir, (types = new Map()))
@@ -55,6 +65,7 @@ export function createPass2Resolution({symIdsByFileName, nodeById, importedLocal
         if (!imported?.targetFile) return null
         return resolveNamedSymbol(imported.originFile || imported.targetFile, imported.originName || imported.imported, 'value')
     }
+    const resolveRustMethod = (dir, typeName, methodName) => rustMethods.get(dir)?.get(typeName)?.get(methodName) || null
     const javaTypeKinds = new Set(['class', 'interface', 'enum', 'record', 'annotation'])
     const resolveJavaType = (name, file) => {
         const imported = importedLocals.get(file)?.get(name)
@@ -66,5 +77,5 @@ export function createPass2Resolution({symIdsByFileName, nodeById, importedLocal
         const target = symByFileName.get(file)?.get(name)
         return target && javaTypeKinds.has(nodeById.get(target)?.symbol_kind) ? target : null
     }
-    return {dirSymbols, dirMethods, dirMethodsByName, dirTypes, resolveNamedSymbol, resolveCall, resolveJavaType}
+    return {dirSymbols, dirMethods, dirMethodsByName, dirTypes, resolveNamedSymbol, resolveCall, resolveJavaType, resolveRustMethod}
 }

package/src/graph/internal-builder.build.js

@@ -240,7 +240,7 @@ export async function buildInternalGraph(repoDir, opts = {}) {
   // not files, so the folder map is the only reliable cross-file resolver) ----
   const {reExportOccurrences} = runInternalGraphPass2({
     files, rel, langs, caps, field, links, nodeById, perFileSymbols, symByFileName,
-    symIdsByFileName, importedLocals, jsExports,
+    symIdsByFileName, importedLocals, jsExports, resolvers,
   });
   // HTML class/id usage → the CSS file(s) defining that selector: file-level reference edges (deduped per pair).
   const htmlRefSeen = new Set();

package/src/graph/internal-builder.pass2.js

@@ -8,10 +8,11 @@ import {createGoReceiverResolution} from './builder/go-receiver-resolution.js'
 
 export function runInternalGraphPass2({
     files, rel, langs, caps, field, links, nodeById, perFileSymbols, symByFileName,
-    symIdsByFileName, importedLocals, jsExports,
+    symIdsByFileName, importedLocals, jsExports, resolvers,
 }) {
     const resolution = createPass2Resolution({symIdsByFileName, nodeById, importedLocals, symByFileName})
-    const {dirSymbols, resolveNamedSymbol, resolveCall, resolveJavaType} = resolution
+    const {dirSymbols, resolveNamedSymbol, resolveCall, resolveJavaType, resolveRustMethod} = resolution
+    const {resolveRustPath, resolveRustCratePath} = resolvers || {}
     const {resolveNamespaceMember, reExportOccurrences} = resolveJsBarrels({
         jsExports, importedLocals, links,
         resolveSymbol: (file, name, typeOnly) => resolveNamedSymbol(file, name, typeOnly ? 'type' : 'value'),
@@ -46,6 +47,7 @@ export function runInternalGraphPass2({
             lang.pass2({
                 grammar, tree, fileRel: file, code, caps, field, enclosing, links, nodeById,
                 perFileSymbols, symByFileName, symIdsByFileName, importedLocals, resolveCall, resolveJavaType,
+                dirSymbols, resolveNamedSymbol, resolveRustMethod, resolveRustPath, resolveRustCratePath,
             })
         } catch { /* one language-specific resolver never sinks the graph */ }
         if (lang.selectorCall) for (const capture of caps(grammar, lang.selectorCall, tree.rootNode)) {

package/src/graph/internal-builder.resolvers.js

@@ -5,6 +5,7 @@
 import { readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { parseGoMod } from "../analysis/manifests.js";
+import { parseCargoToml, cargoName } from "../analysis/cargo-manifests.js";
 import { createRepoBoundary } from "../repo-path.js";
 import { listRepoFiles } from "../analysis/internal-audit/repo-files.js";
 import { createRustResolvers } from "./resolvers/rust.js";
@@ -61,6 +62,40 @@ export function buildResolvers(repoDir, fileSet) {
 
   const { resolveRustMod, resolveRustPath } = createRustResolvers(fileSet);
 
+  // Workspace crate map: normalized package name → its crate source root file (lib.rs/main.rs). A path or
+  // `use` that starts with a sibling crate's name (`use radiochron::wlan`) then resolves INTO that crate's
+  // files instead of being logged as an external crates.io dependency — so cross-crate imports and calls
+  // become real graph edges rather than a false "unused dependency" plus missing coupling.
+  // Cargo.toml (like go.mod) is a manifest, not a parsed source file, so it is read via listRepoFiles
+  // rather than the source fileSet. The crate root .rs it points at IS in fileSet (it is parsed).
+  const rustCrates = new Map();
+  const ambiguousCrates = new Set();
+  for (const manifest of listRepoFiles(repoDir).filter((file) => /(^|\/)Cargo\.toml$/i.test(file))) {
+    let parsed;
+    try { parsed = parseCargoToml(readLocal(manifest)); } catch { continue; }
+    if (!parsed.packageName) continue;
+    const dir = manifest.includes("/") ? manifest.slice(0, manifest.lastIndexOf("/")) : "";
+    const rootFile = ["src/lib.rs", "src/main.rs", "lib.rs", "main.rs"]
+      .map((candidate) => [dir, candidate].filter(Boolean).join("/"))
+      .find((path) => fileSet.has(path));
+    if (!rootFile) continue;
+    const key = cargoName(parsed.packageName);
+    // A repo can hold two crates with the same package name (independent workspaces, vendored copies).
+    // Cross-crate resolution has no way to pick the right one from a bare `name::path`, so treat the name
+    // as ambiguous and resolve nothing for it — better a missing edge than a confident wrong one.
+    if (rustCrates.has(key) && rustCrates.get(key) !== rootFile) ambiguousCrates.add(key);
+    else rustCrates.set(key, rootFile);
+  }
+  // Resolve `<crate>::<segments...>` against the named sibling crate's root, reusing the crate-anchored
+  // module resolver. Returns {targetFile, remaining} or null when the head is not an unambiguous workspace crate.
+  const resolveRustCratePath = (crateName, segments = []) => {
+    const key = cargoName(crateName);
+    if (ambiguousCrates.has(key)) return null;
+    const rootFile = rustCrates.get(key);
+    if (!rootFile) return null;
+    return resolveRustPath(rootFile, ["crate", ...segments], { unqualified: false });
+  };
+
   // Path aliases (tsconfig compilerOptions.paths + vite/webpack alias) are scoped to their config folder.
   // Without nearest-config resolution, a monorepo's root `@/*` can hijack the same alias in web/.
   const aliasContexts = new Map();
@@ -247,5 +282,5 @@ export function buildResolvers(repoDir, fileSet) {
     return fileSet.has(cand) ? cand : null;
   };
 
-  return { resolveJsImport, resolveAlias, resolvePyPath, pyBaseDir, pyTopDirs, resolveGoImport, dirFiles, resolveRustMod, resolveRustPath, resolveJavaImport, resolveSolidityImport, resolveHref, selectorIndex, htmlUsages, goModule, goModules, goRequires };
+  return { resolveJsImport, resolveAlias, resolvePyPath, pyBaseDir, pyTopDirs, resolveGoImport, dirFiles, resolveRustMod, resolveRustPath, resolveRustCratePath, resolveJavaImport, resolveSolidityImport, resolveHref, selectorIndex, htmlUsages, goModule, goModules, goRequires };
 }

package/src/mcp/catalog.mjs

@@ -111,6 +111,10 @@ function buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps}) {
                     max_matches: {type: 'integer', minimum: 1, maximum: 5000, default: 1000},
                     max_affected_files: {type: 'integer', minimum: 1, maximum: 500, default: 100},
                     top_n: {type: 'integer', minimum: 1, maximum: 50, default: 10},
+                    response_detail: {type: 'string', enum: ['compact', 'full'], default: 'compact', description: 'Compact returns bounded samples and counts. Full is explicit opt-in and still paginated.'},
+                    page_size: {type: 'integer', minimum: 1, maximum: 50, default: 10, description: 'Maximum HTTP/transport/uncertain evidence items returned on this page.'},
+                    per_item_limit: {type: 'integer', minimum: 1, maximum: 25, default: 5, description: 'Compact-mode sample limit for callsites, affected files, screens and modules per item.'},
+                    cursor: {type: 'string', maxLength: 256, description: 'Opaque nextCursor from the previous page; bound to repository revisions and filters.'},
                 },
                 required: ['backend', 'clients'],
             },

package/src/mcp/company-contract-page.mjs

@@ -0,0 +1,142 @@
+import {createHash} from 'node:crypto'
+
+const DEFAULT_PAGE_SIZE = 10
+const MAX_PAGE_SIZE = 50
+const DEFAULT_RELATED_LIMIT = 5
+const MAX_RELATED_LIMIT = 25
+
+export class ContractCursorError extends Error {
+    constructor(message) {
+        super(message)
+        this.name = 'ContractCursorError'
+        this.code = 'INVALID_CURSOR'
+    }
+}
+
+const boundedInteger = (value, fallback, minimum, maximum) => {
+    const parsed = Number(value)
+    return Number.isInteger(parsed) ? Math.max(minimum, Math.min(maximum, parsed)) : fallback
+}
+
+const pageFingerprint = (parts) => createHash('sha256')
+    .update(JSON.stringify(parts))
+    .digest('hex')
+    .slice(0, 24)
+
+const encodeCursor = (fingerprint, offset) => Buffer
+    .from(JSON.stringify({v: 1, fingerprint, offset}), 'utf8')
+    .toString('base64url')
+
+function decodeCursor(raw, fingerprint, total) {
+    if (!raw) return 0
+    try {
+        const parsed = JSON.parse(Buffer.from(String(raw), 'base64url').toString('utf8'))
+        if (parsed?.v !== 1 || parsed.fingerprint !== fingerprint) {
+            throw new ContractCursorError('cursor does not belong to this repository revision and filter set')
+        }
+        if (!Number.isInteger(parsed.offset) || parsed.offset < 0 || parsed.offset > total) {
+            throw new ContractCursorError('cursor offset is outside the available evidence')
+        }
+        return parsed.offset
+    } catch (error) {
+        if (error instanceof ContractCursorError) throw error
+        throw new ContractCursorError('cursor is malformed')
+    }
+}
+
+const sample = (items, limit) => ({
+    total: Array.isArray(items) ? items.length : 0,
+    items: Array.isArray(items) ? items.slice(0, limit) : [],
+    truncated: Array.isArray(items) && items.length > limit,
+})
+
+function compactEndpoint(endpoint, relatedLimit) {
+    const affected = endpoint?.affected || {}
+    return {
+        kind: 'http-endpoint',
+        backend: endpoint.backend,
+        method: endpoint.method,
+        path: endpoint.path,
+        normalizedPath: endpoint.normalizedPath,
+        handler: endpoint.handler,
+        handlerNodeId: endpoint.handlerNodeId,
+        handlerResolution: endpoint.handlerResolution,
+        file: endpoint.file,
+        line: endpoint.line,
+        callsites: sample(endpoint.callsites, relatedLimit),
+        methodMismatches: endpoint.methodMismatches,
+        methodMismatchSites: sample(endpoint.methodMismatchSites, relatedLimit),
+        liveness: endpoint.liveness,
+        affected: {
+            complete: affected.complete === true,
+            files: sample(affected.files, relatedLimit),
+            screens: sample(affected.screens, relatedLimit),
+            modules: sample(affected.modules, relatedLimit),
+            traversalTruncated: affected.truncated || {},
+        },
+    }
+}
+
+function compactTransport(contract, relatedLimit) {
+    const affected = contract?.affected || {}
+    return {
+        kind: 'transport-contract',
+        transport: contract.transport,
+        side: contract.side,
+        service: contract.service,
+        operation: contract.operation,
+        name: contract.name,
+        file: contract.file,
+        line: contract.line,
+        detector: contract.detector,
+        liveness: contract.liveness,
+        runtimeObserved: contract.runtimeObserved === true,
+        callsites: sample(contract.callsites, relatedLimit),
+        affected: {
+            complete: affected.complete === true,
+            files: sample(affected.files, relatedLimit),
+            screens: sample(affected.screens, relatedLimit),
+            modules: sample(affected.modules, relatedLimit),
+            traversalTruncated: affected.truncated || {},
+        },
+    }
+}
+
+function evidenceItems(analysis, transportAnalysis) {
+    return [
+        ...(analysis.endpoints || []).map((value) => ({kind: 'http-endpoint', value})),
+        ...(transportAnalysis.contracts || []).map((value) => ({kind: 'transport-contract', value})),
+        ...(analysis.uncertain || []).map((value) => ({kind: 'http-uncertain', value})),
+        ...(transportAnalysis.uncertain || []).map((value) => ({kind: 'transport-uncertain', value})),
+    ]
+}
+
+function projectItem(item, detail, relatedLimit) {
+    if (detail === 'full') return {kind: item.kind, ...item.value}
+    if (item.kind === 'http-endpoint') return compactEndpoint(item.value, relatedLimit)
+    if (item.kind === 'transport-contract') return compactTransport(item.value, relatedLimit)
+    return {kind: item.kind, ...item.value}
+}
+
+export function paginateContractEvidence({analysis, transportAnalysis, args = {}, fingerprintParts = []}) {
+    const detail = args.response_detail === 'full' ? 'full' : 'compact'
+    const pageSize = boundedInteger(args.page_size, DEFAULT_PAGE_SIZE, 1, MAX_PAGE_SIZE)
+    const relatedLimit = boundedInteger(args.per_item_limit, DEFAULT_RELATED_LIMIT, 1, MAX_RELATED_LIMIT)
+    const all = evidenceItems(analysis, transportAnalysis)
+    const fingerprint = pageFingerprint(fingerprintParts)
+    const offset = decodeCursor(args.cursor, fingerprint, all.length)
+    const selected = all.slice(offset, offset + pageSize)
+    const nextOffset = offset + selected.length
+    const nextCursor = nextOffset < all.length ? encodeCursor(fingerprint, nextOffset) : null
+    return {
+        detail,
+        offset,
+        pageSize,
+        perItemLimit: detail === 'compact' ? relatedLimit : null,
+        totalItems: all.length,
+        returnedItems: selected.length,
+        hasMore: nextCursor !== null,
+        nextCursor,
+        items: selected.map((item) => projectItem(item, detail, relatedLimit)),
+    }
+}

package/src/mcp/company-contract-reconcile.mjs

@@ -0,0 +1,87 @@
+import {join} from 'node:path'
+import {buildGraphForRepo} from '../build-graph.js'
+import {persistedFreshnessMatches, repositoryFreshnessProbe} from '../graph/freshness-probe.js'
+import {loadGraph} from './graph-context.mjs'
+
+export const publicRecord = (record, alias) => ({repositoryId: record.repositoryId, label: record.label, alias})
+
+function safeRefreshReason(record, error) {
+    let message = String(error instanceof Error ? error.message : error || 'graph refresh failed')
+    for (const path of [record.repoPath, record.graphDir]) {
+        if (!path) continue
+        message = message.split(String(path)).join(record.label || 'repository')
+        message = message.split(String(path).replace(/\\/g, '/')).join(record.label || 'repository')
+    }
+    return message.replace(/[\r\n]+/g, ' ').trim().slice(0, 400) || 'graph refresh failed'
+}
+
+export async function reconcileGraph(record, alias, role, graphHome) {
+    let registeredGraph = null
+    try { registeredGraph = loadGraph(join(record.graphDir, 'graph.json'), {repoRoot: record.repoPath}) } catch { /* refresh may repair it */ }
+    const buildMode = ['full', 'no-tests', 'tests-only'].includes(registeredGraph?.graphBuildMode)
+        ? registeredGraph.graphBuildMode
+        : 'full'
+    const precision = registeredGraph?.graphPrecisionMode === 'off' ? 'off' : 'lsp'
+    const freshnessProbe = repositoryFreshnessProbe(record.repoPath)
+    if (registeredGraph && freshnessProbe && persistedFreshnessMatches(registeredGraph, freshnessProbe, buildMode)) {
+        return {
+            record,
+            alias,
+            graph: registeredGraph,
+            publicStatus: {
+                role,
+                repository: publicRecord(record, alias),
+                buildMode,
+                status: 'CURRENT',
+                refresh: {kind: 'none', reason: 'persisted-freshness-match', changedFileCount: 0},
+            },
+        }
+    }
+    let build
+    try {
+        build = await buildGraphForRepo(record.repoPath, {
+            mode: buildMode,
+            precision,
+            scope: '',
+            outDir: record.graphDir,
+            graphHome,
+        })
+    } catch (error) {
+        build = {ok: false, error: safeRefreshReason(record, error)}
+    }
+    const refreshKind = build?.refresh?.kind || null
+    const changedFiles = Array.isArray(build?.refresh?.changedFiles) ? build.refresh.changedFiles : []
+    const publicStatus = {
+        role,
+        repository: publicRecord(record, alias),
+        buildMode,
+        status: build?.ok ? (refreshKind === 'none' ? 'CURRENT' : 'REFRESHED') : 'STALE_FALLBACK',
+        refresh: build?.ok ? {
+            kind: refreshKind || 'full',
+            reason: String(build?.refresh?.reason || 'graph-rebuilt'),
+            changedFileCount: changedFiles.length,
+        } : null,
+    }
+    if (build?.ok) {
+        try {
+            return {record, alias, graph: loadGraph(join(record.graphDir, 'graph.json'), {repoRoot: record.repoPath}), publicStatus}
+        } catch (error) {
+            const reason = `refreshed graph could not be loaded: ${safeRefreshReason(record, error)}`
+            return {record, alias, graph: null, reason, publicStatus: {...publicStatus, status: 'FAILED', reason}}
+        }
+    }
+
+    const reason = `graph refresh failed: ${safeRefreshReason(record, build?.error)}`
+    try {
+        return {
+            record,
+            alias,
+            graph: loadGraph(join(record.graphDir, 'graph.json'), {repoRoot: record.repoPath}),
+            reason: `${reason}; stale registered graph used`,
+            publicStatus: {...publicStatus, reason: `${reason}; stale registered graph used`},
+        }
+    } catch (error) {
+        const loadReason = `${reason}; registered graph could not be loaded: ${safeRefreshReason(record, error)}`
+        return {record, alias, graph: null, reason: loadReason, publicStatus: {...publicStatus, status: 'FAILED', reason: loadReason}}
+    }
+}

package/src/mcp/graph/context-seeds.mjs

@@ -89,13 +89,16 @@ function toolExecutionSignal(node, source, words, stem) {
     return score
 }
 
-function queryConcepts(query) {
+// relaxStop is the last-resort fallback: when EVERY token is a stop word (e.g. a bare
+// "architecture" query), keep them as concepts so the query still seeds instead of
+// misreporting "No nodes matched" for a concept the repository clearly contains.
+function queryConcepts(query, {relaxStop = false} = {}) {
     const tokens = wordsOf(query)
     const toolExecution = tokens.some((token) => TOOL_EXECUTION_TRIGGERS.has(token))
     const explanatoryWork = tokens.some((token) => token === 'how' || token === 'explain')
     const seen = new Set(), concepts = []
     for (const raw of tokens) {
-        if (raw.length < 2 || QUERY_STOP.has(raw)) continue
+        if (raw.length < 2 || (!relaxStop && QUERY_STOP.has(raw))) continue
         if (explanatoryWork && (raw === 'work' || raw === 'works' || raw === 'working')) continue
         if (toolExecution && TOOL_EXECUTION_TERMS.includes(raw)) {
             if (seen.has('tool-execution')) continue
@@ -116,7 +119,7 @@ function exactIdentifierSeeds(g, query, limit, {repoRoot = null} = {}) {
     const identifiers = [...new Set((String(query || '').match(/[A-Za-z_$][A-Za-z0-9_$]*/g) || [])
         .filter((item) => /(?:[a-z0-9][A-Z]|_)/.test(item)).map((item) => item.toLowerCase()))]
     if (!identifiers.length) return []
-    const requestedClasses = requestedPathClasses(query), languageExtensions = requestedLanguages(query)
+    const requestedClasses = requestedPathClasses(query), languageExtensions = effectiveLanguages(g, query)
     const classifier = createPathClassifier(repoRoot), classificationCache = new Map(), matches = []
     for (const identifier of identifiers) {
         const candidates = g.nodes.filter((node) => String(node.label || '').replace(/\(\)$/, '').toLowerCase() === identifier
@@ -158,12 +161,22 @@ function conceptScore(g, node, concept, queryContext) {
     return Math.max(0, score)
 }
 
+// A requested language that matches ZERO nodes in this graph is over-eager inference (e.g.
+// "contract" inferring Solidity in a repo with no .sol files); drop the filter rather than
+// eliminate every candidate and return nothing.
+function effectiveLanguages(g, query) {
+    const languageExtensions = requestedLanguages(query)
+    if (languageExtensions.size && !g.nodes.some((node) => matchesLanguage(node, languageExtensions))) return new Set()
+    return languageExtensions
+}
+
 export function findSeeds(g, query, limit = 8, {repoRoot = null} = {}) {
     const exact = exactIdentifierSeeds(g, query, limit, {repoRoot})
     if (exact.length) return exact
-    const concepts = queryConcepts(query)
+    let concepts = queryConcepts(query)
+    if (!concepts.length) concepts = queryConcepts(query, {relaxStop: true})
     if (!concepts.length || limit <= 0) return []
-    const requestedClasses = requestedPathClasses(query), languageExtensions = requestedLanguages(query)
+    const requestedClasses = requestedPathClasses(query), languageExtensions = effectiveLanguages(g, query)
     const queryContext = {runtimeIntent: concepts.some((concept) => concept.id === 'bootstrap' || concept.id === 'tool-execution'), maintenanceIntent: wordsOf(query).some((word) => ['script', 'scripts', 'build', 'release', 'publish', 'packaging'].includes(word)), languageExtensions}
     const classifier = createPathClassifier(repoRoot), classificationCache = new Map()
     const rows = g.nodes.filter((node) => matchesLanguage(node, languageExtensions) && isQueryEligible(node, requestedClasses, classificationCache, classifier)).map((node) => {
@@ -192,10 +205,3 @@ export function resolveSeedFiles(g, requested, limit = 12) {
     }
     return {seeds, missing}
 }
-
-export function undirectedNeighbors(g, id) {
-    const seen = new Map()
-    for (const e of g.out.get(id) || []) if (e.barrelProxy !== true) seen.set(e.id, e.relation)
-    for (const e of g.inn.get(id) || []) if (e.barrelProxy !== true && !seen.has(e.id)) seen.set(e.id, e.relation)
-    return seen
-}

package/src/mcp/graph/tools-query.mjs

@@ -1,6 +1,6 @@
 import {
     isSymbol, degreeOf, labelOf, resolveNode, findSeeds, resolveSeedFiles,
-    undirectedNeighbors, requestedPathClasses,
+    requestedPathClasses,
 } from '../graph-context.mjs'
 import {createPathClassifier, hasPathClass} from '../../path-classification.js'
 
@@ -52,6 +52,22 @@ const makeEdgeLabel = (g, shownIds) => {
     }
 }
 
+// shortest_path is intentionally a connectivity query, so it may walk an edge in either
+// direction. Keep the stored direction on every hop so the rendered path never turns a reverse
+// traversal into a false caller/importer direction.
+const connectivityNeighbors = (g, id) => {
+    const seen = new Map()
+    for (const edge of g.out.get(id) || []) {
+        if (edge.barrelProxy !== true) seen.set(String(edge.id), {relation: edge.relation, direction: 'forward'})
+    }
+    for (const edge of g.inn.get(id) || []) {
+        if (edge.barrelProxy !== true && !seen.has(String(edge.id))) {
+            seen.set(String(edge.id), {relation: edge.relation, direction: 'backward'})
+        }
+    }
+    return seen
+}
+
 const relationSet = (relationFilter, legacyFilter) => {
     const raw = relationFilter ?? legacyFilter
     const values = Array.isArray(raw) ? raw : (raw == null ? [] : String(raw).split(','))
@@ -221,17 +237,17 @@ export function tShortestPath(g, {source, target, max_hops = 8} = {}) {
     if (sourceId === targetId) return `Source and target are the same node: ${sourceNode.label ?? sourceId}.`
     const limit = Math.max(1, Math.min(20, Number(max_hops) || 8))
     const previous = new Map([[sourceId, null]])
-    const relationTo = new Map()
+    const edgeTo = new Map()
     let frontier = [sourceId]
     let hops = 0
     let found = false
     while (frontier.length && hops < limit && !found) {
         const next = []
         for (const id of frontier) {
-            for (const [neighbor, relation] of undirectedNeighbors(g, id)) {
+            for (const [neighbor, edge] of connectivityNeighbors(g, id)) {
                 if (previous.has(neighbor)) continue
                 previous.set(neighbor, id)
-                relationTo.set(neighbor, relation)
+                edgeTo.set(neighbor, edge)
                 if (neighbor === targetId) { found = true; break }
                 next.push(neighbor)
             }
@@ -244,6 +260,17 @@ export function tShortestPath(g, {source, target, max_hops = 8} = {}) {
     const path = []
     for (let current = targetId; current != null; current = previous.get(current)) path.unshift(current)
     const edgeLabel = makeEdgeLabel(g, path)
-    const lines = path.map((id, index) => index === 0 ? `  ${edgeLabel(id)}` : `  --${relationTo.get(id) || 'rel'}--> ${edgeLabel(id)}`)
-    return [`Shortest path (${path.length - 1} hops): ${sourceNode.label ?? sourceId} → ${targetNode.label ?? targetId}`, ...lines].join('\n')
+    const hopCount = path.length - 1
+    const lines = path.map((id, index) => {
+        if (index === 0) return `  ${edgeLabel(id)}`
+        const edge = edgeTo.get(id) || {}
+        return edge.direction === 'backward'
+            ? `  <--${edge.relation || 'rel'}-- ${edgeLabel(id)}`
+            : `  --${edge.relation || 'rel'}--> ${edgeLabel(id)}`
+    })
+    return [
+        `Shortest path (${hopCount} ${hopCount === 1 ? 'hop' : 'hops'}; undirected connectivity) from ${edgeLabel(sourceId)} to ${edgeLabel(targetId)}`,
+        'Edge arrows preserve stored graph direction; traversal may move with or against them.',
+        ...lines,
+    ].join('\n')
 }

package/src/mcp/tools-company.mjs

@@ -1,17 +1,16 @@
 // Cross-repository HTTP contract intelligence. Repository paths are resolved only through the
 // local global registry; callers can select an opaque repository UUID or an unambiguous label but
 // can never pass an arbitrary filesystem path through this tool.
-import {join} from 'node:path'
 import {analyzeHttpContracts} from '../analysis/http-contracts.js'
 import {analyzeTransportContracts} from '../analysis/transport-contracts.js'
-import {buildGraphForRepo} from '../build-graph.js'
 import {graphHomeDir} from '../graph/layout.js'
 import {liveRepositoryRecords} from '../graph/repo-registry.js'
-import {loadGraph} from './graph-context.mjs'
+import {ContractCursorError, paginateContractEvidence} from './company-contract-page.mjs'
+import {publicRecord, reconcileGraph} from './company-contract-reconcile.mjs'
 import {toolResult} from './tool-result.mjs'
 import {contractVerdict, contractVerdictLine} from './company-contract-verdict.mjs'
 
-const CROSS_REPO_HTTP_CONTRACT_V = 3
+const CROSS_REPO_HTTP_CONTRACT_V = 4
 const selectorText = (value) => String(value ?? '').trim()
 
 function selectRecord(records, selector) {
@@ -35,76 +34,6 @@ function safeAlias(record, records) {
     return duplicates.length > 1 ? `${base}-${String(record.repositoryId).slice(0, 8)}` : base
 }
 
-function publicRecord(record, alias) {
-    return {repositoryId: record.repositoryId, label: record.label, alias}
-}
-
-function safeRefreshReason(record, error) {
-    let message = String(error instanceof Error ? error.message : error || 'graph refresh failed')
-    for (const path of [record.repoPath, record.graphDir]) {
-        if (!path) continue
-        message = message.split(String(path)).join(record.label || 'repository')
-        message = message.split(String(path).replace(/\\/g, '/')).join(record.label || 'repository')
-    }
-    return message.replace(/[\r\n]+/g, ' ').trim().slice(0, 400) || 'graph refresh failed'
-}
-
-async function reconcileGraph(record, alias, role, graphHome) {
-    let registeredGraph = null
-    try { registeredGraph = loadGraph(join(record.graphDir, 'graph.json'), {repoRoot: record.repoPath}) } catch { /* refresh may repair it */ }
-    const buildMode = ['full', 'no-tests', 'tests-only'].includes(registeredGraph?.graphBuildMode)
-        ? registeredGraph.graphBuildMode
-        : 'full'
-    const precision = registeredGraph?.graphPrecisionMode === 'off' ? 'off' : 'lsp'
-    let build
-    try {
-        build = await buildGraphForRepo(record.repoPath, {
-            mode: buildMode,
-            precision,
-            scope: '',
-            outDir: record.graphDir,
-            graphHome,
-        })
-    } catch (error) {
-        build = {ok: false, error: safeRefreshReason(record, error)}
-    }
-    const refreshKind = build?.refresh?.kind || null
-    const changedFiles = Array.isArray(build?.refresh?.changedFiles) ? build.refresh.changedFiles : []
-    const publicStatus = {
-        role,
-        repository: publicRecord(record, alias),
-        buildMode,
-        status: build?.ok ? (refreshKind === 'none' ? 'CURRENT' : 'REFRESHED') : 'STALE_FALLBACK',
-        refresh: build?.ok ? {
-            kind: refreshKind || 'full',
-            reason: String(build?.refresh?.reason || 'graph-rebuilt'),
-            changedFileCount: changedFiles.length,
-        } : null,
-    }
-    if (build?.ok) {
-        try {
-            return {record, alias, graph: loadGraph(join(record.graphDir, 'graph.json'), {repoRoot: record.repoPath}), publicStatus}
-        } catch (error) {
-            const reason = `refreshed graph could not be loaded: ${safeRefreshReason(record, error)}`
-            return {record, alias, graph: null, reason, publicStatus: {...publicStatus, status: 'FAILED', reason}}
-        }
-    }
-
-    const reason = `graph refresh failed: ${safeRefreshReason(record, build?.error)}`
-    try {
-        return {
-            record,
-            alias,
-            graph: loadGraph(join(record.graphDir, 'graph.json'), {repoRoot: record.repoPath}),
-            reason: `${reason}; stale registered graph used`,
-            publicStatus: {...publicStatus, reason: `${reason}; stale registered graph used`},
-        }
-    } catch (error) {
-        const loadReason = `${reason}; registered graph could not be loaded: ${safeRefreshReason(record, error)}`
-        return {record, alias, graph: null, reason: loadReason, publicStatus: {...publicStatus, status: 'FAILED', reason: loadReason}}
-    }
-}
-
 export async function tTraceApiContract(_g, args = {}, ctx = {}) {
     const graphHome = ctx.graphHome || graphHomeDir()
     const records = liveRepositoryRecords(graphHome)
@@ -246,6 +175,39 @@ export async function tTraceApiContract(_g, args = {}, ctx = {}) {
                 ? 'Completeness: complete within the declared repository graphs, supported static models and fresh revision-bound runtime capture.'
                 : `Completeness: partial — ${completeness.reasons.join('; ')}.`,
         ]
+        let evidencePage
+        try {
+            evidencePage = paginateContractEvidence({
+                analysis,
+                transportAnalysis,
+                args,
+                fingerprintParts: [
+                    backend.repositoryId,
+                    backendGraph.graph?.graphRevision || null,
+                    ...clientGraphs.flatMap((item) => [item.record.repositoryId, item.graph?.graphRevision || null]),
+                    selectedTransport,
+                    args.method || null,
+                    args.path || null,
+                    Array.isArray(args.changed_files) ? [...args.changed_files].sort() : [],
+                    args.include_tests === true,
+                ],
+            })
+        } catch (error) {
+            if (!(error instanceof ContractCursorError)) throw error
+            return toolResult(
+                `VERDICT INVALID_CURSOR — ${error.message}. Restart from the first page without cursor.`,
+                {status: 'INVALID_CURSOR', code: error.code, reason: error.message},
+                {page: {status: 'INVALID_CURSOR'}},
+            )
+        }
+        const transportSummary = {
+            transportContractsV: transportAnalysis.transportContractsV,
+            transport: transportAnalysis.transport,
+            status: transportAnalysis.status,
+            completeness: transportAnalysis.completeness,
+            totals: transportAnalysis.totals,
+            runtimeEvidence: transportAnalysis.runtimeEvidence,
+        }
         const result = {
             crossRepoHttpContractV: CROSS_REPO_HTTP_CONTRACT_V,
             verdict,
@@ -253,14 +215,28 @@ export async function tTraceApiContract(_g, args = {}, ctx = {}) {
                 backend: publicRecord(backend, backendAlias),
                 clients: clients.map(({record, alias}) => publicRecord(record, alias)),
             },
-            ...analysis,
-            transportContracts: transportAnalysis,
+            httpContractsV: analysis.httpContractsV,
+            filters: analysis.filters,
+            limits: analysis.limits,
+            totals: analysis.totals,
+            wrapperDiscovery: analysis.wrapperDiscovery,
+            transportContracts: transportSummary,
+            evidencePage,
             status: completeness.status,
             graphReconciliation,
             completeness,
         }
         return toolResult(lines.join('\n'), result, {
             completeness,
+            page: {
+                detail: evidencePage.detail,
+                offset: evidencePage.offset,
+                pageSize: evidencePage.pageSize,
+                totalItems: evidencePage.totalItems,
+                returnedItems: evidencePage.returnedItems,
+                hasMore: evidencePage.hasMore,
+                nextCursor: evidencePage.nextCursor,
+            },
             warnings: completeness.complete ? [] : [{code: 'CROSS_REPO_ANALYSIS_PARTIAL', message: completeness.reasons.join('; ')}],
         })
     } catch (error) {

package/src/mcp/tools-verified-change.mjs

@@ -148,10 +148,17 @@ export async function tVerifiedChange(g, args = {}, ctx = {}, tools = {}, permis
   const baseRef = String(args.base_ref || 'HEAD').trim()
   const graph = phase === 'verify' ? await baselineProof(ctx, baseRef, currentGraph) : {state: 'PLANNED', baseline: baseRef}
 
-  let duplicates = {state: 'SKIPPED', reason: 'duplicate ratchet disabled'}
-  if (phase === 'verify' && args.duplicate_ratchet !== false) duplicates = permissions.health
-    ? await compareDuplicateGroups({repoRoot: ctx.repoRoot, graphPath: ctx.graphPath, currentGraph, baseRef, changedFiles, args: {mode: 'renamed', min_similarity: 80, min_tokens: 50}})
-    : {state: 'UNKNOWN', reason: 'health capability is not enabled'}
+  const duplicateRatchetEnabled = args.duplicate_ratchet !== false
+  let duplicates
+  if (!duplicateRatchetEnabled) {
+    duplicates = {state: 'SKIPPED', enabled: false, reason: 'duplicate ratchet disabled'}
+  } else if (phase !== 'verify') {
+    duplicates = {state: 'PLANNED', enabled: true, reason: 'duplicate ratchet runs during verify phase'}
+  } else {
+    duplicates = permissions.health
+      ? {enabled: true, ...await compareDuplicateGroups({repoRoot: ctx.repoRoot, graphPath: ctx.graphPath, currentGraph, baseRef, changedFiles, args: {mode: 'renamed', min_similarity: 80, min_tokens: 50}})}
+      : {state: 'UNKNOWN', enabled: true, reason: 'health capability is not enabled'}
+  }
 
   let api = {state: 'SKIPPED', reason: 'no api_contract scope was requested'}
   if (args.api_contract) {

package/src/precision/typescript-provider/client.js

@@ -37,6 +37,7 @@ export async function createTypeScriptLspClient({repoRoot, timeoutMs = 10_000} =
                 textDocument: {
                     definition: {linkSupport: true},
                     references: {},
+                    rename: {},
                     publishDiagnostics: {relatedInformation: false},
                 },
             },
@@ -68,6 +69,12 @@ export async function createTypeScriptLspClient({repoRoot, timeoutMs = 10_000} =
         references(relPath, position, includeDeclaration = true, referenceTimeoutMs = timeoutMs) {
             return client.references({filePath: relPath, position, includeDeclaration, timeoutMs: referenceTimeoutMs})
         },
+        // Generic read-only JSON-RPC passthrough plus URI normalization, so consumers outside
+        // the core (weavatrix-refactor) can issue their own read-only LSP requests. The client
+        // still refuses workspace/applyEdit, so nothing here can apply an edit.
+        request(method, params, options) { return client.request(method, params, options) },
+        toUri(relPath) { return client.normalizer.toUri(relPath) },
+        fromUri(uri) { return client.normalizer.fromUri(uri) },
         definition(relPath, position) { return client.definition({filePath: relPath, position}) },
         closeDocument(relPath) { return client.closeDocument(relPath) },
         async close(shutdownTimeoutMs = timeoutMs) {

package/src/security/advisory-store.js

@@ -76,7 +76,6 @@ export function normalizeOsvAdvisory(record, ecosystem, name) {
     kind: String(record.id || '').startsWith('MAL-') ? 'malicious' : 'vuln',
     severity: severityOf(record),
     summary: String(record.summary || record.details || '').slice(0, 300),
-    url: `https://osv.dev/vulnerability/${record.id}`,
     modified: record.modified || '',
     aliases: (record.aliases || []).slice(0, 6),
     fixedIn: [...new Set(fixed)].slice(0, 4),

package/src/security/malware-heuristics.exclusions.js

@@ -111,7 +111,7 @@ export function installScriptSnippet(scripts = {}) {
 }
 
 // weak URL rules only: URL evidence in a license/prose file or in comment/doc-link context is
-// documentation, not behavior (LICENSE:5 "http://www.apache.org/licenses/" was the hot FP).
+// documentation, not behavior (a license-header scheme reference on LICENSE line 5 was the hot FP).
 // Strong rules (miner/shell/exfil-url) are untouched and still scan those same files.
 export function isDocUrlNoise(file, signal) {
   if (!NOISY_URL_KEYS.has(signal?.key)) return false;

package/src/security/registry-sig.rules.js

@@ -77,7 +77,7 @@ export const CONTENT_RULES = [
     severity: "medium", // raw-IP URLs have some legit uses (local tooling) — escalates via co-occurrence
     nearZeroFp: false,
     pattern: "https?://[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}",
-    re: /https?:\/\/(?!127\.|0\.0\.0\.0|10\.|192\.168\.|169\.254\.|172\.(1[6-9]|2\d|3[01])\.)[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/i, // /i: rg sweeps -i; URL schemes are case-insensitive (HTTP:// is a known evasion)
+    re: /https?:\/\/(?!127\.|0\.0\.0\.0|10\.|192\.168\.|169\.254\.|172\.(1[6-9]|2\d|3[01])\.)[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/i, // /i: rg sweeps -i; schemes are case-insensitive (an uppercase scheme prefix is a known evasion)
     what: "hardcoded raw-IP URL (loopback/private/link-local ranges excluded)", // 169.254.169.254 = cloud IMDS (AWS/GCP/Azure SDK metadata) — benign, was a hot FP
   },
   {